Surge

Privacy

What Surge stores, and what stays on your devices.

Last updated 30 September 2026.

Surge is an AI-native running coach. You ask in the iPhone app and confirm before a workout is saved; the app sends it to Apple Watch. An external AI client can still change the calendar through MCP. This page describes the data that flow actually uses. It is not a substitute for Apple’s privacy labels once the app is on the App Store.

Account

Sign-in is email and password, and Google or Apple when those are configured for the server you use. We store your email, name, a password hash when you use a password, the provider you signed in with, and the session that keeps you signed in. OAuth grants for MCP clients are stored the same way.

From the iPhone Account screen you can download a JSON copy of what Surge stored, and delete the account. The same actions are available as GET /api/account/export and DELETE /api/account. The download leaves out password hashes, session tokens, and OAuth tokens. Deletion removes the user and the workouts, plans, routes, runs, health readings, and coach history stored for it.

Workouts and calendar

Workout definitions, dated sessions, training plans, and Watch sync status live in Postgres (Neon in production). That includes the structured workout (steps, paces, heart-rate targets) and whether the phone has confirmed it on Apple’s scheduler. Postgres is the source of truth; the Watch is a short cache.

Routes and GPX

If you or your agent import a GPX file, we parse it and store the route profile (points, elevation, distance). The file is used to compute pace targets. We do not send the polyline to Apple Watch, and the Watch will not navigate the course.

Health data

HealthKit stays on the iPhone until you grant read access. Sending those runs to Surge is a second, separate choice: the app asks before the first upload and does nothing until you say yes. Decline and every completed run stays on the phone.

When you do turn it on, we upload a minimised activity record — start and end time, duration, distance, average pace, heart-rate summary, cadence, power, whether it was indoors, the recording device name, and per-kilometre splits. We also upload one value per day for resting heart rate, heart-rate variability, body weight, sleep hours and VO2 max, so your coach can plan around how recovered you are.

Detailed traces stay on the phone: we do not upload your heart-rate, cadence, power, ground-contact, oscillation or GPS series, and we never take a full Health export. You can stop the sync at any time from the Account screen.

Surge does not sync in the background. HealthKit background delivery is off, and there is no silent push. Runs and Watch updates move when you open the app.

WorkoutKit permission is separate and only lets Surge schedule compositions into Apple’s Workout app.

Coaching

  • On iOS 27 and later, when Apple Intelligence is available, the coach conversation goes to Apple’s Private Cloud Compute. It carries your request, recent run totals, easy pace, heart-rate zone boundaries, upcoming sessions, and the last few coach messages. Apple processes it under its Private Cloud Compute privacy terms. Surge’s server and the AI gateway do not receive that prompt. Apple sets a daily limit on these requests.
  • When Private Cloud Compute is offline, over its daily limit, or not available, and Apple Intelligence is on, the prompt stays on the phone and the on-device model answers.
  • When neither Apple model can answer, the app sends the request to Surge’s server, which may call the configured AI gateway. The gateway receives your goal, recent run summaries (distance, duration, and pace), and daily metrics such as body mass and sleep. It does not receive GPS tracks, heart-rate series, GPX XML, or your email.
  • Multi-week plans are computed in Surge’s own code from those summaries. The model does not write the workout distances.
  • Coach conversations are stored with your account: the messages you send, the coach’s replies, short notes about which tools it used, and the approval cards. They do not include GPS tracks, heart-rate series, or GPX files. Deleting the account deletes them.
  • The gateway can be configured for Zero Data Retention. That is not guaranteed, and the providers behind the gateway can change.

AI clients

When you connect Claude, Cursor, or another MCP host, that client can create, list, update, schedule, and cancel workouts as you. Tokens are resource-bound. The model never supplies your user id; it comes from the access token. Treat an allowed MCP client like a signed-in copy of the app.

What we do not do

We do not sell personal data. We do not run advertising. We do not share workouts between users. There is no public feed. Analytics and marketing pixels are not part of this site.

Retention

Account and calendar data remain until you delete the account in the app or we shut the service down. Cancelling a session keeps a cancelled row so the phone can remove it from the Watch. Short-lived records used to stop a retried request from creating a workout twice are deleted after 30 days.

Contact

For deletion or access requests, sign in and contact the operator of the Surge instance you use. A production deployment should publish an operator email here before inviting people outside the team.