PaceMap
Privacy Policy
1. Who we are
PaceMap is a running and outdoor-activity tracker. We're the data controller for the personal information described below.
2. What we collect
- Account details you provide: display name, username, email address, password (stored only as a one-way bcrypt hash).
- Activity data you record or upload: GPS waypoints with timestamps and elevation, distance, pace, duration, heart rate (if supplied), activity title and optional description.
- Photos you attach to activities or to your profile.
- Social interactions: kudos, comments, follows, and the resulting in-app notifications.
- Push-notification tokens, if you grant the permission.
- Limited technical metadata (request IPs, user agents) used for security and rate-limiting.
3. How we use it
- To run the service — saving your activities, rendering the feed for you and the followers you allow to see it, and detecting personal records.
- To send transactional emails (verification, password reset) and push notifications you've enabled.
- To prevent abuse: rate-limiting, account-recovery flows, and investigating reports.
We do not sell personal data, share it with advertisers, or use it to profile you across third-party services.
4. Where it's stored
- Account and activity data is held in a PostgreSQL database operated by Railway.
- Photos are stored on Cloudinary.
- Transactional emails are sent via Resend.
- Push notifications are delivered through Expo's push service.
- Authentication tokens live in your device's secure storage (Keychain on iOS, Keystore on Android) and never on our servers in plaintext.
5. Sharing
Personal information is only shared with the processors listed above, and only to the extent needed for them to provide the service. We do not share with any other third parties.
6. Your rights
You can view, edit, or delete your data at any time inside the app via Edit Profile. The Delete Account action removes your account and cascades to your activities, waypoints, kudos, comments, follows, and push tokens immediately.
Under UK GDPR and equivalent legislation you also have the right to a copy of your data, to correct it, to restrict or object to processing, and to lodge a complaint with the Information Commissioner's Office. Email privacy@pacemap.tech for any of these requests.
7. Retention
We keep your data while your account is active. Deletion through the app is immediate and irreversible. Backups containing already-deleted data roll off within 30 days.
8. Cookies and tracking
The mobile app does not use cookies or third-party analytics. Web pages on this domain (such as this one) set no cookies and load no tracking scripts.
9. Children
PaceMap is not intended for use by anyone under 13. We do not knowingly collect personal information from children. If you believe a child has signed up, contact privacy@pacemap.tech and we'll remove the account.
10. Changes to this policy
If we make material changes we'll notify you in the app at least 14 days before they take effect.
11. Contact
Questions about this policy: privacy@pacemap.tech.