Privacy notice

In short

• Sign-in with passkeys only: no email address, no password.
• We store only what your account, goals, runs and groups need. No tracking, no advertising, no selling of data, no externally loaded fonts.
• We store your heart rate only if you explicitly consent. You can withdraw at any time; we then delete all heart-rate values.
• You can download your data at any time and delete your account instantly.

Controller

Maximilian Auer, Vienna, Austria · contact@maximilianauer.at. Legal notice and the general privacy policy: maximilianauer.at/legal.

What we store

• Account: a random account ID, name (any name or nickname), language, and when the account was created, the notice confirmed and last used.
• Training setup from the welcome flow: your starting point (e.g. “30 easy minutes work”), runs per week and whether you do strength training.
• Passkey: your passkey's ID, its public key, a signature counter, the transport type and timestamps. Your private key and biometric data (Face ID, Touch ID) never leave your device.
• Sign-in: only a checksum (SHA-256) of the session token and its expiry; during sign-in a one-time challenge for 5 minutes.
• Goals: race, date, distance, target time.
• Runs: time, type (Run 1/2/3, test), distance, duration, effort 1–10, walk breaks, your notes, source (e.g. file or Strava) and the activity ID at the provider. We do not store GPS tracks: imports only calculate distance and duration.
• Heart rate (only with consent): average and maximum heart rate per run.
• Groups: group name, invite code, membership and role.
• Connections to other services: access tokens (encrypted with AES-256), your user ID at the service, time of the last sync.
• API tokens: label and only a checksum of the token.

Purpose and legal basis

• Account, goals, runs, plan, groups and imports: providing the service you use (Art. 6(1)(b) GDPR).
• Heart rate: your explicit consent (Art. 9(2)(a) GDPR). Voluntary; everything else works the same without it. Withdraw at any time in Settings, with effect for the future (Art. 7(3) GDPR).
• Abuse protection such as limiting sign-in attempts: legitimate interest in secure operation (Art. 6(1)(f) GDPR). IP addresses are only counted briefly in memory and never stored.

What others in your groups see

Group members see your name and the date, type, distance, duration and pace of your runs, plus figures calculated from them. They do not see your notes, heart rate, goals or training setup. Runs imported from Strava are visible to you only. When you leave a group, its members no longer see your runs.

Connections to Strava, Polar, Fitbit, Wahoo and Suunto

A connection is only created when you start it and approve it at the service. Pacepact then reads your running activities and never posts anything back. The service's own privacy policy applies to the data it holds. “Disconnect” deletes the stored access tokens immediately; runs already imported stay until you delete them. You can also revoke access in the service's settings.

Cookies

Only strictly necessary cookies, no analytics or advertising cookies: pp_session (sign-in, 30 days), pp_locale (your language choice, 1 year), pp_challenge (only during sign-in, 5 minutes) and pp_oauth (only while you connect a service, 10 minutes). In your browser's storage we only remember when you choose “Not now” for installing the app, so we do not ask again for 30 days. Passkeys are managed by your operating system (e.g. iCloud Keychain); the provider's terms apply.

Recipients and storage location

Hosting and database: Cloudflare, Inc. (Cloudflare Workers and D1) as processor under its data processing addendum. Location: EU (jurisdiction “EU”). Any access from the US is covered by the EU-US Data Privacy Framework or standard contractual clauses. When you load the site, the host processes technically necessary connection data (see the general privacy policy). We do not share data with anyone else, except the services you connect yourself.

Retention

• Until you delete runs or your account. Deletion is immediate and final; the host's technical restore points expire after 30 days at the latest.
• Accounts unused for 2 years are deleted automatically.
• Sign-ins expire after 30 days.
• Heart-rate values are deleted immediately when you withdraw consent.

Age and health

Pacepact is for people aged 14 and over. The training plan is general guidance, not medical advice, and not an automated decision about you.

Your rights

Access, rectification, erasure, restriction, portability, objection and withdrawal of consent. Access and portability: “Download my data” in Settings. Erasure: “Delete account and all data”. For anything else, write to contact@maximilianauer.at. You can also complain to the Austrian Data Protection Authority (dsb.gv.at).