Training data is health data. We treat it that way.

None of this is novel. It's the careful, boring version of each decision, written down here so you know what to expect.

Passwords

At least 16 characters. Length beats complexity rules, and a password manager makes it free.
Hashed with PBKDF2-SHA256 at 100,000 iterations, salted and mixed with a secret key kept apart from the database. Sign-in takes the same time whether or not the account exists, so response timing can't be used to discover who has one.
Error messages never say which half was wrong.

Sessions

A short-lived access token, held in memory only and never written to your browser's storage, so a script bug can't lift a long-lived credential.
A long-lived refresh token in an HttpOnly cookie that page code can't read. It rotates on every use.
Present an already-used refresh token and the whole session is revoked. That's what a stolen token looks like.
Every write that relies on the cookie also needs a CSRF token the cookie alone can't supply.

Email codes

On by default: signing in with a password also asks for a 6-digit code sent to your email. It works once and expires after 10 minutes.
Tick "Trust this device for 30 days" and that browser skips the code until then. Signing out everywhere or changing your password forgets every trusted device.
An authenticator app or a passkey replaces the email code, if you'd rather not wait for mail.

Passkeys

Sign in with your fingerprint, face or device PIN, from a button or straight from the email field's autofill.
Only the public key is stored. A database copy gives an attacker nothing to sign in with.
Your browser binds every passkey to app.pacestreak.com, so a look-alike site can't use it. That's why a passkey counts as two-factor on its own.
Adding or removing one needs your password, so a stolen session can't plant its own way in. Each challenge works once.

Authenticator app

Optional: time-based codes from any authenticator app, with the secret encrypted at rest.
A code can't be replayed, even within its own 30-second window.
Ten single-use recovery codes, replaceable at any time. Each works in place of any code.
Turning two-factor on or off needs your password and a current code.

Your control

A list of every signed-in device. End one, or sign out everywhere.
Changing your password keeps this session and ends all the others. Resetting it ends every session.
Lost your password and your email? A recovery code sets a new password, once, and ends every session.
Changing your email needs your password and only takes effect when you enter the code sent to the new address. The old address is told.
A security history of sign-ins, password, passkey and two-factor changes, and an email alert when a device you've never used signs in.
Rate limits on sign-up, sign-in, two-factor, recovery, password reset and verification, and failed attempts watched by IP and by account.

No third parties, enforced

No analytics, no tracking pixels, no advertising, no font CDN, no embedded widgets, on this site, on the blog or in the app. Every site ships a content security policy of default-src 'self', so the browser refuses to load anything from anywhere else. If someone added a tracker by mistake, it wouldn't run.

Email that stays quiet

No newsletters, no marketing email. PaceStreak only writes about your account and your own activity, and every kind of email except sign-in codes and security notices can be turned off in the app. A habit's name, note or amount never appears in an email subject or a push notification's title, because those show on a lock screen; details stay inside.

Backups

The database can be restored to any minute of the last seven days, and a full copy is taken off-site every night, so one provider's bad day can't take your history with it.

One domain, one trust boundary

The session is shared across pacestreak.com so the app can reach the API. That makes a promise necessary: nothing untrusted is ever hosted under this domain. No user-generated pages, no third-party tools on a subdomain.

Your data, your call

Export everything as JSON, CSV or a calendar file, whenever you like. Delete your account and it's scheduled 30 days out, so a mistake is recoverable, then removed. Body metrics are private and never leave your account.

Source code

Every line of PaceStreak is open source under AGPL-3.0 at github.com/PaceStreak, so you can check each measure on this page against the code. Its security rests on those measures, not on anything being hidden. Uptime is public at status.pacestreak.com.

Reporting a vulnerability

Please email hello@pacestreak.com rather than opening a public issue. You'll get an acknowledgement within 72 hours and a straight answer.