Privacy policy

The short version

• M42 has no accounts, no analytics and no tracking.
• Your plan, runs and health data are stored in your browser only. They never reach a server I run.
• Export files you import (Apple Health, Garmin, Strava, Polar, Oura, WHOOP, Fitbit, or FIT/GPX/TCX files) are read entirely in your browser and never uploaded.

Controller (Verantwortlicher)

Hosting

The site is hosted by Vercel Inc., USA, which processes data on my behalf (Art. 28 GDPR). When you load a page, Vercel necessarily receives technical data: your IP address, date and time, the page requested, browser and operating system, and the referring page. This is needed to deliver the site and keep it secure (Art. 6 (1) (f) GDPR). Vercel keeps these logs only for a limited time and is certified under the EU-US Data Privacy Framework (Art. 45 GDPR).

What is stored in your browser

Your profile, plan settings, logged and imported runs (including heart-rate data), daily health metrics and preferences are kept in your browser's local storage. They are not transmitted to me or anyone else. You can delete them at any time under Settings → Reset everything, or by clearing your browser data. Settings → Export backup lets you save a copy as a file.

So the app also works offline, for example when installed to your home screen, your browser keeps a copy of the site's own pages, scripts and icons (a service worker cache). It contains no personal data and is cleared together with your browser data.

The site sets only cookies that are strictly necessary for features you use (§ 25 (2) no. 2 TDDDG), so there is no consent banner:

• NEXT_LOCALE: remembers your language choice. Set when you switch language; kept for one year.

File imports

When you import an export from Apple Health, Garmin Connect, Strava, Polar Flow, Oura, WHOOP or Fitbit (Google Takeout), or single activity files, the files are opened and read in your browser. They are never uploaded. The extracted runs and daily values (resting heart rate, heart-rate variability, VO₂max) are stored locally as described above. Heart-rate data counts as health data (Art. 9 GDPR); because it never leaves your device, I don't process it. The import page links to the providers' own help pages, which you request your export from yourself.

No analytics, no third-party content

M42 uses no analytics, advertising or tracking tools. Fonts are served from this site, not from Google. Your browser doesn't load anything from third parties.

External links

The site links to other websites, such as GitHub and the help pages of Apple, Garmin, Strava, Polar, Oura and Google. Their privacy policies apply once you follow a link.

Your rights

Under the GDPR you have the right to access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and to object (Art. 21), and to withdraw consent at any time with effect for the future (Art. 7 (3)). Since your training data stays on your device, you can view, export and delete it yourself in the app. For anything else, email me at the address above.

You also have the right to lodge a complaint with a data protection supervisory authority, for example the Berlin Commissioner for Data Protection and Freedom of Information (Berliner Beauftragte für Datenschutz und Informationsfreiheit) or the authority where you live.

Changes

If the app starts processing data differently, this policy will be updated first.

Last updated: 19 October 2026