Cookie Policy
Last updated: 29 October 2026
1. What Are Cookies?
Cookies are small text files stored on your device when you visit a website. They help the site remember you (so you stay logged in) and remember your preferences (theme, sidebar state, etc). This policy explains how Run on Realms (the “Service”), operated by Mobinsons Ventures Private Limited (“we”, “us”, “our”), uses cookies and similar local-storage technologies.
This policy is published in compliance with the Digital Personal Data Protection Act, 2023 (DPDPA), the Information Technology (Reasonable Security Practices and Procedures) Rules, 2011, and the IT (Intermediary Guidelines) Rules, 2021.
2. What We Use Cookies For
| Type | Name / Purpose | Lifetime | Can Disable? |
|---|---|---|---|
| Strictly necessary | Authentication JWT (access + refresh tokens) — keeps you signed in | Access: 15 min · Refresh: 30 days | No (disabling = cannot log in) |
| Strictly necessary | CSRF protection token — prevents cross-site request forgery | Session | No |
| Functional | UI preferences (theme, sidebar collapsed state, last-viewed tab) | 1 year (Local Storage) | Yes (via browser settings) |
| Functional | Onboarding state (which steps you've seen) | 1 year (Local Storage) | Yes |
| Functional | Referral attribution (which invite link brought you) & cookie-notice dismissal — first-party only, no cross-site tracking | 60 days (Local Storage) | Yes |
| Functional | Campaign attribution: which link, campaign or website brought you (the utm_ tags in the link, the website you came from, and the page you first landed on) — first-party, saved with your sign-up, never sent to anyone else | 60 days (Local Storage) | Yes |
| Functional | Your cookie choice (Accept or Decline for the Meta pixel) | Until you change it (Local Storage) | Yes (you will be asked again) |
| Ad measurement | Meta pixel (_fbp, and _fbc after you click one of our Meta ads) — cookies set by Meta’s script on our site (only with consent). They tell us which of our Facebook and Instagram ads brought people to the waitlist. Only if you choose Accept, and only on our public pages (such as home, waitlist, FAQ and blog), never in your account or the app. Meta may also read its own cookies (such as fr) on its own domains under its own terms. | 90 days | Yes (choose Decline, below) |
| Third-party | Razorpay Checkout iframe — only loads on payment screen | Per Razorpay's policy | Yes (but payment will fail) |
| Third-party | Stripe Checkout iframe — only loads on international payment screen | Per Stripe's policy | Yes (but payment will fail) |
| Third-party | Mapbox map tiles — rate limiting / abuse prevention only | Per Mapbox's policy | Yes (maps will not load) |
3. The Meta Pixel (only with your OK)
- What it sends: that a page was visited, and that someone joined the waitlist (“Lead”), with the browser details Meta’s script reads (such as IP address, browser type and the
_fbpand_fbccookies). - What it never sends: your email, name or phone number, or anything about your runs, distance, pace or location. Automatic form and button tracking is switched off.
- Where it runs: only our public pages (home, waitlist, referral, FAQ, blog, season, gear and medal pages). Never in your account, the admin area, checkout or the app.
- Why: to see which of our ads bring people to the waitlist, so we spend less on the ones that don't.
- Adults only: the pixel is for people 18 and over. If you are under 18, choose Decline. We do not knowingly track anyone under 18 or target ads at them (DPDPA §9), and our ads are aimed at people 18 and over.
- Meta's role: Meta Platforms receives these events and may also use them under its own terms. See Meta's Privacy Policy.
What we do not use
- No Google Analytics user-identifying cookies
- No other advertising-network cookies (Google Ads, etc.)
- No ads inside the app, and we never sell your data
For product analytics we use privacy-friendly, cookieless web analytics (currently Cloudflare Web Analytics; we may also use Plausible Analytics). These tools set no cookies and collect only aggregate, anonymous usage data (page views, referrer, country, browser/OS, device type). They cannot identify you, do not track you across sites, and store no personal data, so they need no choice from you. See our Privacy Policy for details.
4. Consent
We rely on the legitimate interest exception under DPDPA 2023 §7(g) for our strictly-necessary cookies (authentication, security) — these are required for the Service to function and cannot be reasonably refused without disabling the Service entirely.
Functional cookies are set only after you sign in and use the Service, which constitutes deemed consent under DPDPA §6. You may withdraw consent at any time by clearing your browser storage (instructions below).
The Meta pixel is different: it runs only with your consent. On your first visit we ask with two equal buttons, Accept and Decline, and nothing is ticked for you. You can change your answer at any time in section 3 of this page, as easily as you gave it. Declining (or withdrawing) stops the pixel from then on; it does not affect anything else on the site, including the waitlist.
5. How to Manage Cookies
You can control cookies through your browser settings:
- Chrome: Settings → Privacy and security → Cookies and other site data
- Safari: Settings → Privacy → Manage Website Data
- Firefox: Settings → Privacy & Security → Cookies and Site Data
- Edge: Settings → Cookies and site permissions → Cookies and site data
Note: blocking our strictly-necessary cookies will prevent you from signing in. Functional cookies can be cleared without breaking the Service — only your preferences will reset.
6. Local Storage & Mobile App
Our mobile app (iOS and Android) does not use browser cookies. Instead it uses native secure storage (iOS Keychain, Android Keystore) for authentication tokens and Expo SQLite for offline run data. The mobile app does not send any data to advertising networks.
You can clear all local app data by uninstalling and reinstalling the app, or via the device Settings → Apps → Run on Realms → Storage → Clear Data.
7. Third-Party Services
When you interact with third-party services embedded in our app (payment processing via Razorpay or Stripe, maps via Mapbox), those services may set their own cookies governed by their respective privacy policies:
- Razorpay: https://razorpay.com/privacy/
- Stripe: https://stripe.com/privacy
- Mapbox: https://www.mapbox.com/legal/privacy
- Meta (pixel, only if you accept): https://www.facebook.com/privacy/policy/
8. Updates to This Policy
We may update this Cookie Policy when we add, remove, or change how we use cookies. Material changes will be notified via email or in-app banner at least 30 days in advance. The “Last updated” date at the top of this page reflects the most recent revision.
9. Contact
Questions about cookies or this policy?
Mobinsons Ventures Private Limited
CIN: U62011OD2026PTC053747
Registered Office: Banspani, Joda, Kendujhar — 758034, Odisha, India
Email: [email protected]