Privacy

No ads. No third-party trackers. We never sell or share your data. This page covers both the waitlist on this website and the Flogram app.

No tracking, anywhere

No analytics scripts, advertising, pixels, session recording or social media buttons, on this site or in the app. This site sets no cookies; the app sets one, to keep you signed in. Fonts, icons and images come from our own servers, so your browser never contacts anyone else while you use Flogram.

The waitlist

When you enter your email on this site, we send you one message with a Confirm link. Until you confirm, we store nothing: the link itself carries your address, signed so nobody else can make one. If you never open it, you’re never added.

Your email addressOnly once you confirm. Until you unsubscribe or ask us to delete it.

When you confirmed, and whether you’ve unsubscribedKept by Resend with your address. As long as your address is on the list.

A record of each email sent to youResend’s delivery logs. Resend deletes these after a short period.

We use your address to email you when Flogram is ready, and with the occasional update before then. Nothing else: we never sell it, share it or use it for advertising.

The reason we’re allowed to hold it (the legal basis, under UK GDPR and PECR) is your consent, which you give by confirming. You can take it back at any time.

Stopping abuse

To stop the form being used to flood someone’s inbox, the server counts recent sign-up attempts by IP address (5 in 10 minutes) and by a one-way code made from the email address (one email every 10 minutes, 3 a day). The form also carries the time the page was shown, so posts made faster than a person could type are ignored. Before sending, we ask Resend whether the address is already on the list, so subscribers aren’t emailed again. The counts are held in memory only, never written to disk, and forgotten once the time has passed or the server restarts. Our server logs never contain email addresses or IP addresses.

The Flogram app (beta)

The app at plan.flogram.app is in a private beta for people we’ve invited.

What we collect, and why

Only what’s needed to build and adapt your training plan: your email (to sign in), your race and current running, the sports and gym sessions you tell us about, and the activities your watch or uploads send us. We don’t ask for your date of birth, gender, weight or location.

Activity and heart-rate data is health data under UK GDPR. We only process it with your explicit consent, given during setup, and you can withdraw it at any time by deleting your account.

We count things like sign-ups and how many plans are created from our own database, never with tracking tools.

How long we keep it

Account, plan and settingsUntil you delete your account

Activities (duration, distance, heart-rate zones, splits)Until you delete them or your account

Detailed heart-rate traces90 days, then reduced to zone totals

GPS routesKept for runs unless you turn routes off in Settings (which deletes the ones we hold)

Sign-in codes and linksWork once and expire after 15 minutes

Server request logs14 days, with no health data or email addresses

BackupsEncrypted; deleted data ages out within 30 days

Your controls

In Settings you can download all your data as a file, turn off GPS routes, disconnect your watch, and delete your account. Deleting is immediate and permanent: we disconnect your watch, cancel your subscription and remove everything.

The app runs on servers in the UK/EU. Maps are drawn from your GPS points on our own server, without sending anything about you to a map service.

Who else is involved

These are the only companies that process data for us, and which part of Flogram each one is for:

CloudflareCarrying traffic to this website and the app (network and secure tunnel). Both.Every request passes through Cloudflare, so it handles your IP address and the pages and data you send and receive. We don’t use its analytics or tracking features.

Resend (Resend, Inc., United States)Sending our emails: waitlist confirmations and news, sign-in codes and links, beta invitations. Both.Your email address and the message. It also keeps the waitlist itself. Your address is stored on their servers in the US; Resend’s data processing agreement covers that transfer with the standard contractual clauses and the UK addendum. Open and click tracking are turned off.

StripePayments and receipts. App only, and not used during the private beta.Your email and payment details, entered on Stripe’s own pages: we never see your card.

GarminOnly if you connect it: sending workouts, receiving activities. App only.Planned workouts go to Garmin; your activities come back to us.

Zepp (Amazfit)Only if you connect it (experimental): sending runs, receiving activities. App only.Planned runs go to your Zepp training calendar; finished workouts come back to us. We keep Zepp’s access token, encrypted, never your Zepp password.

OpenStreetMapMap tiles behind your routes. App only.Our server fetches map images for the area a route covers and keeps a copy. Your browser never contacts them, and nothing about you is sent.

Unsubscribe, delete or ask

Every waitlist email has an unsubscribe link at the bottom; one tap and you won’t hear from us again. App accounts can be deleted in Settings.

To have your address removed from the waitlist completely, to ask what we hold about you, or to have anything corrected or deleted, email [email protected]. We’ll do it within 30 days, usually much sooner.

If you’re unhappy with how we’ve handled your data, you can complain to the Information Commissioner’s Office at ico.org.uk.

Last updated 3 November 2026.