Privacy policy

What WorkoutsMCP stores, who else sees it, and how to get rid of it. Last updated 13 October 2026.

This covers the hosted instance at workouts-mcp.com, run as a free, open-source side project rather than a company. The short version is the same as the one on the front page: I don't want your data. What is stored is what planning a workout and syncing it somewhere needs, and nothing else.

What is stored

• Your account. The provider you signed in with (Google or Apple), that provider's stable id for you, your email address, and when the account was created and last used. Apple's private relay addresses are kept as-is — if that is what Apple sends, that is all I have.
• Your sign-in session. One httpOnly cookie, stored server-side as a hash rather than the cookie itself, with an expiry. In-flight sign-ins are held for ten minutes and then swept.
• Your workouts. The plan you made — date, name, sport, notes, and the steps — and whether you marked it done.
• Basic stats about the session you recorded against one. When a connected training platform says you recorded a workout you planned here, its file is read once and a summary is kept: how long, how far, average and maximum heart rate, and a row per lap with its pace, cadence and four equal quarters. No second-by-second data — no heart-rate stream, no GPS track, nothing about where you were — and the file itself is thrown away. Exactly which figures is src/stats.ts. It ages out with the workout it belongs to, and goes when you delete it.
• API tokens and connected apps. Tokens you create are stored as a hash plus the first few characters, so the dashboard can show you which is which; the full token is shown once and never again. Apps you connect over OAuth have their grant recorded so you can revoke them.
• Training-platform connections. If you connect intervals.icu, its API key is stored encrypted at rest, along with the account name it belongs to and the error from the last failed sync. Without the encryption key configured, a connection is refused rather than stored in the clear.

What is not

No analytics, no tracking pixels, no advertising, no third-party scripts on any page here — the GitHub logo in the FAQ is inlined so that even a badge does not call out to anyone. Nothing is sold, rented or shared for marketing, and there is no profiling or automated decision-making. Your data is not used to train anything.

Who else sees it

• Cloudflare hosts the site, the database and the session store, and sees the request traffic that reaches it.
• Google or Apple, whichever you sign in with, tell me who you are; what they log about the sign-in is between you and them.
• intervals.icu, and only if you connect it: workouts you sync are pushed there, and completions are read back hourly.
• Whoever you give a download link to. When you ask for the recordings themselves, you get a link that needs no password, so anyone holding it can fetch those files for the four hours it lasts. The files are pulled from your training platform as the link is followed and are not stored here.
• The MCP client you connect — Claude, or whatever else you authorize — can read and write the workouts in your window, because that is the point of it. Revoke it and that stops.

Beyond that, data is disclosed only if the law actually requires it. There is no other recipient and no sale.

How long it is kept

Workouts are only readable inside a rolling window — 7 days back and 14 days ahead. A session that ages out of that window stops being visible and is not deleted: nothing here throws away training history you did not ask it to. Expired login sessions, abandoned sign-ins and stale OAuth grants are swept nightly. Everything else stays until you delete it or ask for the account to go.

What you can do about it

• Delete any workout from the dashboard, or through your MCP client.
• Revoke an API token, or a connected app, from the Setup section of the dashboard.
• Disconnect a training platform, which deletes the stored credential.
• Delete the account itself — identity row, tokens, sessions and every workout — from Settings › Delete account in the iPhone app, or by writing to tejas@gja.in. A copy of what is held can be asked for by email.
• Or skip trusting someone else's copy entirely: it is MIT-licensed, so you can run your own, on your own Cloudflare account, where none of the above involves me.

Changes and contact

If this policy changes, the date at the top changes with it, and the diff is public in the repository's history. Questions, corrections and complaints go to tejas@gja.in, or to the issue tracker if they are about the code.