Run The Streets

PRIVACY

Last changed on 9 November 2026.

Run The Streets is a small app you can only join with an invite. This page says what it stores about you, why, where, who else sees any of it, and how you get it out or delete it. It describes what the app does today. Where something has not been decided yet, it says so.

WHO RUNS IT

Kristof Feys (kristof.dev) runs this app and decides what happens with the data in it. In GDPR terms he is the controller.

Questions, requests or complaints about your data: [contact email: to be filled in by the owner].

WHAT IS STORED, AND WHY

  • Your account: name, first name (optional), email, interface language and when you joined. Your password only as an argon2id hash, never the password itself. To sign you in and greet you.
  • Home (optional): a latitude and longitude you type in yourself. For distances and route starts, and to keep the area around it out of what others see.
  • Your runs: the GPS track, the time at each point, start time, distance, duration and activity type, and for runs from Garmin the Garmin activity id. Uploaded files are read and then deleted; only these values are kept. To work out which streets you ran, and everything built on that: map, progress, routes, training plans, quests, badges and best efforts.
  • Heart rate, only if you said yes: see below.
  • What you set up in the app: privacy zones, training plans and workouts, races and race courses, the routes you picked, weekly quests, friends and challenges.
  • Your Garmin connection, if you connect one: the login tokens Garmin gives back, encrypted (AES-256-GCM), and since when you are connected. Your Garmin password is passed on once to log in and never stored. To fetch your runs.
  • A sync log: when runs were synced or uploaded, how many were new, and any error.
  • Sign-in security: your sessions (only a hash of the session key; a session ends 30 days after you last used it) and failed sign-in attempts (only a hash of the email or IP address). To keep accounts safe against password guessing.

HEART RATE

Heart rate is health data, a special category under the GDPR. The app stores it only if you say yes: when you sign up, or the first time you open the app if your account is older than this page.

With your yes, the heart rate at each point of a run is kept when the file or Garmin download has it, and the app works out steady minutes from it for the PROGRESS page. Only you see it: it is never part of a challenge, the recap image or a log line. It is in your data export.

Without a yes, runs are stored without heart rate. Everything else works the same; PROGRESS shows no heart-rate charts.

You can withdraw any time under HEART RATE on your account page. That deletes the heart rate of every run and everything worked out from it, at once. Your runs stay. Saying yes again later only applies to runs added after that.

WHERE IT IS STORED

On one server: a virtual machine at Oracle Cloud in the Paris region (France), which also runs another app of the owner's. The database, the app and the backups are all on that machine. Every connection to it is encrypted (HTTPS). The domain's DNS is at Cloudflare, but your traffic does not pass through Cloudflare.

A copy of the database is made every night and kept for 14 days, on the same machine. There is no copy anywhere else yet.

WHO SEES WHAT

  • You see everything about yourself.
  • Friends see your name. Someone you send a friend request to sees your name and email. Nothing else, until you accept a challenge.
  • Members of a challenge you accepted see which streets of its area you completed since it started, who was first on each, and your counts per month and week. Never your runs, tracks, run times, heart rate or home, and never streets in your privacy zones or within 300 m of your home or of where any of your runs started or finished.
  • The recap image is made for you to share yourself. The track in it is cut around your privacy zones, your home and the run's start and finish.
  • The owner runs the server, so he has technical access to the whole database, including tracks and heart rate. His admin page shows your email, when you joined, whether you have a password and how many sessions you have.
  • Nobody else. Your data is not sold or handed to anyone, there are no ads and no analytics. The only cookie is the one that keeps you signed in.

OTHER SERVICES THE APP USES

  • Oracle Cloud hosts the server (above).
  • MapTiler draws the map and does the address search in the route planner. Your browser asks MapTiler directly, so MapTiler sees your IP address, the part of the map you look at and what you type in the search box, with a nearby point to rank the results. No account data is sent.
  • OpenStreetMap's tile server draws the map when MapTiler is not set up; your browser asks it directly, as with MapTiler.
  • The Overpass API (OpenStreetMap data) gives the server the streets of a city the first time someone needs that city. The request names the area, not you.
  • Copernicus elevation data, on Amazon Web Services' public storage: the server downloads elevation tiles of one degree by one degree (roughly 100 km) around runs and routes. No personal data is sent.
  • Have I Been Pwned: when you set a password, the server sends the first 5 characters of its SHA-1 hash, to check that the password has not appeared in a data breach. Your password and email are never sent.
  • Garmin Connect, only if you connect your Garmin account on your account page. This is not an official Garmin integration: the server logs in the way Garmin's own apps do and then fetches your runs and races about every hour or two. Garmin sees that this server reads your account. Courses and workouts are only sent to Garmin if you turn that on. DISCONNECT deletes the tokens; your runs stay.

HOW LONG IT IS KEPT

  • Your account, runs, heart rate and everything you set up: until you delete them or your account. Nothing expires on its own.
  • Sessions: until 30 days after you last used them, or until you log out.
  • Failed sign-in attempts: they count for 15 minutes and are cleared out once they are a day old, the next time a sign-in fails.
  • Backups: 14 days. After you delete your account, your data is gone from the app at once and from the backups within 14 days.
  • Server logs: the web server logs requests with your IP address and the page asked for (never invite or reset links). How long these logs are kept has not been decided yet.

YOUR RIGHTS

  • See and take your data: EXPORT MY DATA on your account page gives a ZIP with everything about you, tracks and heart rate included.
  • Correct it: name, first name, home and language on your account page. For anything else, write to the contact above.
  • Delete it: DELETE ACCOUNT on your account page deletes your account and all your data at once.
  • Withdraw your heart-rate consent: HEART RATE on your account page.
  • Object to or limit what the app does with your data, or ask anything about it: write to the contact above.
  • Complain to a data protection authority: the one where you live or work. In Belgium that is the Gegevensbeschermingsautoriteit.

WHY THIS IS ALLOWED

  • Your account, runs and what you set up: the app cannot do what you joined for without them (GDPR art. 6(1)(b)).
  • Sign-in security records: keeping accounts safe (legitimate interest, art. 6(1)(f)).
  • Heart rate: your explicit consent (art. 9(2)(a)), which you can withdraw any time.