The short version. STEUD doesn't ask for your name, email or age, and your account is anonymous. Your routes and run history stay on your phone. To rank each race, the server stores your time, whether your run passed the app's checks and, only if you choose to share them, your country and whether to rank you among women. It deletes them 14 days after the race closes. There are no ads, no analytics and no tracking; if the app crashes, an anonymous crash report is sent so the problem can be fixed.
Who I am
STEUD is made by Thomas Martin, an independent developer in the United Kingdom, who is the data controller for the personal data described here. You can reach me at hello@steud.app.
What stays on your phone
These are stored only on your device and never sent to me:
- Your location and routes. STEUD uses your location while you're recording a run, including when your phone is locked, to measure the route and distance. The GPS points, maps and splits are saved on your phone.
- Motion data. Step counts and barometer readings during a run are used on your phone to check the run was on foot and to measure climbs.
- Heart rate, for runs recorded on Apple Watch.
- Your run history, results you've received, run reviews, stats and your settings.
The app checks each run on your phone and only sends a verdict ("pass" or "flagged") to the server, never the route itself. If you delete the app or your account, this data is erased from your phone.
Country and gender (optional)
When you first open STEUD, and at any time in Settings, you can choose to share your country and your gender. Both are optional and you can skip them.
- Country. If you choose one, it's sent with each race you enter, so your time counts towards your country's average. After each race, the app shows every runner a leaderboard of countries: each country's average time and how many ran for it. It never shows anyone's own time or who they are.
- Gender. Everyone is ranked together. If you choose "female", your races are also ranked among women, and you see that place too. If you choose "male" or "prefer not to say", nothing extra is shared.
Your choices are kept on your phone and sent only with the races you enter. Changing them in Settings applies to your next race.
Apple Watch
If you use STEUD on Apple Watch, the watch records your run (GPS, heart rate and steps) and sends it straight to STEUD on your iPhone over Apple's watch connection, not through any server. From there it's handled exactly like a run recorded on your phone. When your phone and watch are in touch, the phone also sends the watch the races open now, so you can start them from your wrist.
Run reviews
STEUD writes a short review of each run. The app works out the facts itself (pacing, your finish, heart rate and how the run compares with your earlier ones), and on iPhones with Apple Intelligence, Apple's on-device model puts them into words. This happens entirely on your phone: nothing about the run is sent to Apple, to me or to anyone else.
What the server stores
STEUD's backend is hosted by Supabase. It stores:
| Data | Why | How long |
|---|---|---|
| A random anonymous account ID, created when you first race | To tell your entries apart without knowing who you are | Until you delete your account |
| Your device's push notification token, app language, and whether you've turned on special event notifications | To send your results and, if you turn them on, a notification when a new special event opens, in your language | Until you delete your account |
| Your STEUD+ expiry date, if you subscribe | To unlock STEUD+ races and results | Until you delete your account |
| For each race you enter: your finish time, the run's verdict and your position; your country, and your place among women, if you chose to share them | To rank the race and tell you where you placed | Deleted automatically 14 days after the race closes |
| Each country's average time, number of runners and position in a race | To show the country leaderboard | Deleted 14 days after the race closes |
| Special event prizes you've won | To give you the prize | Deleted 14 days after the event closes |
I can see submitted times and verdicts to review flagged runs, and may disqualify a time that doesn't look genuine. Your position is shown only to you; there is no public leaderboard of runners.
Like any web service, Supabase's servers receive your IP address when the app connects. It's kept in short-lived service logs and isn't linked to anything else.
Crash reports
If the app crashes or hits an unexpected error, a report is sent to Sentry so I can fix it. A report contains the error, where in the app's code it happened, the app and iOS versions, and your phone model. It doesn't contain your account ID, your name, your location or your routes: identifiers and anything that looks like a location are removed on your phone before it's sent, and Sentry is set not to store IP addresses. Reports are held in the EU and deleted after 30 days.
Services that receive data
- Supabase hosts the database and server functions described above.
- RevenueCat manages subscriptions. It receives your anonymous account ID and your App Store purchase details (product, price, dates and country), but not your name or payment card. See RevenueCat's privacy policy.
- Sentry receives the anonymous crash reports described above. See Sentry's privacy policy.
- Apple processes App Store payments and delivers push notifications. If you choose to, STEUD saves your runs to Apple Health as workouts with their route. The iPhone app never reads your health data; the Apple Watch app reads your heart rate during a run, to show it and save it with the run.
- Expo relays notifications to Apple's push service. It receives your push token and the notification text (your position, or the name of a new special event). See Expo's privacy policy.
- Maps. Route maps use your phone's built-in map service (Apple Maps on iPhone), which loads map tiles for the area you're viewing.
I don't sell your data or share it with anyone else. STEUD contains no advertising, analytics or tracking SDKs, and doesn't track you across other apps or websites. This website doesn't use cookies or analytics either.
Some of these providers may process data outside the UK. Where they do, they rely on safeguards recognised under UK data protection law, such as the International Data Transfer Addendum or the UK–US data bridge.
Permissions
- Location (including while the phone is locked): to record your run. Only used while recording.
- Motion & fitness: step counting and barometer readings, used on your phone to check runs.
- Notifications: to tell you your result when a race closes and, if you turn on Special events in Settings (it's off unless you do), when a new special event opens.
- Apple Health: on iPhone, write only, to save your runs as workouts. On Apple Watch, also to read your heart rate during a run.
- Photos (add only): to save result cards when you tap Save to Photos. STEUD can't see your photo library.
You can change any of these in your phone's Settings at any time.
Legal basis
Under UK GDPR, I process this data because it's needed to provide the service you asked for: entering races, ranking them and sending your results (contract). Sharing your country and gender relies on your consent, which you can withdraw at any time in Settings. I rely on my legitimate interests to keep races fair, by reviewing flagged runs, and to keep the app working, through crash reports. Saving to Apple Health and notifications rely on your choice to turn them on.
Deleting your data
In the app, go to Settings → Delete account. This deletes your profile, race entries and RevenueCat customer record from the server, and erases your runs from your phone. Deleting your account doesn't cancel an App Store subscription, so cancel that in your Apple ID settings.
Your rights
You have the right to access, correct, delete or restrict the use of your personal data, to object to its use, and to data portability. Because accounts are anonymous, I usually can't tell which data is yours from an email alone. Deleting your account in the app is the quickest way to erase everything. For any other request, email hello@steud.app.
If you're unhappy with how your data is handled, you can complain to the Information Commissioner's Office at ico.org.uk.
Children
STEUD isn't directed at children under 13, and I don't knowingly collect data from them.
Changes
If this policy changes, I'll update it here and change the date at the top. If a change significantly affects how your data is used, I'll also tell you in the app.