Agndofa ehf. is responsible for your data within the Rúnar application and on the website therunekeeper.com. Company ID 540312-1170, address Brekkugata 38, 600 Akureyri. We are based in Iceland — a member of the European Economic Area — and are fully bound by the General Data Protection Regulation (GDPR).

Rúnar is for people aged 13 and over. If the law in your country sets a higher age for consent (GDPR allows up to 16), you need the consent of a parent or guardian. We do not verify age; we rely on what you tell us.

Contact: info@agndofa.is

When you walk through Rúnar, certain things are remembered. Here is everything, without omission:

We process your data on the following legal grounds under GDPR Article 6:

Contract — to provide the readings in the language you choose, Rúnar's voice, your journal, and the account features you have requested.

Legitimate interest — to prevent abuse of the free reading allowance, to keep the service running reliably, and to improve the quality of Rúnar's readings. For that we may review and analyse readings — the text and the details you enter. You can opt out of this at any time in the menu, under Privacy.

Consent — only where we ask for it. If you take part in testing Rúnar, you give it in the app before you begin, so that we may review your readings. A question you write may say something about your health or another sensitive matter. So, as Article 9 of the GDPR requires, we ask for your explicit consent before we send and keep your first question. You can withdraw it at any time in the menu, under Privacy. After that, your questions are not sent. If you register on therunekeeper.com to hear when Rúnar launches, you give your consent by clicking the link in the confirmation e-mail. You can withdraw it at any time by writing to runar@therunekeeper.com.

We do not use your data for advertising, profiling, or automated decision-making.

We share only what is necessary, and only with these processors:

Supabase (database & authentication) — servers in EU West (Ireland). What we store stays in the European Economic Area, apart from the backup copy described below. supabase.com/privacy

Brevo (e-mail, France) — sends the sign-in code to your e-mail address and, if you register on therunekeeper.com, the confirmation e-mail and later the e-mail that Rúnar has launched, and it brings us the messages you send with “Send Rúnar a line”. Brevo keeps the list of those who registered and processes everything within the European Union. Where Brevo's sub-processors outside the European Economic Area are involved, the transfer rests on the EU standard contractual clauses or the EU–U.S. Data Privacy Framework. brevo.com/legal/privacypolicy

Google (sign-in) — only if you choose to sign in with Google. Google confirms who you are and passes us your e-mail address, the name on your Google account and a link to its profile picture. The sign-in service stores these with your account; Rúnar itself uses only the e-mail address. policies.google.com/privacy

Google (Drive, backups) — once a day we store a backup copy of our database there, in encrypted form (AES-256; only we hold the key, so Google cannot read it). Google may keep it outside the European Economic Area; the transfer then rests on the EU–U.S. Data Privacy Framework, under which Google is certified. It is used only to restore the data. Copies older than 30 days are deleted at the next successful backup; Google may keep a deleted copy in its trash for up to 30 more days. An encrypted copy is also kept on our own computer under the same rules. To test that a copy can be restored, we now and then restore it into a second Supabase project in the same EU region and delete it straight after. policies.google.com/privacy

Google (Workspace, e-mail) — messages you send us with “Send Rúnar a line” arrive at our address runar@therunekeeper.com, with your e-mail address so that we can answer you. Google may keep them outside the European Economic Area; the transfer then rests on the EU–U.S. Data Privacy Framework, under which Google is certified. We delete them 6 months after our last reply, or 6 months after they arrived if we did not reply; Google may keep them in its trash for up to 30 more days. policies.google.com/privacy

OpenAI (AI readings, United States) — to write your reading we send the details you enter (a name if you give one, your choices and your question) and the runes drawn; for your life rune, also your day and month of birth. In a reading for someone else, the name is that person's. OpenAI does not use them to train its models and keeps them for no more than 30 days to check for misuse, unless the law requires longer or they are flagged for misuse. openai.com/policies/privacy-policy

Anthropic (AI readings, United States) — receives the same details only when OpenAI is unavailable. Anthropic does not use them to train its models and deletes them within 30 days, unless the law requires longer or they are flagged for misuse. anthropic.com/privacy

In both cases, the transfer to the United States rests on the EU standard contractual clauses.

ElevenLabs (voice, United States) — the text of your reading is sent only when Rúnar first reads it aloud. ElevenLabs does not use the text to train its models. Training was switched off in our account on 12 October 2026 and this applies to everything we have sent there since. As soon as the audio is ready, we delete the text and the audio from our ElevenLabs account. The transfer rests on the EU–U.S. Data Privacy Framework and the EU standard contractual clauses. elevenlabs.io/privacy

GitHub (hosting of the app and the website, United States) — like any host, GitHub sees your IP address when you open Rúnar or therunekeeper.com and keeps it in its logs for security. The transfer rests on the EU standard contractual clauses and the EU–U.S. Data Privacy Framework, in which GitHub takes part. docs.github.com

No data is sold. No data is shared with advertisers or data brokers. Ever.

Under GDPR, these rights belong to you. They are not privileges — they are yours by law.

Rúnar does not use tracking cookies or third-party analytics.

Your browser's local storage keeps only what the app and the website need on this device: your sign-in, your language and how Rúnar addresses you, which introductions and notices you have already seen, and which image Rúnar last used for each rune, so that he does not repeat himself. For the current visit only, it also remembers a gift card code you opened from a link, until you sign in, and whether you opened Rúnar from Google Play.

Sometimes our server has not yet confirmed that a reading, or your question to Rúnar and his answer, has been saved. A copy then waits here; the app sends it to your account at the first opportunity and then removes it. If you sign out before that succeeds, the copy waits until you sign in again. If you send us a report from the app, it waits here until it has been sent. The name you give in reports is kept so that you do not have to type it again.

None of this leaves your device, except the copies on their way to your account and the reports you send us. You can clear all of it at any time in your browser settings; signing out removes your sign-in from the browser.

You may delete your account at any time. Open the menu in Rúnar and choose Delete Account. This permanently removes from our database your account, your readings and journal, your saved voice recordings and the messages you have sent us. Copies of those messages in our mailbox are deleted on their usual schedule, described above. Records of credit movements keep only an internal account number, without your name or e-mail, for accounting; the record of the voice is no longer linked to you. Reports sent with the testers' reporting tool are not linked to accounts; write to us if you want yours removed.

If you prefer, write to us at info@agndofa.is and we will do it for you within one month, as required by GDPR.

Gift card codes you have redeemed remain in our records (without your personal data attached) for accounting purposes only.

If this policy changes in a way that affects your rights, we will notify you through the app before the change takes effect. The date of the last update is shown below.

The current version always lives at this address.