Privacy
What OneRunex collects, why, who receives it, how long it stays and how to control it. Last updated 7 November 2026.
Who is responsible
OneRunex is operated by ONE DIGITECH CO., LTD., 267/340 Rat Phatthana Road, Rat Phatthana, Saphan Sung, Bangkok 10240, Thailand. The company is the data controller under Thailand’s Personal Data Protection Act (PDPA). Questions and requests go to support@onerunex.com.
What we collect
Your account holds your email, display name, a hashed password, language, weekly goal and run style, plus the birth date you declare before using location features. A race registration holds your name, email, phone, birth date, order and ticket details, any emergency contact you enter, and your answers to the organizer’s questions. Medal delivery holds the recipient, phone and address. Guardian agreement holds the guardian’s name, email and relationship, the device type and the version of the text they agreed to. A crew you create holds its name. A race suggestion holds what you sent and the network address recorded with the request.
Location and activity
The app reads your precise location only while the Run or mission screen is open, never in the background. A saved run stores a simplified route line, times, distance, pace, checkpoints and points. Check-ins, Park Hunt collections and park reports store the coordinates and accuracy of that moment, and Park Hunt also records signs of faked locations. An appeal against a Park Hunt penalty stores what you wrote. The app does not read HealthKit, Google Fit or heart rate data.
Why we use it
We use account, registration, delivery and location data to provide what you asked for: your account, race entries, medals, missions, runs and leaderboards. Location features depend on the permission you give, which you can withdraw at any time in your device settings. We use records of activity to prevent cheating, abuse and fraud, which is our legitimate interest, and we keep order and payment records to meet accounting and legal duties.
Who can see it
Anyone can see leaderboards, which show your display name, rank and points or places visited. Virtual race boards show your display name, minutes and score. Choose a display name you are comfortable sharing. Members of a crew or group run see your name inside that crew or group. Signed-in runners see crew names on the park map. Your route is not shown to other runners. The organizer of a race you enter sees your name, email, phone, order reference, ticket and price, check-in status, answers, birth date and emergency contact, and your delivery address once a medal is ready to ship. Authorized OneRunex staff can see order and participant details, and read Park Hunt appeals, to run the service.
Service providers and outside services
Cloudflare carries all traffic to OneRunex and can read it in transit. Resend delivers account and refund email. Hosting and backup providers store our servers’ data. Google Fonts receives your IP address when a page loads fonts. The app loads its maps from OpenFreeMap, an outside map service. It receives your IP address and the map area you view, including the area around you while the run map follows your position. Google Maps opens only when you choose a map link, and the organizer portal contacts Google only for its Google sign-in. Some providers handle data outside Thailand, including Cloudflare’s global network and Resend in Japan.
What we do not do
We do not sell personal data, show advertising, use advertising or analytics trackers, or send crash reports to a third party. We do not ask for national ID numbers or medical records, although an organizer’s free-text question could collect something you choose to type.
Cookies and device storage
The site sets one cookie for your language, and also keeps your language and text size in your browser. Signing in stores a session token in your browser’s local storage until you sign out or it expires. The app keeps your session and ticket cache in your device’s secure storage, and runs not yet uploaded in encrypted storage on the device. None of this tracks you across other sites, so there is no cookie banner.
How long we keep it
Account data, runs, check-ins, Park Hunt penalties and appeals, and accepted Park Hunt collections stay until you delete your account. Rejected Park Hunt claims are removed after 30 days and park reports after 7 days. Delivery addresses are removed 60 days after shipping, or 180 days if a medal never ships. Race suggestion records have no fixed removal date. Deleted data can remain in backups for up to 30 days.
Deleting your account
Delete your account in the app under Profile, or follow the steps at onerunex.com/delete-account. We remove or anonymize your name, email, password, birth date, registration details, answers, delivery addresses, memberships, Park Hunt penalties and appeals, and route lines. A crew you created keeps its name while other members remain. We keep orders and payments as accounting records, plus run summaries, audit records and the coordinates of check-ins and accepted Park Hunt collections, no longer linked to your name.
Young runners
OneRunex accounts and race registrations are for people aged 13 and over. We count age on the day of registration and refuse anyone younger, even when a parent or guardian fills in the form. An organizer may set a higher age. People declare their birth date themselves, and we do not verify it. If a younger child’s details reach us anyway, a parent or guardian can ask us to delete them at support@onerunex.com. We ask account holders for their birth date before location features. Runners under 20 need a parent or guardian to agree on the same device before using location features, and we do not independently verify that agreement. Runners under 18 cannot take part in Park Hunt between 19:00 and 06:00. A guardian can ask us to withdraw the agreement or delete the data at support@onerunex.com.
Your rights and changes
Under the PDPA you may ask to access, copy, correct, transfer or delete your data, object to or limit its use, and withdraw consent. Email support@onerunex.com and we aim to reply within 30 days. You may also complain to Thailand’s Personal Data Protection Committee. We protect traffic with TLS, hash passwords and encrypt delivery addresses, but no system is perfectly secure. If this policy changes we will update the date above, and tell you in the app or by email when a change materially affects you.