Legal · as of October 2026

Privacy Policy

Your health data is the most sensitive thing you entrust to us. Here is what we collect, why, who is involved and what is guaranteed not to happen.

This is a convenience translation. The German version is legally binding.

Never sold

Your data is never sold to third parties.

No ad tracking

No advertising cookies, no third-party analytics, neither in the app nor on the website.

Only for your training

Health data is processed exclusively for the training features you use and actively connect.

1. Controller

Daniel Schwarz
Mauritiusstraße 190
50226 Frechen
Germany
Email: hello@paceos.run

This privacy policy applies to the website paceos.run and the paceos app for iOS and watchOS.

2. Collection and storage of personal data

2.1 When you visit this website

When you open our website, your browser automatically sends information to the server of our hosting provider Vercel, which is stored temporarily in server log files: IP address, date and time of access, name and URL of the file requested, browser and operating system, and referrer URL. This is processed on the basis of Art. 6(1)(f) GDPR; our legitimate interest is ensuring technical operation. The website sets no cookies and uses no analytics or advertising services.

2.2 When you use the paceos app

The app processes the following data, which you provide voluntarily or which arises from your use:

  • Account data: email address, user ID, optionally your name
  • Profile data: age, weight, training goals, run days, threshold pace, preferences and settings
  • Training and health data from connected sources (only after explicit permission): workouts, distance, duration, pace, heart rate, training load, HRV, resting heart rate, sleep, breathing rate, SpO₂, VO2 max, readiness and similar values
  • Coach chat content, training plans, decisions, race goals, your feedback after sessions
  • Subscription status and, if you enter one, a partner code
  • Technical metadata (iOS version, device type) for troubleshooting, and support communication

The legal basis is Art. 6(1)(b) GDPR (performance of a contract) and, for health data, Art. 9(2)(a) GDPR (explicit consent). Connecting Apple Health, Garmin, COROS, Polar, Wahoo, Zepp or Strava is voluntary and can be disconnected in the app or at the respective provider at any time.

3. Purpose of processing

We process your data exclusively to provide the dashboard, readiness, the daily training decision, coach insights, training planning, workout analysis, watch synchronisation, reminders, Crew and Duel features, support and subscription features, and to develop the app technically. Health and training data is not sold and not used for third-party advertising.

4. Service providers and recipients

Your personal data is not sold. It is only disclosed to the following service providers, to the extent necessary for the respective feature:

  • Supabase (Supabase Inc., USA): backend, authentication and database. Your data, including health and training data, is stored there encrypted. Supabase is certified under the EU-US Data Privacy Framework. Supabase privacy policy
  • OpenAI (OpenAI, L.L.C., USA): AI-powered coach features (chat, explanations, weekly review). The training and recovery values and chat content needed for the respective answer are transmitted via our own servers, pseudonymised and without your name or direct identifiers. OpenAI does not use API data to train its models. OpenAI privacy policy
  • RevenueCat (RevenueCat, Inc., USA): subscription status and purchase processing. A partner code you enter is transmitted so that partners can be paid for completed subscriptions; the partner only learns the number of subscriptions, never your name.
  • Apple: in-app purchases and subscription management via your Apple ID. Apple Health data is read only after your permission and then processed like other training data.
  • stridee (sync service for Garmin, COROS, Polar, Wahoo and Zepp): if you pair one of these watches, activities and health data are transferred to paceos via stridee and workouts are sent to your watch. You set up the connection yourself and can disconnect it at any time.
  • Strava (Strava Inc., USA): optional, only after connecting. Activity data is retrieved. Strava privacy policy
  • Vercel (Vercel Inc., USA): hosting of this website.

Depending on the service provider, processing may take place outside the EU/EEA. In such cases we rely on appropriate safeguards, such as the EU-US Data Privacy Framework or standard contractual clauses.

5. Crew and Duel (sharing with friends)

Crew and Duel are optional features. They are only active once you explicitly switch sharing on (Art. 9(2)(a) GDPR). Friendships are created only through an invitation code that you pass on or receive; there is no search and no public profile. Connected people see your name, profile picture and totals per week or month: running kilometres, elevation, number of sessions, plan completion rate and consecutive training weeks, and in the feed per session the sport, start time, distance, duration, elevation and pace. Routes, GPS data, heart rate, sleep or recovery data are never shared. You can switch sharing off or remove individual connections at any time.

Comments and emoji reactions on a shared session are visible to everyone who sees that session in the feed, meaning the crew of the person the session belongs to, with first name and profile picture also shown to people who are not connected to each other. In a duel, participants see a shared timeline with messages, cheers and automatic entries about runs and the current standing. Posts can be reported, your own posts deleted (comments on your own session also as its owner) and people blocked; blocking removes the connection, prevents new invitations and hides posts in both directions. Reports store the reporting person, the reported content and the reason and are reviewed by us. When an account is deleted, comments, posts and reactions are removed with it.

6. Storage period and deletion

We store your data only as long as necessary for the stated purposes or as required by statutory retention periods. You can delete your account directly in the app. After deletion, all personal data is completely deleted within 30 days unless statutory retention obligations prevent this.

7. Your rights

You have the following rights regarding your personal data: access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18), data portability (Art. 20) and objection (Art. 21). You can withdraw consent at any time with effect for the future. To exercise your rights, contact hello@paceos.run.

You also have the right to lodge a complaint with a data protection supervisory authority. The competent authority for North Rhine-Westphalia is the State Commissioner for Data Protection and Freedom of Information (LDI NRW): www.ldi.nrw.de.

8. Data security

All data transfers are encrypted via HTTPS/TLS. Data in the database is stored encrypted. AI requests are processed exclusively server-side via our own Edge Functions; the API key is never stored in the app. Absolute security cannot be guaranteed for internet-based services.

9. Not a medical device

paceos is a fitness and training app and not a medical device. Health data is not used for diagnosis or medical treatment.

10. Changes to this privacy policy

We update this privacy policy when features, service providers or legal requirements change. The current version is available on this page and in the app.