privacy policy.
Draft. A lawyer has not reviewed this yet, so the final text may change. Questions in the meantime: hello@jellybeanrunclub.com.
the short version.
- You sign in with Apple. We never ask for your phone number.
- Before you join or post a run, you check a government ID and a live selfie once, with our provider Stripe.
- Purchases go through Apple. We get a transaction record from Apple, never your card details.
- From that check we keep four things: that you passed, that you are 18 or older, whether you can join women-only runs, and the date. Not your name, date of birth, ID images or the sex marker itself.
- Other runners see your colour, your streak and the runs you post or join. Never your name, photo, age or gender.
- No ads, no selling your data, no third-party analytics, no tracking you across other apps.
1who we are
jellybean is run by Runners High Group Limited, a company incorporated in Ontario, Canada ("we", "us"). We are responsible for the personal information described here.
Privacy officer: the founder, reachable at hello@jellybeanrunclub.com.
2what this policy covers
The jellybean iOS app, our website at jellybeanrunclub.com and its waitlist, and our support email. It does not cover Stripe or Apple, which have their own policies (linked below).
3what we collect and why
| what | source | why we use it |
|---|---|---|
| Apple user identifier (a random code Apple gives us for your Apple ID) and an Apple sign-in token | Apple, when you use Sign in with Apple | To create your account and sign you in. We keep the token only so we can revoke jellybean's access to your Apple ID when you delete your account. Apple may offer us your name and email; we do not store them. |
| ID verification result: verified yes or no, 18 or older yes or no, women-only eligible yes or no, the date, the status of your check and Stripe's reference number for it | Stripe, after your check | To let verified adults use jellybean, to keep anyone under 18 out, and to decide whether you can see and join women-only runs (see section 4). |
| Review request for women-only runs, and any note you add | You, if you ask for a review | So a person at jellybean can review your eligibility (see section 4). |
| Your colour and streak | You and your activity | This is how other runners see you in the app. |
| Home location and radius | You place a pin, or tap "use current" to let your phone suggest one | To show runs near you. Never shown to others. |
| Runs and jars (weekly runs at the same start point and time) you post: start point, time, pace, distance, route type, description, jar name | You | Shown to other runners so they can join you. |
| Runs and jars you join, and attendance marks | You and the other runners on that run | Running the join system, streaks and credits. |
| Credit balance and history | Our servers | Running the credit system. |
| Purchase records: Apple's transaction ID, the product (Starter, credit pack or jellybean Unlimited), the date, and for the subscription when it renews or ends. Also Apple's notices of renewals, refunds and cancellations | Apple, when you buy in the app | Adding the credits you paid for, turning jellybean Unlimited on and off, making sure each purchase counts once, and removing unspent credits if Apple refunds a purchase. We never receive your card number, billing address or Apple ID email. Apple handles payment. |
| Reports, blocks, and messages to support | You and other runners | Moderation, enforcing our rules and answering you. |
| Device push token, notification settings and in-app notifications | Your phone and our servers | Sending the notifications you turned on, through Apple's push service. |
| Technical logs: IP address, time, the request your app made, error messages | Your phone, when it talks to our servers | Keeping the service running, stopping abuse (for example rate limits) and fixing bugs. Kept for a short time (see section 8). |
| Waitlist answers: email, neighbourhood, easy pace, when you like to run, where you heard about us | You, on our website | Telling you when jellybean opens near you and deciding where to launch. |
We do not collect your phone number, contacts, photo library, health data, background location or advertising identifier. We do not use a third-party analytics or advertising service.
4ID verification, selfies and your sex marker
Everyone checks a government ID and a live selfie before they can join or post a run, or start or join a jar. The check comes right after you buy the Starter. Until you pass, you can sign in, browse runs (not women-only runs), read these policies and delete your account, but you cannot join or post.
- Stripe does the check. Inside the app, Stripe Identity's screen asks you to photograph your government ID and take a live selfie. Stripe checks that the document looks genuine and compares the selfie to the ID photo using facial recognition (a biometric check). We ask for your express consent before anything is captured.
- What we keep. When Stripe tells us the result, our server reads your date of birth and the sex marker from Stripe's result once, works out the flags below, and stores only the flags: verified (yes or no), 18 or older (yes or no), women-only eligible (yes only if the sex marker on your ID reads female), and the date of the check.
- What we do not keep. We do not store your name, date of birth, ID number, ID images, selfie or the sex marker itself in jellybean's systems. We never receive the biometric template Stripe makes from your face.
- Using the sex marker. We use it for one purpose only: deciding whether you can see, join and post women-only runs and jars. We never show it or the eligibility flag to other runners and never use it for ads or recommendations.
- Under 18. If your ID shows you are under 18, your account stays locked. We keep only the fact that the check showed under 18, so the account cannot be used. You can delete it at any time.
- Stripe's own copy. Stripe also keeps verification data under its own policy, as an independent controller. Stripe says it removes the biometric identifiers within one year and may keep the images and extracted data for longer to meet its own legal obligations. See Stripe: managing your ID verification information and the Stripe Privacy Policy.
- Redaction in our Stripe account. We can ask Stripe to redact your verification session from our Stripe account, which removes our access to the images and extracted details. Write to us and we will do it.
if you are not automatically eligible for women-only runs
Women-only eligibility is automatic when the sex marker on your ID reads female. If it shows another marker (for example M or X), you can use every mixed run and jar, and women-only runs are not shown to you. If you are a woman and your ID does not reflect that, tap "ask for a review" in the app, or write to us. A person at jellybean will review it. You will not be asked for medical documents.
5what other runners can see
Other runners see your colour, your streak and the details of runs and jars you post or join (including the start point you chose and the time). They never see your name, Apple ID, photo, age, gender, home location or ID details.
Please remember: when you meet someone at a run, they will see you in person. Not showing your name in the app does not hide you on the street. The start point and time of a run you post are visible to every jellybean member who can see that area (for a women-only run, every eligible member who can see that area). Choose public start points, never your home.
6who we share information with
We do not sell your personal information and we do not share it for advertising. We share only with service providers who help us run jellybean, under contracts that require them to protect it:
- Stripe (ID and selfie verification). Also an independent controller of verification data. Privacy policy.
- Cloudflare (our servers, database, website and waitlist). Cloudflare stores the information in section 3 on our behalf. Privacy policy.
- Apple (Sign in with Apple, push notifications through Apple's push service, in-app purchases and subscriptions, and the App Store). Apple processes your payment under its own policy. Privacy policy.
We may also disclose information if the law requires it, for example a valid court order, or where we believe in good faith it is needed to prevent imminent harm to someone.
7where your information is stored
Our database runs on Cloudflare in its Eastern North America location, which may be in the United States or Canada. Stripe and Apple process data in the United States and other countries. Information stored outside Canada can be accessed by courts and authorities of that country under its laws.
8how long we keep it
- Account information: while your account is open.
- When you delete your account: straight away we cancel your upcoming runs (joiners get their credit back), take you off runs and jars you joined, revoke jellybean's access to your Apple ID, clear your home location and your verification flags, and delete your sign-in sessions, push tokens, notifications and review requests. Your past runs, attendance marks, reports and credit history stay, linked only to an internal number that no longer connects to your Apple ID, so other runners' history and our moderation records still make sense. Database backups roll off after a short period.
- Purchase records: kept after you delete your account, linked only to the internal number, for as long as tax and accounting law requires, so a purchase cannot be redeemed twice and refunds can be matched.
- Banned accounts: we keep the Apple user identifier of a banned account, and the reports about it, so the same Apple ID cannot sign up again.
- ID verification at Stripe: see section 4. Stripe's own retention applies on its side.
- Technical logs: kept for a short time, then deleted.
- Waitlist: until jellybean launches in your area plus 12 months, or until you unsubscribe.
9your choices and rights
- Delete your account in the app: tap you, then delete account. This works before or after verification and also revokes Sign in with Apple for jellybean. You can also stop jellybean using your Apple ID in your iPhone's Settings, under your name, then Sign in with Apple.
- Location: you can deny location access and place your home pin by hand. jellybean works without it.
- Notifications: turn each type on or off under you in the app, or in iOS Settings.
- Access and correction: email us and we will send you a copy of your information or correct it, usually within 30 days.
- Withdrawing consent to ID verification: the check is required to join or post runs, so withdrawing means deleting your account. You can also ask us to have Stripe redact your session (section 4).
- Complaints: tell us first. You can also complain to the Office of the Privacy Commissioner of Canada, or, in Quebec, the Commission d'accès à l'information.
10automated decisions
Three decisions are made automatically from your ID check: whether it passes (by Stripe), whether you are 18 or older, and whether you can see and join women-only runs (from the sex marker). You can ask a person at jellybean to review any of them by writing to us, or for women-only runs by tapping "ask for a review" in the app.
11age
jellybean is for adults 18 and older. The ID check confirms age; accounts that show under 18 stay locked. If you think a minor is using jellybean, tell us and we will act on it.
12security
We use encryption in transit, store sign-in sessions only as one-way hashes, limit who on our team can use moderation tools, and keep ID details out of our systems. No system is perfectly secure. If a breach creates a real risk of significant harm to you, we will tell you and the Privacy Commissioner as the law requires.
13changes
If we change this policy in a way that matters, we will tell you in the app before the change takes effect.
14contact
hello@jellybeanrunclub.com
Runners High Group Limited, Ontario, Canada.