1. Information we collect
We may collect your account details (email address and profile name), profile picture, preferences, invitations, support-circle relationships, goals, challenges, Crews, reactions, comments, community posts and discussion messages, progress photos you choose to share, and the activities you record or import. Activity information can include movement type (walk, run, hike, ride or swim), date, duration, distance, pace or speed, elevation, effort, notes, mood, gear and the service that supplied it.
When you record a movement with MulaRun, we collect your precise location through GPS to draw your route and measure distance, including while the screen is locked if you allow it. Recording only starts when you tap Start. If you turn on live sharing with your Circle, your Circle sees your approximate progress during that movement, never your precise route.
On iPhone, Apple Health access is optional and read-only. With your permission, MulaRun imports walking, running, hiking, cycling and swimming workouts, with their dates, duration, distance, heart-rate summaries, steps, active energy, pace or speed, elevation, source-device information and available workout routes. MulaRun also reads your daily steps, resting heart rate, average heart rate, heart rate variability and sleep, to show them on your private My Health page. Imported records are linked to your MulaRun account and stored in our Supabase database. Routes contain precise location information.
On Android, Google Health Connect access is optional and read-only. With your permission, MulaRun imports the same kinds of workouts, metrics and routes, and the same daily steps, heart rate, heart rate variability and sleep readings. MulaRun never writes to or changes your Apple Health or Health Connect data. Health authorization remains on your phone; MulaRun does not store your Apple Health or Health Connect authorization.
If you connect Strava, MulaRun imports your Strava activities, including ones you marked private on Strava, which stay visible only to you in MulaRun. You can choose on Strava’s own consent screen which activities MulaRun may read.
If you choose to use My Health, we collect the personal information you enter or allow there: date of birth, sex, height, dated weight entries, smart-scale readings you type in (such as body fat, muscle, body water, visceral fat, bone mass, BMR and metabolic age) and optional notes; water you log; nights of sleep; fasting sessions with their start, target, end, and the weight and mood you choose to record; your calorie, protein, carbohydrate and fat targets; and the foods, meals and recipes you log. These records are optional, stored separately from your social profile and visible only to you. Your Circle and other MulaRun members cannot read them.
If you turn on notifications, we store a notification token for your phone or browser so we can send the reminders and updates you chose. We also send account emails, such as password resets, and activity emails, which you can turn off in the app.
2. How we use information
We use information to authenticate you, show progress, award badges, prevent duplicate imports, support invitations and challenges, provide support, protect the service and improve the beginner running experience. We do not use health or activity information for advertising.
We do not use or share Apple Health or fitness data for advertising, marketing, data brokerage or tracking across other companies’ apps and websites. We use this data to provide your MulaRun fitness features.
My Health calculates weight change, adult BMI, fasting progress, water, sleep and calorie and nutrient totals for your private dashboard. BMI is a screening measure rather than a diagnosis. MulaRun does not diagnose conditions, prescribe fasting or reward prolonged fasting, and does not use personal health information for advertising, eligibility decisions or public rankings.
3. Sharing and service providers
We share information only when needed to operate MulaRun, follow your instructions, protect users or comply with law. Our infrastructure providers process data on our behalf, including Cloudflare for hosting, security and email forwarding, Supabase for authentication and database services, Expo, Apple and Google for delivering notifications, and Resend for sending email. Connected providers such as Strava, Apple Health and Health Connect process data under their own privacy terms.
Using these infrastructure providers to operate MulaRun is distinct from selling data or sharing it for another company’s advertising. Health and fitness records are processed to provide MulaRun’s services, not for those providers’ independent marketing use.
Events. When you register for an event listed on MulaRun, we collect what its organiser needs to run it: your name, date of birth, gender, NRIC or passport number (stored encrypted), phone, email, emergency contact, any medical note you choose to give, your answers to the organiser’s questions, your kit sizes, and later your results. We share these with that event’s organiser and the people they appoint, such as their kit team, medical team and timing company, who use them to run the event. Medical notes are shown only to the organiser’s owners, admins and medical team, and full NRIC numbers only to the organiser’s owners, in downloads that are recorded. We keep these details only as long as the event and the law require.
Messages from event organisers. An event’s organiser can send messages about an event you entered, such as pack-collection times, a race-morning briefing or your results. We send them by email from MulaRun, and as a notification if you use the app. They reach you even if you turned off MulaRun’s activity emails, because they are about an event you entered. Organisers can message only the runners of their own events, and replies go to the organiser.
4. Your visibility choices
For supported activities, you can choose “Only me”, “My support circle” or “MulaRun members”. Movements you record or import start with your support circle unless you choose otherwise, and you can change who sees each one at any time. Private activities are not displayed to other members. You should share only invitations, notes and reactions that you are comfortable sending to their intended recipients.
A route recorded or imported with an activity is shown by default to everyone who can see that activity. You can set any route to “Only me”, or turn on home protection to hide its first and last 200 metres.
If you join a shared virtual city journey, your profile display name and cumulative distance on that journey are visible to signed-in MulaRun members so participants can move together. Your pace, notes and individual activity details keep the visibility setting you chose and are not added to the shared map.
5. Security and retention
We use access controls, row-level database security and restricted server access. No online service is risk-free. We retain account information while your account is active and as reasonably needed for security, dispute resolution and legal obligations.
Personal health profiles, weight and smart-scale entries, water, sleep, daily health readings, fasting sessions, nutrition targets and food logs are protected by owner-only database policies. They are deleted with your MulaRun account. You can also edit or delete individual weight, fasting, sleep and food records from My Health.
6. Your choices and rights
You can correct profile information, change activity visibility and revoke connected-provider access. You can permanently remove your account and associated personal information from the MulaRun account deletion page. A photograph you added to a journey landmark is a contribution to that journey: when you delete your account it stays on the map, but its credit changes to “A MulaRun member” and it is no longer linked to you. To have one removed instead, contact hello@mularun.com. Disconnecting a provider stops future imports but does not automatically remove activities already stored by MulaRun.
You can revoke individual Apple Health permissions in the Health app or iPhone Settings, and Android permissions in Health Connect. Revoking read access prevents future reads of those data types; it does not automatically delete records already imported into MulaRun. You can continue using manual activity logging without health-service access.
7. International processing and changes
MulaRun may process information in countries where its service providers operate, using appropriate safeguards where required. We will update the effective date when this policy changes materially and provide additional notice when appropriate.
8. Contact
For privacy questions or requests, email hello@mularun.com or visit the MulaRun support page.