Privacy policy

Last updated 24 October 2026

The short version: scanme.run doesn't have accounts, doesn't use tracking cookies and doesn't keep your details. What you enter is used to build your pass and deleted within 15 minutes.

Who we are

scanme.run is an independent, non-commercial tool run by an individual in the United Kingdom, who is the data controller. It isn't affiliated with parkrun Limited. Contact: hello@scanme.run.

What we use and why

• Your athlete ID, name, chosen events, colours and any image you add. These are needed to build your pass. When you tap Add to Apple Wallet they're sent to our server and held for up to 15 minutes so your download link works, then deleted automatically. Lawful basis: providing the service you asked for (legitimate interests).
• Emergency contact and medical information (optional). If you add these, they're written into your pass and handled exactly like the details above: deleted within 15 minutes, and never stored, logged or analysed. Medical details are special category data. We only use them because you chose to add them, for the purpose of putting them on your pass (explicit consent). Leave the fields empty if you'd rather not.
• Your location. If you choose "Use my location", your browser works out the nearest events on your device. Your location is never sent to us.
• Your IP address. To stop abuse we limit how many passes can be made in a short time. We do this with a scrambled (hashed) version of your IP address that expires after 10 minutes. Our hosting provider also keeps standard server logs, including IP addresses, for a short period for security and troubleshooting. Lawful basis: legitimate interests (keeping the service secure).
• Anonymous usage totals. We count things like passes made per day, which events and countries are popular, whether people used location or search, which themes they picked, the type of device (for example iPhone or Android) and how often the Ko-fi and share buttons are clicked. These totals can't identify you and we don't record athlete IDs, names or IP addresses with them. We keep them for up to 400 days. Lawful basis: legitimate interests (improving the service).
• Page visits. We use Vercel Web Analytics to count page views, which pages people visit, the website or app that sent them, their country and their type of device and browser. It doesn't use cookies, it doesn't track you across other websites, and it can't identify you. Visits are grouped using a code that changes every day. Lawful basis: legitimate interests (understanding how the site is used).

Cookies and storage on your device

We don't use cookies for visitors, and there's no advertising or third-party tracking. Your browser's local storage remembers your light or dark mode choice, your theme and your chosen events, so making a new pass is quicker. This stays on your device and you can clear it in your browser settings. The admin area uses one strictly necessary sign-in cookie for the site owner only.

If you dismiss the language suggestion, local storage remembers that too. If you use the phone barcode page, your athlete ID, name and colours are saved in local storage on that phone only, and a copy of the page is kept in your browser's offline cache so it opens without signal. None of this is sent to us. Use "Remove from this phone" on that page, or clear your browser data, to delete it.

"Save as image" and "Print a card" are made entirely in your browser. Your details aren't sent to us to create them.

Who else is involved

• Vercel hosts the website. It may process data in the United States under the UK International Data Transfer Addendum or the UK Extension to the EU–US Data Privacy Framework.
• Upstash provides the short-lived storage for download links, rate limits and the anonymous totals.
• Apple: once the pass is in your Wallet, it's handled by Apple under Apple's own privacy policy. We don't receive anything back from your pass.
• Ko-fi: if you choose to support scanme.run, Ko-fi handles the payment under its own privacy policy. We count clicks on our Ko-fi links as part of the anonymous totals above, and we don't send Ko-fi anything about you.

We don't sell or share your data with anyone else.

Your rights

Under UK data protection law you can ask to see, correct or delete your personal data, or object to how we use it. Because we don't keep personal data beyond 15 minutes, there's usually nothing for us to find, but please get in touch if you have any questions. If you're not happy, you can complain to the Information Commissioner's Office at ico.org.uk.

Changes

If this policy changes, we'll update it here and change the date at the top. Thanks for using scanme.run, and if it's useful you can support it on Ko-fi.