Runnel ("we," "us," or "our") respects your privacy and is committed to protecting your personal data. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our short-form video platform ("Service").
By using Runnel, you agree to the collection and use of information in accordance with this policy. If you do not agree with our policies and practices, please do not use our Service.
1. Information We Collect
1.1 Information You Provide Directly
We collect information that you voluntarily provide when using our Service:
Account Information
Email address (required for account creation and authentication)
Username (publicly visible, unique identifier)
Password (stored as cryptographic hash, never in plain text)
Display name (optional, publicly visible)
Bio (optional, publicly visible, max 500 characters)
Profile picture (optional, publicly visible)
Content You Create
Videos (uploaded content, including audio and visual elements)
Video metadata (duration, timestamps, processing status)
Video transcripts (automatically generated from audio)
Topics (subject categories you create or contribute to)
Replies (video responses to other users' content)
Social Interactions
Likes (videos you like)
Follows (users you follow)
Blocks (users you block)
Reports (content you report, including reason and optional description)
Communications
Push notification preferences (notification types you wish to receive)
Device tokens (for push notification delivery)
1.2 Information Collected Automatically
When you use our Service, we automatically collect certain information:
Device & Technical Information
Device fingerprint (unique identifier derived from device characteristics)
Device name (e.g., "iPhone 13", for push notification management)
Push notification tokens (Expo Push Tokens for mobile notifications)
IP address (for security, fraud prevention, and analytics)
User agent (browser/app version and operating system)
Usage Data
Video views (videos you watch, watch duration, completion rate)
Session data (authentication sessions, login timestamps, device info)
Interaction timestamps (when you like, follow, share, or view content)
Share link clicks (when someone clicks your shared content)
We do not purchase or receive personal data from third-party data brokers. However, we use third-party services that may collect data independently (see Section 4).
2. How We Use Your Information
2.1 Service Provision
Create and manage your account
Authenticate your identity and maintain session security
Process, store, and deliver your video content
Generate video transcripts and thumbnails
Enable social features (follows, likes, replies)
Send push notifications (if you opt in)
Provide customer support
2.2 Content Discovery & Personalization
Generate personalized content recommendations using AI/ML algorithms
Create user and video "vectors" (mathematical representations) for content matching
Rank videos in your feed based on similarity, virality, recency, and social signals
Update recommendation algorithms based on your viewing behavior
2.3 Safety & Moderation
Automatically scan uploaded videos for prohibited content (nudity, violence, hate speech)
Review user-reported content
Enforce Community Guidelines and Terms of Service
Prevent fraud, spam, and abuse
Detect and block malicious activity
2.4 Analytics & Improvement
Analyze usage patterns to improve Service performance
Track share link attribution for creator analytics
Measure video engagement and retention
Optimize video processing and streaming infrastructure
Debug technical issues
2.5 Legal Compliance
Comply with legal obligations and law enforcement requests
Enforce our Terms of Service
Protect our rights, property, and safety
Respond to legal claims
3. Legal Basis for Processing (GDPR)
If you are in the European Economic Area (EEA), UK, or Switzerland, our legal basis for collecting and using your information depends on the data and context:
Contract Performance: Processing necessary to provide the Service (account creation, content delivery, authentication)
Expo Push Notification Service: Mobile push notifications
We do NOT sell your personal data to third parties. We only share data with service providers necessary to operate the Service. All third-party providers are contractually bound to use data only for specified purposes.
5. Data Retention
We retain your data only as long as necessary to provide the Service and comply with legal obligations:
5.1 Active Account Data
User profiles: Retained while your account is active
Videos: Retained until you delete them or close your account
Social interactions: Retained while relevant content exists
Analytics data: Aggregated data retained indefinitely (anonymized)
5.2 Deleted Content
Deleted videos: Permanently removed from storage within 72 hours
Deleted accounts: Permanent deletion within 30 days
5.3 Temporary Data
Push notification tokens: Deleted after 60 days of inactivity or 7 days after marked inactive
Session tokens: Expire after 15 minutes (access) or 30 days (refresh)
View session data: Retained for 24 hours for deduplication, then anonymized
IP addresses (share clicks): Retained for 90 days for fraud prevention
6. Data Security
We implement industry-standard security measures to protect your data:
Technical Safeguards
Encryption in transit: All data transmission uses TLS 1.3+ encryption
Encryption at rest: Database and file storage are encrypted
Password security: Passwords hashed using bcrypt (industry-standard algorithm)
JWT tokens: Cryptographically signed session tokens
Rate limiting: Protection against brute force and DDoS attacks
Input validation: Protection against injection attacks
Access Controls
Principle of least privilege: Staff access limited to necessary data only
Authentication required: All API endpoints require valid authentication
Database access: Restricted to authorized backend systems only
Audit logging: Critical operations logged for security review
Limitations: While we implement strong security measures, no system is 100% secure. We cannot guarantee absolute security of data transmitted over the internet.
7. Your Privacy Rights
7.1 Rights for All Users
Access: View your profile, videos, and account data within the app
Correction: Edit your profile, display name, bio, and profile picture
Deletion: Delete individual videos or your entire account
Opt-out: Disable specific push notification types in app settings
Block: Block users to prevent them from viewing your content or interacting with you
7.2 GDPR Rights (EEA/UK/Switzerland)
If you are in the EEA, UK, or Switzerland, you have additional rights:
Right to access your personal data
Right to rectification of inaccurate personal data
Right to erasure ("right to be forgotten")
Right to restrict processing
Right to data portability
Right to object to processing based on legitimate interests
Right to withdraw consent
Right to lodge a complaint with your data protection authority
If you are in the EEA, UK, or Switzerland and believe we have not addressed your privacy concerns adequately, you have the right to lodge a complaint with your local data protection authority:
EU: Find your authority at https://edpb.europa.eu/about-edpb/board/members_en
UK: Information Commissioner's Office (ICO) - https://ico.org.uk/make-a-complaint/
Switzerland: Federal Data Protection and Information Commissioner (FDPIC) - https://www.edoeb.admin.ch/