Privacy policy

Version of 21 October 2026.

This English translation is provided for convenience. In case of discrepancy, the French version prevails: Politique de confidentialité.

Runcon processes the data in your GPX files (including location data) solely to provide you with the analysis of your courses. This policy explains which data is involved, who has access to it, how long it is kept and how to exercise your rights.

Data controller

Camille Collet, entrepreneur individuel (EI, French sole trader), trading as Runcon App, SIREN 130 404 890, 75017 Paris, France. Contact: contact@runcon.app.

Data collected and purposes

— Your account: email address, creation date, date and version of your consent. To sign you in and link your courses to your account (performance of the terms of use).
— Your courses: imported GPX files (track, elevation, timestamps if it is a recorded activity), file name, race date, waypoints and time targets. To produce your analyses (performance of the contract, and your consent for location data).
— Your runner profile, optional: level, discipline, reference times and pace. To personalise estimated times.
— Your paid access: dates of your annual access, Stripe customer ID, billing address entered with Stripe. For the sale and invoicing (performance of the contract and accounting obligations).

Runcon does not collect your name, your phone number or your password: the password is handled by the authentication service, and Runcon never sees it. Your data is never sold or used for advertising.

Recipients of personal data

Your data is accessible only to Runcon and to the providers strictly needed to run the service:
— Railway Corporation, a US company, hosts the Runcon server and its database — and therefore your account and your GPX files — in a data centre located in the European Union (Netherlands).
— Google Ireland Limited (Firebase) hosts the website and the app, and handles signing in to your account: email address, password, Google sign-in, password reset emails.
— Stripe Payments Europe (Ireland) processes the payment for annual access. It receives your email address and collects your payment and billing details itself; Runcon never has access to your bank card.

Displaying a course map involves a third party, and you should know this before you accept. The base map is not made by Runcon: it is made of tiles — small images — that your device fetches itself, directly, from an external provider. These requests do not go through the Runcon server. There are two such providers:
— IGN (the French National Institute of Geographic and Forest Information), via data.geopf.fr, for a large part of mainland France;
— Mapbox, everywhere else — and this includes a significant share of courses located in France. IGN coverage is defined by zones: overseas France is excluded, as are parts of the coastline, the borders and the Mediterranean rim. A course that goes outside these zones, even one entirely in France, is served by Mapbox.

What these providers see as a result of these requests: your device's IP address, and the geographical area of the course you are displaying — in practice, the place where you ran. They do not receive your name, your email address or your GPX file. Their own privacy policies apply to these requests.

Where this data goes: IGN is a French public body, and these requests stay within the European Union. Mapbox is a company established in the United States: requests made to it leave the European Union and are subject to US law. Google and Stripe may also process some data in the United States. These transfers are covered by the safeguards provided for by the GDPR (European Commission standard contractual clauses or the Data Privacy Framework).

Cookies and local storage

Runcon sets no advertising or audience measurement cookies. The app keeps in your browser only what it needs to work: your sign-in session, an encrypted copy of your analyses (to reopen them faster, even offline), the fact that you have already seen the introduction, and the language you chose (French or English), which the website and the app share. These items are strictly necessary and do not require consent; you can clear them at any time from your browser settings. Stripe's payment pages and Google sign-in set their own cookies, governed by their own policies.

To measure traffic on the runcon.app website, its pages use Cloudflare Web Analytics, a cookie-free audience measurement tool. It receives visitors' IP address and browser type, without keeping them to identify anyone, and is used only to count visits and page views. Cloudflare is a company established in the United States; this data is covered by the same safeguards as above.

Retention periods

— Account, courses and analyses: for as long as your account exists. When it is deleted, they are erased immediately and permanently from the server, and your sign-in is revoked.
— Invoices and payment data: 10 years, as required by the French Commercial Code. They are kept by Stripe.
— Server technical logs, which may contain your IP address: a limited period set by the hosting provider, solely to keep the service running and secure.

Your rights

You have the right to access, rectify, erase, restrict, object to and port your data. You can ask for your account and data to be deleted at any time, and you can delete a course, your profile or your whole account yourself from the app. For any other request — receiving a copy of your data, for example — write to contact@runcon.app: you will get a reply within one month at most. Exercising these rights is free. If you believe your rights are not being respected, you can lodge a complaint with the CNIL, the French data protection authority (cnil.fr).

Data security

Exchanges between your device and the Runcon server use an encrypted connection (HTTPS). Your password is never sent to Runcon. Every request to the server is authenticated, and deleting your account revokes your sign-in. The copy of your analyses kept in your browser is encrypted, and payment is handled by Stripe, which is PCI DSS certified. As no system is infallible, keep your password to yourself and sign out on a shared device.

Data of children under 15

Runcon is not intended for children. In France, a minor under 15 cannot consent alone to the processing of their data: they must do so together with a holder of parental authority. If you are a parent and your child has created an account without your permission, write to contact@runcon.app to have it deleted.

Changes to this policy

This policy may change; the version date shows the one in force. If a change affects what Runcon does with your data — a new recipient, a new use, a new transfer outside the European Union — it will be presented to you in the app before it applies.

Terms of sale · Legal notice