Rootahrootah

Privacy Policy

Last updated: October 11, 2026

This Privacy Policy explains what information Rootah ("we", "us") collects through the Rootah mobile app and website (together, the "Service"), why we collect it, and the choices you have. It should be read alongside our Terms & Conditions.

1. Information we collect

We collect the following categories of information:

  • Account information — the email address and password you sign up with, and the username, bio, and profile photo you choose to add.
  • Location data — if you grant permission, your device's current location, used to center the map and speed up route building. Location access is optional — you can browse and build routes without granting it.
  • Route data — the waypoints, paths, names, descriptions, and notes of routes you create, along with distance, elevation, and activity type derived from them.
  • Activity recordings & live location — when you record an activity, Rootah collects your GPS location (including in the background, while a recording is running) to build your track, distance, pace, and elevation. If you turn on live sharing, or record a race or an expedition, your current position is sent to our servers while you record so others can follow along.
  • Expeditions (Rootah Pro) — for multi-day journeys, Rootah stores your full GPS track for each leg, the waypoints you drop (time, location, your notes and photos), your daily updates, and an identifier for the phone that recorded each leg. Each leg is also saved as a GPX file on your phone and uploaded to your account when you have internet. To keep a reliable record, uploaded track data is stored with a timestamp and a fingerprint and cannot be edited afterwards; a waypoint's time and location also cannot be changed, and edits to its note, photos, or visibility are logged.
  • Race registrations & payment proof — when you register for a race through Rootah, we collect the details the form asks for (such as name, mobile number, birthdate, sex, shirt size, emergency contact, and any questions the organizer adds), your waiver acceptance and its time, and the payment screenshot and reference number you upload. Payments go directly to the race organizer; Rootah never receives or holds your money or your bank or e-wallet login.
  • Emergency & medical information — optional details you add in Your details & health details (such as emergency contact, blood type, conditions, and allergies), and any SOS or issue you raise during an activity, including your location at that moment.
  • Social activity — likes, saves, comments, meetups you create or RSVP to, and who you follow or are followed by, where applicable.
  • Device & usage information — basic technical data such as app version, device type, and crash/error logs, used to keep the Service running reliably.
  • Health data — only if you connect Apple Health (iPhone, optional). Rootah writes the activities you record to Apple Health and reads your heart rate during those activities. See “Apple Health & health data” below for exactly what is read, written, and stored.
  • Subscription status — if you purchase Rootah Pro, we receive your subscription status (active, expired, cancelled) from Apple or Google via our subscription platform, RevenueCat, so we can unlock Pro features on your account. We never receive or store your card number or other payment details — those are handled entirely by Apple or Google.

2. How we use your information

  • To provide core functionality — building, routing, saving, and displaying routes and maps;
  • To operate account features — authentication, your profile, and your saved/created routes;
  • To power social features — Discover, likes, saves, comments, and meetups;
  • To generate shareable public preview pages for routes you mark public;
  • To show your live position, route, and SOS alerts to the people you share a live link with, and on public expedition pages;
  • To run races: share your registration with the race's organizers, send registration emails, and give organizers and medical responders your emergency details on race day;
  • To send notifications you've asked for, such as race updates or updates from expeditions you follow;
  • To unlock Rootah Pro features for subscribers and keep your subscription status current;
  • To maintain, secure, and improve the Service, including diagnosing bugs and abuse.

We do not sell your personal information.

3. What's public vs. private

Your username, bio, and profile photo are visible to other users. Routes are private by default until you choose to make them public; public routes (including their name, path, stats, and your username) are visible to anyone on the Discover map and on their shareable web preview page. Comments and RSVPs on a meetup are visible to other participants of that meetup.

Following and your feed. Other users can follow you. If you make your account private, you approve each follower first. Each activity you save has its own setting — Everyone, Followers, or Only me — and you choose the default in Settings. Activities and cards you post appear in your followers' feeds according to that setting. By default, the first and last 200 metres of your activity maps are hidden from others so your home or workplace isn't revealed; you can turn this off. Your follower and following lists can be hidden. Cheers show the activity's owner who cheered. Blocking someone ends any follow between you and hides your content from each other.

Live now. Each time you share your live location, you choose whether your followers can also see that you're live. If you turn it on, they see your position, distance and time in the app until you finish, and get one notification for that session.

Live tracking. Anyone with your live tracking link can see your position, pace, distance, photos you share during the activity, and any SOS you raise, until the link expires.

Expeditions. A public expedition has a page anyone can open, showing your route so far, your latest position and whether you're moving, your daily updates, total distance, and your public waypoints with their notes and photos. Waypoints you mark private, your full GPS files, and your exports are visible only to you. You can make the whole expedition private at any time. Other Rootah users can follow a public expedition to get notifications; you can see how many people follow it.

Race registrations. Your registration details, payment screenshot, and emergency details are visible to you and to the organizers Rootah has assigned to that race — not to other participants or the public. Payment screenshots are stored privately.

4. Third-party services

We rely on the following third-party services to operate Rootah:

  • Supabase — hosts our database, authentication, and file storage (profile photos).
  • Mapbox — provides maps, street-level routing/directions, and geocoding. Waypoint coordinates are sent to Mapbox to compute routes.
  • Open-Meteo — provides elevation data for the coordinates along your routes.
  • SMTP2GO — sends account and race registration emails (your email address and the content of the email).
  • Expo — delivers push notifications to your device and app updates.
  • Railway — hosts the Rootah website, including public route preview pages.
  • RevenueCat, Apple, and Google — process and manage Rootah Pro subscription purchases. Apple and Google handle all payment collection directly; RevenueCat relays your subscription status to us so we can grant Pro access. None of them receive any Rootah data beyond what's needed to identify your account and subscription.

These providers process data only as needed to deliver their service to us and are bound by their own privacy and security terms.

5. Apple Health & health data

On iPhone, you can connect Apple Health from Rootah's Settings → Integrations. This connection is optional and stays off until you turn it on. iOS asks you to approve exactly what Rootah may read and write.

  • What Rootah writes to Apple Health. When connected, each run, ride, walk, or hike you record in Rootah is saved to Apple Health as a workout — including its GPS route, distance, duration, elevation gain, and an estimated active-energy value. You can also choose to write your previously recorded Rootah activities to Apple Health.
  • What Rootah reads from Apple Health. Rootah reads heart-rate samples recorded during an activity you completed, so it can show your average and maximum heart rate for that activity. It reads a short list of your recent workouts recorded by other apps or an Apple Watch, shown read-only in your activity feed. And when you choose to import a workout (for example a run from an Apple Watch, COROS, or Garmin that syncs into Apple Health), Rootah reads that workout's route, distance, duration, pace, elevation, heart rate, and energy burned, and saves it as a Rootah activity in your account — the same as an activity you record in Rootah.
  • Where this data goes. Health data read from Apple Health is used only on your device, with two exceptions you control: (1) your average and maximum heart rate for a recorded activity is stored with that activity in your Rootah account; and (2) any workout you explicitly choose to import is saved to your Rootah account as an activity. Rootah does not send any other Apple Health data to our servers, does not use Apple Health data for advertising or marketing, and does not share it with any third party. Health data is never sold.
  • Your control. You can turn the Apple Health connection off at any time in Rootah's Settings, or change exactly what Rootah can read and write in the iOS Settings app under Privacy & Security → Health → Rootah. Turning it off stops all future reading and writing; activities already saved to Apple Health, and heart-rate values already saved to your Rootah account, remain until you delete them (deleting a Rootah activity or your account removes the heart-rate values held by Rootah).

6. Data retention & deletion

We keep your account and route data for as long as your account is active. You can delete individual routes at any time from within the app. You can also delete your account entirely, at any time, from Profile → Delete account in the app, or by following the instructions on our account deletion page. Deleting your account removes your profile, routes, and associated data immediately, except where we're required to retain records for legal or security reasons.

Expeditions are kept until you delete them or your account. Leg files saved on your phone stay on your device until you remove them or uninstall the app. Race registrations are kept for the organizer's records of that race (for example results, refunds, and transfers) until you delete your account.

7. Your choices

  • Location permission can be granted or revoked at any time in your device settings;
  • Photo library access (for a profile picture) can likewise be granted or revoked at any time;
  • You can edit or delete your profile information and routes directly in the app;
  • You can mark any route private at any time to remove it from public/Discover visibility;
  • You can delete your account at any time — see how to delete your account.

8. Children's privacy

Rootah is not directed at children under 13, and we do not knowingly collect personal information from anyone under 13. If you believe a child has provided us with personal information, contact us and we'll delete it.

9. Changes to this policy

We may update this Privacy Policy from time to time. If we make material changes, we'll update the "Last updated" date above and, where appropriate, notify you in the app.

10. Contact

Questions about this Privacy Policy, or want to access, correct, or delete your data? Reach out to us at privacy@rootah.com.