Legal
Privacy Policy
Runtasy is a real-world running game played in Singapore's parks. This policy explains what personal data the Runtasy app and service collect, why, who can see it, how long we keep it and the choices you have. It is written to meet Singapore's Personal Data Protection Act 2012 (PDPA).
In short: we collect your email address to sign you in, the name and handle you choose, and your location when you check in at a park and while you play a game. Other runners in your game see what the game needs them to see, and the run's organisers see where runners are for safety. We don't sell your data, show ads or track you across other apps and websites. You can delete your account in the app at any time.
Who we are
Runtasy is operated by Jun Kiat Koh in Singapore ("we", "us"). For any question about your personal data, including access and correction requests, contact our data protection contact at hello@runtasy.com.
What we collect
Your account
- Email address, used to send you one-time sign-in codes and to identify your account.
- Display name and handle that you choose, shown to other runners.
- Settings, such as distance units, the narrator and whether friends can see your check-ins.
Location
- Check-ins. When you check in for a run, the app sends your precise location and its accuracy so we can confirm you're at the park's meeting place.
- During a game. While a game you're playing is running, the app sends your precise location to the game server, including when the app is in the background (iOS shows the location indicator). The game uses it to place checkpoints, score the cure, give proximity alerts, show radar and sightings, and detect infections and escapes.
- Your route. After a game we keep the path you ran, so you can see it in your Journal.
The app only uses your location when you check in or play. It does not track you at other times.
Game and social activity
- The runs you join, your roles and results, distance, checkpoints, cure points, infections and escapes, and the game's key moments.
- Your friends, crew invites, and in-app notifications.
Camera
When you play a zombie, the camera scans other runners' game codes. Scanning happens on your phone; we don't store images or video.
Technical data
- Sign-in sessions, which we store only as one-way hashes.
- To slow down abuse, we count sign-in attempts per email address and per network address. We store only one-way hashes of these, never the addresses themselves.
- Our hosting provider keeps short-lived request logs (such as the time, the request and the network address) to keep the service running and secure.
We don't use analytics or advertising tools, and the app contains no third-party tracking code.
How we use it
- To sign you in and keep your account secure.
- To run events and games: checking you in, assigning roles, playing the game and recording results.
- To show your Journal, statistics, friends and crew.
- To keep runners safe: organisers can see runners' positions and help requests during a run.
- To prevent abuse, fix problems and improve the service.
We collect and use your data with your consent, which you give by creating an account and allowing the permissions the app asks for, and as needed to provide the service you asked for.
Who can see it
| Who | What they see |
|---|---|
| Everyone using Runtasy | Your display name and handle, for example in a run's crew list. |
| Your friends | Your recent runs, and which park you're checked in at if you turn on sharing check-ins. |
| Runners in your run | Whether you've checked in at the meeting place. During a game, your role and game events. Zombies may see survivors' approximate positions through the radar and sightings, and survivors are warned when a zombie is near. |
| Run organisers (Runtasy admins) | Who joined and checked in, and every runner's live position and status during a run, for safety and to run the game. |
| Our service providers | Cloudflare, Inc. hosts the service, stores data and sends sign-in emails for us. Apple provides the maps in the app and distributes it through the App Store. |
We don't sell your personal data or share it with advertisers. We may disclose data if the law requires it, or to protect the safety of runners or others.
Where it's stored
Our service runs on Cloudflare's network. Its database is located in the Asia-Pacific region, and data may be processed in other countries where Cloudflare operates. When data leaves Singapore, we rely on our providers' contractual commitments to protect it to a standard comparable to the PDPA.
How long we keep it
| Data | Kept for |
|---|---|
| Sign-in codes | Valid for 10 minutes; deleted within a day after that. |
| Sign-in sessions | Until you sign out, or 90 days after you last used the app. |
| Check-ins | 2 hours. |
| Live positions during a game | Until the game ends and your route is saved, when the trail is deleted. Your last position stays with the game until its next round starts. |
| Routes, results and your profile | Until you delete your account. |
| Read notifications | 90 days. |
| Abuse counters | 2 hours. |
| Hosting request logs | A few days. |
Your choices and rights
- Location: you can deny or revoke location access in iOS Settings. You'll need it to check in and play.
- Check-in sharing: turn off "share check-ins" in the app's settings at any time.
- Access and correction: you can change your name and handle in the app. To get a copy of your data, or to correct anything else, email us.
- Withdrawing consent and deletion: delete your account in the app (You → Privacy → Delete account). This removes your email address, name, handle, sessions, friends, check-ins, notifications, invites, upcoming registrations and routes. Results from games you played stay in other runners' history under "Deleted runner", without anything that identifies you. You can also ask us by email to delete your account.
We reply to requests within 30 days. If you're not satisfied with our reply, you can contact Singapore's Personal Data Protection Commission.
Children
Runtasy is not for children under 13, and we don't knowingly collect their data. If you believe a child under 13 has an account, email us and we'll delete it. Runners under 18 should have a parent's or guardian's permission.
Security
All traffic is encrypted in transit. We store sign-in codes and sessions only as hashes and limit sign-in attempts. Organiser access requires a separate admin sign-in. No system is perfectly secure, so please tell us at once if you think your account has been misused.
Changes to this policy
We'll update this page when our practices change and revise the date at the top. If a change is significant, we'll tell you in the app before it takes effect.
Contact
Email hello@runtasy.com.