Privacy policy

Last updated: 14 November 2026

AllRun is an iPhone and Android app that puts your Strava activities’ data on your photos so you can design and share images. This policy explains what data the app processes, why, with whom and how to exercise your rights, under the General Data Protection Regulation (GDPR) and Spain’s Organic Law 3/2018 (LOPDGDD).

Controller

Pedro Luis Soto Santos, who runs AllRun. Contact for any privacy matter:privacidad@allrun.es.

What data we process and why

Your account

• Your email address and your password (stored hashed by our authentication provider) or, if you sign in with Google, your Google account’s identifier and email. They are used to create your account, sign you in and let you recover access.
• Your profile settings: hiding the start and end of your routes, language, units, and whether you want news by email.
• The designs you save (how the elements sit over the photo), so you have them on all your devices. Your photos never leave your phone.

Your Strava data

Only if you connect your Strava account, and with the permissions you accept on Strava (read, activity:read_all and profile:read_all): your activities and their data (distance, times, paces, routes, elevation, heart rate, power, cadence, laps, splits, zones and best efforts), your name, your profile photo and your zones.

• The app asks Strava for them straight from your phone and shows them only to you. They are kept on your phone for 7 days at most, as Strava requires, and deleted when you disconnect Strava or sign out.
• On our server we only keep, encrypted, the tokens Strava gives us to access it on your behalf, with your Strava identifier and name, and for 8 days the identifiers of activities you delete on Strava, to remove them from your phone too.
• We do not sell or share your Strava data, combine it with other data, or use it for advertising or to train or run artificial intelligence models.
• The images you create are yours: AllRun doesn’t publish them. If you choose to share them, you do it, with the data you choose to show.

Strava is responsible for your data on its service and may collect data about your use of its API through AllRun. See Strava’s privacy policy.

Your photos

The app accesses the photos you pick from your library, with your phone’s permission, to draw them in your designs. They are processed only on your phone and never uploaded to any server.

Places and maps

• To write where an activity started (“Andújar, Jaén”), the app sends that point’s coordinates to your phone’s geocoding service (Apple on iPhone, Google on Android). On Android, the system asks for the location permission for it. AllRun does not record or keep your current location.
• To draw the maps under your routes, the app downloads the map tiles of your activities’ areas from OpenFreeMap. Those downloads reveal the map areas and your IP address to that service.

Emails

We send you the emails your account needs (confirmation and password changes) and, only if you turn it on in your profile, news about the app, which you can stop at any time.

Legal basis

• Performing the service you ask for by creating your account (account, designs, profile).
• Your consent: when you connect Strava, give access to your photos or location, and accept news by email. You can withdraw it at any time.

Who we share it with

Only with the providers that make the app work, for that purpose:

• Supabase (authentication, database and server functions), with data hosted in London, United Kingdom, a country with an EU adequacy decision.
• Strava, where your activity data comes from.
• Google, if you sign in with your Google account.
• Apple and Google, as your phone’s geocoding services.
• OpenFreeMap, for the map tiles.
• Cloudflare, which hosts this website and forwards the emails you send us.

Some of these providers may process data outside the European Economic Area; if so, they do it with the safeguards of the GDPR, such as the European Commission’s standard contractual clauses.

How long

• Your account, profile and designs: until you delete your account.
• Your Strava data on your phone: 7 days at most.
• Strava tokens: until you disconnect Strava, revoke AllRun’s access on Strava or delete your account.
• Identifiers of activities deleted on Strava: 8 days.

Your rights

You can access, rectify, erase, restrict or object to the processing of your data, ask for its portability and withdraw your consent by writing toprivacidad@allrun.es. You can delete your account and all its data from the app’s profile, and disconnect Strava from the app or from Strava’s settings. If you think we don’t handle your data properly, you can complain to theSpanish Data Protection Agency (AEPD).

Children

AllRun is not intended for children under 14.

Changes

If this policy changes, we will update the date above and, if the change is significant, tell you in the app.