Privacy Policy

This policy explains what personal data In the Running collects, why it is held, who it is shared with, how long it is kept and what rights you have over it. It applies to the website at intherunning.app, the web application at my.intherunning.app, and the Android application published as com.thenextrace.run (together, "the Service").

1. Who is responsible for your data

Max Slinger, trading as In the Running, is the data controller for the personal data described in this policy, within the meaning of the UK General Data Protection Regulation (UK GDPR) as it forms part of the law of England and Wales, Scotland and Northern Ireland by virtue of section 3 of the European Union (Withdrawal) Act 2018, and the Data Protection Act 2018. A controller is the party that decides why and how personal data is processed.

In the Running is registered with the Information Commissioner's Office as a data controller, registration number ZC264578.

The Service is operated from the United Kingdom. Article 13(1)(a) UK GDPR requires the identity and contact details of the controller to be given, and they are set out in full in section 16.

No data protection officer is appointed, because the Service does not meet any of the conditions in Article 37(1) UK GDPR: it is not a public authority, its core activities do not consist of large-scale regular and systematic monitoring, and it does not process special category data on a large scale. Correspondence about data protection should be sent to the contact address in section 16.

2. The personal data collected

Personal data means information relating to an identified or identifiable living individual. The Service processes the following categories.

Account and identity data

You sign in with a Google Account, or with a code sent to your email address. With Google, Google returns a signed identity token from which the Service reads your email address, display name, a stable Google account identifier and, where present, a link to your profile picture. The Service never receives, sees or stores your Google password. With a code, the Service sends a six-digit code to the address you give, through Resend. The code is stored only as a one-way hash, works once, and expires after 10 minutes. If that address has not been invited, it sends a short note saying so instead.

People a trip is shared with

From people a trip is shared with, when they open it with an emailed code: their email address, which the runner gave us when they shared the trip.

About you

Your year of birth, which you give when you sign up. It confirms you are 18 or over, and it is used for age grading and heart-rate zones. If you choose to add them, your sex (for age grading), your body weight (to estimate calories) and your maximum heart rate (for training zones). Body weight and maximum heart rate are health data. See section 3.

Training and activity data

• Runs and rides: date, start time, distance, duration, pace, elevation gain, heart rate, cadence, per-kilometre and per-mile splits, and the activity name and description.
• Route data: the recorded GPS track of each activity, stored as an encoded polyline. A GPS track can reveal where you live, work and habitually run.
• Footwear and equipment names and their accumulated mileage, where a connected account supplies them.
• Planned training: training plans, individual sessions, workouts you build, and any notes on them, including injury or "niggle" notes you choose to record.

Wellness and health data

If, and only if, you connect a wellness account: daily readiness score, sleep duration and sleep score, resting heart rate, heart rate variability and its balance, body temperature deviation, blood oxygen saturation, an estimated VO₂ max, a daily stress indication, and any day you mark yourself unwell. This is health data and is treated as special category data. See section 3.

Race, travel and trip data

• Races you have entered, are considering, or have completed, with dates, distances, entry status, goal times, results, bib numbers, wave or corral allocations and your own notes.
• Course files you upload, including GPX route files and race information packs, and anything they contain.
• Travel itineraries: flight numbers, train services, departure and arrival times, booking references you choose to record, accommodation names and addresses, check-in and check-out times, and journey costs.
• When you share a trip you give us the email addresses of the people you share it with. We keep them while the link exists and use them to check who may open the trip and to send a code to someone who asks for one. Remove an address, or the link, and we stop.
• The calendar feed is a private link. If you turn on trip legs, it lists your flights, trains, drives and stays with their times and places, and leaves out booking references, costs and notes.
• Packing lists and templates.
• Photographs you upload, including any location or device metadata embedded in them.

Location data

A home location you enter as free text, the locations of races you add, accommodation addresses you enter, and the GPS tracks described above. Only if you tap From here on a race-morning card, the app asks for your location once, to open walking directions in Google Maps. It goes into that link on your phone and is never sent to us or kept.

Preferences and settings

Units, currency, theme and palette, notification choices, coaching style, and similar display settings.

Technical data

• Your IP address, processed transiently to apply rate limits and to protect the Service against abuse. It is not stored against your account.
• Error records, which may include the failing operation, a timestamp and a message. These are kept to diagnose faults.
• Standard network information handled by the hosting provider, such as request timing and status codes.

The app has no analytics package, no advertising technology and no cross-site tracking. The website at intherunning.app counts visits with Cloudflare Web Analytics, which sets no cookie, stores nothing on your device and does not follow you to other websites. It records the page, the referring site, the browser and the country of each visit.

Counting visits to this website

We count visits to this website so we know which pages people read. We use no cookies for this and store nothing on your device. Each visit is counted with a code made from your IP address, your browser and a secret that changes every day, so we can tell visits apart on one day but cannot follow you from one day to the next. We never store your IP address. We keep each visit's page, referring site, country and city, browser, device, screen size and language for 90 days, then keep only daily totals. The pages of the app you sign in to are not counted. We also count how the app is used. Some of this is totals from the app's own records, such as how many accounts were active on a day. And the app records a short list of things you do, against your account: finishing the first-run tour, adding a race, adding a leg to a trip, saving a race weekend for offline use, sending a workout to a watch (and whether these worked), opening Race Day mode, sharing a trip and sending feedback. Each record holds only which of these it was, when, the app version and whether it was the website or the Android app. It never holds anything you wrote, a race, a place, a route or any health figure. We use these records to find what fails and what people never reach, and we look at them in totals. You can turn this off with Help improve the app in You ▸ Your data, which also deletes what was recorded. The lawful basis is our legitimate interest in keeping the Service working and improving it. If your browser sends Do Not Track or Global Privacy Control, you are not counted on this website. The lawful basis for counting visits to this website is our legitimate interest in knowing how the website is used.

Support access

An administrator can open a read-only view of your account to help you with a problem. The view shows what you would see, including any health data you have connected, and it cannot change anything. Each time one is opened, the administrator's address, yours and the time are recorded in the administrator log. Administrators are the owner of the Service and anyone the owner has given that role. Today the owner is the only administrator.

If you join the waitlist

Your email address, when you asked to join, and when you confirmed it. Nothing else is asked for.

If you join from a race guide, we record which guide it was, so we can see which guides help people find the app. Nothing else about your visit is kept with your email.

Bookings you forward

The text and subject line of a booking confirmation you forward to your trips address. Your device reads it to fill in a trip leg.

Whether you have to provide any of this

There is no statutory or contractual requirement to give any of it. The only data that must be provided is the email address you sign in with, or the identity information Google returns, because without it there is no account to attach anything to and the Service cannot be provided. Everything else is optional, and the consequence of not providing it is simply that the feature it feeds does not work: no connected activity account means no imported runs, no connected wellness account means no readiness figures, no home location means no travel times or nearest-race sorting.

3. Health data and explicit consent

Data about your sleep, heart rate, heart rate variability, body temperature, blood oxygen, body weight, injuries and recorded illness is data concerning health and is therefore special category data under Article 9(1) UK GDPR. Processing it is prohibited unless a condition in Article 9(2) applies.

The condition relied on is Article 9(2)(a): your explicit consent, and you give it in words, not just by using a feature. An administrator's read-only view, described in section 2, can show this data, and you can ask the contact address in section 16 for the record of views of your account.

• Connecting Strava, Oura, intervals.icu or Health Connect. Before you connect, the Service names the health data that service will send, and you confirm by tapping Agree and connect. The date and the version of the words you agreed to are recorded against your account.
• Things you enter yourself. Next to the body weight and maximum heart rate fields, the file import, the niggle log, the "Unwell today" switch and the stomach question on a fuel rehearsal, the Service says that what you enter is health data and what it is kept for. Entering it confirms your consent.

No health data is collected unless you take one of those steps.

You may withdraw consent at any time by disconnecting the account in the Service's settings, or by clearing what you entered. Withdrawal does not affect the lawfulness of processing carried out before it. On withdrawal the Service stops retrieving new health data; to remove health data already held, use the deletion right in section 10.

Heart rate and cadence recorded during an activity are also data concerning health, whether they come from a connected account or a file you import, and are processed on the same basis.

4. Lawful bases for processing

Article 6(1) UK GDPR requires a lawful basis for every processing operation.

Where legitimate interests are relied on, that interest has been balanced against your rights and freedoms. The processing concerned is limited to what is needed to keep the Service running safely, and you may object to it under section 10.

5. Where the data comes from

• From you, when you enter a race, upload a file, record a result or change a setting.
• From Google, when you sign in, limited to the identity fields in section 2.
• From you, when you sign in with an emailed code: your email address.
• From services you connect, using OAuth authorisation that you grant and can revoke. The Service holds an access token for each connected account and uses it only to read the data described above and, where you ask it to, to write a planned workout to your calendar.
• From public information sources, such as a public race calendar entry, used to prefill race details. This is information about events, not about you.

6. Who your data is shared with

Your personal data is not sold, rented or shared for anyone else's marketing, and it is not used to train machine learning or artificial intelligence models. It is disclosed only as set out below.

Processors acting on instructions

Third parties you connect, acting as their own controllers

Connecting an account causes data to flow between that provider and the Service. Each provider handles your data under its own privacy policy, which you should read before connecting.

Once you connect Strava, Strava also sends the Service a short notice when you save, change or delete an activity, or take the app's access away. The notice holds your Strava athlete id, the activity's id and the time, and nothing else. The Service uses it only as a prompt to ask Strava for that activity through your own connection, and it keeps nothing a notice says about an activity.

If you delete an activity on Strava, or set it to Only You where the Service cannot read private activities, the run stays in the Service but is hidden from your lists. Its notes and shoe stay with it, and it comes back if the activity returns. To remove a run for good, delete your account.

If you take the app's access away on Strava, the Service deletes your Strava connection and stops syncing. The runs it had already imported stay until you delete them or your account.

Information providers

To show a forecast, a route, a journey time or a landmark, the Service asks external providers for information about a place or a coordinate. These requests are made by the Service's own servers, not by your browser, and carry no account identifier, no name and no email address. The providers are: Open-Meteo (weather, air quality and elevation), Open Topo Data (elevation), OpenStreetMap-based geocoding and routing services including Nominatim, Photon, Valhalla and Stadia Maps, Overpass, Wikidata and Wikipedia (landmarks and images), Protomaps (map tiles), AeroDataBox (flight status and flight lookups; the app's flight data comes from AeroDataBox), National Rail Enquiries (Darwin live departure and arrival boards), Realtime Trains and Transport for London (train and underground times), Transitous (train, bus and underground times in Europe, and the ways between places on a trip, such as an airport and where you are staying; transitous.org), postcodes.io (turning a UK postcode into a place), Frankfurter (exchange rates), and Ignav and Travelpayouts (flight fares), a UK rail industry journey planner (train times and fares; our servers send it the two stations, the days and any railcard type, and nothing about who you are), Mapillary (a street-level photo near a point on a race course, for the flyover's key moments; only the coordinates of that point are sent). The route map draws railway lines from OpenStreetMap (© OpenStreetMap contributors, ODbL), from a file the app holds itself, so drawing it sends nothing to anyone. Airport and station searches are answered from files the app holds itself, made from OurAirports and Wikidata (both public domain) and the Department for Transport's NaPTAN. Contains public sector information licensed under the Open Government Licence v3.0. To show flight fares, our servers send Ignav and Travelpayouts the airport codes and dates of a trip. They receive no name, email address or account identifier.

A coordinate you supply, such as a race start or an accommodation address, is personal data in context even though it is sent without your name attached. It is sent only for the specific lookup you asked for.

Requests your browser makes itself

Most lookups go through our servers, so the other service never learns who you are. Four come straight from your browser, which means that service sees your IP address: map tiles from Stadia Maps, the Strava preview of a run on a race page, the default cover photo from Unsplash, and the street photos shown at a course's key moments, which load from Mapillary. If you tap Open in Uber, Uber receives the two addresses in the link. If you tap Compare on Aviasales or open a fare's booking link, that site receives the trip's airports and dates in the link.

Checking you are a person

The waitlist, account-deletion, email sign-in and shared-trip pages use Cloudflare Turnstile to check that a person, not a script, is sending them. Turnstile reads signals from your browser for that check and nothing else.

Other disclosures

Data may also be disclosed where required by law, court order or a regulator; where necessary to establish, exercise or defend legal claims; and to a successor entity if the Service is transferred, in which case you will be told before your data becomes subject to a different policy.

7. International transfers

Some of the recipients above process data outside the United Kingdom. Where personal data is transferred out of the UK, one of the following applies:

• the country is covered by UK adequacy regulations under Article 45 UK GDPR; or
• the transfer is made under the International Data Transfer Agreement, or the UK Addendum to the European Commission's Standard Contractual Clauses, issued by the Information Commissioner under section 119A of the Data Protection Act 2018; or
• the transfer is necessary for the performance of a contract with you under Article 49(1)(b), which is the case when you connect a provider hosted outside the UK.

Content delivery networks serve static files from the location nearest to you, which may be outside the UK. You may request details of the safeguards applied to a particular transfer using the contact address below.

8. How long data is kept

9. Security

Article 32 UK GDPR requires measures appropriate to the risk. The following are in place:

• All traffic is encrypted in transit using TLS, with HTTP Strict Transport Security enforced.
• Access tokens for connected accounts are encrypted at rest with a key held separately from the database.
• Sign-in tokens are stored only as SHA-256 hashes, so the database does not hold a usable credential.
• The session cookie is HttpOnly, Secure and SameSite=Lax, so it cannot be read by script and is not sent from another site's pages.
• A Content Security Policy restricts what the pages may load and where they may send data, and blocks injected scripts.
• Requests are rate limited at the network edge and per account.
• Every database query for your own data is scoped to your account, and an automated check in the build refuses any query that is not. The one exception is the read-only administrator view described in section 2, which is recorded each time.
• Files you upload are served only to an authenticated session, not from a public link.

No system is perfectly secure. If a personal data breach occurs that is likely to result in a risk to your rights and freedoms, it will be reported to the Information Commissioner's Office within 72 hours as required by Article 33, and you will be told without undue delay where Article 34 requires it.

10. Your rights

Under the UK GDPR you have the right to:

• Be informed about how your data is used, which is the purpose of this policy.
• Access a copy of your personal data (Article 15). The Service also has a self-service export that produces a complete file of your data at any time.
• Rectification of inaccurate or incomplete data (Article 16). Most data can be corrected directly in the Service.
• Erasure of your data (Article 17), including closing your account entirely. The Service has a self-service option to delete all your data or close your account from the You tab (Your data), and a deletion request page for when you cannot sign in. Closing your account removes what is described in section 8, apart from the records that section names as kept.
• Restriction of processing in the circumstances set out in Article 18.
• Data portability (Article 20): a machine-readable copy of the data you provided, which the export function supplies.
• Object to processing carried out on the basis of legitimate interests (Article 21).
• Withdraw consent at any time, without affecting processing already carried out (Article 7(3)).

Requests are answered within one month, extendable by two further months for complex requests, in which case you will be told within the first month. There is no charge unless a request is manifestly unfounded or excessive. Identity may need to be verified before a request is actioned.

11. Automated decision-making and profiling

The Service calculates predictions and estimates from your data, including a predicted finish time, a fitness and fatigue estimate, a readiness score and a training load risk indication. These are analytical outputs shown to you as information. They produce no legal effect and no similarly significant effect within the meaning of Article 22 UK GDPR: nothing is decided about you, no access is granted or refused, and the figures are advisory. You remain free to disregard them.

12. Children

The Service is for adults, 18 and over. You give your year of birth when you sign up, and an account is not set up for anyone younger. If you believe a child has provided personal data, contact the address below and it will be deleted.

13. Cookies and local storage

The Service uses strictly necessary cookies to keep you signed in, one for the app and one for a trip shared with you, and stores settings and an offline copy of your own data in your browser. There are no advertising or tracking cookies, which is why no consent banner is shown: the Privacy and Electronic Communications Regulations 2003 exempt storage that is strictly necessary to provide a service you have requested, and allow display choices and visit counting as long as you can say no. You can turn off remembered display settings in the app, and visit counting on the website, at any time. Full detail is in the Cookie Policy.

14. Changes to this policy

This policy may be updated to reflect changes to the Service or to the law. The version number and date at the top of this page always show the current version. Where a change materially affects how your data is used, you will be told in the Service before it takes effect, and where the change relies on your consent, you will be asked for it again.

14 October 2026. Added the records of what you do in the app (section 2).

15. Complaining about how your data is handled

You have a statutory right to complain directly to us about anything in this policy or about how your personal data has been processed. That right is given by section 164A of the Data Protection Act 2018, inserted by section 103 of the Data (Use and Access) Act 2025, and in force since 19 June 2026.

How to complain.

• Email privacy@intherunning.app. Putting "Data protection complaint" in the subject line makes it easier to route, but a complaint counts however it is worded.
• If you would rather write, ask at that address for a postal address and one will be sent to you.

A complaint does not have to use any particular form of words, cite any law, or arrive by any particular route. It helps to say what happened, when, and what you would like done about it. A complaint made in any other channel we operate is still treated as a complaint.

What happens then.

• Receipt is acknowledged within 30 days, counted from the day after the complaint arrives. If the last day falls on a weekend or public holiday, the next working day is used.
• The complaint is then investigated and the outcome given to you without undue delay. If it is going to take longer than usual, you will be told why and given an expected date.
• A record is kept of the complaint, the acknowledgement, the steps taken and the outcome.
• Complaining costs nothing, and does not affect any of your other rights, including the right to a judicial remedy.

16. Contact details, and complaining to the regulator

To exercise any right in section 10, complain under section 15, ask a question about this policy, or request details of the safeguards applied to a particular international transfer, contact the controller. Account deletion can also be requested directly at the deletion request page.

If you are not satisfied with how a complaint has been handled, or you would rather not raise it with us at all, you may complain to the UK supervisory authority:

Since 19 June 2026 the ICO may ask whether you have raised the matter with us first, and may decline to take a complaint further until you have. Nothing here removes your right to approach the ICO, or to seek a remedy in the courts under Article 79 UK GDPR.