Privacy Policy

2. How We Use Your Data

Your data is used to:

• Shape personalized weekly schedules with an AI planning pass, then materialize and validate workouts with deterministic code and an authored workout library
• Build and maintain your athlete profile and memory
• Run AI assessments of your fitness and training patterns
• Calculate training metrics (fitness, fatigue, form) and track progress
• Sync workouts between PaceBeats and connected platforms
• Send transactional and product emails (which you can control)
• Operate, secure, and improve the platform
• With your consent, measure whether Google ads lead to sign-ups or purchases

3. Data Storage & Security

Your data is stored in a PostgreSQL database with encryption in transit and at rest. Third-party access tokens (e.g. Garmin and Strava) are additionally encrypted at the application layer. Authentication uses secure, HTTP-only session cookies.

We do not sell your personal data or training data. Your athlete memory, workout feedback, and wellness data are used only to run your training experience.

4. Garmin Connect Data

Connecting Garmin is optional. PaceBeats receives only the Garmin data categories you authorize and that Garmin makes available to the integration. These may include activities, activity details, health and wellness summaries, body composition, women's health, and the ability to deliver supported planned workouts and, where enabled, courses to Garmin Connect.

We use Garmin data to calculate training load and recovery metrics, build your training history, personalize plans and assessments, provide coaching features, and deliver supported workouts or, where available, saved routes that you choose to send to Garmin. Garmin connection tokens are encrypted at the application layer. Imported Garmin data is stored with your PaceBeats training record for as long as needed to provide these features.

Disconnecting Garmin stops future synchronization and removes the stored connection credentials. Garmin-sourced data already incorporated into your PaceBeats training history is retained until you delete your PaceBeats account or ask us to delete it by contacting privacy@pacebeats.com. Deleting your PaceBeats account deletes the associated Garmin-sourced data together with the rest of your live account data. Restricted-access backup copies expire within 30 days and are not used for ordinary service operations. If a backup is restored during that period, our external erasure ledger automatically reapplies the deletion before the restored service takes traffic.

When an AI-assisted feature needs Garmin-derived context, PaceBeats sends only the relevant data to OpenAI or Anthropic for processing. These providers process it solely to return the requested coaching output. PaceBeats does not permit them to train their models on Garmin data. We do not sell Garmin data or share it for advertising.

Any material change to how PaceBeats collects, uses, processes, stores, or shares Garmin data will be submitted to the Garmin Connect Developer Program for written approval before implementation.

5. Wahoo Data

Connecting Wahoo is optional. With your authorization, PaceBeats reads your Wahoo account identifier and recorded activities, including available heart rate, power, GPS tracks, laps and other measurements. The initial import covers the last 90 days; subsequent recordings arrive through synchronization. Wahoo does not supply sleep, HRV or all-day wellness data through this integration. We encrypt the credentials that allow synchronization and never ask for your Wahoo password.

We use these activities to display your history, calculate training load, match completed sessions to your plan, and provide coaching. AI-assisted features may send relevant activity context to the AI processors listed below, solely to produce your coaching output. We do not sell Wahoo data, share it for advertising, or forward Wahoo recordings to Strava.

When you send a workout or enable automatic delivery, PaceBeats sends the workout title, date, duration and structured cycling prescription to Wahoo. This can include power and heart-rate targets calculated from your saved thresholds. Wahoo processes the information it receives as an independent controller under its Privacy Policy. Automatic delivery is off until you enable it.

Disconnect in Settings → Connections to stop synchronization, remove Wahoo source activity data and its stored activity details, and request removal of future workouts that PaceBeats sent to Wahoo. An independently recorded Garmin activity is preserved. Remote cleanup retries if Wahoo is temporarily unavailable; encrypted connection credentials are retained only while that cleanup is pending. Completed activities in your Wahoo account are not deleted. You can also revoke access in Wahoo.

Your notes and conversations remain part of your PaceBeats account, including coaching replies you already received. Your data export includes the retained Wahoo activity records and delivery history. Deleting your PaceBeats account removes its live Wahoo data along with the rest of your account; restricted backup copies expire within 30 days as described above.

6. Third-Party Processors

We share data with a small set of service providers only as needed to run PaceBeats:

• Garmin Connect — to import activities and available wellness data, and to sync supported planned workouts. The optional Strava connection, where available, is outbound only: we post your completed sessions to Strava and set their title and description. We do not read or import your Strava activities. Wahoo also imports recorded activities and receives structured cycling workouts when you request delivery. You can disconnect these services in Settings.
• OpenAI and Anthropic — the AI models that power weekly schedule proposals, assessments, and coaching replies. Data sent to the models is used only for those features and is not used to train third-party models.
• AI clients you connect — if you connect ChatGPT, Claude, or another MCP client, it can request only the PaceBeats access you approve. By default that access is read-only. Plan access covers your current and upcoming plan, stored coaching rationale, season phases, and race calendar. Separate training access covers recent session history, training goals, availability, and redacted connection status. Four further permissions are off unless you turn them on when you connect. Fitness and zone access (metrics) shares whether your fitness is building or fading, how fresh you are, and your heart rate, power and pace zone ranges and session targets; because zone ranges are derived from your thresholds, the client can work out approximate thresholds from them. Recovery access (wellness) shares a readiness verdict and whether sleep, HRV and resting heart rate are better or worse than your usual, as labels, bands and percent changes. Raw training-load values, raw sleep, HRV, resting heart rate, body battery and weight readings, named FTP, threshold heart rate or swim threshold pace, routes, provider payloads, credentials and internal identifiers are never shared. Two of the four are write permissions. Logging access (plan.log) lets the client record a session as done or partial with how it felt and a note, and log strength sets, in your training record, after showing you what it will save. Suggestion access (plan.propose) lets it draft a plan change for you to review, or save a short note about an illness, injury or travel disruption to your coach memory, after showing you what it will save. Neither can confirm a plan change, regenerate a week, or alter your races, connected devices or billing; changes to your plan are confirmed only inside PaceBeats. Every write is recorded with the app that made it, and is switched off for all connected clients unless we have enabled it. None of these four permissions is available to athletes under 18 or with no date of birth on file. If you have not granted one, that part of a response is reported as not available. The connected client handles the returned data under its own privacy terms. You can disconnect it in Settings.
• Stripe — to process subscription payments. Card details are handled by Stripe; we never see or store them.
• Brevo — to deliver transactional and product emails.
• PostHog — EU-hosted product analytics that tell us which features are used, which flows people abandon, and what breaks. For account holders this runs on our legitimate interest in improving PaceBeats (Article 6(1)(f)), not on consent, and covers events such as sign-up, plan generation, connecting a device, and subscription changes, together with account attributes such as your email and name, plan tier, stated training focus and weekly hours, which integrations you have connected, and how you found us. Your health and training measurements are never sent: no heart rate, thresholds, weight, injuries, illness or constraint state, and no cycle data. We do not use it for advertising, we do not track you across other sites, and we never sell or share the data. You can object at any time in Settings, on any device, and doing so stops collection entirely. Before an account exists we count a few anonymous events (such as a fresh sign-up) using a one-off identifier and no person profile; those aggregate counts may remain. Deleting your account also deletes your PostHog profile and its event history. Separately, PostHog supplies feature-availability rules to PaceBeats. Those rules are evaluated within PaceBeats without sending your user ID, email, or an exposure event to PostHog, so your analytics choice never changes which features you receive.
• Google Ads — to measure whether an ad led to a visit, sign-up, or purchase. When there is no current choice, the Google tag loads with Consent Mode v2 denied by default and ad-data redaction enabled. Before you accept, advertising storage and sending user data for advertising measurement remain denied; Google may receive limited cookieless measurement signals. Accepting allows conversion measurement and advertising storage. Personalized advertising remains disabled in every state. We do not send Google your health or training data, and you can withdraw this permission at any time from Settings.
• Honeybadger — EU-hosted technical error monitoring that helps us fix failures.
• Tomorrow.io and OpenStreetMap Nominatim — to provide optional local forecasts and place-name lookup. Weather coordinates are rounded to two decimal places (approximately one kilometre) before either processor is contacted. Reverse-geocoding for a location you select is rounded to four decimal places (approximately 11 metres). Requests are sent by PaceBeats servers, not directly by your browser. PaceBeats keeps weather results in browser memory for at most 30 minutes and does not persist weather coordinates or manual weather searches; memory is also cleared on logout or account deletion. The geocoding route does not cache lookup requests; a route start that you deliberately save remains in your route preferences until you change it or delete your account.

7. Your Rights

You have the right to:

• Access and export your data — download a full JSON copy from Settings → Account & Billing.
• Delete your account and all associated data — self-serve from the same page. Live-service deletion is effective immediately. Restricted-access backup copies expire within 30 days; a keyed pseudonymous erasure marker is retained solely to prevent deleted data from reappearing after a restore.
• Disconnect third-party integrations at any time
• Object to product analytics and withdraw Google Ads measurement consent from Settings at any time, with no reason required and no loss of features. You can also control which emails you receive.
• Correct inaccurate profile information

You can also exercise any of these rights by contacting us at the address below.

8. Cookies

We use essential cookies for authentication and session management, plus one small cookie to remember your analytics choice. Product analytics also keep the first-party identifier described below. Google Ads advertising storage is denied unless you accept the analytics banner.

Product analytics keep a durable identifier in this browser from your first visit, which is what allows a visit made before you signed up to be joined to your account. It holds a random identifier only — no name, no email, and never any health or training data. Declining the banner switches product analytics off altogether and clears that identifier, as does objecting later in Settings.

The Google tag is configured for conversion measurement only. It starts with advertising storage, advertising user data, personalized advertising, and Google Analytics storage denied. If you accept, advertising storage and advertising user-data measurement become allowed; personalized advertising and Google Analytics storage remain denied. Declining or withdrawing later sends an immediate denied update and removes first-party Google conversion-linker cookies.