This Privacy Policy explains what personal data we collect when you use the Runotoon website at https://runotoon.com and its related services (the “Service”), why we collect it, who we share it with, and the rights you have. Words defined in our Terms of Use have the same meaning here.
By using the Service, you confirm that you have read this Privacy Policy and that you are at least 16 years old (or the minimum age required where you live, if higher), or that your parent or guardian has read and agreed to it for you. If you do not agree, please stop using the Service and ask us to delete your data.
If this Privacy Policy is translated, the English version prevails. “GDPR” means the General Data Protection Regulation (EU) 2016/679 and, for the United Kingdom, the UK GDPR. “EEA” means the European Economic Area and, for this policy, includes the United Kingdom.
1. What we collect, why, and on what legal basis
We collect personal data directly from you, automatically when you use the Service, and from third parties you connect to it.
| Data | What it is and why we use it | Legal basis |
|---|---|---|
| Data you give us | ||
| Account data | Your email address, display name and password (stored only in hashed form) when you create an Account, and your preferences, such as language. We use them to create and run your Account, sign you in and keep it secure. | Performance of our contract with you. |
| Messages to us | What you write when you contact us, for example at [email protected]. We use it to answer you and help you. | Performance of our contract; our legitimate interest in providing support. |
| Email communications | We email you about your Account and purchases (for example verification, password reset and receipts). With your consent, we may also send you news and offers; you can unsubscribe at any time with the link in those emails. | Performance of our contract and legal obligations (service emails); your consent (marketing emails). |
| Data we collect automatically | ||
| Reading and account activity | Your library, reading, watching and listening history, progress, unlocked episodes, Coin balance and its transactions, rewards and referrals. We use it to provide the Service (for example to continue where you left off) and to show you what you own. | Performance of our contract. |
| Device and log data | IP address, browser and device type, operating system, language and time-zone settings, and an anonymous visitor identifier. We use it to deliver the Service, keep it secure, prevent fraud and fix problems. | Performance of our contract; our legitimate interest in securing the Service. |
| Usage data | Which pages you view, the titles and features you use, searches, how long you stay, and actions such as sign-ups and purchases. We use it to understand how the Service is used, measure and improve it, and test changes. | Our legitimate interest in understanding and improving the Service. |
| Referral and campaign data | The invite code in a link you followed, the campaign parameters of the link (such as utm_ tags and ad click identifiers), the site that referred you and the page you landed on. We use it to credit referral rewards and to measure which campaigns bring readers. | Performance of our contract (referral rewards); our legitimate interest in measuring our marketing. |
| Cookies and similar technologies | Small files and browser storage that keep you signed in, remember your settings and measure use of the Service. See our Cookie Policy. | Performance of our contract (necessary cookies); our legitimate interest or, where required, your consent (other cookies). |
| Data from third parties | ||
| Google or Apple sign-in | If you sign in with Google or Apple, we receive your name and email address (or an Apple relay address) from that provider, and use them to create and run your Account. | Performance of our contract. |
| Payment data | Payments are handled by our payment provider, Polar. We never receive or store your full card number. We receive the details of the transaction: what you bought, the amount, currency, date, its status, and the country and type of payment method. We use them to deliver your purchase, keep records and handle refunds and disputes. | Performance of our contract; legal obligations (tax and accounting records). |
We do not use your personal data for automated decisions that have legal or similarly significant effects on you.
2. Who we share your personal data with
We do not sell your personal data. We share it only as needed for the purposes above, with the following recipients.
2.1 Service providers
Companies that process personal data on our behalf and under our instructions:
| Category | What they do | Data shared |
|---|---|---|
| Hosting and storage | Host and run the Service, its databases and its media (for example Railway and Cloudflare). | All categories in section 1. |
| Payments | Process payments, tax and refunds as merchant of record (Polar). Polar handles your payment details under its own privacy policy. | Identifiers, email address, purchase data, country. |
| Analytics | Measure how the Service is used so we can improve it (PostHog). | Identifiers, device and usage data, referral and campaign data, purchase events. |
| Email delivery | Send our service and marketing emails (Resend). | Email address, name, the content of the email. |
| Sign-in providers | Let you sign in with an existing account (Google, Apple). | The data needed to complete the sign-in. |
2.2 Authorities and legal requests
We may disclose personal data to enforce our Terms of Use; to protect the rights, safety or property of Runotoon, our users or others; and to respond to courts, law enforcement, regulators and other public authorities where the law requires or allows it.
2.3 Business transfers
If we are involved in a merger, acquisition, reorganisation or sale of assets, personal data may be transferred as part of that transaction, subject to this Privacy Policy.
2.4 Affiliates
We may share personal data with companies in our group, which will use it in line with this Privacy Policy.
3. Your choices and rights
- Access and correction. You can see and change your account details in Settings, or ask us for a copy of your data.
- Deletion. You can delete your Account in Settings or ask us to delete your data. We may keep some data where the law requires it (for example, purchase records for tax), and delete it once that obligation ends.
- Objection and restriction. You can ask us to stop or limit some uses of your data.
- Marketing emails. Use the unsubscribe link in any marketing email.
- Cookies and analytics. See the Cookie Policy for how to control them.
To use any of these rights, write to [email protected] from the email address of your Account, or give enough detail for us to verify your identity, and tell us which right you want to use. We use the data in your request only to verify you and answer it, and we reply within the time required by law. We may refuse requests that are manifestly unfounded or excessive, and will explain why.
4. Additional information for users in the EEA and the UK
Under the GDPR, you have the right to:
- Access: get confirmation that we process your data and a copy of it;
- Rectification: have inaccurate or incomplete data corrected;
- Erasure: have your data deleted;
- Withdraw consent at any time, where we rely on your consent;
- Portability: receive your data in a structured, machine-readable format and have it sent to another controller where technically feasible;
- Object to processing based on our legitimate interests, and at any time to direct marketing;
- Restriction: have us limit the processing of your data; and
- Complain to a data protection authority, in particular in the country where you live or work. Our lead authority is the Commissioner for Personal Data Protection of the Republic of Cyprus.
To use these rights, write to [email protected].
5. Additional information for users in the United States
Depending on the state where you live (for example California, Colorado, Connecticut, Virginia or another state with a consumer privacy law), you may have the right to know what personal information we collect, use and disclose; to access it in a portable format; to correct it; to delete it; to limit the use of sensitive personal information; and to opt out of the “sale” or “sharing” of personal information or its use for targeted advertising. For California residents, this section is also our notice at collection.
We collect the categories of personal information described in section 1 (identifiers, commercial information, internet and device activity, and approximate location derived from your IP address) for the purposes described there, and disclose them to the categories of recipients in section 2 for business purposes. We do not sell personal information for money, and we do not knowingly sell or share the personal information of anyone under 18.
To make a request, write to [email protected]. We will verify your identity, for example by asking you to confirm details of your Account. You may use an authorised agent; we may ask the agent for proof of authorisation and ask you to confirm your identity. If we deny your request, you may appeal by replying to our answer, and, if the appeal is denied, contact your state’s Attorney General. We will not discriminate against you for exercising your rights.
6. Additional information for users in Brazil
Under Article 18 of the Brazilian General Data Protection Law (LGPD), you have the right to: confirmation that we process your data; access to it; correction of incomplete, inaccurate or outdated data; anonymisation, blocking or deletion of unnecessary, excessive or unlawfully processed data; portability; deletion of data processed with your consent; information about whom we share it with; information about the possibility of refusing consent and its consequences; and revocation of consent. To use these rights, write to [email protected].
7. Children
The Service is not intended for anyone under 16, and we do not knowingly collect personal data from them. If you believe a child under 16 has given us personal data, please contact us at [email protected] and we will delete it.
8. International transfers
Our service providers may process personal data in countries other than yours, including outside the EEA (for example in the United States). Where we transfer personal data from the EEA or the UK to a country without an adequate level of protection, we rely on safeguards such as the European Commission’s Standard Contractual Clauses (or the UK equivalent), or on an adequacy decision such as the EU–US Data Privacy Framework.
9. How long we keep data
We keep personal data for as long as your Account is open and as long as necessary for the purposes in this policy. When you delete your Account, we delete or anonymise your personal data, except data we must keep to meet legal obligations (such as purchase records, kept for the period required by tax and accounting law), resolve disputes or enforce our agreements.
10. Security
We protect personal data with technical and organisational measures appropriate to the risk, such as encrypted connections, hashed passwords and restricted access. No system is completely secure, so please keep your login details safe and tell us at once at [email protected] if you suspect unauthorised use of your Account.
11. Changes to this Privacy Policy
We may update this Privacy Policy from time to time. We show each update by changing the “Last updated” date, and if we make material changes we will tell you by email or on the Service before they take effect.
12. Data controller and contact
Runotoon, a company established in the Republic of Cyprus, is the controller of your personal data. For any question about this Privacy Policy or your personal data, write to [email protected].