ARC Tech GmbH, c/o Reto Haeberli, Allenmoosstrasse 56, 8057 Zurich, Switzerland, is the controller for RunZone under the Swiss Federal Act on Data Protection (FADP) and, where applicable, the GDPR. Privacy requests go to info@runzone.app. RunZone has no account system, backend, or RunZone-operated training database, and no app-owned cloud health store.
App data
RunZone processes workouts, activity, heart rate, steps, sleep, cardio fitness, body measurements, and routes, to record workouts and provide history, coaching, readiness, and training insights. All health, workout, location, and derived training data stays on your Apple devices, in Apple Health, or in Apple-managed iCloud synchronization you enable. RunZone does not store these data on RunZone-controlled or non-Apple third-party servers. RunZone does not sell your data, use it for advertising, or send health data to external AI.
HealthKit access uses a fine-grained Apple permission sheet. If you deny a permission, the related feature is unavailable. Apple separately controls Apple Health, Apple-managed iCloud synchronization, Apple WeatherKit and Apple Maps, StoreKit, retention, and international processing, including in Ireland and the United States, under Apple's Privacy Policy. Adaptive Volume microphone input is processed briefly on-device and is not recorded or transmitted. App-local preferences, caches, and logs stay on-device only as needed.
Limited external processing
RunZone sends optional anonymized usage events and technical logging signals, with app and platform context and a random app-family identifier, to TelemetryDeck. The SDK hashes the identifier. Signals contain no health, workout, route, precise-location, advertising, payment, or directly identifying data. You can disable analytics and reset the identifier in RunZone settings. Signals are processed in Germany and available to RunZone for up to 13 months. TelemetryDeck may keep older signals in restricted cold storage under its retention rules.
Cloudflare delivers runzone.app and the app's public message file. It may process IP address, URL, browser, and request time in the European Economic Area and United States. Transfers use the Data Privacy Framework or Standard Contractual Clauses, including Swiss adaptations, as applicable. These delivery logs contain no account, subscription, analytics identifier, health, workout, or location data. The website uses no advertising cookies or analytics.
If you subscribe to the RunZone newsletter, Keila processes your email address and subscription status, consent, and delivery or interaction data in the European Union. hCaptcha processes IP, browser, device, and interaction signals and necessary security cookies in the United States under EU Standard Contractual Clauses. Email is required only to subscribe; without it, you cannot receive the newsletter. If you unsubscribe or withdraw your consent, we keep only legally required suppression records.
Diagnostics leave your device only when you choose to share them. Support data is kept only as needed.
Legal basis and rights
Under the GDPR, app features and requested support rely on contract (Article 6(1)(b)); health-data processing relies on explicit consent (Article 9(2)(a)); newsletter delivery relies on consent (Article 6(1)(a)); secure delivery, abuse prevention, and privacy-preserving analytics rely on legitimate interests (Article 6(1)(f)); and required records rely on legal obligations (Article 6(1)(c)). Under the FADP, RunZone processes data for the disclosed purposes and obtains consent where required.
Depending on applicable law, you have rights of access, rectification, erasure, restriction, portability, or objection, and may withdraw consent. Contact us above. You can disable optional analytics, revoke permissions, and delete local app data in RunZone or Apple settings, or unsubscribe from newsletters. You may lodge a complaint with the competent supervisory authority: the Swiss Federal Data Protection and Information Commissioner or your local data protection authority in the EEA or UK. RunZone does not make solely automated decisions that have legal or similarly significant effects.