Privacy Policy

1. Information We Collect

From Our Website:

• Name and email address: when you join our waitlist, so that we can email you a confirmation, a welcome and occasional updates about RunThrough's launch. We email you a link; you are not on the list until you open it and click to confirm. Until then, we hold your name, email address and the time you signed up on our server for up to 24 hours. After you confirm, we add you to our waitlist at Resend, send you a welcome email, and send ourselves a notice of the signup with your name and email address. To prevent abuse, our server counts signups and confirmations by IP address, and confirmation emails sent to each address, keyed by a hash of the address rather than the address itself (see Section 8 for how long). If a limit is reached, we record that, with a salted hash of your IP address, in our hosting logs and in our analytics.
• Support form: your first name, your message, which app it is about, and your email address if you give one. Resend delivers the message to support@runthroughapp.io, the support inbox, hosted by our email provider, and keeps a copy in its log of sent emails. If you give an email address, we also add it and your first name to our support contact list at Resend so we can follow up. We keep that list separate from our marketing list and do not send marketing emails to it. A message you mark as being about another of our apps is covered by that app's privacy policy instead.
• Form checks: our waitlist and support forms use Cloudflare Turnstile to check that a person is submitting them. It loads only when you start using one of those forms (for example, by clicking into a field) or, for the support form, when you open it from a link that already fills in some of its fields, as our app's Contact Us row does. Cloudflare's script then runs in your browser, and Cloudflare receives your IP address and information about your browser and device that it uses to tell people from bots.
• Email you send us: if you write to support@runthroughapp.io, your message, with your email address, name and any attachments, lands in the support inbox, hosted by our email provider.
• Usage data: on every page of our website (except the unsubscribe page), PostHog analytics collects the address and title of each page you visit, when you visit it and how long you stay on it, the text and link addresses of the buttons and links you click, mouse movement and scrolling, the page or campaign that sent you to us, how fast pages load, and your browser (including its full user-agent string), device type, screen and window size, language and time zone, and whether you submitted the waitlist or support form, confirmed your waitlist signup, and which app your support message is about. Before a page address is sent to PostHog or stored in our analytics, including with heatmaps, page-speed measurements and session replays, our site removes or masks one-time codes and other secret-looking parameters in it, such as the code in a waitlist confirmation link, and any name, email address or message carried in a link to our support form. (Our hosting logs still record the full address; see "Hosting logs" below.) PostHog also builds heatmaps of where visitors click, move the mouse and scroll. About 1 in 10 visits is recorded as a session replay: a recording of the page as you saw it, with your mouse movements, clicks and scrolling, the addresses and timing of the requests the page makes, and messages the page writes to the browser console. Replays hide what you type into form fields, and the personal text on the waitlist confirmation page. PostHog stores a random identifier, a session ID and, for your first and current visits, the page you arrived on and the page that sent you there (with one-time codes and other secret parameters removed), in a cookie that expires a year after your last visit and in your browser's local storage, so that your visits can be told apart.
• Fonts and blog images: your browser loads fonts from Google Fonts and blog images from Hashnode, so those services see your IP address and browser details.
• IP address and location: PostHog receives your IP address with each request. It is set to discard the address and not to work out your location from it, and our site also asks it not to look up your location. Our hosting provider and the services above still receive your IP address to deliver pages.
• Hosting logs: our hosting provider, Vercel, logs requests to our website and server, including your IP address and the address requested, which can include the code in a confirmation or unsubscribe link.

From Our iPhone, iPad, and Mac App:

RunThrough does not require you to create an account or sign in to use the app. Subscription status is managed through your Apple Account via StoreKit; we do not operate a separate RunThrough login.

• App usage data: while Share Usage Data is on (it is on by default; see Section 4), the app sends events such as opening the app; starting, finishing or discarding a practice; saving a recording; opening a comparison; creating, editing, completing or deleting a scheduled session; onboarding steps; opening the subscription screen; and asking you to rate the app. It also sends the name of the screen you open, how long a practice lasted, how many recordings it had, whether it had notes, whether you scheduled the next one, the self-rating you gave, and whether a recording was saved after the recording stopped unexpectedly. It records whether you opened the app from Spotlight, from a RunThrough link, or another way.
• Scheduled sessions: when you create or edit a scheduled session, the app sends how it was set up, such as how it repeats and whether it has a title. It does not send what you type: not the text of the schedule, not the names of the songs or courses you pick, and not the date, time or reminder you typed.
• Problems saving: when saving a recording or its details fails, the app sends a general category such as "disk full" or "sync conflict," and where in the app it happened.
• Device and app details: device model and type, operating system and version, app version and build, whether the build came from TestFlight, was sideloaded, or is running in a simulator or on a Mac, screen size, language, time zone (for example America/New_York), whether you are on Wi-Fi or cellular, and a session ID that groups the events from one use of the app.
• Random ID: the analytics service gives each installation a random ID. It is not your Apple advertising identifier (the app does not use or request one). The app sends it only to our analytics provider, PostHog. We do not give it to other apps or to advertisers, and there is no cross-app tracking. When we use AI tools to query our analytics (Section 6), the results can include it. If you start a trial or subscription, it is linked to your subscriber ID (below).
• Subscriber ID and purchases: once you start a trial or subscription, the app links your analytics to a hashed purchase identifier: a SHA-256 hash of the App Store's app transaction ID for your Apple Account or, if the app cannot read it, of your subscription's original transaction ID. Apple keeps the app transaction ID the same for your Apple Account on every device, so your purchase, your earlier events on that device, and your later events on all your devices belong to one pseudonymous person in our analytics. The hash contains no name or email. It is not salted, so anyone who has the identifier, such as Apple, or who can guess it, can compute the same hash and match it to you. The app also attaches to every later event whether you bought the subscription or share it through Family Sharing and a SHA-256 hash of your subscription's original transaction ID, and it sends events for starting or ending a subscription and for buying Lifetime. It switches back to a new random ID only if the app is running when the trial or subscription ends. If it ends while the app is closed, the subscriber ID stays in use on that device. If Share Usage Data is off at that moment, the switch happens when you next turn it on. Deleting and reinstalling the app on an iPhone or iPad gives it a new random ID, which is linked to your subscriber ID again if you still have a trial or subscription. Buying Lifetime does not create a subscriber ID; a subscriber ID from an earlier trial or subscription stays in use on the devices that already had it. We do not receive your payment details; Apple processes payments.
• IP address and location: PostHog is set to discard your IP address and not to work out your location from it, and the app also asks it not to look up your location. Your device's language and time zone are sent as described above.
• What the app does not send us: your recordings, notes, the titles of your songs, lessons or courses, your contacts, your photos, or your microphone audio. The app itself does not record your screen or send crash reports to us. If you choose to share analytics with app developers in your device's settings, Apple may pass us crash reports and other diagnostics, such as hang and energy reports, and TestFlight passes us crash reports from beta builds; Apple's terms govern them.
• Audio recordings: if you use our recording features, audio is processed and stored on your device. If iCloud sync is on, your data, including recordings, is also stored in your private iCloud database, which we cannot read. If you are signed in to iCloud, iCloud sync is on by default. While you have a subscription, trial or Lifetime purchase, you can turn it off in the app's Settings (it takes effect after the app restarts); while the app is locked, the setting can't be changed. We do not upload your recordings to our servers.
• Recordings made while the app is locked: When the app is locked because you have no subscription, trial or Lifetime purchase, you can still practice and record, but those recordings are temporary. (The first session right after the app's introduction is not locked, and recordings from it are kept.) They appear only in the practice you recorded them in and, if iCloud sync is on (the setting can't be changed while the app is locked), they are synced to your private iCloud until they are deleted. They are deleted when you discard the practice; on a Mac, when you close its window or quit the app and choose to delete them; or, if the app closed some other way, the next time you open it on the device you recorded them on. Only that device deletes them. If you delete the app from that iPhone or iPad before opening it again, copies already in your iCloud stay there, hidden in the app, until you delete Run Through's data in your iCloud settings (which deletes everything the app keeps in iCloud). If that device is signed out of iCloud when you next open the app, copies already in your iCloud may stay there. Otherwise they are kept if, before they are deleted, you start a trial, subscribe or buy Lifetime on any of your devices or by restoring a purchase; they show as normal recordings once the app is next opened on the device you recorded them on.
• Permissions: the app asks for access to the microphone (to record), Apple Music and your music library (to pick reference tracks), and notifications (for practice reminders, weekly recaps and milestones, and to tell you when it stopped a recording because you left the app). It does not ask for your location, contacts, photos or camera.
• Apple Music: if you search Apple Music in the app, the app sends Apple the words you search for, and Apple streams any track you play. The title, artist, length, artwork link and Apple Music or music-library ID of a track you pick are saved in your RunThrough library, and in your private iCloud if sync is on.
• Links you add: when you add or share a link, the app may fetch the page directly from your device to show its title and image. The site you linked to, the site that hosts its image, or a service such as YouTube, Vimeo or SoundCloud then sees your IP address and the link, and may set cookies that the app sends back on later requests to that site.
• Contact Us: the Contact Us row in Settings opens the support form on our website, which is covered above.
• Our server: the app asks our server for YouTube information (Section 2). To make sure requests come from a genuine copy of the app, the server checks Apple's App Attest on iPhone and iPad and on Macs where App Attest is available and working; a Mac on macOS 26, or one where App Attest isn't available or fails, signs its requests with a key built into the app instead. With App Attest, each request carries a key ID created for the app on your device. The key ID is kept in your device's keychain, where it can remain after you delete the app and can move to a new device with an encrypted backup. Our server keeps the key ID, with the key's public part, the date it was registered and a counter used to block replayed requests, until 90 days after the app last successfully contacts the server. A Mac's signed request carries a key ID that is the same in every copy of the Mac app, and a one-time code that the server keeps for 10 minutes to block replayed requests. To prevent abuse, the server counts requests by IP address (for IPv6, by network) and by key ID, keeping each count for about two minutes; for signed Mac requests it also keeps a daily count per IP address for up to a day. If you go over a limit, it records the key ID, the request path and, at most, a salted hash of your IP address (which cannot be reversed without our secret), in our hosting logs and in our analytics, whether or not Share Usage Data is on. Our hosting provider's logs may also include your IP address and the YouTube video or playlist IDs you looked up.
• TestFlight betas: if you test a beta of the app, you join through Apple's TestFlight app, Apple's TestFlight terms apply, and Apple handles what you give it there under Apple's privacy policy. Testers join through a public link, not an email invitation from us, so Apple doesn't show us your name or email address unless you add your email address when you send feedback, and then only with that feedback. Feedback, screenshots and crash reports from TestFlight, with the device details TestFlight attaches to them, and TestFlight's install and session counts, reach us through Apple. Beta builds also send the app usage data above, marked as coming from TestFlight.

2. YouTube API Services

RunThrough uses YouTube API Services. By using the app's YouTube features, you agree to be bound by the YouTube Terms of Service. Google's use of information is described in the Google Privacy Policy.

• What we ask YouTube for. When you link a video or playlist, the app looks up its title, description, channel, length, thumbnail and chapters, and for a playlist, the title, thumbnail and length of each video in it. If a video's description lists no chapters, the app reads up to 20 top comments to look for timestamps. It saves only the chapter titles and times it finds, not the comments or who wrote them; the comments it read are held only in the app's memory and are gone once the app closes. Some of these lookups go through our server, which holds our API key and sends YouTube only the video or playlist ID and what to look up, with nothing about you or your device. Others, along with thumbnails and playback, go straight from your device to YouTube, which sees your IP address.
• What we keep. The details above are saved in your RunThrough library on your device, and in your private iCloud if sync is on. The app also keeps copies of lookups and thumbnail images on your device. Most are in its cache, which the system can clear at any time; thumbnails kept for notifications are removed after about a week, when the app next checks them, or when you delete the app, and a copy attached to a notification stays with the system until that notification is removed. The titles, descriptions and channel names of lessons and courses you save are also added to your device's search (Spotlight) until you delete them. Delete the lesson, course or song to remove these details from your library on your devices and in iCloud. A practice you started from a lesson or song, or scheduled for a course, is named after it and keeps that name until you delete the practice. Copies in the app's cache on a device can stay until the system clears the cache or you delete the app. Deleting the app from an iPhone or iPad removes only that device's copy. A copy in iCloud stays until you delete those items in the app on a device that syncs, or delete the app's data in your iCloud settings. On a Mac, the app's data folders can remain after you move the app to the Trash. Our hosting provider can cache our server's YouTube responses, which hold only public YouTube information such as titles and comments, for up to about 25 hours. We do not build profiles from YouTube data.
• The YouTube player. Videos on course, lesson, song and practice screens play in YouTube's embedded player, which is Google's code running inside the app. The app loads the player's script from www.youtube.com and the player itself from youtube-nocookie.com, Google's privacy-enhanced domain (the video streams from Google's servers), and it gives the player storage that is never saved to your device, so cookies and other data the player sets are kept only in memory, are gone once the app closes, and are not shared with your browser. The player loads as soon as you open a screen with a YouTube video while you're online, so Google receives your IP address and the video's ID even if you never press play, and may estimate your approximate location from your IP address. While a video plays, Google may also collect information about your viewing and show ads, as described in the Google Privacy Policy. We do not control or receive that information.
• No Google sign-in. RunThrough does not ask for access to your Google or YouTube account, and its YouTube player is never signed in to one.
• Revoking access and deletion. Because we hold no access to your Google account, there is nothing to revoke, and RunThrough never appears among the apps listed on Google's security settings page. If you have a Google Account, you can review and delete the data Google links to it in your Google Account. To have us delete YouTube information we hold on our systems, email us (Section 15); we will delete what we can find within 7 calendar days. Our hosting provider's cache of YouTube responses clears itself within about 25 hours, and its logs cannot be edited one entry at a time and expire on their own schedule.

3. How We Use Your Information

• If you joined our waitlist, to email you a confirmation, a welcome and occasional updates about RunThrough's launch.
• To answer your support messages.
• To provide app features that use our server, such as YouTube lookups, and to check that requests come from a genuine copy of the app.
• To understand how our site and app are used, and improve them.
• To keep our services working and secure, including limiting abusive requests.

We use PostHog for product analytics on our website and in the app. PostHog is set to discard IP addresses and not to look up location from them, and our site and app also ask PostHog not to look up location. We do not use your information for advertising and we do not track you across other companies' apps or websites. Ads that Google may show in YouTube's player, and the data Google uses for them, are Google's (Section 2).

Legal bases (where the GDPR applies): we rely on your consent for our waitlist emails: the confirmation email you ask for when you sign up, and the welcome and occasional updates about RunThrough's launch that you agree to by confirming your address. We rely on our legitimate interests to answer messages you send us, to provide the app features that use our server, to understand and improve our website and app through analytics, and to keep our services secure. You can object to app analytics at any time by turning off Share Usage Data (Section 4). Our website has no opt-out switch, but you can stop its analytics by blocking it as described in Section 4.

4. Your Choices

• App analytics. Share Usage Data is on by default. To turn it off, open Settings in the app (on a Mac, choose Settings… from the Run Through menu, then General) and turn off Share Usage Data under Privacy. While it is off, the app sends no usage events, no screen names and no subscriber ID, and it makes no requests to PostHog apart from sending events it recorded before you turned it off that had not yet been sent. If it is off when the app starts, the app does not start its analytics service at all. Turning it off does not delete data already sent, and turning it back on resumes sending. The setting applies only to the device where you change it, and deleting and reinstalling the app on an iPhone or iPad turns it back on. It does not cover our server's records of requests over our limits, or pages of our website that you open from the app, such as this policy or the support form; our website analytics cover those pages.
• Website. Our website has no opt-out switch. To stop our website analytics, turn off JavaScript for runthroughapp.io or use a content blocker that blocks requests to runthroughapp.io/ingest. Blocking cookies alone does not stop it, and none of this stops our server's records of requests over our limits, our hosting provider's logs, or the font and image requests described in Section 1. Our website does not currently respond to Do Not Track signals. We do not sell or share personal information for advertising, so there is nothing for a Global Privacy Control signal to opt out of.
• Email. Every marketing email tells you how to unsubscribe, and you can also email us to stop our emails (Section 5).

5. Email Communications

If you join our waitlist and confirm your address using the link we email you, you agree that we may email you a welcome and occasional updates about RunThrough's launch. You can unsubscribe at any time. An email address you give in the support form is used only to reply to you and follow up on your message, never for marketing.

Every marketing email we send tells you how to unsubscribe. Usually it has an Unsubscribe link that opens a page where one more click unsubscribes you, and many mail apps also show their own Unsubscribe button for our emails. You can also stop our emails by writing to support@runthroughapp.io. Emails that confirm your signup or answer a support message are not marketing emails.

We use Resend as our email delivery service. On our behalf, Resend processes your name and email address and, for support requests, your message, to deliver emails and to hold our waitlist and our support contact list. Resend records whether each email was delivered and, where open and click tracking is turned on for our sending domain, whether it was opened and which links in it were clicked.

6. Data Sharing & Third-Party Services

We do not sell your personal information or share it for cross-context behavioral advertising. We give data to the service providers below for the purposes listed.

PostHog, Resend, Upstash and Vercel are bound by data processing terms in their agreements with us. Under those terms they may process the personal data they handle for us only on our instructions, must make their staff keep it confidential, and must protect it with technical and organizational security measures, the same kind of protection we describe in Section 7. PostHog's terms are a data processing agreement we have signed. Resend's, Upstash's and Vercel's are part of our terms of service with them, and apply where data protection law, such as the GDPR or California's, covers the data. As their terms allow, Resend, Upstash and Vercel may also use records of how their service is used, such as delivery and access logs, for their own purposes, like preventing abuse and running their service. Cloudflare's terms make the same commitments for data from people in Europe and California when it checks our forms for us; Cloudflare also uses the information Turnstile collects to improve its bot detection, for its own purposes.

Service providers:

• PostHog: analytics, heatmaps and session replay for our website; analytics for the app; and records from our server, such as requests over our limits.
• Resend: sends our emails, holds our waitlist and our support contact list, and keeps a log of the emails it sends.
• Our email provider: hosts the support inbox, which receives mail sent to support@runthroughapp.io, including support form messages.
• Vercel: hosting for our website and for the server the app contacts, including its response cache and server logs, and relaying our website's analytics to PostHog.
• Upstash: the database that holds app attestation keys, request counters (by IP address, key ID or a hash of an email address), markers that stop repeat reports of requests over our limits, one-time codes that block replayed Mac requests, waitlist signups waiting to be confirmed, and markers that stop an old confirmation link from being used twice.
• Cloudflare: Turnstile, which checks waitlist and support form submissions.

AI tools we use to review our analytics:

We sometimes use AI assistants, Anthropic's Claude and PostHog's AI features, to query and review our analytics. The query results, which can include analytics events and the random IDs in them, are sent to those tools under their providers' terms.

Services your device contacts directly:

When you use certain features, your device contacts these companies itself. They act for themselves, under their own privacy policies, and receive your IP address, basic device and app details, and what you asked for:

• Google: YouTube's player, lookups and thumbnails (Section 2), and Google Fonts on our website. YouTube's player also receives information about how you watch.
• Apple: app distribution, payments, App Attest, iCloud and its sync notifications, TestFlight betas, Apple Music searches, which send Apple the words you search for, and Apple Music tracks you play in the app, which Apple streams to you, all under Apple's privacy policy.
• Vimeo: the title and thumbnail of a Vimeo link you add or share into the app.
• SoundCloud: the title and image of a SoundCloud link you add or share into the app.
• Hashnode: hosts our blog; your browser loads blog images from it.
• Websites you link: the app fetches a page you link, and the image it names, to show its title and image.

7. Data Security

We use technical and organizational measures to protect your personal data against unauthorized access, alteration, disclosure, or destruction, including encryption in transit (HTTPS/TLS) and access controls. However, no method of transmission over the internet or electronic storage is 100% secure.

If a data breach may affect your personal information, we will notify the relevant authorities and affected people as the law requires. If we have to tell people, we would email those whose address we hold, such as waitlist members and support senders, and post a notice on this website for everyone else, because the app collects no contact details.

8. Data Retention & Deletion

We keep personal data for the periods below.

• Waitlist: until you confirm, your name, email address and signup time are held on our server for up to 24 hours. After you confirm, we keep your name and email address in Resend while you remain subscribed. If you unsubscribe, we keep them, flagged as unsubscribed so that we don't send you marketing email again, until you ask us to delete them. The notice of your signup, with your name, email address and signup time, stays in our own mailbox until we delete it. Copies of the emails we sent you, and of that notice, stay in Resend's log of sent emails until Resend removes them; Resend lists a 30-day data retention period on its standard plans.
• Support messages and contact list: your messages stay in our support mailbox, and your name and email address in our Resend support list, until you ask us to delete them. A copy of each message also stays in Resend's log of sent emails until Resend removes it.
• Analytics: app and website events are kept in PostHog for up to 7 years, the longest our PostHog plan allows, unless we delete them sooner. Website session replays are kept for 30 days and heatmap data for 90 days; PostHog can keep a short summary of each recorded session, such as its first page address and how much activity it had, after the recording itself is deleted. Analytics events have no name or email field. Most are tied only to a random ID or, for people who have started a trial or subscription, to a hashed purchase identifier, so in most cases we cannot tell which events are yours. If you give us something that identifies them, such as the random ID stored in your browser or the time and pages of your visit, we will look for them, ask PostHog to delete them, and tell you if we cannot.
• Server records: attestation keys until 90 days after the app last successfully contacts our server; request counts, which include your IP address, for about two minutes, and daily counts for signed Mac requests for up to a day; waitlist signup and confirmation counts by IP address for about 20 minutes, and confirmation-email counts by a hash of the address for about two hours; one-time codes from Mac requests for 10 minutes; markers for old confirmation links until those links expire; cached YouTube responses for up to about 25 hours; a record of any request over our limits (key ID, request path and at most a salted IP hash) in our hosting logs and, with our analytics, in PostHog, plus a marker that stops repeat reports for up to an hour; and hosting logs for the period our hosting provider keeps them on our plan.
• The random analytics ID: on iPhone and iPad, deleting the app removes it from your device. On a Mac the ID is kept in the app's data folder, which can remain after you move the app to the Trash.
• The App Attest key ID: it can remain in your device's keychain after you delete the app, and our server's record of it expires 90 days after the app last successfully contacts the server.

Data on your device or in iCloud: Recordings, your library, and app preferences stored on your device or synced through your Apple iCloud account are controlled by you. Delete them in the app; delete the app from your iPhone or iPad; on a Mac, delete the app and its data folders, which are in the Containers and Group Containers folders of your Library folder; or manage your data through your device's settings and your Apple Account / iCloud account. Deleting the app or turning off iCloud sync does not delete the copy in your iCloud; to remove it, delete the items in the app on a device that syncs, or delete the app's data in your iCloud settings. We cannot delete data stored only on your device or in your iCloud account on your behalf.

Data we store: You may ask us to delete personal data we hold, such as waitlist or support email addresses, support messages in our mailbox, and any analytics events we can link to you, by emailing support@runthroughapp.io. Copies in Resend's log of sent emails are removed when its retention period ends, and our hosting provider's logs expire on their own schedule; we may not be able to delete single entries from either. We will respond within one month.

9. Children's Privacy

RunThrough is not designed for children under 13, and neither the app nor our website asks your age. We do not knowingly collect personal information from children under 13. If we learn that we have, we will promptly delete it from our email lists and mailboxes, and delete any analytics events we can link to that child. Copies in Resend's log of sent emails are removed when its retention period ends.

People aged 13 to 17 may use RunThrough with a parent's or guardian's permission, as our Terms of Service require. The app collects the same information from them as from anyone else, including usage analytics, which is on by default until Share Usage Data is turned off. We do not sell anyone's personal information or share it for cross-context behavioral advertising, including the personal information of people under 16.

10. Your Rights

Wherever you live, you can ask us to tell you what personal information we hold about you, give you a copy, correct it, delete it, or stop or limit how we use it, and you can withdraw any consent you gave. We honor these requests for the information we can link to you, whether or not a law requires us to, and we will not treat you differently for making one. Some records may not be deletable one person at a time, such as our hosting provider's logs and Resend's log of sent emails, and we usually cannot tell which website analytics are yours, because they are tied only to a random ID stored in your browser (the PostHog identifier described in "Usage data"), unless you give us that ID or the time and pages of your visit; these records are kept for the periods in Section 8.

If you are in the EU, EEA or UK, data protection law also gives you the right to receive the personal data you gave us in a portable, machine-readable form, to object to processing based on our legitimate interests, and to lodge a complaint with your local data protection authority.

To make a request, email support@runthroughapp.io. We answer within one month, and we will tell you if we need more time where the law allows it. We may need to verify your identity before acting on a request.

11. International Data Transfers

We are based in the United States, and information you send us is processed in the United States and wherever our service providers operate. If you are outside the United States, your information is transferred there. Where a provider's data processing terms include safeguards for international transfers, such as the EU Standard Contractual Clauses, those terms apply.

12. Automated Decision-Making

We do not use automated decision-making or profiling that produces legal effects or significantly affects you. We use our analytics to understand usage, improve our services and spot abusive requests to our server, not to make decisions about individuals.

13. Do Not Sell or Share Personal Information

We do not sell your personal information to anyone. We do not share it for cross-context behavioral advertising, meaning advertising based on your activity across other companies' apps and websites, either. Some services we use, such as Cloudflare Turnstile and YouTube's player, also use what they collect for their own purposes, as described above.

We give data to the service providers listed in Section 6 to run our services. Some features connect you to companies that act for themselves, such as YouTube's player, Vimeo, SoundCloud, Apple Music and websites you link. Your device contacts them directly, and they receive your IP address, basic device and app details, and the link, search or track involved, and YouTube's player also receives information about how you watch, under their own privacy policies.

Your data is used to operate, secure and improve RunThrough (including limiting abusive requests), to communicate with you, and to provide customer support.

14. Changes to This Policy

We may update this Privacy Policy from time to time. When we do, we post the updated policy on this page with a new effective date. See also our Terms of Service.

15. Contact Us

For questions about this Privacy Policy, or to exercise your data rights, email support@runthroughapp.io. For help with the app, use our support form.

Data controller (EU/EEA/UK): Carl Hinkle, Connecticut, United States (support@runthroughapp.io).