Privacy Policy — Rune
Rune helps you pick the best credit card for each purchase. This policy explains what we collect, why, and what you can do about it.
Who we are
Rune ("we") is an independent app run by its maintainer. For anything about your data, write to support@runecredit.com.
What we collect
Without an account (guest)
- The cards you add are stored only on your phone. We do not receive them.
With an account
- Email address and name from Google or Apple sign-in. If you use Apple's Hide My Email, we receive Apple's relay address instead of your real one. Sign-in is handled by AWS Cognito, and Rune does not store passwords.
- An account ID that ties your cards to your account.
- Your cards: which cards you hold, application month, and optional nicknames.
- Family sharing (optional): the people you add, whose name each card is under, and the email addresses of members you invite. Members of your family group can see the cards in that group. When you mark a credit as used or a bonus as activated in a family group, we store that mark and who made it, and every member of the group can see it. Outside a family group these marks stay on your phone only.
Store category reports (optional)
- If you report a wrong store category, we receive the store name, the categories, and a one-way hash of a random ID created on your phone. It is not linked to your account.
Visiting runecredit.com
- Like any website, our hosting provider (Amazon CloudFront) records standard access logs when you load a page: the page requested, the time, the site that referred you, your browser and device type, and your IP address. We use only summary reports from it (which pages and referring sites are popular, and which countries and devices visit) to see what is useful. There are no cookies and no tracking scripts, and the logs are not linked to any account or to the app.
Feedback from the website or the app (optional)
- If you send feedback on runecredit.com or in the app, we receive the type you pick, your message, your email address only if you enter one, your language, and a one-way hash of your IP address that changes every day and is used only to limit spam. It is not linked to any account. Please don't put card numbers or other sensitive data in your message.
- When you send from the app, we also receive the app version and a short line about what you were looking at (for example a card name and a spending category, or the card name you searched for). The app shows you that line before you send. We do not receive your account, your location, or a device ID with it.
Why we use it
Only to run the app: to sign you in, keep your cards and family group in sync across your devices, improve store categories, and read and answer your feedback. We do not use your data for advertising or profiling.
What stays on your phone
- Location. Used to find nearby stores. Your location is never uploaded to us.
- Reminder marks (credits used, bonuses activated), language choice, and cached card data.
Who else receives data
- Apple Maps (MapKit): store searches near you are sent to Apple under Apple's privacy policy.
- Sign in with Google / Apple: if you use them, they share your name and email with us.
- Amazon Web Services: hosts our servers and database in the United States.
We do not sell or share your personal information, show ads, or use third-party analytics or tracking.
Where data is processed
Account data is stored in the United States. If you use Rune from another country, such as Taiwan, your account data is transferred to and stored in the United States.
Keeping and deleting data
- Account data is kept until you delete your account.
- You can delete your account in the app: Settings → Delete account. This permanently removes your account and your cards. If you own a family group, ownership rules apply before deletion. If you signed in with Apple, you can also remove Rune from your Apple account under Settings → Apple Account → Sign-In & Security → Sign in with Apple.
- Hash-only store reports are not linked to you and may remain.
- Feedback messages are kept until we have answered or acted on them. If you entered an email address, you can ask us to delete your message by writing from that address.
- Cards stored only on your phone are removed when you delete the app.
Your rights
You can ask to see the data we hold about you, correct it, or delete it, and you can withdraw your consent at any time by deleting your account or by writing to us. Residents of California and Taiwan have these rights under their local laws, and we honor them for everyone. We reply within 30 days. You can also use Rune without an account, and turn off notifications at any time. If you are not satisfied with our reply, you may contact your local data protection authority.
Security
Data is sent over HTTPS and stored in access-controlled AWS services. No system is perfectly secure.
Children
Rune is not directed to children under 13, and we do not knowingly collect their data. If you believe a child has given us data, write to us and we will delete it.
Changes
We will update the date above when this policy changes. If a change affects what we collect, we will say so in the app.