Privacy

Last updated 20 October 2026

The short version: we collect what it takes to run a habit and training log, nothing to profile you, and you can take all of it with you or delete it at any time. There is no analytics, no advertising and no selling of data. The only third-party code that runs in your browser is Cloudflare Turnstile in the app's sign-up, sign-in and password-reset forms, which exists only to stop automated abuse of those forms. The only outside service that learns anything from what you log is Open Food Facts, which is sent a product barcode when you look one up, and nothing about you. See Service providers below.

Questions go to hello@pacestreak.com, read by a person.

Who runs PaceStreak

PaceStreak is a free project run by its maintainer, not a company with investors or an advertising business. The maintainer decides how your data is used and is responsible for it (the "data controller", in GDPR terms), and can be reached at hello@pacestreak.com.

The websites

www.pacestreak.com and blog.pacestreak.com set no cookies, store nothing in your browser, and run no analytics or tracking. A content security policy of default-src 'self' makes the browser refuse any third-party script, so this is enforced, not just intended. Cloudflare, which serves the sites, processes the IP address and request needed to deliver each page and keeps operational logs; we receive no per-visitor reports.

Cookies in the app

The app at app.pacestreak.com sets no cookies of its own. The API sets the three below, all strictly necessary for signing in, none used for tracking. They are scoped to pacestreak.com and the API's sign-in path, sent only over HTTPS, and marked SameSite=Lax.

__Secure-refresh_token: keeps you signed in. HttpOnly, so scripts cannot read it. Lasts 7 days and is replaced each time it is used; signing out deletes it.
__Secure-csrf_token: a random value the app sends back with sign-in requests, so another site cannot make them for you. Lasts 7 days; signing out deletes it.
__Secure-trusted_device: set only if you tick "Trust this device for 30 days", so this browser can skip the emailed sign-in code. HttpOnly, lasts 30 days, and stops working as soon as you remove the device, sign out everywhere or change your password.

Cloudflare Turnstile, on the sign-up, sign-in and password-reset forms, runs in a frame from Cloudflare's own domain; see Service providers below.

What the app collects, and why

Account: Email address, a password hash (PBKDF2-SHA256 with a secret key held apart from the database; we never see or store the password), whether the address is verified, your role, whether sign-in codes by email and an authenticator app are on, hashed recovery codes, and the public keys of any passkeys you add (with the name you give each one). A passkey's private key never leaves your device or password manager.; To sign you in and keep the account yours.
Profile: Handle, display name, bio, avatar colour, timezone, units, week start, planned training days, and your birth year (the year only, not a date of birth).; To run the app for you. The birth year exists only for the age rules below.
Training: Sessions (discipline, time, duration, distance, elevation, per-kilometre splits from imported tracks, effort, how it felt, private notes and private tags), sets and supersets, routines, training plans (including any a coach suggested), custom exercises, gear you track (shoes, bikes) and which sessions used it, gyms you add (with their equipment and plates) and which sessions were there, notes you pin to exercises, streak wagers, training blocks, the optional after-session soreness and pump check-in, heart rate from imported files or typed in (with time in each zone), weekly reflections you write, habits you track (name, settings, cue, reason and each day's amount, or slips for a habit you're breaking), streak targets and requirements, monthly goals, rest days you log, repairs, pauses (with an optional private note), and anything you import from a file.; This is the product. Streaks, records, XP and badges are computed from it.
Body metrics: Weigh-ins (weight, time and when in your day), measurements, a weight goal, a max heart rate for zones, and morning check-ins (sleep, energy and soreness, 1 to 5), only if you choose to record them. Progress photos stay on your own device unless you turn on photo backup, which stores them in your account, visible only to you; turning it off deletes our copies.; For your own trend. Never shared, never ranked, never in any feed, never rewarded.
Food and journal: Meals you log (name, servings, calories and macros, which meal and day), foods and recipes you save (including a product barcode if you scanned one), daily nutrition targets, and a daily journal: a mood from 1 to 5 and a note, only if you write one. Insights and the energy-burn estimate are calculated from these and your other data when you open them, and not stored.; For your own log and patterns. Private like body metrics: never shared, ranked, rewarded or in any feed.
Social: Who you follow and who follows you, blocks, kudos, comments, groups and their announcements, challenges, streak buddies, encouragement you send, and reports you make.; Only if you use these features. People under 16 cannot.
Notifications: Your in-app inbox, your per-category choices, and, if you enable push, the browser's push subscription endpoint and keys.; To tell you what you asked to be told.
Security: Active sessions, and a history of sign-ins, password, email, passkey and two-factor changes, exports, calendar-link changes and which version of the terms you accepted, each with the IP address and browser user agent. Failed sign-in attempts are recorded with the IP address and a keyed hash of the address tried (never the address itself), and linked to your account only if the address is yours. Sign-in codes sent by email are stored only as a keyed hash and deleted a day after they expire. If you tick "Trust this device for 30 days", we keep a record of that device: the browser's user agent, the IP address, when it was trusted, when it was last used and when it expires, plus a keyed hash of the cookie that identifies it. It appears in your list of trusted devices and is deleted when it expires, when you remove it, or when you sign out everywhere or change your password.; So you can spot activity that wasn't you, and so we can investigate abuse.

Crash reports

If the app crashes, it sends us the error message, the stack trace, the page's path and your browser's user agent so we can fix it. Nothing else: no account, no query string (which can carry a one-time link), no content from the page. Crash reports are kept for 30 days.

What we don't collect

No location, GPS or map data. Files you import are read for time, distance and elevation; routes are not stored.
No contacts, photos, or data from other apps or devices, except files you upload.
No advertising identifiers, fingerprinting or analytics of any kind.

Who can see what

Nothing is public by default. Your activity reaches only followers you have approved. You can make your profile private or public, or pause sharing entirely.
Visibility is checked every time something is read, so going private, pausing or blocking someone also hides what they could see before.
Groups see your handle, streak and this week's progress, and whether your week counted toward the group's streak. A coach sees your sessions, and your running plan's progress, only if you turn that on for their group, and loses access the moment you turn it off. A coach can suggest a plan to you; it only starts if you start it.
A streak buddy, once you both accept, sees your days trained this week against your target and whether you are paused. Never your sessions, notes or the reason for a pause. Either of you can end it at any time, and blocking ends it.
Never shown to anyone else: your email, notes, tags, gear, gyms, pinned exercise notes, splits, training plans, monthly goals, rest days, body metrics and weight goal, check-ins, heart rate, weekly reflections, habits, pause reasons, passkeys, security history, calendar link and imports.
Leaderboards include you only if you opt in, and never rank anything about your body.
PaceStreak staff can access account data to operate the service, respond to reports and investigate abuse. Every moderation action is recorded in an audit log that cannot be edited.

Why we're allowed to use it

To provide the service you signed up for: your account, profile, logs, streaks, social features you use, and the email that keeps your account working: sign-in and verification codes and security notices.
Your explicit consent for health information: body metrics, heart rate, check-ins, food, journal mood, and habits that reveal something about your health (such as one you're breaking). You choose to record each of these, you agreed to it when you signed up or accepted these terms, and you can withdraw by deleting the entries, or your account, at any time.
Your consent for optional extras you switch on: push notifications, reminder and summary emails, the backup email and photo backup. The weekly summary and milestone emails are on when you sign up; every one of these can be switched off by category in Settings, and switching one off withdraws it.
Legitimate interest in keeping the service safe: the security history, failed sign-in records, crash reports, rate limiting, Turnstile and moderation. These are kept short and used for nothing else.

Age

You must be 13 or older to have an account. Under 16, an account is private only: no feed, no groups, no leaderboards and no public profile, whatever the settings say. We ask for a birth year to apply these rules, and nothing else about your age.

Service providers

We use as few as possible and never share data for anyone else's purposes:

Cloudflare runs everything we operate day to day: it hosts the websites and the app (Pages), runs the API (Workers), stores your account and everything on this page in its database (D1), stores progress photos (R2) if you turn photo backup on, and holds import and export files while they are processed (R2, deleted within a week). It queues and schedules background work such as streak reminders, digests and account deletions (Queues and Cron Triggers). It also runs Turnstile, an invisible challenge on sign-up, sign-in, password-reset, resend-verification and account recovery that exists only to stop those forms being used to spam email or brute-force passwords. Turnstile sees the request needed to tell a human from a script; it is not analytics and does not track you around the web.
Brevo sends our email through its mail relay: sign-in, verification, password-reset and email-change codes, security notices, and the reminders, summaries and milestone emails you keep on. It sees the email address and the message content, nothing else about your account. We send no newsletters and no marketing email. If you turn on the monthly or weekly backup email (off by default, and the app asks you to confirm), that message carries a zip of your whole export, so Brevo handles it in transit and it then sits in your inbox like any other email.
Neon holds one backup: a full copy of the database, made each night and replacing the previous night's copy. It is only for restoring after a failure.
GitHub runs the nightly job that makes that copy (GitHub Actions), so the data passes through GitHub's hosted runners in transit. Nothing is kept there.
Open Food Facts, an open food database, answers barcode lookups. When you look up a barcode that isn't among your saved foods, our server sends Open Food Facts that barcode number and nothing else: no account, no IP address of yours, no cookie. Answers are cached so a popular product is asked about once.
Zoho receives mail sent to hello@pacestreak.com.
Web push messages pass through your browser's own push service (Google's, Apple's, Mozilla's, Microsoft's or Vivaldi's), encrypted so that service cannot read them. Push titles and email subjects never name a habit: they can show on a lock screen.

Where it's stored

The database (Cloudflare D1) is in Cloudflare's Asia-Pacific region, and photos and import and export files (R2) are stored in the same region. The API runs on Cloudflare's global network, usually in a data centre close to the database or to you, and the websites are served from that same network. The nightly backup copy is in the United States (Neon, AWS us-east-2 in Ohio), made by a job on GitHub-hosted runners, whose location GitHub chooses. Brevo is based in the EU. If you live in the EU, the UK or another country with transfer rules, your data is transferred outside it under each provider's data processing terms, which include the European Commission's standard contractual clauses. Everything is encrypted in transit, and the providers encrypt it at rest.

How long we keep it

Your data is kept while your account exists.
Things you delete (a habit and its history, a meal, a session, a recipe, a journal entry) wait in your trash for 30 days so you can restore them, then are deleted for good. You can empty the trash sooner.
Photos or text you share into the app from your phone's share sheet stay on that device until you choose what they are; nothing is uploaded unless you save a progress photo with backup on.
Deleting your account schedules it for 30 days later and signs you out everywhere. Sign in during those 30 days to cancel. After that, the account and everything linked to it is permanently deleted. Copies in the backups below expire on their own.
Backups. The database keeps a rolling 7-day restore history (Cloudflare D1 Time Travel), and a full copy is made in Neon each night, replacing the previous night's copy. Both are used only to recover from a failure. So something you delete can survive in a backup for up to 7 days; if a nightly copy ever fails, the previous one stays until the next copy succeeds. If we add longer-lived backups, this page will say so, and how long they last, before it happens.
Import and export files are deleted within a week of being made.
Failed sign-in records and crash reports are kept for 30 days.
Operational server logs are kept for a short period and then rotated away.

Your controls and rights

Export everything at any time from Settings → Data: a complete JSON archive, CSV files, or a calendar file.
Correct anything from the app, or ask us.
Withdraw consent for health information by deleting it; nothing else about your account changes.
Delete your account from Settings → Data.
Object or restrict: turn off social features, gamification, reminders, push and email by category, and revoke the calendar link, a coach's access or a buddy at any time. The backup reminder (monthly or weekly) is off unless you turn it on, and it links into the app rather than carrying any of your data.
For anything else, including a question about how your data is handled, write to hello@pacestreak.com. We answer within 30 days. You can also complain to your local data protection authority.

Security

Passwords must be at least 16 characters and are hashed with PBKDF2-SHA256 and a secret key kept apart from the database. Sessions use short-lived tokens that are never written to browser storage, with theft detection on refresh. Signing in on a new device asks for a 6-digit code sent by email (on by default; it lasts 10 minutes and works once), unless you trusted that device in the last 30 days. You can use an authenticator app (TOTP) instead of emailed codes, and passkeys and single-use recovery codes are also available; for a passkey only the public key is stored, authenticator secrets are encrypted at rest, and codes are stored only as keyed hashes. The calendar link is stored only as a hash. The details are on the security page. If we ever discover a breach affecting your data, we will tell you and the relevant authority as the law requires.

Changes

Every change to this page has a date and a record in our version history. If a change affects how your data is used, we will tell account holders in the app before it takes effect.