Privacy Policy

Last updated: July 29, 2026

This page is only available in Portuguese for now. The English version is under legal review.

This Policy describes how Run or Pay("we", "us") collects, uses, shares, and protects your personal data, in compliance with Brazilian General Data Protection Law (Law 13.709/2018 — "LGPD") and applicable regulations.

1. Who handles your data

The data controller is Run or Pay. For privacy matters, the Data Protection Officer (DPO) is reachable at contato@runorpay.app and will respond within 15 business days, in accordance with LGPD Article 18.

2. Data we collect

• Account data (Sign in with Apple): a stable identifier from your Apple ID and, depending on what you choose to share, your name and an email address (real or an Apple private relay address). We do not collect a password.
• Payment data: the subscription is processed by Apple (App Store). Run or Pay does not collect or store card data; we keep only your subscription state (active, period, and the Apple transaction identifier) to grant access and compute discounts.
• Activity data: for each run read from Apple Health, with your authorization, we store:
  • distance, duration, and date/time of the workout;
  • unique HealthKit identifier of the workout (for deduplication and reconciliation);
  • identifier of the source app (for example, com.apple.Fitness, com.strava.stravaride);
  • a flag indicating whether the workout was entered manually in the source app;
  • a record of the presence or absence of GPS route and heart rate samples during the workout (used only to validate the run's authenticity).
  We do not store GPS coordinates or the heart rate time series themselves — only the binary information that those signals exist within the workout window.
• Notifications:the app's reminders (for example, to activate your discount before renewal) are local notifications generated and shown on your iPhone. They do not require any data to be sent from our servers.
• Technical data: information necessary for the service to operate, such as session identifiers.

3. Health data — sensitive personal data

Activity data is considered sensitive personal data. It is processed exclusively with your specific, prominent consent, and used only to compute your distance and calculate your charge.

For that purpose, the app requests authorization from Apple Health to read three categories:

• Workouts — to identify your runs;
• Workout Routes — to confirm the exercise was recorded with GPS;
• Heart rate — to confirm there was real physical activity during the workout window.

Route and heart rate permissions are used solely to validate the run's authenticity, as described in the Terms of Use. You can revoke access at any time in your iPhone settings (Settings → Privacy & Security → Health → Run or Pay).

4. How we use your data

• Create and manage your account and authenticate your access.
• Compute miles run and calculate your subscription discount.
• Grant access according to your App Store subscription state.
• Show local reminders on your iPhone related to your subscription (for example, to activate your discount before renewal).
• Comply with legal and regulatory obligations.

5. Legal basis

Processing of signup and payment data is based on contract performance. Processing of activity data is based on your consent. Certain processing may be based on compliance with a legal obligation.

6. Who we share with

We share data only with vendors essential to operating the service, to the extent necessary:

• Apple — authentication (Sign in with Apple), subscription processing (App Store), and providing health data, subject to the permissions you grant.
• Infrastructure providers — hosting of the website, backend, and database.

We do not sell your personal data.

7. International transfer

Some of our infrastructure providers process and store data on servers located outside Brazil. In those cases, we adopt safeguards to ensure an adequate level of protection under LGPD.

8. Storage and security

We use reasonable technical and organizational measures to protect your data against unauthorized access, loss, or destruction. No system, however, is completely immune to risk.

9. How long we keep it

We keep your data for the period necessary for the purposes described in this Policy and to comply with legal obligations. After the relationship ends, data is deleted or anonymized, except where retention is legally required.

10. Your rights

Under LGPD, you can request confirmation of processing, access, correction, anonymization, portability and deletion of your data, as well as revoke consents. To exercise those rights, write to contato@runorpay.app.

11. Cookies

The site uses cookies strictly necessary to keep your session authenticated. We do not use advertising cookies.

12. Changes to this Policy

This Policy may be updated periodically. Relevant changes will be communicated through our channels.

13. Contact

For questions about privacy and data protection, write to contato@runorpay.app.