Privacy Policy

Introduction

Paced ("we", "our", "us") operates the Paced platform — a cycling training app where you log your rides, track your fitness, follow a training plan, and view personalised stats and coaching insights. Paced offers a free tier and optional paid subscriptions (see our Terms of Service).

This policy explains what personal data we collect, why, how we use it, who we share it with, and your rights under the UK GDPR, the EU GDPR, and other applicable data protection law. For the purposes of that law, Paced is the data controller of your personal data.

By creating a Paced account and using the platform, you agree to the collection and use of information as described in this policy. If you do not agree, please do not use the platform.

Who we are

Paced is an independent product built and operated by a sole developer, available at ridepaced.com. You can review, edit, export the substance of, and permanently delete your account and associated data at any time from your account settings within the app. For any question about this policy or your data, send us a message through our contact form.

Visitors to our website

We do not run advertising networks, marketing trackers, analytics platforms, or cross-site tracking on our marketing website. If you browse the site without signing up, we do not build a profile of you.

We do count page views in aggregate: when a page (on this website, in the signup flow, or inside the app) is opened, a per-day counter for that page goes up by one. Nothing is attached to that count — no identifier, no IP address, no cookie, no device information — so it can never describe you, only how many. We use these totals solely to understand which pages are useful and where new riders lose interest.

On one page — the campaign page for Peloton owners at ridepaced.com/peloton — we also measure, in aggregate, how the page is used, because a count of visits cannot tell us whether someone read it and decided against it or never reached the part that would have explained it. While you are on that page, your browser keeps a running tally of steps from a fixed vocabulary: which sections came into view and how long they were on screen, how far down you scrolled, which buttons you pressed, which fields you went into, which rule stopped a form if one did, and how far through the steps you got. Choices you make by tapping — a ride length, which number your bike showed, how hard a ride felt — are counted as choices. Nothing you type is ever part of it: not your ride’s numbers, not your email address, not your password. The most it records about a field is that you went into it, whether you gave a heart rate or ticked that you had no monitor, and whether the result we showed you had a figure on it or a dash. The tally is held in the page’s memory and nowhere else — nothing is written to your device for this, no cookie and no browser storage — so it is gone the moment the page is.

A couple of seconds after you arrive, at intervals while you stay, and when you leave, your browser sends us the change in that tally since it last reported — in effect “add one to this counter, take one off that one” — together with a few coarse facts about the visit: one word for the kind of screen (phone, tablet or computer, worked out from the width of the window) and whether the window is short or tall; one word for the kind of browser, such as “Safari” or “inside another app”, worked out in your own browser so that the full browser string never leaves it; the name of the site that linked you to us, from a short fixed list such as “Reddit” or “Google”; any campaign label in the link you followed, and whether that link came from an advert (we note that it did, and never read the click identifier itself); whether you arrived fresh or by reloading; the hour and day of the week on your own clock; and whether your device asks for reduced motion. Our hosting provider tells us which country the request came from; we never receive, process or store your IP address in order to work that out, and we record nothing more precise.

Nothing in a report identifies you — no account, no cookie, no session or visit id, no IP address, no browser or user-agent string, no precise screen size, no click identifier — because none is ever created or sent. A report does not even say which earlier reports came from the same visit. We add its numbers to that day’s counters (each step, each step-to-step move, each whole sequence of steps, the time spent, and what the visit amounted to, in total and for each of the coarse facts above) and discard it. No record of your individual visit is kept, which means there is nothing afterwards that could be linked to you, matched against another visit, or followed onto another website. Two people who used the page the same way are indistinguishable to us by design.

If your browser sends a “Do Not Track” or “Global Privacy Control” signal, none of this runs, and neither does the page counting above.

Our lawful basis is our legitimate interest in understanding whether our own pages explain the product, balanced against a negligible privacy impact: the measurement is first-party, aggregate-only, never shared, never used to build a profile or make any decision about an individual, and holds nothing that identifies anyone. You can read exactly what is stored on your device, and why there is no consent banner, in our Cookies Policy.

Our public pages do load web fonts from a third-party content delivery network (Google Fonts). When your browser fetches those assets, your IP address is necessarily visible to that provider as part of delivering the file. We do not send them any account or ride data, and we do not use these requests to identify or track you.

Data we collect

We collect the following categories of data, most of it only because you choose to enter it:

1. Account & profile data

• Identity: the name and email address you provide at sign-up, and your authentication credentials (managed and encrypted by Firebase Authentication — we never see your password). If you sign up or log in with Google instead, we receive from Google only your name and email address, and we never see your Google password.
• Preferences & settings: distance units, display mode, theme, notification preferences, onboarding progress, and the timestamp at which you accepted our Terms.
• Cycling profile: details you add to personalise your training — such as your bikes, cycling goals, and functional threshold power (FTP) and its history.

2. Ride & training data

When you log a ride or build your training, we store what you enter and the figures we calculate from it, which may include: distance, duration, elevation, route name, ride type, date, notes, cadence, and — where you provide them — power (including average/normalised power, training-stress and intensity figures) and heart rate. From this we compute personal statistics, records, power curves, training zones, training load, and fitness/fatigue/form trends (CTL · ATL · TSB) and related estimates.

3. Fitness & health-related data

If you choose to use the relevant features, you may enter health-related measurements such as body weight, body-fat percentage, resting heart rate, and maximum heart rate, and your rides may include heart-rate data. If you use the injuries feature, we also store the injury and soreness entries you log — the body area, side, severity, dates, your notes, and your check-in responses — solely to power the injury-awareness features you are using (such as adjusting training guidance while an issue is active). Under data protection law some of this may qualify as a special category (health) data. We process it only with your explicit consent, given when you choose to enter it, and solely to power the training features you are using. You can withdraw that consent at any time by deleting the data or your account. We never use this data for advertising and never sell it.

Life check-ins — the sleep, energy, stress, soreness, notes and tags you could log on the Life page from 23 August to 5 October 2026 — were retired on 21 October 2026. Paced no longer collects or uses them, and the ones stored will be deleted on 20 November 2026. Until then you can download them from Settings.

4. Community & social data

Paced includes optional communities, challenges, and badges. If you join or create a community, information you contribute — such as your display name and the ride/training statistics and activity you choose to share within that community — is visible to other members of that community. This sharing happens only because you choose to take part; if you don't join a community, none of your data is shown to other users.

5. Billing & subscription data

If you buy a paid subscription, payment is handled by our payment processor, Stripe. Stripe collects and processes your payment details (such as card information) directly — Paced never receives or stores your full card number. We store the subscription information we need to give you access: your tier, subscription status, trial and renewal dates, cancellation state, and the customer/subscription identifiers Stripe returns to us.

6. Referral data

If you use our referral programme, we store your referral code, which accounts were attributed to your referrals, and the status of any rewards earned or redeemed.

7. Connected services (optional)

If you choose to connect a third-party service such as Strava, we receive the profile details and activities you authorise it to share (including private activities, where you grant that permission) and import them as rides on your account, along with the secure connection tokens needed to keep the link alive. You can disconnect at any time in Settings — this revokes Paced's access on the provider's side and deletes our copy of the tokens; rides already imported remain yours in Paced. Deleting your account also revokes and deletes the connection. The provider processes your data under its own privacy policy.

If you choose to connect Whoop, we receive your name (to label the connection), your Whoop member number (so that Whoop can tell us when your data has changed), and the daily summaries you authorise there: recovery (recovery score, heart-rate variability, resting heart rate, blood oxygen and skin temperature), sleep (time asleep and in bed, sleep stages, performance, efficiency, consistency, breathing rate and naps), day strain, and workouts (the sport, strain, heart rate, time in heart-rate zones, energy, distance and climb). Whoop does not give us a continuous heart-rate recording, and we do not ask it for your body measurements. We keep one record per day, along with the secure connection tokens needed to keep the link alive.

This is health data. We process it only with your explicit consent, which you give by connecting, and only to show it to you and to power the readiness, Life and coaching features you use. It stays on Paced's own systems: it is not sent to any external AI provider, it is never used for advertising, and it is never sold. You can withdraw that consent at any time in Settings. Disconnecting revokes Paced's access on Whoop's side and deletes our copy of the tokens; you choose, there and then, whether the days already imported stay on your account or are deleted with the connection, and you can delete them later from the same place. They are included in your data export, and deleting your account revokes the connection and deletes all of it. Separately, and only if you switch it on in Settings, Paced copies a few readings from a Whoop workout into the ride it belongs to — its start time, duration, average and maximum heart rate, time in heart-rate zones and energy, and your recovery score that morning. Those copies become part of that ride: they stay with it if you later disconnect Whoop or delete the imported days, and you can take them back out, one ride or all of them, from the same Settings page. Whoop processes your data under its own privacy policy.

8. Blood test results (optional)

If you choose to use the Blood page, we store the blood test results you add: each result's value, the unit it was entered in, where your lab printed one the lab's own reference range, and for a CRP result which kind of CRP test it was (high-sensitivity or standard) where your report or you say; the date the blood was taken and, if you give them, the time, the lab's name, whether you had fasted, whether you had a hard gym session in the 7 days before the test, whether you were ill or injured in the week before it, and a short note; and whether the test was typed in or read from a PDF or a picture of the results. We also store the settings you choose for the page (how strict the ranges are, whose ranges they are, and which units), your answer in Settings to whether you do strength training most weeks, the date you have booked your next test for if you add one, and when you gave your consent.

You can type results in, or choose your lab's PDF report, or screenshots or photos of your results. A PDF or a picture is read on your own device, to fill the results in for you to check: the file itself is never uploaded to us, never stored and never sent anywhere. To read a picture, your device first downloads an open-source text-recognition engine from our own servers — no one else's — and sends nothing with the request. Only the results you check and save reach our servers.

Blood test results are special category (health) data. We process them only with your explicit consent, which you give by ticking the consent box the first time you save a test, and only to show them to you, to read them against reference ranges, and to set them beside the rest of your data on your account. To read your results, Paced uses:

• your sex as you set it, or whose ranges you chose on the page, and your date of birth, for your age on the day of the test;
• your rides: how much you rode in the weeks before the test, how hard, and when;
• your answer in Settings to whether you do strength training most weeks, and your answers on the test to whether you had a hard gym session in the 7 days before it and whether you were ill or injured in the week before it;
• the weights you have logged;
• what you take, if you use the Stack section (see section 9);
• if you have connected Whoop: your sleep, recovery, day strain and workouts, including gym sessions, and the signals your strap recorded overnight (heart-rate variability, resting heart rate, breathing rate, blood oxygen and skin temperature), which together can suggest you were unwell;
• and, from the test itself, the lab's own reference range where it printed one, and for a CRP result which kind of test it was.

For example, Paced uses these to note that a hard ride or gym session before a test can raise some results, to set the iron target for someone who rides a lot, to say a high CRP may come from being ill, to look for signs of eating too little for your training, or to estimate a "blood age" from nine of your results and your age on the day of the test. All of this is read on your device each time you open the page, and what Paced works out from it is not stored. Everything Paced says about them is worked out by Paced's own code: they are not sent to any external AI provider, never shared with other users, never used for advertising and never sold. They are not shown in the support view described below, even when we look at your account to help you.

You can delete a single test, or all of your blood data together with your consent, at any time on the Blood page. Your tests are included in your data export, and deleting your account deletes them.

9. What you take (optional)

If you choose to use the Stack section of the Life page, we store what you add to it: the name of each supplement, medicine, hormone or other substance and what kind it is, and — if you give them — its brand and form, its ingredients and the amount of each in a serving, the dose and its unit, how many servings a day, how often you take it (every day, on set days, or in on-and-off cycles), the time of day, whether with food and when around training, how you take it, the days you started and stopped and the history of any change of dose, how consistently you take it or the days or weeks you tick off as taken, what you take it for (a goal from a list and, if you add them, your own words), what it costs you a month, whether it is tested for sport, a short note and, for something you add yourself, which blood results you say it can affect. We also store when you gave your consent. If you choose to read a label from a photo, the photo is read on your device and is not uploaded or stored: only the ingredients you check and save are.

What you take can reveal things about your health, so we treat it as special category (health) data. We process it only with your explicit consent, which you give by ticking the consent box the first time you add something, and only to show it to you and to set it beside your blood test results and your recovery — for example, to note that creatine can raise your creatinine, to mark the days you started and stopped something on the chart of a result it can move, to say what to pause before a test, to add up each nutrient across your products against its safe upper limit, and to compare your results and your Whoop recovery before and after you started something. These are worked out on your device and are not stored. As with your blood test results, it is not sent to any external AI provider, never shared with other users, never used for advertising and never sold, and it is not shown in the support view described below.

You can delete one thing, or all of it together with your consent, at any time in the Stack section. It is included in your data export, and deleting your account deletes it.

10. Technical, usage & security data

• Request data: IP address (used transiently for rate limiting, security, and abuse prevention — not retained as part of your profile), plus browser and device type.
• Country: when you open the app we record which country the request came from, and store that two-letter country code on your account. Our hosting provider determines it at the network edge and passes us only the country — we never receive, process or store your IP address in order to work it out, and we do not record anything more precise: no region, no city, no postcode, no coordinates. We use it for one thing: to know which countries Paced is used in, so we can prioritise units, languages, currencies and support hours. It is never used for advertising, never shared, and it is deleted with the rest of your account.
• Usage data: to understand whether Paced is genuinely useful and keep improving it, we record when your account uses the app — a count of app opens, when you were last active, and which days you used it (we keep at most your 400 most recent active days). From this we derive simple activity summaries (for example whether an account is regularly active, occasional, or inactive, and an activity calendar), which the operator can see for support, service-statistics and product decisions — never for advertising, and never shared with anyone else. Aggregate business figures (such as total revenue per day) are also snapshotted over time; these contain no personal data.
• Security logs: limited access and event logs kept for a short period to protect the service.
• Device tokens: if you enable notifications, the push token needed to deliver them.

How we use your data

• To provide the service: store your rides, calculate your stats and records, run your training plan, and show your dashboard.
• To generate Paced AI and coaching insights — personalised reads, daily focus, ride breakdowns and projections derived from your own training data (see Paced AI and automated insights).
• To manage your account, subscription, trials, renewals, and referral rewards.
• To operate optional community features you choose to join.
• To keep the service secure, prevent abuse, and diagnose errors.
• To show your blood test results and read them beside your training, if you choose to add them (see Blood test results).
• To show what you take beside your blood test results, if you choose to add it (see What you take).
• To provide customer support and investigate problems: authorised personnel (currently the operator) can access your account data — except blood test results and what you take, which the support view does not show — including through an audited in-app support view that shows the service exactly as you see it. Every such access is recorded in an audit log, is used only for support, troubleshooting, security and service-quality purposes, and does not alter your data, one-time prompts, engagement records or earned rewards.
• To send you service and (if enabled) coaching notifications.
• To comply with our legal and regulatory obligations.

Paced AI and automated insights

Paced generates personalised training insights and coaching from the data on your own account. These insights are computed from your numbers to help you understand your training — they are informational only, are not medical, professional, or safety-critical advice, and no specific outcome is guaranteed. Paced does not carry out automated decision-making that produces legal or similarly significant effects about you within the meaning of Article 22 of the GDPR.

Today these insights are generated by Paced's own coaching engine, running on our servers — your data is not sent to any external AI provider. If we ever introduce one to help power these features, it will be listed on our Subprocessors page (with at least 30 days' advance notice) before any data flows to it, it will be governed by this policy, and your health-related data will only ever be used to serve features you have chosen to use.

Legal bases for processing

How we share your data

We do not sell your personal data and we do not share it for advertising. We share data only with the following parties, and only as needed to run the service:

• Google Firebase / Google Cloud: authentication, database (Cloud Firestore), and related infrastructure. Processes your account, profile, ride, fitness, blood test, what-you-take, community, and referral data on our behalf.
• Google sign-in (only if you use it): when you choose “Continue with Google”, Google confirms who you are and tells us your name and email address, and learns that you use Paced. We send Google nothing about your rides or your account. For this, Google acts as an independent controller under its own privacy policy. Signing in this way is optional: an email address and password works just as well.
• Vercel: hosting and serverless compute. Processes request data on our behalf.
• Stripe: payment processing and subscription management for paid plans. Processes your billing data as an independent controller/processor under its own terms.
• Strava (only if you connect it): when you choose to link your Strava account, we request the profile and activity data you authorise there, and Strava learns that you use Paced. Strava acts as an independent controller under its own privacy policy; disconnecting (or deleting your account) revokes Paced's access.
• Whoop (only if you connect it): when you choose to link your Whoop account, we request the recovery, sleep, strain and workout summaries you authorise there, and Whoop learns that you use Paced. We send Whoop nothing about your rides or your account. Whoop acts as an independent controller under its own privacy policy; disconnecting (or deleting your account) revokes Paced's access.
• Other members of a community you join: for the display name and activity you choose to share there.
• Legal authorities: where required by law, court order, or to protect the rights, property, or safety of Paced, our users, or others.
• A successor: if Paced is involved in a merger, acquisition, or sale of assets, your data may transfer to the successor under the protections of this policy.

A full, current list of our subprocessors is on our Subprocessors page.

International data transfers

Our subprocessors (Google, Vercel, Stripe) may process data outside your country, including in the United States. Where they do, they rely on the UK/EU Standard Contractual Clauses, the UK International Data Transfer Addendum, or other recognised transfer mechanisms and applicable data-processing agreements, designed to give your data an adequate level of protection wherever it is processed.

Data retention

Your rights

Depending on where you live, you may have the following rights over your personal data:

• Access: request a copy of the personal data we hold about you.
• Rectification: correct inaccurate or incomplete data.
• Erasure: delete your data, subject to legal retention obligations.
• Restriction: limit how we process your data in certain circumstances.
• Portability: receive your data in a structured, machine-readable format.
• Objection: object to processing based on legitimate interests.
• Withdraw consent: where we rely on consent (including for health-related and community data), withdraw it at any time without affecting prior processing.

You can exercise most of these rights directly in the app: edit your profile in settings, add/edit/remove rides and measurements from your dashboard, manage your subscription through the billing portal, and permanently delete your account and all associated data at any time. Deleting your account erases your data from our active systems within 30 days, subject to the retention periods above. You also have the right to complain to your local data protection authority (in the UK, the Information Commissioner's Office).

Cookies and local storage

We use only a minimal set of strictly necessary cookies and browser storage — to keep you signed in, secure the service, and remember basic preferences such as your theme and units. We do not use advertising, marketing, or third-party tracking cookies. See our Cookie Policy for details.

Security

We implement technical and organisational measures to protect your data, including HTTPS/TLS encryption in transit, encryption at rest by Google Cloud, Firebase Authentication, account-scoped data isolation, and server-side verification of every request. See our Security & Trust page for details.

No transmission or storage system is ever completely secure. While we take reasonable steps to protect your data, we cannot guarantee absolute security.

Age and children's privacy

Paced is intended for adults and is not directed at children. You must be at least 18 years old to create an account. We do not knowingly collect personal data from anyone under 18; if we learn that we have, we will delete it.

Changes to this policy

We may update this policy from time to time. When we make material changes, we will update the "Last updated" date and, where appropriate, notify you in the app. Continued use of the platform after changes take effect constitutes acceptance of the revised policy.

Contact

You can manage and permanently delete your data at any time from your account settings. To make a data request or ask about this policy, send us a message through our contact form.