Privacy policy

Last updated: 7 September 2026

What this covers

This page says what SkyRunner records about you, where it goes, and how long it is kept. It covers both the Garmin Connect IQ app and this website. If something here is not clear, ask us and we will answer.

What we collect

Scores

Every run submitted from a watch carries:

• Device ID: an identifier that comes from your Garmin device
• The run itself: distance, diamonds collected, speed setting, what ended the run, and the jumps, ducks, shields and floating time behind it
• Device information: watch model, screen resolution and app version
• Country: worked out from your IP address, so the country leaderboards can exist
• IP address: used for rate limiting and to spot faked scores. It is not shown on the site
• Timestamp: when the run was played and when it arrived

Account and device linking

Linking a watch to an account is optional. It is what puts your player name next to your scores. When you link one, we store:

• Device ID: the identifier your Garmin device sends
• Device information: watch model and device details
• Activation code: the short code the watch shows you, used once to match the device to your account

Donations

The game is free. Donations are optional and go through Stripe, which handles the card details. We never see or store a card number. Stripe may collect:

• Payment card details
• Billing address
• Email address, for the receipt

Website analytics

We run our own analytics software on servers we control, so we can see which pages of this website are useful without handing visitor data to anyone else. It records the page visited, the referring site, and your browser, operating system, device type and country. It does not use advertising cookies, does not track you across other websites, and does not build a profile of you. No analytics data is sent to Google, to any advertising network, or to any other third party.

What we use it for

We use all of it for:

• Show your scores on the public leaderboards
• Match a watch to the account that linked it
• Spot faked scores and abuse of the API
• Work out which watch models and levels people actually play
• Take donations and send the receipt
• Answer you when you use the contact form

Who else sees it

We do not sell your personal information. We share data only in these cases:

• Public leaderboards: your score, your country, your watch model and your player name if you linked an account are all publicly visible
• Stripe: donation payments are processed by Stripe under their own privacy policy
• Legal requests: where the law requires it

How long we keep it

• Scores: kept indefinitely, because the leaderboard is all-time
• Account and linked devices: kept until you delete the account
• Rate-limit records: deleted automatically after 24 hours
• Login attempts: deleted automatically after 24 hours

Your rights

You have the right to:

• Ask what we hold about you
• Ask us to correct something that is wrong
• Ask us to delete your scores, or your whole history. The watch has no setting that stops it submitting, so this has to go through us

How it is protected

What that means in practice:

• HMAC signature verification for API requests
• Rate limiting to prevent abuse
• Encrypted connections (HTTPS)
• Secure password storage
• Dependency and server updates as they are released

Children

SkyRunner is not aimed at children under 13, and we do not knowingly collect anything from them. If you think we have, tell us and we will delete it.

Changes to this policy

This page changes when what we do changes. The date at the top is when it last did. Carrying on using SkyRunner after a change means you accept the current version.

Contact

For a question about this page, or to ask for your data or its deletion, use the contact form or email us:

Email: support@skyrunner.div.nz

Third-party services

• Garmin Connect IQ: subject to Garmin's privacy policy
• Stripe: subject to Stripe's privacy policy
• ip-api.com: turns an IP address into a country for the country leaderboards

Website analytics is not in this list: it is self-hosted on our own infrastructure, so no third party receives it.