Ghost Runner sharing privacy
Local running and optional sharing
Ordinary local running does not require a sharing account. Sharing uses native Sign in with Apple and a display name for attribution. The service stores an Apple account identifier, session credentials in hashed form and an encrypted Apple credential for account revocation. It does not request your email address.
Creating a challenge shares the selected full recorded course, including its start and finish, with the people who join, together with the opening performance; its public preview hides the first and last 200 m and anything near the start and finish. Later performances are uploaded only when you choose to post them. Shared performances contain elapsed location and accuracy samples, elapsed time, course information and participant and attempt identifiers. Participants can see display names, rankings and shared performances and download opponents to their devices.
The shared performance upload excludes heart rate, calories, Health workout identifiers, absolute recording dates and raw private workout archives. The full shared route can still reveal sensitive locations, including your home or workplace.
Invitations and access
Challenges are unlisted, not public directories. Anyone with the page address can view the creator's runner name, satellite course preview, general area, distance and original time, without signing in. The preview, its social image and the app's invitation preview hide the first and last 200 m of the course (on a course shorter than 1 km, a fifth of it at each end) and anything near the start and finish, such as laps that pass it again, so they do not show its exact start or finish; members who join get the full course. Social and messaging services can display and retain that preview. Joining and downloading performances still require the complete invitation and app sign-in. Replacing (rotating) an invitation stops the old link from showing the preview and from accepting new members; existing participants keep access. Deleting the challenge removes the preview entirely. Copies already kept by social and messaging services, caches or screenshots cannot be recalled.
Groups are unlisted too. A group link's page shows only the group name, the owner's runner name and the member count: no roster, course, map or area. Joining still requires the complete link and app sign-in, and a group holds at most 50 members. The owner can replace the group link, which stops the old link from showing the page and from admitting anyone; removing a member also replaces it. Deleting the group removes its page.
Invitation pages use local scripts and fonts, but no third-party browser resources. The service requests satellite imagery and a general place label from Apple Maps. The join secret stays in the link's fragment: local scripts use it only to open Ghost Runner and generate an on-device QR code. It is not sent to the website or Apple. Do not send invitation secrets, access tokens, routes or Health records to support.
Website visits
The website counts visits anonymously: per day, how many times each kind of page was opened, what kind of site linked to it and any campaign tag in the link, how often an install link was followed, which missing addresses were requested (with identifiers removed), and an estimate of distinct visitors made from a one-day key that is discarded. It sets no cookies, runs no tracking scripts, and stores no IP addresses, browser details or invitation addresses.
Withdrawal, deletion and offline copies
Withdraw a posted attempt in the app to remove its shared performance. Leaving a challenge you joined withdraws all of your posted attempts in it. Deleting a challenge removes its shared course and everyone's posted attempts. Leaving a group, or being removed from it, takes you off its roster. Deleting a group removes it, its seasons and their posted attempts for every member. Deleting your account disables access, removes your owned shared content, created challenges and owned groups, and takes you off every group roster; Apple credential revocation is retried if Apple is temporarily unavailable.
Deleting only a local source Run does not withdraw an already shared copy. Shared deletion does not delete your personal workouts or Health records. Minimal removal identities are retained to prevent delayed deliveries from recreating removed content.
Connected clients process removal notices and purge removed shared downloads and foreign comparison details while preserving your own result. Offline devices cannot be recalled immediately: they must reconnect, and an active run's shared snapshot retires after saving. The service cannot undo copies someone has saved outside the app.
Safety and support
Use the app to report unsafe shared content or a group, or block a participant. Blocking restricts new access to each other's contributions but cannot immediately erase existing offline copies. Inside a group, blocking hides you from each other's roster; nobody leaves the group because of a block. Reports are handled by the service operator.
Response owner: Alexandre