What we store, and what never leaves your phone.

BorderRunner is operated by DROPPIN, LLC, which decides how the data described here is used. If you have a question about anything on this page, write to support@borderrunnerapp.com.

BorderRunner needs an account, so your clocks survive a lost phone and everyone in your household sees the same numbers. For each account we store:

• Your email address, to sign you in and to send the emails described below.
• Your household: the travelers you add (name, passport countries, passport expiry dates, the last 4 characters of a passport number if you enter them, never the whole number, and countries where they hold residence), and the vehicles you add (nickname, type, registration country, plate).
• Your crossings: for each one, the country, the date, whether it was an entry or an exit, who and what crossed, and how it was logged (by hand, by your phone's location, from a photo, or from an imported file).
• Paperwork you add: document types, names, and dates, like an insurance card that expires in November, and any document photos you choose to attach. Photos sit in private storage that only your household can open.
• Your settings: the rules you added, which reminders you want and how early, and the times bonded storage held a vehicle.
• Your plan: whether you are on a free week, a yearly plan, or the founder plan, when it renews, and the identifiers Apple or Polar give us to match a purchase to your account.
• What you send us: questions and error reports you send from the rulebook.

People you add to your household share its data. Anyone who joins your household on their own phone sees the same travelers, vehicles, and crossings you do.

Location is off until you turn it on, and you can switch it back off at any time, on the You screen or in iOS Settings.

• Automatic logging. With “Always” permission, your iPhone tells BorderRunner when you have moved a meaningful distance. To name the country you are in, iOS asks Apple's location service, the same one Maps uses. BorderRunner keeps only the country and the date, first on your phone, and turns a change of country into a crossing. Your coordinates are never sent to us and never stored.
• Where am I, right now. When you ask the app where you are, it converts your position to a country with a map of borders bundled inside the app, on your phone. Nothing is sent anywhere.

• Your photos. Restoring past trips from photos reads when and where each photo was taken, on your phone. The app never looks at the pictures and never uploads them. Only the crossings you choose to add are saved.
• Files you import. A Google Timeline export, a Flighty export, a TripIt calendar, or a spreadsheet is read on your phone. Only the crossings you keep are saved.
• Your calendar. If you turn on calendar dates, the app writes them into your own calendar and removes the ones it wrote when they change. It works only with events it created, and none of your calendar contents are sent to us.

• The border card's scan code. When you open your border card online, we make a private link and show it as a QR code. Anyone who scans it within 7 days sees that traveler's record: name, passport country, the last 4 of the passport number if you entered it, the day counts, and every entry and exit with how it was logged. After 7 days the link stops working. We keep only a scrambled copy of the link, so we can check it but can't read it back.
• A calendar feed. If you make a calendar link, calendar apps that subscribe to it can read your household's dates: last days, planned trips, and paperwork. You can stop or replace the link at any time, and we store only a scrambled copy of it.

The app contains no advertising and no third-party analytics or tracking software. We do not track you across other apps or websites, and there is no advertising identifier in the app.

We do count, on our own servers, when the Pro offer is shown, which feature led to it, and whether a free week, a purchase, or a restore followed. Those counts are tied to your account, are used only to improve BorderRunner, and are deleted with your account.

We use a small number of providers, each for one job:

• Supabase hosts the accounts, the household data, and the document photos, in the United States.
• Vercel hosts the BorderRunner website and the service the app talks to.
• Apple handles purchases made in the App Store. We receive a signed record of the purchase: the product, its dates, and the account it belongs to. Apple's location service also names the country for automatic logging, as described above.
• Polar handles purchases made on our website. Checkout happens on their page, so your card details go to them and never through us.
• Resend delivers sign-in codes, receipts, and the warning emails you choose to get.

Every one of these is a button in the app, not a request you have to send us:

• Export. Download your household's travelers, vehicles, and full crossing history from the You screen.
• Delete. Deleting your account from the You screen removes your household data, your document photos, and the account itself, and cancels a web subscription. A subscription bought in the App Store is managed by Apple, so cancel it in your Apple ID settings.
• Turn features off. Location, automatic logging, reminders, calendar dates, and photo access are each off until you turn them on, and each can be switched back off at any time.

Depending on where you live, you may also have the right to a copy of your data, to have it corrected or deleted, to take it elsewhere, or to object to how it is used, and to complain to your data protection authority. Write to support@borderrunnerapp.com and we will handle it.

We store your data to provide the service you signed up for. Location and photo access rely on your permission, which you can withdraw in Settings. The Pro offer counts rely on our interest in improving the app. Your data is stored in the United States.

Your household data is kept while your account exists, because it is what the app reads to show your clocks. When you delete your account it is removed. Scan links end after 7 days. Records we are required to keep for tax or accounting, such as a record that a payment happened, are kept as long as the law requires.

BorderRunner is built for adults managing their own travel and is not directed at children. We do not knowingly collect data from anyone under 13. If you add a child to your household, you are the one managing their record.

If we change what the app collects, we will update this page and the date at the top. Material changes will be surfaced in the app rather than left here for you to find.

The Terms of Use cover plans, payments, and what BorderRunner can and can't promise. Questions, or something here that does not match what you are seeing? Support has the fastest route to a person.