MileStreak — Privacy Policy
Last updated: 2026-09-30
This policy covers the MileStreak app on iPhone and Android, and the website at milestreak.com.
Status — 2026-09-30. MileStreak is not yet in the App Store or on Google Play. This policy describes MileStreak version 1, the version being released, and applies to you from the first time the app asks you to create an account.
The short version
MileStreak counts how many days in a row you have run. To do that it needs to know about your runs, which is health data, so it is treated as the most sensitive thing in the app.
- Your runs, your streak, your name and your email address are stored in MileStreak's database and nowhere else.
- Your health data is never used for advertising. It is never sold. It is never shared with anyone else for their own purposes. MileStreak has no advertising in it at all.
- You can delete your account and everything in it from inside the app, or from a web page, at any time.
- The whole thing is run by one person, Kevin Rudd, who you can reach at kevin@nextmindadvisors.com.
Which laws this is written for
MileStreak is published from the United States. There is no single US privacy law, so this policy is written to meet the rules that apply to a health app sold to people in the US:
- Washington's My Health My Data Act, and Nevada's SB 370, which both cover consumer health data collected by apps that are not doctors or hospitals. These have no company-size exemption, so they apply from the first user.
- California's CCPA/CPRA, and the similar laws in Virginia, Colorado, Connecticut, Texas and Oregon, which treat health data as sensitive and require that you be asked before it is collected.
- COPPA, the US children's privacy law.
- Apple's App Store rules and Google Play's user data policies, which apply whatever the law says.
The rights described below are given to everyone who uses MileStreak, not only to people in states that happen to have a law. It is simpler, and it is the right thing to do.
MileStreak is not a doctor, a hospital or an insurer, so HIPAA does not apply to it. That does not mean your data is less protected — it means a different set of rules protects it, the ones above.
If MileStreak is ever sold in the EU, the EEA or the UK, GDPR will apply to those users and this policy will be rewritten before that happens.
What MileStreak collects, and why
Your account
| What | Why |
|---|---|
| Email address | It is how you sign in, how a forgotten password is reset, and the only way to contact you about your account. |
| Your name | Shown on your profile, so the app can address you rather than your email address. If you sign in with Apple or Google, it comes from them; if you sign up with an email address, you type it. It can be blank — Apple lets you withhold it — and the app works the same either way. |
| Password | So you can sign in. It is stored scrambled (hashed) by the sign-in service. Nobody — including Kevin Rudd — can read it or recover it. If you sign in with Apple or Google, MileStreak never sees or stores a password at all, and the "forgot password" and "change password" screens do not apply to you. |
| If you sign in with Apple or Google: which of the two, and their ID for you | So the app can recognise you as the same person next time. |
| The date you joined | Shown on your profile. |
Your email address and your name are never used for marketing. MileStreak does not have a mailing list.
No photo. MileStreak does not have a profile picture today and does not ask for one. If that changes, this policy changes with it, before the feature ships.
Signing in with Apple or Google
You can create your account with Sign in with Apple (on iPhone) or Sign in with Google (on either phone) instead of an email address and password.
- MileStreak asks Apple and Google for your email address and your name, and nothing else. It does not ask for, keep or display the profile picture they offer.
- Apple's Hide My Email. If you choose it, Apple gives MileStreak a forwarding address instead of your real one. That is fine — but it is then the only address MileStreak has for you, so it is the address any account email is sent to. If you stop the forwarding on Apple's side, MileStreak has no way to reach you.
- Apple and Google know that you signed in to MileStreak. They are told nothing about your runs or your streak.
- Apple and Google each hand their sign-in service a little of their own profile information along with your email address, and for Google that includes a link to your profile picture. It is kept by the sign-in service that runs MileStreak's accounts. MileStreak never reads it, never shows it, and it is deleted when your account is. It is written down here because this list is meant to be the honest one, not the flattering one.
Your settings
| What | Why |
|---|---|
| Your time zone | A run counts toward the calendar day it started on, where you were. Without your time zone the app would count runs on the wrong day when you travel. |
| Whether the daily reminder is on, and its time | So the reminder fires when you asked it to. |
| How far through setup you have got | So that if you close the app part-way through setting it up, it picks up where you left off instead of starting over — including on a new phone. |
The reminder itself is scheduled by your phone, not sent from a server. MileStreak does not use push notifications and does not hold a push token for your device.
Your streak rule and your streaks
| What | Why |
|---|---|
| Your rule: miles or minutes, and the minimum | It is what makes a day count. Every change is kept as a new version, because a rule change applies from tomorrow and must never break a streak that already happened. |
| Your streaks, current and past: when each started, when the app started checking it, the last day confirmed, when it ended and how long it was | This is the product. Your longest-ever streak is worked out from these. |
Your runs
| What | Why |
|---|---|
| Runs you type in by hand: the day, and a distance or a time | So you can keep your streak going when the app cannot see a run automatically. |
| Runs read from Apple Health or Health Connect: which of the two it came from, that source's own ID for the run, the run's start time, the calendar day it counts toward, how long it lasted, and how far it went | So the app can tell whether a day met your minimum, without you having to tell it. The source's own ID is kept so the same run is never counted twice, and so the run can be removed if you delete it in Apple Health or Health Connect. |
| Whether you have connected Apple Health or Health Connect, and when it was last checked | So the app knows whether to read runs automatically or to ask you to log them. |
Subscriptions, and RevenueCat
MileStreak is free. An optional subscription removes the MileStreak band from your share picture.
Subscriptions are handled by RevenueCat, a company that sits between the app and Apple's and Google's payment systems. So that your subscription follows your account rather than your phone, RevenueCat is given your MileStreak account ID — a random string of letters and numbers, not your name or email — and keeps your purchase records: which plan, when it was bought and renews, which store it came from, and whether it is active. That record is tied to your MileStreak account, not your phone, so a subscription follows you when you sign in on a new one. RevenueCat also receives the basic technical details any app sends when it connects (the app's version, your phone's system version and your country), and Apple's tracking-permission setting, which MileStreak never asks for, so it is always recorded as "not allowed".
RevenueCat is told nothing about your runs, your streak, your health data, your name or your email address. It happens for everybody who signs in, whether or not they ever subscribe, because the app has to ask RevenueCat before it can know you haven't. Neither RevenueCat nor MileStreak uses any of it for advertising.
Your card details go to Apple or Google and never touch MileStreak or RevenueCat. MileStreak's own database does not record whether you have paid; RevenueCat is the only record of that.
Technical sign-in records
When you sign in, the service that runs MileStreak's database records your IP address and the time, the way every website does, so that sign-in problems and abuse can be spotted. These records are kept for a short period set by Supabase and then deleted automatically. They are not linked to your runs and are not used for anything else.
Health data — said plainly
MileStreak reads health data. On iPhone it reads from Apple Health; on Android it reads from Health Connect. It asks your permission first, on its own screen, before your phone's permission dialog appears — and that screen tells you what is read and that your runs are saved to your MileStreak account, before you decide. If you say no, the app still works — you log your runs by hand — and it will not ask again unless you go and connect it yourself.
On Android you can also reach "How MileStreak uses your health data" from inside Health Connect itself, by tapping the privacy link on its permission screen. It says the same thing this section does.
Exactly what it reads:
- that a run happened, and when it started
- how long that run lasted
- how far that run went
Exactly what it does not read, and never asks permission for:
- your route, your GPS location, or anywhere you have been
- your heart rate
- calories, steps, sleep, weight, or any other health or body measurement
- your name, or any other detail attached to your health record
And, without qualification:
- Your health data is not used for advertising. MileStreak contains no advertising of any kind.
- Your health data is not sold. It never has been and it will not be.
- Your health data is not shared with anyone else for their own purposes — not with data brokers, not with advertisers, not with analytics companies, not with other apps.
- Your health data is used for one thing: showing you your own streak, in the app, to you.
If any of that ever changes, you will be asked first. It will not change quietly.
Turning it off. You can disconnect Apple Health or Health Connect at any time, either in MileStreak's Settings or in your phone's own settings. When you disconnect inside MileStreak, every run that came from that source is deleted from MileStreak's database straight away. Your streak number survives, because the app keeps its own record of which days it had already confirmed.
Where it is stored, and who can see it
MileStreak's database is run by Supabase, on servers in the United States. Your data travels there over an encrypted connection and is stored encrypted.
Inside that database, every row belongs to one person, and the database itself enforces that only that person's app can read or change it. This is not just a rule in the screens — it is a rule in the database underneath them.
Who can actually see your data:
- You.
- Kevin Rudd. As the person who owns the database, they can see what is in it through the administration screens, in the same way any app's owner can. This access is used for keeping the app working and for helping you if you ask for help — not for browsing. It is written down here because you deserve to know it is possible.
- Supabase, the company that hosts the database, to the extent any hosting company can see what it stores. They are not allowed to use it for their own purposes.
- RevenueCat, which runs subscriptions, sees your MileStreak account ID and your purchase records, as described under "Subscriptions, and RevenueCat" — never your runs, your streak or your health data. They are not allowed to use it for their own purposes.
- Resend, the service that sends MileStreak's account emails — the forgot-password email, and the confirmations when you change your email address. To send one it sees your email address and the email itself, and keeps a record of having sent it for 30 days. It never sees your runs, your streak or your health data, and it is not allowed to use your address for its own purposes.
- Apple and Google, in two situations and no others. If you use Sign in with Apple or Sign in with Google, they know you signed in to MileStreak, and they are the ones who give MileStreak your email address and your name. If you subscribe, they are told a subscription was bought. In neither case are they told anything about your runs or your streak.
Nobody else. There are no advertising networks, no analytics services, no crash reporting services and no data brokers in MileStreak.
When you share your streak picture, the picture is made on your phone and handed to your phone's own share sheet. You choose where it goes. MileStreak does not keep a copy and does not know where you sent it.
How long it is kept
- Your account, name, settings, rule, streaks and runs are kept for as long as your account exists. The point of the app is a number that goes back years, so nothing is quietly aged out.
- Runs imported from Apple Health or Health Connect are deleted immediately when you disconnect that source.
- A run you delete in Apple Health or Health Connect is removed from MileStreak the next time the app checks, which is the next time you open it.
- Sign-in records (IP address and time) are kept for a short period set by Supabase, then deleted automatically.
- Your purchase records at RevenueCat are kept for as long as your account exists, and deleted when you delete it.
- When you delete your account, everything above is deleted from the live database immediately, and from encrypted backups within 30 days, after which it is gone for good.
Deleting your account and your data
You can do this yourself. You do not have to ask, and you do not have to give a reason.
In the app: Settings → Delete account. You are shown exactly what will be deleted, you confirm, and then your account, your name, your settings, your rules, your streaks and every run — typed in or imported — are deleted. You are signed out.
When you delete your account, MileStreak also:
- ends its Sign in with Apple link to your Apple ID, if you signed in with Apple. Apple asks you to confirm it is you, and MileStreak tells Apple to revoke its access. Apple requires this.
- disconnects from your Google account, if you signed in with Google.
- clears what it kept on your phone: the last streak number it saved for when you are offline, and any daily reminders it had scheduled.
- asks RevenueCat to delete its record of you — your account ID and your purchase records. RevenueCat carries this out shortly afterwards rather than at the same instant.
Without the app: go to https://milestreak.com/delete-account, which explains how to ask by email from the address on your account. You will hear back within 2 business days, and the account is deleted within 7 days of confirming the request came from that address. You do not need to reinstall MileStreak to delete your account. If you ask by email, our email exchange is kept for 12 months as the record that your request was carried out, then deleted.
Deleting your MileStreak account does not touch anything in Apple Health or Health Connect. Your runs stay on your phone, where they were to begin with. MileStreak only ever had a copy.
If you subscribed, cancel the subscription in your phone's own subscription settings — deleting your MileStreak account does not cancel billing, because the subscription belongs to Apple or Google, not to MileStreak.
Advertising
There is none. MileStreak shows no ads, contains no advertising software, does not track you across other apps or websites, and does not take part in any advertising network. Nothing in MileStreak is used to profile you or to target anything at you.
MileStreak makes money, when it makes money, from one optional subscription that removes the MileStreak watermark from your share picture. That is the whole business model.
Your rights over your own data
Whoever you are and wherever you live, with MileStreak you can:
- See what is held about you. Most of it is already on your own screens; ask at kevin@nextmindadvisors.com for the rest.
- Get a copy of it in a form you can take elsewhere.
- Correct anything that is wrong — your name, your email and your rule in the app, anything else by asking.
- Delete it, in the app or at https://milestreak.com/delete-account, as described above.
- Withdraw your permission for health data at any time, by disconnecting Apple Health or Health Connect. Doing so deletes the runs that came from it.
- Not be treated differently for using any of these rights. There is no worse version of MileStreak for people who ask.
To use any of these, write to kevin@nextmindadvisors.com. You will get an answer within 45 days, and usually a great deal sooner than that, because it is one person reading the mail. A request to delete your account is faster: acknowledged within 2 business days and carried out within 7 days, as described under "Deleting your account and your data". If a request is refused — which realistically only happens if it cannot be confirmed that the account is yours — you will be told why, and you can reply and say so.
If you are in California, health data is "sensitive personal information" and you have the right to limit how it is used. MileStreak already limits it to the one purpose described above, so there is nothing further to opt out of. MileStreak does not sell or share personal information as California defines those words, and has never done so.
If you are in Washington or Nevada, the consumer health data section below is the part that applies to you specifically.
Consumer health data (Washington and Nevada)
The consumer health data MileStreak collects is: that a run happened, when it started, how long it lasted, how far it went, and the streak worked out from those. It comes from two places — from Apple Health or Health Connect with your permission, or from you typing it in.
It is collected for one purpose: to count your streak and show it to you. It is kept as described in "How long it is kept". It is shared with nobody. It is sold to nobody — and because MileStreak does not sell consumer health data at all, there is no authorisation for you to sign and nothing for you to opt out of.
The only people who can reach it are the ones listed in "Who can actually see your data": you, Kevin Rudd, and Supabase as the hosting company.
You have the right to be told what health data is held about you, to get a copy of it, to withdraw your permission for it to be collected, and to have it deleted — including from backups. Use Settings → Delete account, or https://milestreak.com/delete-account, or write to kevin@nextmindadvisors.com.
This section is also published on its own, as MileStreak's Consumer Health Data Privacy Policy, at https://milestreak.com/consumer-health-data.
Children
MileStreak is not for children. You must be at least 13 years old to create an account. MileStreak does not knowingly collect anything from anyone under 13. If you believe a child under 13 has created an account, write to kevin@nextmindadvisors.com and it will be deleted.
Keeping it safe
Data travels to and from MileStreak over an encrypted connection, and is stored encrypted. Passwords are stored scrambled and cannot be read by anyone. The database refuses to hand one person's rows to another person, as a rule inside the database rather than a rule in the app.
No app can promise perfect security, and this policy will not pretend otherwise. What it can promise is that if something goes wrong in a way that affects your data, you will be told, and told promptly.
Changes to this policy
If this policy changes in a way that affects what is collected or what happens to it, you will be told inside the app before the change takes effect, and — where it concerns health data — you will be asked again rather than assumed to agree. The date at the top always shows when it last changed.
Contact
Kevin Rudd kevin@nextmindadvisors.com
Email is answered within 2 business days.
Write about anything: your data, a question about this policy, or something in it that does not match what the app actually does. That last one matters most — if the app and this page disagree, the app is what gets fixed.