This policy explains what personal data My First Marathon (the "App") processes, why, and what rights you have under the EU General Data Protection Regulation (GDPR). In short: we collect only what the App needs to train you for your race, we store your cloud data in the European Union, we do not sell it, we do not show ads, and you can export or delete everything at any time.
1. WHO WE ARE
The data controller is Worldwide Brands Hungary Kft., a company registered in Hungary with its seat in Üröm, Hungary ("we", "us"). You can reach us about anything in this policy at worldwidebrandskft@gmail.com.
2. WHAT DATA WE PROCESS
Account data: your e-mail address and authentication identifiers, managed by Firebase Authentication. If you sign in with Google, we receive the e-mail address and basic profile identifiers of your Google account.
Profile data you provide during onboarding and in your settings: your race goal and race date, running experience self-assessment, an optional recent test-run result, an optional target finish time, your weekly training days and preferred long-run day, height, weight, an optional target race weight, age, sex, number of meals per day, dietary preferences (such as vegetarian or gluten-free), and your preferred measurement units.
Training and activity data: your generated training plan, the edits you make to it, which sessions you completed, and your logged activities — both manually entered runs and runs recorded with the App's GPS tracking (distance, duration, pace, per-kilometre or per-mile splits, and the route line of the run itself, that is, the series of location coordinates recorded while you ran). The route line is stored in your account so that it is restored when you sign in again or on another phone; it is visible only to you. If you rate how a run felt or add a short note to it, that rating and note are stored with the activity in your account, included in your data export, and deleted together with the activity.
Subscription data: your subscription status and technical purchase tokens issued by Google Play. Payments are processed entirely by Google Play — we never receive your card or bank details.
Crash diagnostics: if the App crashes, we receive a technical crash report through Firebase Crashlytics, including the device model, operating system version, App version, and technical details of the failure. Crash reports do not include your training plan or profile content. Crashlytics also records anonymous app-session counts (when the App was opened, with the same technical details) so that we can see how many users a problem affects. Reports are identified only by a random installation identifier, never by your account, and you can switch crash reporting off at any time in Profile ("Send crash reports").
Support correspondence: if you write to us, we process your e-mail address and the content of your message to help you.
Connected services: if you choose to connect Strava (where this feature is available), we import your running activities from Strava in line with the authorization you grant there. We never post to your Strava account.
Technical log data: when the App talks to our servers (for example to verify a purchase, to process a subscription notification from Google Play, or to delete your account), Google Cloud records the request in operational logs: the IP address, the time, the name of the function called, a shortened one-way hash of your account identifier, and, if something goes wrong, the type, code and message of the error. These logs never contain your purchase tokens or your profile, plan or activity content, and we keep them for 30 days. The Firebase software in the App also assigns each installation a technical Firebase Installation ID that is used to deliver the services listed in section 6, and each request to our servers carries a short-lived App Check token that shows it comes from a genuine copy of the App (see section 6).
3. DATA THAT STAYS ON YOUR DEVICE
Some data is stored only on your device and is never uploaded to our servers: your checklist tick marks, which badges you have already seen, theme, reminder and display settings, a local cache of your subscription status, and the checkpoint of a run that is still being recorded (once you save the run, it is stored in your account together with its route line, as described in section 2). This data disappears when you uninstall the App or clear its storage. It is also excluded from Android cloud backup and device-to-device transfer, so it does not leave your device through those channels either.
One clarification about routes and maps: your route line goes only to our servers (Google Firebase, section 6) and only into your own account. When you view a run on a map, the App asks Google Maps to display the map of that area, so Google receives the map area being shown (not your route line) under Google's own privacy policy, as described in section 6. You can turn this off at any time in Profile with the "Show routes on Google Maps" switch; the App then draws a simple sketch of your route on your device instead and nothing is requested from Google Maps.
4. HEALTH-RELATED DATA AND YOUR CONSENT
Some of the data above — your body metrics (height, weight, target weight), age, sex, and your activity data — is health-related data under Article 9 GDPR. We process it ONLY with your explicit consent, which you give during registration. You can withdraw this consent at any time by deleting your account; without it, the App cannot generate or maintain your plan. We never use health-related data for advertising and never sell it.
5. WHY WE PROCESS YOUR DATA AND ON WHAT LEGAL BASIS
- To generate and adjust your personal training plan and nutrition suggestions, and to sync your data across your devices: performance of our contract with you (Article 6(1)(b)); for the health-related parts, your explicit consent (Article 9(2)(a)).
- To verify your subscription and unlock paid features: performance of the contract (Article 6(1)(b)).
- To fix crashes and keep the App secure and free of abuse: our legitimate interests in providing a working, safe service (Article 6(1)(f)).
- To comply with legal obligations, such as accounting rules: Article 6(1)(c).
We do not sell your data, do not use it for third-party advertising, do not build advertising profiles, and do not send marketing e-mails. Your training plan is generated by automated, rule-based logic from the inputs you provide; this automation has no legal or similarly significant effect on you, and you can always edit the plan or ask us about how it was generated.
6. WHO WE SHARE IT WITH
We use a small number of service providers (processors) to run the App:
- Google (Firebase Authentication, Cloud Firestore, Cloud Functions, Crashlytics, App Check) — hosting, authentication, database, crash reporting, and abuse protection. Crash reporting is not used if you turn off "Send crash reports" in Profile. Firebase App Check uses the Google Play Integrity API to confirm that requests to our backend come from a genuine, unmodified copy of the App on a device with Google Play services: Google receives a technical attestation about the App and your device and returns a short-lived token; no account, profile or training data is part of it.
- Google Play — subscription billing. Google processes your payment as an independent controller under Google's own privacy policy.
- Google Maps Platform (Google Maps SDK for Android) — map display when you view the route of a run. Google receives the map area being shown, technical identifiers of your device and our API key, under Google's own privacy policy; your route line is not sent. Not used if you turn off "Show routes on Google Maps" in Profile.
- Strava — only if you choose to connect it, under Strava's own terms and privacy policy.
We may disclose data to authorities where the law requires it. We do not share your data with advertisers or data brokers, and we do not sell it.
7. WHERE YOUR DATA IS STORED AND INTERNATIONAL TRANSFERS
Your cloud data is stored in Google Firebase (Firestore) in data centres located in the European Union, protected in transit and at rest. Where Google transfers limited data outside the EU (for example for support or operations), the transfer is safeguarded by the EU-U.S. Data Privacy Framework and/or Standard Contractual Clauses. Our website serves static pages only and sets no cookies.
8. HOW LONG WE KEEP IT
Your data is kept while your account exists. If you delete your account in the App, your cloud data is deleted promptly and permanently, and your authentication account is removed. After deletion we keep a single, permanent deletion record consisting of your former account identifier and the time of deletion, without any profile or training content; its only purpose is to make sure that a device still signed in to the deleted account cannot re-create your data. Data stored only on your device remains until you uninstall the App or clear its storage. Google Play retains its own billing records under Google's policies. Technical log data is kept for 30 days. Crash reports are retained for a limited period. Support e-mails are kept only as long as needed to handle your request and any follow-up.
9. YOUR RIGHTS
Under the GDPR you have the right to access your data, to rectify it, to erase it, to restrict or object to processing, to receive your data in a portable format, and to withdraw consent at any time. The App includes built-in tools for the most important ones: a data export (Profile → Export my data) and account deletion (Profile → Delete account). The export is a JSON file with your account e-mail address and sign-up date, your profile, your training plans and the edits you made to them, your activities (including the GPS routes of your recorded runs), your meal choices, your consent records (which versions of the Terms and this Policy you accepted, and when), your subscription status, your app settings (including the crash-report switch), and the checklist items and badges you have ticked or seen on that device; on a free account, plan weeks that are still locked behind the subscription are not included. The consent records are read from the cloud, so they are missing from an export made while offline. For anything else, contact us at worldwidebrandskft@gmail.com. You may also lodge a complaint with the Hungarian National Authority for Data Protection and Freedom of Information (NAIH, naih.hu) or with the data protection authority of your country of residence.
10. SECURITY
Data is encrypted in transit (TLS) and at rest. Access to your cloud data is restricted by per-user security rules, so other users of the App can never read your data. We limit administrative access to what is necessary to operate the service. Our server logs identify your account only by a shortened one-way hash and never contain purchase tokens.
11. CHILDREN
The App is intended for adults. You must be at least 18 years old to create an account, and we do not knowingly collect data from anyone younger.
12. CHANGES TO THIS POLICY
If we make material changes, the App will ask you to review and accept the new version before continuing, and the version shown at the top of this policy will change.
13. CONTACT
Worldwide Brands Hungary Kft., Üröm, Hungary. E-mail: worldwidebrandskft@gmail.com.