RunBridge privacy

Updated October 29, 2026. RunBridge is operated by the developer reachable at dev@fogcity.us.

RunBridge stores private planned running workouts, schedules, optional pace zones, preferences, an app-specific Apple account identifier, app-verification keys, and authorization records on its service backend. It does not use CloudKit or upload completed Apple Health workout history or GPS routes.

Apple handles sign-in and purchases. RunBridge never collects your Apple password or payment-card details. It stores encrypted Apple refresh credentials to revoke sign-in authorization, and hashes app/assistant access tokens.

For a paid unlock, RunBridge stores the product and transaction identifiers, verified purchase/refund status, and a pseudonymous account token derived from your app-scoped Apple sign-in identifier. This token associates the purchase with your RunBridge account and lets the original Apple sign-in restore an unlock after account recreation. The App Store purchasing account may differ from your RunBridge Apple sign-in. Apple retains the purchase history under its own policies. RunBridge does not send workout usage information to Apple to contest refund requests.

An assistant can read and change only the resources you authorize. Its provider processes data it reads under its own terms. The consent screen shows its permissions and destinations. Revoke a connection in Settings to stop further access. Your hosted workouts are private to your account; there are no public workout links or anonymous imports.

Hosted workouts expire 14 days after their scheduled time and at most 45 days after creation. The app refreshes its offline cache when opened; signing out clears that account's local library. Short-lived mutation counters last one day, and free-allowance records last seven days. Notification deduplication records contain no workout content.

Delete your account and live hosted data in Settings. Deletion removes workouts, profiles, sessions, assistant grants, and server purchase associations immediately. If Apple cannot be reached to revoke sign-in authorization, RunBridge retains only the encrypted authorization needed to retry for up to 30 days. Completed Apple Health history is preserved. A restored purchase does not recreate deleted workouts.

Automatic off-machine workout backups are not enabled. Restricted deployment recovery copies expire after seven days and are cleaned hourly. They are not used to serve workouts or restore deleted accounts. Code rollback uses the current database; recovery after unrecoverable database loss starts with fresh account data and users can restore valid purchases through Apple. Planned workouts and preferences may need to be recreated.

RunBridge does not use advertising or cross-service tracking. It uses bounded request counters and verification records for reliability and fraud prevention, and does not log workout bodies, access tokens, or signed purchase payloads. Contact dev@fogcity.us for support, privacy questions, or data requests.