RunflightPrivacy policy
Last updated: 9 October 2026
Runflight is a timer with an agenda for sales demos, made by Tokek.io ( "we"). This policy explains what we collect when you use Runflight on iPhone, Android or the web, and at runflight.io, why we collect it, and the rights you have. We collect as little as the app needs. We don't sell your data, we don't show ads and we don't use tracking cookies.
1. Who is responsible
Tokek.io, [address], Ireland, registered under CRO number [number], is the controller of your personal data. Questions or requests: hello@tokek.io.
2. What we collect
| Data | Why | Legal basis |
|---|---|---|
| Account: email address, name, initials, the icon you pick and a protected (hashed) password if you use email | To create your account, sign you in and show your name to people you share with | Contract |
| Sign in with Google, Microsoft or Apple: your name and email address from that provider | To sign you in without a password. We never see your password there. | Contract |
| Your content: demos (company, topic), agendas and sections, your co-driver messages and the runs of your demos (start, pause and section times) | To provide the app and sync it between your devices | Contract |
| Sharing: who has access to a demo, and the email addresses you invite | To share demos and send invitations on your behalf | Contract, and our legitimate interest for the invitee |
| Live presence while a demo runs: who is presenting and who is watching as co-driver | To show the presenter who is connected. Not stored afterwards. | Contract |
| Technical data: IP address, device and browser type, and error and access logs kept by our hosting providers | Security, preventing abuse and fixing problems | Legitimate interest |
| Company licence requests: company name, email and number of seats, if you ask for a company licence | To answer and invoice you | Contract, steps before a contract |
Agenda photos. If you use "With AI" to build an agenda from a photo, the photo is sent once to the AI model to read the sections and is then discarded. We never store it.
On your device. The app keeps your sign-in session and a few settings (such as showing co-driver messages) in your device's storage. On the web this uses local storage, which is strictly necessary for signing in. We use no analytics or advertising cookies.
3. Who processes your data for us
We use a few trusted providers. Each one processes data only on our instructions, under a data processing agreement.
- Supabase: database, sign-in, live updates and server functions. Your account and demos are stored in the EU (Frankfurt, Germany).
- Vercel: hosts the web app and this website, and routes AI requests (AI Gateway).
- Mistral AI: the AI model behind "With AI", only when you use it. Mistral is based in France.
- Resend: sends emails such as invitations, sign-up confirmations and password resets.
- Expo: delivers app updates to iPhone and Android.
- Google, Microsoft and Apple: only if you choose to sign in with them. Their own privacy policies apply to your account with them.
- Apple App Store and Google Play: distribute the app; their policies apply to downloads.
Some of these providers are based in, or use support staff in, the United States. Where data leaves the European Economic Area, it is protected by the EU-US Data Privacy Framework or the European Commission's Standard Contractual Clauses.
4. Who else sees your data
Only the people you share a demo with see that demo, and they see your name and initials. A co-driver's messages show their first name on the presenter's screen. We never sell your data and never share it with advertisers. We only give data to authorities when the law requires it.
5. How long we keep it
- Your account and content: until you delete your account.
- Deleting your account (Settings › Delete account) removes your profile, the demos you own with their agendas and runs, your invitations and your messages right away. Demos other people own stay theirs.
- Open invitations: until they are accepted, withdrawn or the demo is deleted.
- Backups and provider logs: overwritten within 30 days.
- Licence requests and invoices: as long as tax law requires (6 years in Ireland).
6. Your rights
Under the GDPR you can ask to access, correct, delete or export your data, to restrict or object to how we use it, and to withdraw consent where we rely on it. You can correct your name and delete your account in the app yourself. For anything else, email hello@tokek.io; we answer within a month.
You can also complain to a data protection authority. In Ireland this is the Data Protection Commission.
7. Security
Data is encrypted in transit (HTTPS) and at rest. Access rules in the database make sure only you and the people you share with can read your demos. Passwords are stored as hashes, never in plain text.
8. Children
Runflight is a work tool and is not meant for anyone under 16.
9. Changes
If we change this policy, we update the date at the top. If a change matters, we tell you in the app or by email first.