RUN LDN

Privacy policy

Last updated: 20 October 2026

RUN LDN is an iPhone and Apple Watch app that plans green running routes in London. It is made by Marc Lee ("we", "us"). This policy says what information the app uses, what leaves your devices, and what happens to it.

The short version

• No account, no sign-in, no ads, no tracking and no analytics.
• To plan a route, the app sends the start and finish points and your route settings to our route server. We do not receive your name, email address, Apple ID or any device identifier.
• Your workouts, heart rate and run routes stay on your devices and in Apple Health. We never receive them.
• Your saved routes live on your iPhone and your Apple Watch.

What leaves your devices, and why

Planning a route

When you plan a route, the iPhone app sends our route server (runldn-api.onrender.com):

• the start point, and the finish point for an A to B run, as map coordinates;
• whether it is a loop, the distance you asked for, any "aim for at least X % green" setting, and your pace if you turned it on.

The server uses these to plan the route and sends the routes back. If you used "Use my location", the start point is your location at that moment. The app does not send your location at any other time.

Searching for a place

When you type in the Start or Finish field, the app sends what you typed to our route server, which passes it to Photon, a place search service run by komoot (photon.komoot.io), and returns the matching places in London. Photon receives the search text from our server, not from your device, so it does not see your IP address. We do not keep what you searched for: the search text is left out of our logs.

Maps

Maps on the iPhone and the Watch are Apple Maps (MapKit). Apple provides the map tiles, and Apple's privacy policy applies to them: https://www.apple.com/legal/privacy/

Sending a route to your Watch

Routes go from your iPhone to your Apple Watch directly, through Apple's WatchConnectivity. The Watch tells the iPhone when a route has arrived. Nothing passes through our server.

Reporting a problem

"Report a problem" in Settings opens an email in your mail app. It quotes the ID of your last route request, the app version, your iOS version and which server the app uses. Nothing is sent unless you send the email yourself, and you can edit or delete any of it first. If you write to us, we use your email only to reply.

What stays on your devices

• Location. The iPhone uses your location to set the start of a route when you ask it to, and to show where you are on the map. The Watch uses it during a run to record your GPS route and to warn you if you leave the planned route. This stays on your devices.
• Workouts and Apple Health. A run on the Watch is a workout. With your permission, the Watch saves it to Apple Health with its GPS route, and reads your heart rate, distance, active energy and running speed during the run to show them on screen and in the summary. None of this is sent to us or to anyone else. Apple Health may sync it across your devices according to your own iCloud settings; that is Apple's service, under Apple's privacy policy.
• Saved routes are stored in the app on your iPhone and on your Watch, and are included in your device backup. Deleting a route on the iPhone also removes it from the Watch.
• Settings and the planner's form (such as your default pace and the last places you entered) are stored on your iPhone.

What our server keeps, and for how long

Our route server runs on Render (render.com) in Frankfurt, Germany. Requests reach it through Cloudflare, which Render uses to carry traffic.

• Request log. One line per request: the time, which part of the server was asked for, whether it worked, how long it took, a request ID, and for route requests the distance and whether it was a loop. It holds a hash of your IP address, not the address itself. The hash is salted with a random value that is replaced every time the server restarts, so it cannot be turned back into your address and cannot link your requests across restarts. These lines are kept by our host, Render, in its platform logs for a short period.
• Route log. For each route request, the start and finish points, the settings you sent and the routes we returned, under the same request ID. We use it to find and fix bad routes. It is kept for up to 30 days and then deleted, and is never kept anywhere else.
• Rate limits. To stop any one connection overloading the service, the server counts recent requests by IP address. These counts are held in memory for at most 10 minutes and are never written to a log.

Render and Cloudflare handle your connection to our server, and so see your IP address as part of delivering it, under their own privacy terms.

What we do not do

• We do not ask you for a name, email address or account.
• We do not show ads.
• We do not track you across other companies' apps or websites, and we do not use advertising identifiers.
• We do not use analytics or crash reporting services.
• We do not sell or share your information.
• We never receive your Apple Health data.

Your choices

• You can refuse or remove location access in Settings > Privacy & Security > Location Services. You can still plan routes by searching for a place or tapping the map, but the Watch cannot record or guide a run without location.
• You can refuse or remove Apple Health access in the Health app (or Settings > Health > Data Access & Devices on iPhone). Runs then are not saved to Health.
• You can delete saved routes in the app, and delete the app to remove everything it stores on your devices.
• The information we keep on the server is not linked to you, so we cannot find "your" requests. If you have a request ID from "Report a problem", we can look that request up and delete it on request while it is still held.

Under UK and EU data protection law you have rights over personal data about you, including access and deletion. Write to us at the address below. You can also complain to the Information Commissioner's Office (ico.org.uk).

Children

RUN LDN is not aimed at children and collects nothing that identifies anyone.

Changes

If this policy changes, we will update it here and change the date at the top.

Contact

Marc Lee, runldn@marc.ly