Last updated 5 October 2026
Runco runs on your Mac. Most of what you do in it never reaches us, and this page is specific about the parts that do, because a privacy policy that only says reassuring things is not one.
Your companies, briefs, documents, decision ledgers, boards, threads and desk notes are files and a database on your own disk. Your API keys and licence key are in your macOS Keychain. There is no Runco server holding any of it, no account to sign into to use the app, and no copy of it we could hand to anyone.
If you delete the app and its folder, that data is gone. We cannot restore it, because we never had it.
Runco's employees think by calling a model provider — Anthropic, or another you configure — using your API key, under your account with that provider. The text of a turn goes to them: the brief, the relevant thread, and whatever the work involves. That relationship is yours, not ours. What they keep, and for how long, is set by their terms, and we would encourage you to read them.
We never see those calls and never receive a copy.
Documents (decks, spreadsheets, Word files) are always made on Anthropic, which builds them in its own sandbox: the brief and the files a document draws on are uploaded there, and deleted once it's made. For an employee on another provider's model, Runco asks you once per company before anything goes to Anthropic; you can change the answer in Company settings.
If you add a TypeSafe key, the Board asks TypeSafe who looks right for each card nobody has picked up, and the roadmap asks which cards belong to a goal when you link them. Each question sends the card titles and notes involved, the goal's title and why, and each employee's name, role and one-line description, using your key, under your account with TypeSafe. Threads and files are not sent, but a card's note can include text from an email you handed to an employee. Without a key, nothing is sent.
If you connect a code folder and approve an engineering run, it executes locally through the Claude Code CLI on your machine, under your own subscription. Nothing about the run reaches us.
If you connect a repository, employees with the power can file issues on it and Runco reads issue status, with your token, under your GitHub account. On a public repository, every issue waits for your approval before it's filed, because anyone can read it. Separately, Runco reads a public list of model prices hosted on GitHub; that request carries nothing about you.
If you claim an address at mail.runco.io, mail sent to it arrives on our infrastructure before it
reaches your Mac. We store the message and its attachments so the app can fetch them, and it stays there until
the app has it, including mail from senders you haven't approved, which waits in Screening. The addresses
you approve are kept so their mail can skip Screening. Mail nobody collects is deleted after 30 days, and
deleting your mail account deletes all of it at once. This is
the one part of Runco where your content sits on a server we run. If that is not
acceptable for the mail you would forward, do not claim an address — everything else works without one.
Activating a licence sends your licence key, your email address, a one-way hash identifying the Mac, the name the Mac gives itself (such as "Jo's MacBook Pro", so a seat can be told apart from your others when one is freed), and the app version. We keep that so a licence works on the machines it is meant to and not others, and we record activation attempts, including refused ones, so we can tell a problem from an abuse. The machine hash is not reversible into anything about your computer. A running copy repeats this check about once a day, so we also know which days the app was open and which build it is on. It tells us nothing about what you do in it.
The app asks once, the first time you open it, whether you want to share usage numbers, and Settings has the switch afterwards. It is off unless you say yes. With it on, the app sends once a day: counts of what happened in the company you have open (how many replies, documents, runs and similar), how many companies and employees you have, which models and integrations are in use, named only when the name is from a list Runco ships or a provider publishes, which setup steps you have reached (such as "model key added" or "first work approved") with how long the first approval took in a coarse band like "5 to 15 minutes", and the app version. It never sends your messages, files, company or employee names, keys, or the name of anything you set up yourself. The numbers go with your licence key, your email address and the Mac's one-way hash, which prove they come from a real licence, so they are linked to your licence rather than anonymous. The same screen shows exactly what would be sent. Switching it off stops it. Numbers already sent are kept unless you ask us to delete them.
The feedback form sends what you wrote, your email address and the app version. Diagnostics are attached only when you tick the box to include them. Nothing is gathered in the background.
Suggesting a catalogue entry sends the entry and its test report (which tools it has and how Runco treats them, not which account you tested it with). Submitting a person from the builder sends that person's files.
The request form on this site sends your email address, whether you are asking as an individual or for a company, and the company name if you gave one. Cloudflare tells us the country the request came from. We keep it so we can send you a key and know who we sent it to. We do not store your IP address.
runco.io uses Google Analytics to count visits and to see whether a download link was used. That sets cookies and sends Google an IP address and information about your browser. It tells us how many, never who. The site is served by Cloudflare, who process requests on our behalf and keep their own operational logs. We also count downloads of the app and its checks for updates, by day and country. No IP address or identifier is kept with those counts.
We do not sell anything to anyone, we do not share your details with advertisers, and we do not use your work to train anything.
Mail is deleted once the app has collected it, and after 30 days if it never is. Licence records last as long as the licence, and a while after, because we need to know that a key we issued was revoked. Usage numbers, if you shared them, are kept as daily counts for the last thirty days you sent. After that we keep only totals added up across everyone who shares them, with nothing that says who sent what. Feedback and access requests we keep until they are no longer useful to us — realistically, years, because "who asked and what did they say" is the memory of a small company.
Write to hello@runco.io and ask what we hold about you, ask us to correct it, or ask us to delete it. We will do it, and we will tell you what we could not delete and why — a revoked licence record is the likely example. If you are in the EU or UK you have these rights in law; we would do it anyway.
Runco is a tool for running a business and is not intended for anyone under 16.
If this page changes in a way that matters, the date at the top changes and we will say so to anyone holding a licence. Quietly rewriting a privacy policy is a thing we would rather not become.
Runco is made by type-safe : Studio B.V., registered in the Netherlands. Questions, or anything on this page you think is wrong: hello@runco.io.