Magic TrainingHome
This policy explains how we handle information when you use our platform. We value your privacy and are committed to transparency in how we process your data.
Magic Training collects and stores information necessary to provide our personalized training services. Data is securely stored in PostgreSQL databases managed by Supabase, with encryption in transit and at rest and per-user isolation enforced at the row level.
The platform has monthly challenges with rankings, a weekly league with divisions, XP levels and badges. Everything is computed from the completed activities already in your account; no new data is collected for it.
Rankings exist only among logged-in people and show the minimum needed to compare results:
Opening the challenges or league page places you in this week's group of your division. Anyone who trained during the week and has not opened the page yet is placed the next day. You can leave the leagues at any time on the league page; from then on you are no longer placed in a group, and the XP from your activities keeps counting only toward your level. Challenges are always opt-in: you only appear in the rankings of the ones you chose to join.
At the end of each challenge and each league week we keep a summary (value, position, outcome and XP) for your history and for computing your level and badges. These records are deleted together with the account.
The full rules are at How challenges, the league and levels work.
We publish an overview of amateur running at magic.training/dados, built from workouts logged on the platform. No individual data is disclosed: only percentages, medians and counts describing the group leave the database.
Aggregate figures such as the distribution of workouts by weekday, the share of plans still active in each week, the distance distribution of runs and the median pace by target distance.
This processing relies on the legitimate interest in producing statistical information about training, under art. 7, IX of Brazil's LGPD. Because the result is anonymised and irreversible, it cannot identify you. Even so, if you prefer your records to be left out of these aggregates, write to us and we will exclude your account from the computation.
We use cookies and similar technologies to improve user experience and analyze platform usage. This includes:
You can manage your cookie preferences through your browser settings.
To process premium subscription payments via PIX, we use Efí Bank. During the payment process, we collect and share with Efí Bank:
This data is processed in accordance with Efí Bank's privacy policies and is necessary for the security of PIX transactions.
We use the Resend service for sending transactional emails such as subscription confirmations, account updates, and important communications. We only share your email address and name for message personalization.
We use Google Analytics to analyze the usage of our platform. Google Analytics uses cookies to collect information about how you interact with Magic Training. This information is used to generate reports and help us improve the platform. Google Analytics collects information anonymously, without identifying individual users.
Our platform is hosted on Vercel, which provides performance and usage analytics. Vercel may collect information such as IP addresses, browser type, and pages visited to provide these insights. This information is processed in aggregate and does not identify individual users.
The Magic Training app for iPhone and iPad can read data from Apple Health (HealthKit) to automatically log the workouts you recorded on your Apple Watch. Access is optional, requested explicitly the first time, and can be revoked at any moment.
The app never writes data to Apple Health: the authorization we request is read-only.
With your authorization, the app reads only what it needs to recognize and log the workout in your plan:
Data read from Apple Health is tied to your account and used exclusively to:
In accordance with Apple's HealthKit guidelines and with applicable data protection law, we commit to:
You can revoke Magic Training's access to Apple Health at any time under Settings → Privacy & Security → Health → Magic Training on your iPhone, or turn off automatic import inside the app itself. Revoking access stops any further reads; to delete workouts already logged, use the rights described in the "Your Data Rights" section.
Magic Training has apps for Android and for Wear OS watches. This section describes what those apps collect and send to our servers, in addition to what the other sections of this policy already describe.
On a Wear OS watch, the app uses the permissions you grant to record the workout in progress:
GPS coordinates never leave your device: the watch turns them into distance, pace and altitude, and only those numbers are sent to your account. We do not record or store the route of your workout.
When you finish a workout on the watch or log it on your phone, we send the following to our servers:
To send notifications (today's workout, sync completed, coach alerts), we register a notification identifier generated by Firebase Cloud Messaging, along with your device model and app version. That identifier is tied to your account, used only to deliver notifications, and deleted when you sign out or uninstall the app.
We use Firebase Crashlytics (Google) to receive reports when the app crashes or misbehaves. It collects crash logs, diagnostic information (device model, Android version, memory and app state at the time of the failure) and an installation identifier generated by Firebase. This data is used solely to fix defects. The app uses no advertising ID, shows no ads, and contains no advertising or behavioural analytics SDK.
When you subscribe from the Android app, billing is handled by Google Play. The app receives a purchase identifier and the product code from Google, which we send to our server only to validate the subscription and unlock premium access. Card details never pass through Magic Training.
As on iOS, the health and fitness data collected by the Android and Wear OS apps:
You can revoke the watch permissions under Settings → Apps → Magic Training → Permissions, turn notifications off in the system settings or inside the app, and delete your account and all your data directly in the app, under Profile → Delete account.
Before connecting your Garmin Connect account, you must provide explicit consent for the transfer and processing of your training data. Your data will only be synchronized after your specific authorization.
When you connect your Garmin Connect account to Magic Training, we collect the following types of data:
Data obtained from your Garmin Connect account is used exclusively for:
For detailed information about how Garmin handles your data, please refer to theGarmin Connect Privacy Policy.
When you connect your Garmin Connect account, some of your data may be transferred to Garmin servers located in the United States and other countries. These transfers are protected by standard contractual clauses approved by the European Union and follow international data protection best practices.
You have the following rights regarding data collected from your Garmin account:
To exercise these rights, go to the "Synchronizations" section in your profile or contact us.
This platform uses artificial intelligence systems to process and analyze training data, including data obtained from Garmin devices.
Our AI systems process your training data (including Garmin data) to:
By using our platform and connecting Garmin devices, you explicitly consent to:
You may withdraw this consent at any time through your account settings or by contacting us. Withdrawing consent may affect the functionality of some platform features.
We implement technical and organizational security measures to protect your data:
However, please remember that no method of internet transmission or electronic storage is 100% secure.
In compliance with the LGPD, you have the following rights over your personal data:
To exercise these rights, go to your account settings or contact us.
We retain your personal data only for as long as necessary to fulfill the purposes described in this policy or as required by law. Data from accounts inactive for more than 2 years may be automatically deleted, except when necessary for compliance with legal obligations.
If you have questions about this privacy policy or how we handle your information, contact us at: contato@magic.training