Privacy.
Updated 16 September 2026.
What we keep.
Your name, your city, your email, and the runs you upload: distance, time, start time, the file itself, and any start photo you add. If you connect Strava we keep the tokens that let us read your runs. Nothing else.
What is public.
Your name, city, daily times, total, rank, start photos and posts. That is the point of the wall. Your email, your files and your tokens are never public.
Where it lives.
Supabase in Ireland, on the EU servers. The site runs on Vercel. Sign in is by email address alone. No password, and no email is sent.
Apple Health and location.
The app reads running workouts and their routes from Apple Health only when you ask it to import one. When you record a run, the app uses your location to measure it. Routes are used to measure distance and are stored as the file you upload.
Your rights.
Delete your account yourself, on the dashboard or in the app under Me. Everything goes at once: name, days, files, posts, email. For a copy of your data, write to hello@megamarathon.iitsup.com. Disconnect Strava at any time, on the dashboard or at strava.com.
Cookies.
One for your session, one for km or mi. No tracking, no ads.