The data controller is Thin Ice Digital Ltd, company number 17405513, registered office 71-75 Shelton Street, Covent Garden, London WC2H 9JQ, contact info@thinicedigital.com. We are the data controller for personal data collected through runnr.fyi.
If you sign in with Google or Apple, we receive your email address and your account identifier from them. From Google we also receive your first name and the link to your profile picture; from Apple, your first name (Apple sends it only the first time). We store the identifier, your email and your first name (and, for Google, the picture link) in your Runnr account, so you can sign in again and see your name in the app. We do not keep any Google or Apple sign-in token. Google or Apple learns that you signed in to Runnr, under their own privacy policies. Signing in with them is optional; you can use an email and password instead.
We count daily unique visitors and pageviews ourselves on the Runnr API (hosted on Railway). We do not use Google Analytics or any other third-party analytics service.
On each counted page load, the server hashes the visitor’s IP address together with the UTC date and browser user-agent, using a secret that never leaves the server. The IP address is then discarded. We store that daily hash (so we can tell if the visitor is unique that UTC day) and the daily counters. Daily hashes older than two days are deleted. We never store IP addresses. These totals are internal and are not published.
If your browser does not send Do Not Track or Global Privacy Control, the page also sends a random anonymous id kept in localStorage (or a first-party cookie only when storage is blocked). We hash that id with the same secret and store the first and last UTC day it was seen, so we can tell a first visit from a later one. We do not store the raw id. Hashes not seen for about 400 days are deleted.
On that first counted visit of a UTC day we also store the page path and a short source label: the link’s utm_source and utm_campaign when they are present, otherwise the referring site’s hostname, otherwise direct. A new account keeps that first ad source. We do not store the raw address bar.
If your browser sends Global Privacy Control or Do Not Track, we do not set the anonymous visitor id.
The lawful basis for these visit counts is legitimate interests: basic counts of how the site is used.
On the room left calculator (/room-left/), a page view and named button clicks are counted without a persistent visitor id. We do not store a browser id or a first-touch tag for that page. The page view still uses the daily IP hash described above, together with the page path and a short source label for that visit. If your browser sends Do Not Track or Global Privacy Control, we do not record the visit or the clicks.
If you ask us to email the result, we create an account with that email address. The result text is placed in the confirmation email. We do not save that result in our database. From the room left calculator that text is the firm preset name, the daily allowance, the currency, and the sentence on screen. From the check page it can also include the instrument, entry, stop, and size you typed. If the link you used had a utm_source, we store that short source label on the new account.
A new account receives a welcome email when you confirm the address. The note when two days of the trial remain, and the note when the trial ends, go only to confirmed accounts that have not opted out. Each of those three emails includes an unsubscribe link. The confirmation, password-reset, and result emails do not.
The lawful basis for these trial emails is legitimate interests: telling you about your trial and the paid plan, which you can stop at any time with the unsubscribe link.
If you connect Alpaca, IBKR Flex, or Trading 212, we retrieve your trade history in read-only mode. Broker API keys and Flex tokens are stored only on the server, encrypted at rest using AES/Fernet. We do not keep raw broker secrets in your browser. We cannot place, modify, or cancel orders on your behalf.
Payments are handled entirely by Stripe. Runnr does not store your card number, bank details, or full payment information. Stripe's privacy policy applies to payment processing: stripe.com/privacy.
If a payment can't be linked to your account automatically, we keep the Stripe event, subscription and customer IDs for up to 90 days. During that time we link it to your account, either automatically when Stripe sends an update or manually after checking, for example using your verified email. Then we delete them.
We use your data to:
We do not sell your data. We do not share your journal, trade history or notes with third parties. Coach analytics run in your browser on your own journal data. The one exception is the watchlist market brief. When you open your watchlist, briefs are generated automatically for rows without your own note, and we send OpenAI the symbol and, if you set them on that watchlist row, the direction, entry, stop, target and current price, plus a few public news headlines, so it can write the brief. We do not send your name, email address, journal or trade history.
Your journal, watchlist, and settings are stored:
The position-size panel saves your settings in your own browser (local storage): the symbol, the contract sizes and conversion rates you type, your account currency and your language. They stay on your device, are not sent to us, and you can delete them at any time by clearing your browser's site data.
We take reasonable technical measures to protect your data, including encryption in transit (HTTPS) and at rest.
First-party visitor hashes, anonymous-id hashes, and daily counters are stored in the same Railway database as the API. They do not include IP addresses.
If you create an account but never confirm your email, we delete it after 30 days. Confirmed accounts are kept until you delete them or ask us to. After deletion we keep payment and invoice records for up to 6 years where tax and accounting law requires it (held by us and Stripe). Server logs (request and application logs) are held by our hosting provider, Railway, under its retention policy, currently up to 90 days, and then deleted. We don't keep separate copies. We do not keep database backups. When an account is deleted, it is removed from the live database straight away. There is no backup copy that keeps it.
If you are located in the European Economic Area or the United Kingdom, you have the following rights under GDPR and UK GDPR:
You can delete your account yourself in Settings.
For anything else (access, correction, objection, a copy of your data) email info@thinicedigital.com. We reply within one month.
If you are unsatisfied with our response, you have the right to lodge a complaint with your local data protection authority (in the UK: the ICO at ico.org.uk).
Runnr uses minimal cookies necessary for session management and authentication. We do not use advertising cookies. We do not use Google Analytics or any other third-party analytics. Daily unique counts are a hash of IP, date, and browser, not a cookie. To tell new visitors from returning ones, browsers that allow storage and do not send Do Not Track or Global Privacy Control keep a random anonymous id in localStorage. If localStorage is blocked, that same id is stored in a first-party cookie on runnr.fyi. The server stores only a keyed hash of the id.
Runnr uses the following third-party services:
| Service | Purpose | Privacy Policy |
|---|---|---|
| Stripe | Payment processing | stripe.com/privacy |
| Railway | Cloud hosting | railway.app/legal/privacy |
| Alpaca | Optional broker sync (read-only) | alpaca.markets/privacy |
| Trading 212 | Optional broker sync (read-only) | UK, EU |
| Interactive Brokers | Optional broker sync via Flex (read-only) | interactivebrokers.co.uk privacy policy |
| Resend | sending our emails (confirmation, welcome and trial notes) | resend.com/legal/privacy-policy |
| OpenAI | Writes the watchlist market brief (symbol, price levels and public headlines only) | openai.com/policies/privacy-policy |
| Optional sign-in | policies.google.com/privacy | |
| Apple | Optional sign-in | apple.com/legal/privacy |
Prices, indices and public headlines come from public market-data and news sources that our servers request. These requests contain the instrument symbol, not your name, email or IP address. The exception is Alpaca: if you connect Alpaca, market data for your account is requested with your own Alpaca key, under Alpaca's privacy policy.
Some of these providers (Stripe, Railway, Resend, OpenAI, Google, Apple) may process data outside the UK and the EEA, including in the United States. Where they do, we rely on the safeguards the law allows, such as the UK International Data Transfer Addendum or an adequacy decision, as set out in their data processing terms.
Runnr is not intended for use by anyone under the age of 18. We do not knowingly collect data from minors.
We may update this Privacy Policy from time to time. We will notify active users of material changes by email. The “last updated” date at the top of this page reflects the most recent revision.
Thin Ice Digital Ltd, company number 17405513
Registered office: 71-75 Shelton Street, Covent Garden, London WC2H 9JQ, United Kingdom
Email: info@thinicedigital.com
Website: thinicedigital.com
© 2026 Thin Ice Digital Ltd · All rights reserved