Your privacy is our priority. Calcpace is a tool built by runners, for runners — we collect only what is strictly necessary to provide the service, and we never sell your data to anyone.

Who We Are

Calcpace is an independent project providing free running performance calculators, including pace calculation, race prediction, VO2max estimation, and performance by age. You can reach us at contact@calcpace.app for any privacy-related questions.

Who Controls Your Data

Calcpace is operated as an independent project by its maintainer, who is the data controller for everything described in this policy (controlador, LGPD art. 5, VI; controller, GDPR art. 4(7)). Every request in this policy — access, correction, deletion, portability, withdrawal of consent — goes to contact@calcpace.app, and we will provide our full legal identification and postal address on request.

Data Protection Officer

Calcpace has no separate privacy department. The maintainer performs the role of data protection officer (encarregado, LGPD art. 41) and answers privacy requests personally at contact@calcpace.app. We reply within 30 days.

What Data We Collect

We collect different data depending on how you use the site: (1) Visitors without an account — the calculators and guides run in your browser, and we store nothing about you beyond the ordinary server logs every website keeps. (2) Registered users — your email address and your password (stored only as a hash); the profile you fill in (first and last name, username, bio, city, country, date of birth, sex, maximum heart rate, language and unit preference, and a photo if you upload one); the activities you log or import (date, name, distance, duration, pace, elevation, temperature, altitude, place, average and peak heart rate, and the GPS route when you upload a GPX file or connect Strava); your active sessions (IP address, browser, date); and the record of the consents you gave. Heart rate, VO2max, date of birth and sex are health data and are stored only if you consent — see "Health data" below.

Health Data (Sensitive Data)

If you use the training features, Calcpace stores health data about you: your average and peak heart rate for each run, your maximum heart rate, your date of birth and your sex. From these we estimate VO2max, heart-rate zones and age-graded results. This is sensitive personal data under LGPD art. 11 and a special category of personal data under GDPR art. 9, and our only legal basis for it is your explicit consent — asked for separately when you set up your profile, never bundled with anything else, and recorded with its date, its version and the language you read it in. You can withdraw it at any time from your profile settings. When you do, we permanently delete every heart-rate and VO2max value we hold and stop calculating new ones, while the rest of your runs — distance, time, pace, elevation and map — stays exactly as it was. Calcpace keeps working without the physiological estimates.

Location and GPS Data

Your profile can hold a city and a country that you type in yourself. When you upload a GPX file or import a run from Strava, we also store the route — the individual track points with their latitude and longitude, and the encoded map line. A route usually starts and ends where you started and ended your run, which for most people is their home. Your activities and their maps are visible only to you unless you make your profile public and the activity public, in which case the map, including its starting point, becomes visible to anyone with the link. You can delete an activity, remove its GPX file, or make your profile private again at any time.

Legal Basis for Each Purpose

We process each category of data for a specific purpose and on a specific legal basis: running your account (email address, password, sessions) — performance of the contract you enter into by accepting the Terms (LGPD art. 7, V; GDPR art. 6(1)(b)); storing and displaying the activities you log — the same contract; health data, meaning heart rate, VO2max, date of birth and sex — your explicit consent and nothing else (LGPD art. 11, I; GDPR art. 9(2)(a)); importing activities from Strava — your explicit consent, given when you connect the account; keeping the service secure and available, including abuse prevention — our legitimate interest (LGPD art. 7, IX; GDPR art. 6(1)(f)); responding to legal orders — compliance with a legal obligation.

How We Use Your Data

Your email address is used exclusively for account authentication, password reset, and transactional notices about your account. We never send marketing email. Your activity data is used to compute and display your own performance history. Your activities are visible only to you unless you make your profile public and mark an activity as public — see "Location and GPS data".

Strava Integration

If you connect Strava, we request the `activity:read_all` scope — which includes your private activities — and import your runs: date, name, distance, duration, elevation, city and country, the summary line of the route, and your average and peak heart rate when your device recorded them. Heart rate imported from Strava is health data and follows the consent described above. Strava access tokens are stored encrypted and are never shared or exported. Disconnecting Strava — from your account page or from Strava itself — revokes our access and permanently deletes every activity we imported from it, together with its heart-rate and VO2max values. Activities you logged by hand are not touched.

Cookies

Calcpace uses a minimal number of cookies and sets no tracking or profiling cookie. A signed session cookie identifies you after you log in and lasts until you log out or revoke that session from your account page. Your unit preference (km/mi) and temperature preference are kept in that same session cookie — not in your browser's local storage. Nothing else is stored on your device by Calcpace.

Advertising

Calcpace does not currently serve ads. No advertising script, no advertising cookie and no consent management platform is loaded on any page — public or logged-in. The layout reserves space for ads on the public calculators and guides, but that space is empty. If we ever switch advertising on, we will update this policy first and ask for your consent before any ad or ad cookie loads, and the logged-in area will stay ad-free and tracker-free.

Who Processes Data For Us

We rely on a small set of providers, each acting only on our instructions: DigitalOcean (application hosting and the PostgreSQL database), Cloudflare (R2 object storage for photos and GPX files, and Turnstile, which receives your IP address on the sign-up page to tell humans from bots), Resend (transactional email — verification, password reset, account notices), AppSignal (application performance monitoring, which processes request metadata including IP addresses), and Strava (only if you choose to connect it). Each provider operates under its own privacy policy and a contract that limits it to processing data on our behalf.

California Privacy Rights

We do not sell or share personal information as those terms are defined by the California Consumer Privacy Act, and we do not process it for cross-context behavioural advertising. If you are a California resident, the rights listed above — to know, to access, to correct, to delete, and not to be discriminated against for exercising them — apply to you as well. Write to contact@calcpace.app to exercise any of them.

Children

Calcpace is not intended for children under 13, and we do not knowingly collect data from them. We do not verify age at sign-up. If you believe a child has created an account, write to contact@calcpace.app and we will delete the account and its data.

Data Sharing

We do not sell, rent or trade your personal data, and we never share it for advertising. We share it only with the providers listed under "Who processes data for us", strictly so they can run the service on our instructions, and with authorities when a valid legal order requires it.

International Transfers

Our servers and providers are located outside Brazil — mainly in the United States and the European Union — so using Calcpace involves an international transfer of your data. Transfers rely on the contractual safeguards offered by each provider, including the European Commission's standard contractual clauses where they apply. Write to contact@calcpace.app if you want to know which provider holds which category of data.

Data Retention

Your account and everything attached to it are kept for as long as your account exists. You can delete your account yourself at any time from Account settings — it asks for your password and then permanently removes your profile, activities, heart-rate and VO2max values, GPS track points, photos, GPX files, sessions and Strava connection. Disconnecting Strava deletes everything imported from it immediately. Database backups are kept by our hosting provider and rotate on their schedule, so a deleted record can survive in a backup until that backup rolls over. We do not delete inactive accounts automatically; if we start doing so, we will announce it here and by email before it takes effect.

Automated Estimates

VO2max, heart-rate zones, age-graded percentages and race predictions are calculated automatically from the data you give us, using published formulas (Riegel, Cameron, Daniels & Gilbert, WMA). They are training estimates, not decisions about you: nothing about your account, your access or your treatment depends on them, and no profile derived from them is sold or shared. You can still ask us how a number was produced or ask for it to be reviewed (LGPD art. 20) at contact@calcpace.app.

Your Rights (LGPD and GDPR)

Wherever you live, you can: confirm that we process your data and get a copy of it; correct incomplete or inaccurate data; ask for the anonymisation, blocking or deletion of unnecessary or excessive data; take your data elsewhere (portability); withdraw a consent you gave, at any time and without losing the parts of Calcpace that do not depend on it; know with whom we share your data; be told what happens if you refuse a consent; ask for a review of an automated estimate; object to or restrict processing based on legitimate interest; and complain to a supervisory authority. Deleting your account is one click in Account settings, exporting your activity history as CSV is one click on the Activities page, and health-data consent is a switch in your profile settings. For a full copy of everything we hold, or for anything else, email contact@calcpace.app — we answer within 30 days.

Complaints

If you think we mishandled your data, write to contact@calcpace.app first — we would rather fix it. You can also complain to a supervisory authority: in Brazil, the Autoridade Nacional de Proteção de Dados (ANPD, gov.br/anpd); in the European Economic Area or the United Kingdom, the data protection authority of the country where you live.

Changes to This Policy

We may update this policy from time to time. When we do, we will update the date at the top of this page. If a change affects how we handle health data or any other processing based on your consent, we will ask you to accept the new version before it applies to you.

Privacy Policy