Privacy Policy
Paceva analyses swim, bike and run training. To do that it handles health data: heart rate, heart rate variability, sleep and workouts. This policy says exactly what we collect, why, who else touches it, how long we keep it, and how you delete it. Paceva operates Paceva and is responsible for your data. Contact: privacy@paceva.app.
The short version
- We only import training and health data after you tick a consent box and connect your own watch, Apple Health or files.
- We never sell your data, never use it for advertising, and never give it to anyone to train AI models.
- We don't store GPS routes or locations from your workouts.
- Nothing is shared with anyone unless you choose to: a coach link you create, or an AI app you connect. Health data is left out of shared links unless you tick a box.
- You can download everything we hold, disconnect your device, and delete your data or your whole account from the Account page, at any time.
What we collect
Account. Your name, email address, and a one-way hash of your password (we never see or store the password itself). If you sign in with Google, we receive your name, email and profile picture from Google.
Profile. The sports you train and your goal races (distance, date, goal time). Optionally, if you choose to give them: your date of birth, sex, height and weight. Each optional field has one use, shown where you enter it: age sets heart-rate zones until your watch records a true maximum, weight gives bike power-to-weight, height puts stride length in context, and sex is kept for age-graded comparisons and isn't used in predictions. Leave any blank, or clear it later on the Account page.
Training and health data (only if you connect a source). From whichever you connect: your watch through Intervals.icu (Garmin, Coros, Wahoo, Polar, Suunto, Zwift), Apple Health on your iPhone, .fit files you upload, or Garmin directly through Terra. Each workout's sport, start time, duration, distance, heart rate, pace or speed, cadence, power, stroke counts, pool length and elevation gain, plus the second-by-second streams of those measurements; each night's sleep stages and sleep score; overnight heart rate variability; resting, average and maximum daily heart rate; and, where your watch reports them, Body Battery, stress and readiness scores. This is "consumer health data" and "special category" data under laws such as the GDPR and Washington's My Health My Data Act, and we treat it that way.
Not collected. GPS tracks and locations (discarded on import), body weight, menstrual or reproductive data, contacts, and the passwords for your watch or Intervals.icu accounts (you enter those on their own pages; we never see them). Apple Health's heart rate variability isn't imported, because it's measured differently from the overnight reading Paceva uses.
Security records. IP address and time of sign-ins, failed sign-ins, device connections, exports and deletions; and, if you use the iOS app, a session record with your phone's model (never its name) and when it was last used. These hold no health data.
Cookies. Strictly necessary ones only: your sign-in session, your theme and unit preferences, and short-lived cookies that secure the step where you connect your watch. No analytics, advertising or tracking cookies.
Waitlist. If you join the waitlist without an account, we keep only your email address and where you signed up, to email you once when the dashboard opens. Ask us and we'll delete it; deleting your account deletes it too.
How we use it
- To show you your dashboard: recovery, fitness and fatigue, trends, zones, best efforts, race predictions and race plans.
- To keep the service secure: rate-limiting sign-ins, detecting abuse, and investigating incidents.
- To email you: a weekly summary on Sundays (turn it off in Account or with the link in any of them), one reminder if your watch stops syncing for a week, and messages about your account, security or changes to these terms.
- To keep an honest record of our predictions: each day we save what we predicted for your upcoming races and never edit it afterwards, so a race debrief can compare your result with what we really said beforehand.
We use device data only to provide Paceva to you. We don't combine it with data from other sources about you, build marketing profiles, or share it with anyone for their own purposes.
Automated analysis and AI
Scores, zones and race predictions are calculated by statistical formulas running on our own servers. No generative AI is involved in producing them. Predictions are estimates with an uncertainty range, not medical assessments. See the Terms.
AI is used in two places, and only when you use them. Ask Paceva sends your question, and the parts of your training data needed to answer it, to Anthropic's Claude; we keep a count of the tokens used per day for cost control, never the questions or answers. AI apps you connect (such as Claude or ChatGPT) can read your data after you approve them. Neither is used to train AI models.
Legal basis (EU, UK and similar laws)
- Your account and profile: to perform our contract with you.
- Device and health data: your explicit consent, which you can withdraw any time by disconnecting.
- Security records: our legitimate interest in keeping accounts and data safe.
Who else processes your data
We share data only with these service providers, only so they can run Paceva for us, under contracts that limit them to that:
- Intervals.icu receives your workouts from your watch and passes them to us, read-only, if you connect your watch. Your Intervals.icu account is governed by its own terms and privacy policy; you can revoke Paceva's access there or here.
- Apple: Apple Health data is read on your iPhone by the Paceva app, only the types you allow, and sent to us over HTTPS.
- Terra (Terra Enabling Developers, Inc.), only if you connect Garmin directly, connects to Garmin and delivers your device data to us. Terra processes it under its End User Privacy Policy, which you also agree to when you connect a device.
- Garmin is where the data originates. Garmin's own privacy policy governs your Garmin account.
- Vercel hosts the website and application servers.
- Neon, our database host, stores your account and training data, encrypted at rest.
- Google, only if you choose to sign in with Google.
- Anthropic receives the make and model you type into the race-bike builder, to look up what that bike looks like (answers are stored per bike model, not per person). If you use Ask Paceva, Anthropic also receives your question and the training data needed to answer it. Under Anthropic's API terms it isn't used to train their models.
- Vercel hosts Paceva and counts page visits and load times with Web Analytics and Speed Insights: no cookies, no cross-site tracking, aggregate numbers only.
- Resend delivers our emails (password resets, the weekly summary and the sync reminder). It receives your email address and the message, nothing else.
- AI apps you connect yourself (such as Claude or ChatGPT) receive the training and wellness data they ask for, read-only, only after you approve them, and only your own. They pass it to their AI model under their own privacy terms. Nothing is sent until you connect one, and you can disconnect it from your account page at any time.
Sharing you choose
You can create a private, read-only link to show your training to a coach or friends. Anyone with the link can see it, so share it only with people you trust. By default it shows your training and race ranges; heart rate variability, sleep and resting heart rate are only included if you tick that box. You can turn any link off at any time, and it stops working straight away.
Crews. If you join a crew (only through its invite link, and only after you agree), its other members see your first name, your weekly streak, this week's score as a percentage of your own usual week, and how many badges you've earned. Never your paces, times, routes, workouts or health data. Leaving a crew removes you from it at once.
We don't sell or "share" personal data as those terms are defined in California law, and we don't disclose consumer health data to anyone other than the processors above. We may disclose data if required by valid legal process, and would notify you unless prohibited.
How long we keep it
- Account, profile and device data: until you delete it or your account.
- After you disconnect a source: imported history stays until you delete it (you can choose to delete it as you disconnect), and no new data arrives. The access token for your watch is deleted straight away.
- Prediction records and Ask usage counts: until you delete your account.
- Security records: up to 12 months, with your email removed when you delete your account.
- Database backups: deleted data can persist in encrypted backups for up to 30 days before it is overwritten.
Your rights and controls
From the Account page you can, at any time:
- Download a complete copy of your data as JSON.
- Disconnect your watch or Apple Health, which stops imports and withdraws your consent.
- Delete all imported data, or your entire account.
You can also ask us to correct your data, or exercise any other right you have under the GDPR, UK GDPR, CCPA/CPRA, Washington's My Health My Data Act or other applicable law, by emailing privacy@paceva.app. We respond within 30 days and won't treat you differently for exercising a right. You can complain to your local data protection authority.
Security
Data is encrypted in transit (HTTPS everywhere) and at rest. Passwords are hashed with bcrypt. Access tokens for connected services are encrypted with AES-256. Connections are tied to the browser that started them, and one watch account can belong to only one Paceva account, so nobody can connect their account to yours, or yours to theirs. Notifications from connected services are only treated as a prompt: we then fetch your data ourselves with your own access, so nobody can slip fake workouts in. Sign-in attempts are rate-limited and every query is restricted to the signed-in user's own data. See Security for how to report a vulnerability.
If a breach affects your data, we'll notify you and the relevant regulators without unreasonable delay and within the time limits the law sets, including the US Federal Trade Commission's Health Breach Notification Rule.
Age
Paceva is for people aged 13 and over, or older where local law sets a higher age for agreeing to how data is used (up to 16 in some EU countries). We don't knowingly collect data from anyone younger; if you believe we have, email privacy@paceva.app and we'll delete it.
International transfers
Our providers may process data in the United States. Where the law requires it, transfers rely on safeguards such as the European Commission's Standard Contractual Clauses.
Changes
If we change this policy materially we'll update the version above and ask you to accept it again before you continue using Paceva.