Shoelace is built around your safety, so we collect as little as we can, keep it in the EU, and never show other runners where you are.
This notice explains what we collect, why, who helps us run Shoelace, how long we keep things and your rights under UK data protection law. Shoelace is the controller of your personal data. Contact us at support@shoelace.run.
If you join the waitlist
- Your email address and postcode district (for example SO14). We never store your full postcode.
- We use them to decide where to open next and to email you when we launch near you. Our basis is your consent, which you can withdraw at any time by emailing us.
- To stop abuse we keep a scrambled (hashed) version of your connection's IP address for 24 hours.
If you use the app
- Your account: your email address, or your Apple ID's email if you sign in with Apple.
- Your profile: first name, photo, short bio, pace, run distances and when you're free. Other verified runners who match you see these.
- Your running area: you drop a pin, and we turn it into an area of roughly 5 km² straight away. The exact point is never stored. Other runners only see a distance range like "2–5 km", never a pin or a map.
- Full name and date of birth: seen only by our team. We use them to confirm you're 18 or over and to stop removed accounts coming back.
- Verification: a short selfie video, watched by a woman on our team and deleted as soon as she's made a decision (in any case within 7 days). If you're verified in person, we look at your ID but never copy or photograph it. We note only the type of document.
- Photos: we strip hidden information such as location from every photo you upload.
- Messages and runs: your messages, the runs you arrange (time and place) and your answers after a run.
- Safety: blocks, reports and our decisions on them. If you report someone, our team can read your conversation with her.
- Share my run: the link you send shows your first name, your partner's first name, the place, the time and the planned distance. It stops working 6 hours after the run starts, or sooner if the run is cancelled.
- Notifications: a device token so we can send you notifications. Lock screen notifications never include message text or meeting places.
Why we use it
- To run Shoelace for you (our contract with you): your account, matching, messages, runs and notifications.
- To keep the community safe (our legitimate interests): verification, moderation, handling reports and stopping removed accounts coming back.
- To understand and improve Shoelace (our legitimate interests): we record when you reach milestones such as signing up, getting verified or your first run. These records include your account ID, email, first name and launch area. They never include your messages or location.
- To meet legal obligations, for example responding to lawful requests.
We don't sell your data, and we don't show adverts.
Who helps us
- Cloudflare hosts Shoelace, its database and stored files (in the EU) and sends our emails.
- PostHog stores our product analytics, in the EU.
- Apple, if you sign in with Apple, and to deliver notifications to iPhones.
- Expo passes notifications from us to Apple and Google. It's based in the US, so notification text and your device token pass through the US. That transfer is covered by the UK's data bridge or standard contractual clauses.
How long we keep it
- Verification videos: deleted when reviewed, and always within 7 days.
- Waitlist entries: until you ask us to remove them.
- Your account: until you delete it in the app. When you do, we delete your profile, photo, running area and sign-ins, and remove your email and name from our analytics.
- Messages you sent stay in the other runner's chat, under "Deleted user". Reports and our records of safety decisions are kept so we can act on concerns.
- Your full name and date of birth are deleted with your account, unless your account was removed or reported. Then we keep them to stop the same person coming back.
Your rights
You can ask for a copy of your data, ask us to correct or delete it, object to how we use it, or ask us to restrict it. Email support@shoelace.run and we'll reply within a month. If you're unhappy with how we've handled your data, you can complain to the Information Commissioner's Office at ico.org.uk.
Cookies
This website doesn't use cookies or tracking. The app keeps you signed in with a token stored on your phone.
Changes
If we change this notice in a way that matters, we'll tell you in the app before it applies.