Privacy Policy — MGKFitness: Run

Last updated: 16 October 2026 · Controller: MGKCodes Ltd · Contact: run@mgkfitness.mgkcodes.com

Summary

MGKFitness: Run is a running coach. Your runs and plans live on your phone; backing up to our servers is optional and off until you ask. To coach you it sends your training context, and what you say in the conversation, to an AI provider. We do not sell your data. You can delete everything at any time.

What we collect

• Account data — your email address, the account identifier it is keyed to, the name you give the coach, if you give one, and the date you gave the coach permission to send your training to the AI provider, if you did. Only if you create an account; the app works without one. If you sign in with Apple or Google, they pass us an email address and an identifier, and nothing else: we do not ask either for your name or photograph. With Apple's Hide My Email, the address is one Apple forwards to yours, and we never see the real one.

  The name is optional and you can change or remove it at any time — clear the field and the coach stops using one. It is stored with your login rather than with your training, so it is what the app calls you and nothing more. It is never sent to the AI provider; see the sub-processors below.

• A profile photo, if you choose one — and it is the one thing here that we never receive. It is copied into the app's own storage, and it is never uploaded to us or sent to your coach. Your phone's own backup (iCloud or Google) may include it, as it may include the rest of the app's data; that backup is between you and Apple or Google. Remove it in Account, or by deleting the app.
• Profile data — your unit preference, and your running profile: current volume, longest run, available days, a recent race or time trial, and any injury notes you choose to give. We do not ask for your date of birth or your weight.
• Activity data — the runs you record, and any you add by hand: route points, distance, duration, pace, and any note you write on a run. If you give Apple Health permission we also read your step count for the run. A heart rate is stored only if you type one in; we do not read heart rate from a watch or a chest strap.
• Training data — generated plans and sessions, whether each session was marked done or skipped, your rating of how hard it felt (RPE), and the plans you have finished with, so your coach knows what you have already tried.
• What you say to your coach — your messages, the coach's replies, and a short rolling summary of what matters across conversations. This is free text you wrote, so it may contain anything you chose to tell it, including how you feel and where you hurt. Treat it as the most personal thing here, because it is.
• Reports — if you report one of the coach's replies: the reply, the reason you chose and any note you add, kept with your account so we can review it. They are deleted with your account.
• Usage records — for each AI request, which part of the coach it came from, how many tokens it used and what it cost. Needed to enforce fair-use limits and keep the service affordable; it holds no training or message content.

We collect only what the coaching product needs (data minimisation).

Health data

Activity and profile data are health data — special-category data under UK GDPR. We process it to provide the coaching service you request. The lawful basis is your explicit consent: the coach asks for it before anything is sent to the AI provider, backup asks for it before anything is stored on our servers, and you can withdraw either in Settings, or all of it by deleting your data.

Apple HealthKit data is read only with your explicit permission, and we never write anything to Health. We ask for one thing: your step count over each run you record, which we store alongside that run. HealthKit data is never used for advertising and is not shared with third parties for their own purposes.

On Android the app requests no health permissions at all.

Who we share it with (sub-processors)

• Supabase — hosts our database, authentication, and server functions.
• OpenRouter — routes our AI requests to the model provider that serves the model we have selected. Requests are made by our server, not your device, so the provider never sees your IP address or device.

  What we send depends on what the coach is doing:

  • To generate or adapt a plan: your training profile and the plan itself — goals, volumes, available days, session history, and your injury notes if you gave any.
  • To hold a conversation: a written summary of your training and of what you have told the coach before, up to your last twenty messages, as you wrote them, and up to four older messages of yours that the coach recalls because they match what you are asking. If you told your coach about an injury, a symptom or how you are feeling, that text is sent.

  We never send your name, email, or account identifier, and we never send raw GPS traces. One honest qualification on the first of those: your messages go as you wrote them, so if you type your own name into the conversation, you have sent it. We do not add it.

  We will not pretend the rest is anonymous: taken together it is health information about one person, and if you would rather it did not leave the app, do not use the coach.

  The coach asks first. Before anything is sent to OpenRouter the app asks your permission, saying what is sent and what is not, and until you agree nothing is. You can withdraw it at any time in Settings › Privacy & legal, and the coach asks again before its next request.

  What we control, and what we do not. Every request we make asks OpenRouter to route only to providers that do not keep or train on what we send. That setting is on for all of them, and it is the strongest control available to us. What we cannot do is audit the provider that ultimately serves a request, so treat that as a control we apply rather than a promise we can make for them. We will say so here if that ever changes.

• RevenueCat — handles subscription purchases and tells our server whether yours is active. We send it your account identifier and nothing else: no runs, no training data, and nothing you said to your coach. Like any purchase SDK it also collects technical information of its own about the install, such as a device-scoped identifier, your store country and your app version.
• Esri — serves the basemap tiles behind your route while you run and, once you have allowed location, the few around where you are when you open the app, so the map is ready before you start; receives the map coordinates being displayed or loaded and, like any web request, your IP address. This happens whether or not you have an account. The tiles are kept in the app's cache on your phone, so the map can still draw without a signal; we never receive them. Configured per build; a build with no tile provider draws routes with no basemap and contacts no one.
• SMTP2GO — sends the emails your account needs: the link to confirm your address when you sign up, the link to reset your password, and a note when your password changes. It receives your email address and the email itself, through its servers in the EU, and nothing about your training. Its open and click tracking are turned off.

We do not sell personal data, and we do not use it for third-party advertising. The app contains no analytics, no advertising SDK and no crash reporter, and reads no advertising identifier.

Apple and Google are not sub-processors. They are two of the three ways you can sign in, beside an email address and a password, and they hold your Apple ID or Google account on their own terms. They pass us an email address and an identifier; we tell them nothing about your training. Choosing Hide My Email with Apple starts a separate account, because the address Apple gives us is not one any other account uses. On an iPhone, deleting an account made with Apple asks Apple to confirm first, so that when the login goes we can also end the app's access to your Apple ID.

Where data is stored

Your runs, plans and conversations live on your device, which is the copy the app actually works from — it records, reads and plans with no network at all. Data in transit is encrypted (HTTPS/TLS).

Backing up is optional, and off until you ask

Nothing about your training leaves your phone for our servers unless you turn on Back up my data in Settings. It starts off. With it off, we keep no copy: your training is on your phone, and in your phone's own backup if it makes one, and deleting the app deletes it from the phone — which is the trade we let you make rather than make for you, because this is health information.

Some things are not covered by that switch, because they are what an account is, or something you send us yourself, rather than training we keep: your email address, which we need to sign you in; your unit preference, which follows you to a new phone so the app opens in miles if that is how you left it; the date you gave the coach permission to send your training to the AI provider; and any coach reply you report. They are written when you sign in, change them or send them, whatever the backup switch says.

With backup on:

• Your runs (with any note you wrote on one), routes, plans and coach conversations are copied to our Supabase project in eu-west-1 (Ireland).
• Signing in on a new phone pulls them back down, so a lost or replaced device does not lose your training. The restore only ever adds — it will not overwrite anything already on the new phone.
• Turning it back off deletes your training data from our servers. Your phone keeps its own copy. Your account itself, and the usage records described under Retention, are not part of that — use Delete account for those.

The AI requests described above are a separate thing and happen either way: the coach cannot answer without sending your training context, so using the coach, once you have given it permission, sends it whether or not backup is on.

Sharing with our lifting app

Our Supabase project is shared with our lifting app MGKFitness: Lift, and one login serves both. Each app's own data lives in its own area, separated per user by row-level security, and neither app can read the other's.

One thing does cross, and it is worth naming: when a run is backed up, a short summary of it — the date, how long it lasted, how far it went, and how hard it felt — is copied into a shared activity feed on your account, alongside your lifting sessions. It exists so that one app can show you a complete picture of a week's training. It is readable only by you, holds no route and no conversation, and is deleted with the run it came from.

Your rights

Under UK GDPR you can access, correct, export, or delete your data, and withdraw consent. There are three in-app controls, and they do different things:

• Back up my data → off withdraws consent to storing your training on our servers and deletes what is already there. Your phone keeps its copy.
• Coach and AI, in Settings › Privacy & legal, withdraws your permission for the coach to send anything to the AI provider. Nothing more is sent, and the coach asks again before it next would.
• Delete account removes every record this app holds for you — runs, route points, splits, plans, sessions, your runner profile, your coach conversations and their summary, and any coach replies you reported. It sweeps every table keyed to your account rather than a list someone has to remember to update, so a feature added later is covered by that design rather than by our diligence.

  Two deliberate exceptions. Your usage records survive, because they are the meter that enforces fair-use limits and erasing them would let a deletion reset a spend cap; they hold no training data and nothing you wrote, and they are pruned after 31 days regardless. And your login survives if our lifting app still holds data on it — see below.

To exercise any right, use those controls or contact run@mgkfitness.mgkcodes.com. If you have already uninstalled the app, ask us at https://mgkfitness.mgkcodes.com/run/delete-account — the in-app control is faster and complete, but it is no use to you once the app is gone.

Deletion asks how much, because your login is your MGKFitness account and it is shared with our lifting app MGKFitness: Lift. Delete this app only, and we erase everything this app holds; your account survives so Lift keeps working. Delete your whole account, and everything Lift holds goes too, along with the login itself.

One thing the narrow choice cannot promise: if Lift holds no data, there is nothing left for the account to be for, so it is removed as well. We tell you which happened rather than leaving you to find out.

Retention

We keep your data while your account is active, and deletion removes it immediately, except where we must retain limited records to meet legal obligations. Two things expire on their own without you asking:

• Usage records are pruned after 31 days — long enough for the monthly fair-use window and no longer.
• Coach conversations are kept so your coach remembers you between sessions, then pruned after 180 days, or sooner once there are more than 1,000 messages. The short rolling summary is what survives.

Children

The app is not directed at children under 16 and we do not knowingly collect data.

Changes

We'll update this policy as the product evolves and note the date above.

Contact

MGKCodes Ltd — run@mgkfitness.mgkcodes.com.