Privacy policy

1Who this is and what it covers

This policy covers the Staterunner iPhone app, the display device it pairs with, the service behind them, and this website including the waitlist form. There is no Android app.

The operator is Aurora Algorithm Inc., 42 Almond Lane, Ottawa, Ontario, Canada, K2L 3T4. Privacy questions go to support@auroraalgorithm.com. The company is registered in Ontario and the address above is its registered office. That mailbox is read by one person, not a help desk.

The law that applies is Canada's Personal Information Protection and Electronic Documents Act, PIPEDA. It covers every organisation that collects personal information in the course of commercial activity, and Ontario has no private-sector privacy statute of its own that would replace it. The regulator is the Office of the Privacy Commissioner of Canada. Section 12 says how to reach it. Everything else on this page states what the system does, and where a sentence states what the law requires it names the law.

[VERIFY] Whether Quebec Law 25 — the Act respecting the protection of personal information in the private sector — also binds this company is a question for a lawyer. It applies to anyone who carries on an enterprise in Quebec, and whether an Ontario company selling online to Quebec residents does so is unsettled. This page is written as if it does: the Commission d'accès à l'information is named in section 12, the under-14 rule is stated there, and the 30-day access deadline in section 10 is the same under both laws.

[VERIFY] The product is sold in the United States as well as Canada. Washington's My Health My Data Act applies to any business that offers a product to Washington residents and handles consumer health data, with no size threshold, and other states have laws of the same kind. Which of them bind this company, and what they add to this page, is a question for a lawyer.

Privacy inquiries and requests may be submitted in English or French. Les demandes relatives à la confidentialité et aux renseignements personnels peuvent être transmises en français ou en anglais.

2Health data, which is the main thing

The app reads from Apple Health on your iPhone. It asks for read access to seven types and nothing else. It never asks for permission to write to Apple Health, and it contains no code that could write, change or delete anything there.

You grant this in Apple's own permission sheet, one type at a time, and you can withdraw any of it in the Health app at any time. We never see a type you did not grant.

Cycling distance and swimming distance are on the list because a ride's or a swim's distance is not recorded under the walking and running type. They are read off a workout you already recorded. Nothing queries them on their own, and there is no daily total for either.

This is training and exercise data only. No heart rate of any kind is read: not a workout average, not a resting rate, not a series. No body measurement and no vital sign is read either — no weight, no height, no body fat, no blood pressure, no blood oxygen, no respiratory rate, no temperature, no sleep, no menstrual or reproductive data, no clinical records. None of these appears in the permission sheet, and a type the sheet does not ask for is a type iOS will not hand the app.

3What actually leaves your phone

Summaries, not recordings. The app does not upload Apple Health samples. It uploads nine fields per workout, and one number per metric per day for the daily figures, which are the totals Apple Health itself has already calculated.

The nine are: the identifier Apple Health gave the workout, the sport, Apple's own activity type, the start time, the elapsed seconds, the distance, the elevation gain, the energy burned, and whether it was indoors. No heart rate is among them. There is no second-by-second series of anything, and no location data of any kind: no GPS track, no route, no start or finish point.

An upload carries your sign-in token, a key that stops the same upload being counted twice, the identifier Apple Health gave the workout, a marker of how far the last sync got, and your time zone name. It carries no advertising identifier, no device fingerprint and no installation id.

4The rest of what is collected

Your email address is held in the sign-in system only. It is never copied into the database that holds your training data.

The IP address and browser string in the waitlist row are there for one reason: Canadian anti-spam law puts the burden of proving you agreed to be emailed on us, and that proof is a record of when and from where you agreed. They are not analytics, they are not used to profile you, and they are not combined with anything else. If you never sign up to the waitlist, none of this row exists.

The waitlist is kept in its own database table, not the one holding training data. Signing up to the waitlist creates no account and touches no health data.

This website itself keeps no visitor log. Neither the file store nor the content network in front of it has access logging switched on, and there are no cookies.

5What is never collected

• Location, routes and GPS tracks. No widget uses them and none is requested.
• Heart rate, in any form. No workout average, no resting rate, no series.
• Body measurements and vital signs. No weight, height, body fat, blood pressure, blood oxygen, respiratory rate, temperature, sleep, or menstrual and reproductive data.
• Clinical records. No conditions, medications, lab results or immunisations.
• Photos, contacts, calendars, microphone or camera.
• Advertising identifiers. There is no IDFA and no IDFV in any upload.
• Anything from a service other than Apple Health. There is no third-party fitness account to connect.

There is no analytics product, no crash reporting product and no tracking pixel in the app or on this website. No Sentry, no Firebase Analytics, no Crashlytics, no Google Analytics, no Amplitude, no Mixpanel, no Segment.

One qualification, stated because it is true rather than because it is tidy: the app's dependency list names Firebase Messaging, a push-notification library. It is never started. No line of the app's code refers to it, there is no Firebase configuration file, no project key, and no push permission is requested, so the library has no service to contact, obtains no token and sends nothing. It is an unused dependency, not a feature.

6Why it is collected, and on what basis

To draw your numbers on your display, and to keep your account and your device working. That is the whole purpose.

Health data is never used for advertising or marketing, is never sold, and is never shared with a data broker. Apple's App Store rules require this of any app reading Apple Health, and it is also the intent.

PIPEDA has one basis for collecting personal information: your consent, in a form that matches how sensitive the information is. Health information counts as sensitive, so consent for it must be express — a deliberate act, not something read into your use of the app. Quebec's law says the same. The rest may rest on consent implied by what you plainly asked for.

You can withdraw consent at any time: in Apple's Health app for each health type, with the unsubscribe link for the waitlist, and by deleting your account for the rest. Section 11 says exactly what each does.

7How long it is kept

These are the periods the code actually enforces, by expiry timestamps on the records themselves or by a retention setting on the log.

Automatic expiry is not instant. The database removes an expired record within roughly 48 hours of its expiry time.

Both databases keep continuous point-in-time backups, with the window AWS sets by default: 35 days. A restore creates a new table rather than changing the live one, and nothing is restored as routine. A record you delete, or one that expires, therefore survives in those backups for up to 35 days and is then gone. There is no other backup: the separate backup vault the deployment can enable is switched off, and this page will state its window before it is switched on.

8Where it is kept, and who else touches it

The service runs on Amazon Web Services in the Canada Central region, in Montreal. The database, the sign-in system, the servers, the device messaging, the waitlist and the mail that sends its confirmation are all deployed there, verified 3 September 2026. The deployment code lists Canada Central as the only permitted region and its own tests fail on any other, so this is a checkable property of the code, not a policy.

Two things do touch servers outside Canada, and neither carries health data:

• This website's pages are copies cached at content-network locations across North America and Europe, so a page can reach you from outside Canada. Those pages are the same files for everyone and hold nothing about you. The waitlist form posts straight to the service in Montreal, not through the cache.
• The email that confirms a new app account is sent by AWS's default sender, which is not pinned to Canada. It carries your email address and a confirmation code, nothing else. Moving it to the mail service in Montreal is planned and not done.

Amazon Web Services is headquartered in the United States. Your data is stored in Canada, but United States authorities can in some cases compel a United States company to produce data it holds abroad. That is the one route by which data held here could reach a foreign authority, and it comes with any American cloud provider.

There is no one else. Your data is not sold, rented, or given to an advertiser, a broker or an insurer.

9How it is protected

• Your password never leaves your phone. Sign-in uses SRP, which proves you know it without sending it.
• Everything between the app and the service travels over HTTPS.
• The database is encrypted at rest and cannot be deleted by accident.
• The display device's private key is generated on the device and never leaves it.
• The service holds no password or access token for any other company's health service, because there is none to hold — Apple Health is read on your phone.

10Getting your data back

Open the app and go to Settings, then Account, then Export my data. It produces a structured JSON file containing your profile, your connected sources, your devices, your goals, your full workout history and every daily figure. It is immediate and it is free.

If you would rather ask, write to support@auroraalgorithm.com. It is monitored. PIPEDA gives an organisation 30 days after it receives a request to answer, extendable once by at most 30 more days with a written reason, and a request that gets no answer counts as refused. Quebec's law sets the same 30 days. A charge is allowed only if you are told the amount first and choose to go ahead, and there is no charge here.

11Deleting your account, and exactly what that does

Deleting your account immediately erases your goals, your gear, your layouts, your computed figures, every workout, every daily figure, and the copy of each upload as your phone sent it. Any display device you own is unclaimed, your sign-in credential is deleted from the sign-in system, and your account is marked deleted so nothing can be read from it again.

Two things are not erased at once, and this page says so rather than implying otherwise. Your account row — display name, time zone, units — is marked deleted and left in place; the scheduled job that removes it is built but not switched on, so today it stays until that job runs. And if the call that deletes your sign-in credential fails, the deletion is reported as failed rather than done, the failure is logged against your account identifier, and removing the credential is a manual step for us: write to support@auroraalgorithm.com and quote the error.

You can also withdraw a single data source without deleting the account, by turning off the permission in Apple's Health app. That takes effect on your phone immediately, and nothing further is uploaded.

12Changes, children, and complaints

If this policy changes, the date at the top changes with it, and a material change will be told to account holders by email.

The app does not ask your age and has no age check, and neither the product nor this site is aimed at children. PIPEDA sets no fixed age. The Privacy Commissioner's position is that anyone under 13 cannot consent for themselves and a parent or guardian must; Quebec's law puts that line at 14 unless the collection is clearly for the child's benefit. Using the app needs an Apple Account, which in Canada and the United States a person under 13 cannot open without a parent. [VERIFY] Whether these terms should refuse anyone under 13, or under 14 in Quebec, and whether the app must ask an age, is a choice a lawyer must make. Until it is made, the app is not for anyone under 13.

If you think we have handled your information wrongly, write to support@auroraalgorithm.com first. The federal regulator expects you to raise it with us before it will take a complaint. If that does not settle it:

• Office of the Privacy Commissioner of Canada, 30 Victoria Street, Gatineau, Quebec K1A 1H3. Toll-free 1-800-282-1376. Complaints are filed online at priv.gc.ca under Report a concern. After the Commissioner reports, you may apply to the Federal Court.
• Quebec residents may instead apply to the Commission d'accès à l'information du Québec, toll-free 1 888 528-7741, 2045 rue Stanley, bureau 900, Montréal (Québec) H3A 2V4, using its form for the examination of a disagreement. A refused access request must be brought to it 30 days from the refusal.