Last updated: October 11, 2026
Mystery Run is an iPhone app made by Jason Girouard. It gives you a running route that traces a drawing on the street map, and calls the turns by voice. This page says what the app, and its website at getmysteryrun.com, do with your information.
The short version: there's no account, your runs stay on your phone, and nothing is sold. The one thing that goes to an ad company is a count of installs and purchases sent to Meta, so I can tell whether Mystery Run's ads on Facebook and Instagram work.
What stays on your phone
Your runs, GPS tracks, drawings, pace and settings are stored on your phone and nowhere else, unless you post a run to Strava (see Strava). Routes are worked out on the phone. I can't see your route or your GPS track, and I have no copy to give anyone. The one thing I learn is the city and neighborhood a run started in (see Usage analytics).
Settings → Delete all data erases all of it. Deleting the app does the same.
Location
Mystery Run asks for your location while you use the app. It uses it to build a route near you and to call each turn, including while your screen is locked during a run. It never asks for "Always" access, and it stops reading your location when the run ends.
Two requests send your position off your phone. Neither is tied to you and I don't keep either:
- Street data. The app downloads the street map in squares about 2 km (1.2 miles) wide from a content delivery network run by Amazon Web Services. The request says which square is needed, so, like any web server, the network can see that a device at some IP address asked for that square.
- Start-point search. If you search for a place to start from, the text you type and your current position go to Photon, an OpenStreetMap search service run by komoot GmbH, so nearby results come first. You can skip the search and start from where you are, or drop a pin by hand.
Your route and your GPS track are never sent anywhere, except to your own Strava account when you choose to post a run.
Usage analytics
The app uses PostHog (PostHog Inc., hosted in the United States) to count how the app is used, so I know what to fix and what to build. It sends:
- a random ID created when the app is installed, which isn't tied to your name, email, Apple ID or advertising identifier
- your app version, iOS version, device model and language
- events such as "route generated" or "run finished", with details like the distance chosen, the shape drawn and the number of turns
- for each finished run, the names of the city and neighborhood it started in, such as "New York" and "Lower East Side". Your phone works these out with Apple's geocoder and sends only the names.
It never sends coordinates, routes, GPS tracks, run titles or anything you type. Location lookup from your IP address is switched off. There's no session recording.
You can turn this off at any time in Settings → Data → Share usage analytics. With it off the app sends no usage events. It still checks which features are switched on, a request that carries the same random ID and your app version.
Ad measurement (Meta)
Mystery Run advertises on Facebook and Instagram. To see whether those ads lead to installs and purchases, the app includes Meta's software development kit (Meta Platforms, Inc.). It sends Meta:
- that the app was installed and opened
- when you buy something in the app, which item and its price
- device details Meta's kit collects for this, such as device model, iOS version, and a random ID the kit creates on your phone
It doesn't send your name, email, location, runs or GPS tracks. The app never asks to track you, so your Apple advertising identifier stays hidden, and Meta matches ads to installs through Apple's SKAdNetwork, which is built so that no one can tell which person installed. Meta handles what it receives under its own privacy policy at facebook.com/privacy/policy.
The same switch in Settings → Data → Share usage analytics turns this off.
Strava
Connecting Strava is optional. If you connect it, the app posts the runs you choose to your own Strava account: the GPS track with its times, the distance, and the title and description from the save screen. The "Upload to Strava" switch on the save screen decides it for each run. Strava handles what it receives under its own privacy policy at strava.com/legal/privacy.
You sign in on Strava's own page. Strava requires a secret key that can't safely live inside an app, so the sign-in goes through a small server of mine on Amazon Web Services. It swaps Strava's one-time code for your access tokens and hands them straight to your phone, which keeps them in its keychain. The server has no database and keeps nothing. Settings → Strava → Disconnect Strava removes the tokens from your phone, and you can also revoke access on Strava's site.
Purchases
Purchases go through Apple. The app learns which items your Apple ID owns, never your payment details, and that record stays on your phone. The only purchase information that leaves it is the purchase event sent to Meta, described above.
Feedback and research sign-ups
If you send feedback from Settings, or sign up for a research call, what you type and the email address you choose to give are emailed to me. That's all that happens to them: they sit in my inbox so I can read them and reply. Leaving an email is optional. Ask and I'll delete your messages.
Photos
If you save a share card, the app asks for permission to add that one image to your photo library. It can't see or read your photos.
This website
getmysteryrun.com counts visits with PostHog, without cookies and without storing anything in your browser. For each page you open, PostHog receives the page address, the site that linked you there, your browser, device type and screen size, and whether you tapped an App Store button. To count unique visitors without a cookie, PostHog combines your IP address and browser with a random value that changes every day, keeps only the resulting code, and discards the IP address. That means one visitor can't be followed from one day to the next, and no location is looked up from your IP.
The site has no ads, no other trackers, and nothing to sign up for. The App Store buttons take you to Apple.
What the app doesn't do
- No account, no sign-in.
- No ads inside the app, and no advertising identifier.
- No tracking across other companies' apps or websites.
- No selling or renting of data to anyone.
Who processes data
- Amazon Web Services: delivers street data, relays feedback emails, swaps the Strava sign-in code for tokens, and hosts this website.
- PostHog: usage analytics in the app and visit counts on this website, as described above.
- Strava: receives the runs you choose to post, if you connect it.
- komoot (Photon): place search, only when you use it.
- Meta: measures whether Mystery Run's ads lead to installs and purchases, as described above.
- Apple: in-app purchases.
Each one gets only what's described above.
Children
Mystery Run isn't directed at children under 13 and doesn't knowingly collect personal information from them.
Your choices and rights
Because your runs live on your phone, you control them directly: delete a run, or delete everything, from inside the app. To have feedback or a research sign-up deleted, or to ask anything about this policy, email me. Depending on where you live you may have legal rights to access, correct or delete personal information; the only personal information I could hold is an email you sent me, and I'll act on any such request.
Changes
If the app starts handling information differently, this page will change before the update ships, and the date at the top will change with it.
Contact
Jason Girouard
jasontgirouard@gmail.com