Privacy Policy
No Last Run ("NLR", "the app") is a gravity-league mobile app for MTB riders. This policy describes what data we collect, why we need it and what rights you have.
1. Data controller and contact
The controller is the operator of the No Last Run app: Cybird Consulting Dariusz Ptaszek, ul. Chmielna 2/31, 00-020 Warsaw, Poland, Tax ID (NIP) 7343126589, REGON 387337946. Email for privacy matters and support: cybird.consulting@gmail.com.
2. What we collect
Account and rider profile — e-mail address, internal user ID, rider tag / display name, and league profile data (rank, XP, run history, personal records, achievements).
Location — collected in several distinct situations: (a) on the spots list and the trail start screen, to show the distance to the bike park, GPS quality and the distance to the start line; (b) while a run is being recorded — tracking begins when you enter the run readiness screen and continues until the run ends. With "Always" permission granted this also works in the background with the screen off, for both ranked and practice runs, because in both the phone belongs in your pocket; an in-app disclosure precedes the system prompt. Recording stops automatically once you cross the finish line — if the finish is never crossed, it continues until you stop it, which is why the app warns about long-open sessions. (c) while pioneering a new trail, which starts with a GPS warm-up and normally ends when you tap "FINISH AT THE FINISH LINE"; as a safeguard it also closes itself after roughly 30 minutes (60 at the latest).
Outside these situations NLR does not track your location. A run record may include GPS points, time, speed, accuracy, verification status, trail, bike park, result, PB and leaderboard position. Your run trace is private — raw points with dates, speeds and accuracy are visible only to the account owner. Trail geometry is a separate matter: if you pioneer a trail, its shape (points, elevations and times measured from the start of your run) becomes the public definition of that trail, since otherwise nobody else could race it or see the gates. It carries no date or time of your run and begins at the start line, but it is openly attributed to your rider tag and lets others infer the pace the trail was built from.
Profile photo — optional; requires photo library permission. Feedback and support — the content of your report plus technical context, linked to your account so we can reply. Product analytics and diagnostics — limited interaction events and crash reports; the current app version sends events to our own Umami without your account identifier, email or GPS position; an installation is known by a random identifier stored on the phone (a new one after sign-out). App versions before the November 2026 update sent events to Amplitude, linked to your account identifier and an installation identifier. We do not use data for ad tracking, do not sell data, use no advertising SDKs and do not combine NLR data with data from other apps or sites for ad targeting.
3. Public elements
Rider tag, avatar, run times, leaderboard positions, PBs, ranks and achievements are visible to other users — that is the core of the league. The raw GPS trace is not. Sending a challenge creates a public link (e.g. nolast.run/c/CODE) showing your rider tag, trail name and challenge time to anyone holding the link.
4. Processors, data location and transfers
Supabase (account, database, storage — EU, Ireland); Amplitude (product analytics in app versions before the November 2026 update — EU instance); Sentry (crash reporting — US, SCC); Expo/EAS (app updates — US, SCC); Vercel (website and challenge pages — US, SCC); Umami (our own statistics: cookieless visit counts for the website and product analytics in the app — EU, Frankfurt); Apple (App Store distribution and iOS system mechanisms); Google (Google Play distribution, Android system mechanisms and Google Maps on Android). Transfers outside the EEA rely on Standard Contractual Clauses or equivalent mechanisms; a copy of the safeguards is available at cybird.consulting@gmail.com.
5. Legal bases, withdrawing consent, retention and your rights
We process data to perform the contract (core features), on legitimate interest (security, diagnostics, anti-cheat, product analytics) and on consent (system location and photo permissions). You can withdraw system consents at any time in iOS or Android settings, without affecting the lawfulness of processing before withdrawal — note that revoking "Always" location makes ranked runs impossible, since the timer must work with the screen off. Account data is kept until you delete your account (Profile → Delete account; see details). Depending on applicable law (GDPR/UK GDPR, PIPEDA, Australian Privacy Act, NZ Privacy Act, US state laws) you may request access, rectification, erasure, restriction, portability or object to processing — write to cybird.consulting@gmail.com. We do not sell personal data. EEA residents may lodge a complaint with a supervisory authority.
6. Children
NLR is not directed at children under 13. Users under 18 may use the app with parental or guardian permission (see Terms). If you believe a child created an account without guardian consent, contact us.
7. Changes
We may update this policy. The current version is always available at /en/privacy.