Legal

Privacy Policy

Last updated: 15 May 2026

MakoFit (“MakoFit”, “we”, “our”, or “us”) is a workout tracker for iPhone and Apple Watch, with an accompanying website at on-rep.web.app. This Privacy Policy explains what information we collect, why we collect it, and the choices you have. We aim to collect the minimum data needed to make the app work and to keep working out the only thing you have to think about.

1. Information we collect

Account information

When you create an account we use a third-party single sign-on provider. It sends us:

  • a stable, opaque user identifier,
  • the email address you choose to share (which may be a private relay address generated by the sign-in provider), and
  • the display name you choose to share at first sign-in.

We never see your sign-in password.

Profile information

In the app you can provide profile details that personalise the experience:

  • Display name and an avatar image (optional).
  • Date of birth — used to compute the age multiplier when MakoFit auto-scales suggested loads, and to confirm you meet the minimum age requirement (see section 7).
  • Gender — used to pick the body figure rendered on the muscle map and to refine load suggestions. You can leave this unset.
  • Body weight and preferred weight unit (kg or lb) — used so that bodyweight and assisted exercises calculate accurate loads.

Workout content

Anything you log: routines, exercises, sets, reps, weights, durations, distances, RPE, rest times, session timestamps, and notes you add. This is the core data MakoFit exists to track.

Health and sensor data

If you grant permission, MakoFit reads and writes the following through your device’s health framework:

  • Heart rate (BPM) — streamed live during workouts from your paired Apple Watch or compatible heart-rate sensor, and saved per-session as average and peak.
  • Active energy (calories) — recorded during workouts.
  • Body weight — read from your device’s health store so loads on bodyweight exercises stay accurate without manual entry.
  • Workouts — every workout you complete is written back to your device’s health store attributed to MakoFit so it counts toward your activity rings.

You control these permissions in your device’s health and privacy settings at any time. Revoking permission stops new reads and writes; entries already written to the health store remain there until you delete them through the health app.

We do not request your precise location, microphone, camera (other than to pick an avatar from your photo library, which is processed on-device), contacts, calendar, motion data outside of the health framework’s workout types, or any advertising identifier.

Diagnostics and analytics

MakoFit uses third-party analytics and crash-reporting services to understand which screens are used and to receive crash reports. These services collect:

  • a randomised installation identifier,
  • app version, OS version, device model, language, country,
  • screen-view events, and
  • on crash, a stack trace and the build number.

We do not log workout names, custom exercise names, routine names, exercise notes, or any other content you have entered. Analytics is automatically disabled in debug builds and the simulator.

Website data

When you visit on-rep.web.app:

  • Our hosting infrastructure logs standard server access information (IP address, user agent, requested path, timestamp, referrer) for security and operational purposes.
  • After you sign in on the website, an essential session cookie scoped to the signed-in area is set so the server can recognise your session. This cookie is required to use the authenticated area of the site and cannot be disabled while signed in.
  • We do not run advertising, retargeting, or social media trackers, and we do not set marketing cookies.

2. How we use information

We use the information described above to:

  • create and authenticate your account,
  • store and sync your workouts and routines between your devices,
  • render the muscle map, suggest loads, and produce session summaries,
  • show your live and historical heart rate and active calories,
  • diagnose crashes and fix bugs, and decide which features to invest in,
  • contact you about service-related matters such as security notices or material changes to this policy.

We do not sell or rent your personal information. We do not use your workout, health, or profile data for advertising, and we do not share it with data brokers.

All MakoFit users — wherever they live — are treated as being covered by the UK GDPR, the EU GDPR, or an equivalent data-protection regime. We extend the same access, portability, correction, restriction, objection, and erasure rights to every user, regardless of whether your local law would otherwise require it.

Our legal bases for processing are:

  • Contract — to deliver the app you signed up for (account, sync, workout logging).
  • Legitimate interests — to keep the service reliable, secure, and to improve it (crash reports, aggregate analytics).
  • Consent — for any access to health data; you may withdraw it at any time in your device’s privacy settings.
  • Legal obligation — to respond to lawful requests from authorities.

4. Sharing and disclosure

We share information only with the processors needed to run MakoFit:

  • the operating system platforms our apps run on, for sign-in, health data access, and app-store billing,
  • our cloud infrastructure provider, which handles authentication, database storage, server-side logic, hosting, analytics, and crash reporting on our behalf under data-processing terms.

We may disclose information if required by law, to protect the rights, property, or safety of MakoFit, our users, or others, or in connection with a sale of the service (in which case we will notify you and the new owner will be bound by this policy or an equivalent one).

5. Third-party clients you authorize

MakoFit exposes a Model Context Protocol (MCP) endpoint so that you can connect AI assistants and other third-party clients of your choosing to your MakoFit account. You initiate this connection yourself, from inside the iOS app, by granting an OAuth token under Settings → AI Assistants.

What this means in practice:

  • The third-party client can read, and where you grant the scope, modify your MakoFit data — profile, routines, workouts, sets, exercises, and notes — by calling our API on your behalf.
  • Actions taken against MakoFit using that token (data your client reads from us, writes back to us, or deletes through us) are covered by this policy and by our Terms of Use, in the same way as actions you take in the app yourself.
  • Anything the third-party client does after it receives your data — how it stores it, retains it, processes it, trains models on it, shares it with sub-processors, or shows it to other users of that client — is outside MakoFit’s control and outside this policy. It is governed solely by the third party’s own privacy policy and terms.
  • We do not see or store the contents of conversations between you and the third-party client. We only see the API calls it makes against your account.
  • You can revoke any third-party client at any time under Settings → AI Assistants in the iOS app. Once revoked, the token stops working. Data the client has already retrieved and stored on its own systems is no longer under our control; you will need to follow that third party’s deletion process for any copies it holds.

Before connecting a third-party client, please review its own privacy policy and terms. You are responsible for your choice of client and for the scopes you grant.

6. Data retention

  • Workout history, routines, and profile data are kept for as long as your account exists.
  • Diagnostic and analytics data is retained by our processors for limited periods, typically no longer than 14 months.
  • When you delete your account (see section 7), we delete or irreversibly anonymise your profile, workouts, and routines within 30 days, except where we are required to retain records for legal or accounting reasons.

7. Your rights and choices

You have the right to:

  • Access and export your data — the in-app Export feature (Settings → Account → Export my data) produces a complete, machine-readable copy of every piece of personal data we hold about you: profile, routines, workouts, sets, notes, and the health values we have recorded. This is the primary mechanism for exercising your GDPR right of access and right to data portability, and you can use it at any time without contacting us.
  • Correct inaccurate data — most fields can be edited directly in the app.
  • Delete your account and all associated data. You can do this in Settings → Account → Delete account in the iOS app, or by contacting us.
  • Object to or restrict certain processing, and withdraw consent for health data access.
  • Lodge a complaint with your local data protection authority (in the UK, the ICO).

If the in-app tools don’t cover what you need, or if you want a written response, get in touch via the contact page. We will respond within 30 days.

8. Children’s privacy

MakoFit is not directed at children under 13 and we do not knowingly collect personal information from them. If you believe a child has provided us with personal data, contact us and we will delete it. Some regions impose a higher minimum age (for example 16 in parts of the EU); in those regions you must meet that age or have the consent of a parent or guardian.

9. Security

We protect your data with measures appropriate to its sensitivity:

  • traffic between your device, the website, and our servers is encrypted in transit (HTTPS / TLS),
  • data stored in our database and file storage is encrypted at rest,
  • access to production data is limited to the developer of MakoFit,
  • server-side security rules enforce that only you can read or write your own documents.

No system is perfectly secure. If we become aware of a breach affecting your personal data we will notify you and the relevant authorities as required by law.

10. International transfers

MakoFit is operated from the United Kingdom. Our processors may handle your data in data centres in the United States and other countries. Where data is transferred outside the UK or EEA, we rely on Standard Contractual Clauses and equivalent safeguards.

11. Changes to this policy

We may update this policy from time to time. If the changes are material we will notify you in the app or by email before they take effect. The “Last updated” date at the top of this page always reflects the current version.

12. Contact

Questions, requests, or concerns? Reach out via the contact page and we will get back to you.

© 2026 MakoFit. Available on iPhone and Apple Watch.