Privacy Policy

Version 0.1 · Last updated 2026-06-30

⚠️ Placeholder text. The final Privacy Policy will be drafted by a privacy specialist before public launch. The content below is illustrative only.

1. What we collect

Account data: email, name, date of birth, biological sex (optional), height (optional).
Health and training data: heart rate, HRV, recovery score, sleep, resting heart rate, respiratory rate, power output (watts), cadence, perceived effort, weight.
Activity data: ride routes, durations, distances, GPS coordinates, elevation, weather (via Open-Meteo).
Usage data: sessions, pages viewed, AI chat messages.

2. Why we collect it

To provide the coaching service: build your training plan, adapt it to your recovery, generate workouts, analyse rides, surface readiness signals, and answer your questions about training.

3. Health-data consent

Under GDPR Art. 9, health data requires explicit consent. By creating an account and continuing through signup, you consent to PacePilot processing the health metrics listed above for the sole purpose of providing the coaching service. You can withdraw this consent at any time by deleting your account, which permanently erases the associated data.

4. Sub-processors

Provider	Location	What they see
Supabase	EU (Frankfurt)	All account and training data (database + auth hosting)
Anthropic	United States	Chat messages and training-context summary (used to generate Elena's responses). EU→US transfers covered by Standard Contractual Clauses.
Vercel	EU + global edge	HTTP requests (no data stored)
Strava	United States	Optional integration — only data you explicitly authorise via OAuth
Whoop	United States	Optional integration — only recovery / sleep data you explicitly authorise
intervals.icu	EU	Optional integration — used to sync planned workouts to your head unit

5. AI processing disclosure

When you chat with Elena or trigger an AI-generated coaching recommendation, the messages you send and a summary of your recent training context (recent rides, FTP, planned sessions, recovery score) are sent to Anthropic for processing. Anthropic does not retain or train on this data.

6. Your rights (GDPR)

You have the right to access, correct, export, and delete your data at any time. Account deletion is available in-app via Profile → Danger Zone and permanently removes all personal data that identifies you — your profile, training and health data, rides, chats, and connected-service tokens — with no recovery period.

We may retain anonymized, aggregate usage statistics — for example, that a training plan was generated, completed, or extended, and its duration or focus — after your account is deleted. These records are stripped of any link to your identity and cannot be traced back to you, so under GDPR they are no longer personal data (Recital 26). We keep them only to understand how the service is used in aggregate.

7. Cookies and storage

We use localStorage for caching your data on-device for fast loading, and Supabase auth cookies for keeping you signed in. We do not use tracking or advertising cookies.

8. Children

This service is not directed to anyone under 16. Account creation requires a date of birth ≥ 16 (verified at signup).

If you have any questions, contact contact@pacepilot.cc.