Privacy Policy

1. Information Paceory may process

Depending on which features you choose to use, Paceory may process activity information such as date and time, distance, duration, pace, heart rate, elevation, route coordinates, activity type, notes and related fitness metrics.

You may provide this information manually, import it from supported activity files such as FIT, GPX and TCX, or authorize optional sources such as Strava, Apple Health (HealthKit) or Garmin Connect to provide it.

2. Local-first storage

Paceory is designed so that core activity history and statistics can be stored locally on your device. Features that require an external service may transmit information needed for the requested feature through Paceory's backend or directly to the relevant service. In particular, the optional Garmin Connect integration receives and stores encrypted activity payloads in Paceory's Cloudflare infrastructure; these server copies are separate from your local running history.

Paceory does not require a Paceory account to use the core app.

3. Strava

If you choose to connect Strava, Paceory uses Strava's authorization process to request permissions for supported activity imports and, where you approve the relevant scope, optional activity uploads. Authorization and token exchange may pass through Paceory's secure API infrastructure. Imported activity records may be stored locally on your device. Authentication tokens used by the iOS app are protected using platform security features such as the iOS Keychain where applicable.

If you explicitly choose to send a Paceory-recorded activity to Strava, its details and available GPS route may be transferred to Strava and will then be governed by your Strava account settings and Strava's policies. Paceory does not automatically make your activities public. You can disconnect Strava in Paceory or revoke access in your Strava settings. Previously imported local activities are not necessarily removed when you disconnect.

4. Garmin Connect

Garmin Connect is an optional integration. If you choose to connect it, Paceory uses Garmin's authorization process to access activity data you authorize Garmin to share. Paceory does not receive your Garmin password. Authorization codes and encrypted access and refresh tokens are handled by Paceory's backend, as required for the Garmin server-to-server integration.

Garmin may deliver supported activity summaries, activity details and related route information to Paceory's backend. Paceory stores encrypted Garmin activity payloads in Cloudflare infrastructure so that your connected installation can retrieve and import them. Imported activities are kept separately in your local Paceory history. Garmin data supports personal history, statistics, progress, maps and heatmaps where corresponding data is available.

Paceory does not sell Garmin device-sourced data, use it for advertising or third-party profiling, or send it to machine-learning or artificial-intelligence providers. Garmin device-sourced data and data derived from it are not used to train, test, evaluate, benchmark or improve AI models.

When a Garmin activity is marked as imported, its server-side encrypted payload is not automatically erased. At present, there is no fixed automatic expiration period for these stored Garmin activity payloads while the account remains connected. When a Garmin connection is successfully disconnected through Paceory, the backend requests deregistration with Garmin and deletes the associated Garmin account record and stored Garmin activity payloads in Paceory's backend. You may also manage sharing permissions in Garmin Connect or contact support@paceory.app to request assistance with deletion. Already imported activities on your iPhone remain until you delete them in Paceory.

5. Apple Health (HealthKit)

If you choose to connect Apple Health, Paceory requests your permission to read supported running workouts and related data where available and authorized. This may include workout dates, distance, duration, heart rate, GPS workout routes, and running metrics such as speed, power, stride length, ground contact time and vertical oscillation.

Paceory uses permitted HealthKit data to import and display running activities, calculate personal statistics and help prevent duplicates. Imported activities may be stored in Paceory's local running history. Paceory requests read access only; it does not write workouts to Apple Health.

Apple Health is entirely optional. You can manage or revoke Paceory's Health permissions in your iPhone's Health settings and disconnect Apple Health inside Paceory. Disconnecting does not automatically delete workouts that were previously imported into Paceory; those remain in your local Paceory history until removed using available data controls.

HealthKit data is not sold or used for advertising, marketing or cross-app advertising tracking.

6. Maps, 3D Replay, location, Paceory Start and weather

Map, route, 3D Run Replay, place-search and weather features use Apple services such as MapKit and WeatherKit. Requests to these services are subject to Apple's applicable privacy terms. 3D Run Replay uses a compatible recorded GPS route and may display heart rate or elevation when those values exist.

When you choose to record a run with Paceory Start, the app uses your iPhone's location permission to record your GPS route, distance, pace and time. If you allow the relevant permissions, tracking may continue during an active recording when the phone is locked or the app is in the background. Live Activities can show ongoing time, distance and pace on the Lock Screen. Recorded routes are saved in local activity history when you choose to save the run; they are not uploaded to Strava unless you choose the upload option.

Paceory uses location for features you choose, including route recording and viewing, place search and weather. Garmin activity payloads may also contain routes received from Garmin, as described above.

7. File imports and manual activities

When you import a FIT, GPX or TCX file, Paceory may parse the file on your device to create an activity. Paceory may calculate a file fingerprint and compare activity details such as start time, duration, distance and route information to help prevent duplicate activities.

If you add an activity manually, the information you enter is used to create the local activity record and related statistics.

8. Service providers and infrastructure

Cloudflare provides website hosting, network security, database and encrypted object storage for features using paceory.app and api.paceory.app. Cloudflare may process technical request information such as IP addresses, limited security records, authorization traffic and Garmin activity payloads to operate and protect the service. Server-side Garmin account records and encrypted activity payloads are stored using Cloudflare services. Paceory does not use Cloudflare to profile running activities for advertising.

Apple provides relevant platform, map and weather functionality. Strava handles connected-account authorization, activity imports and any uploads you explicitly initiate. Garmin handles account authorization and delivery of the activity data you have authorized it to share. Each provider also operates under its own applicable terms and privacy policies.

Paceory does not use third-party behavioral advertising or AI platforms to process Garmin device-sourced data.

9. Website

The Paceory website does not intentionally use advertising cookies or behavioral advertising. Cloudflare provides hosting, security and network services and may process technical request information necessary to deliver and protect the website.

10. Data sharing and sale

Paceory does not sell personal information or connected-service activity data. We do not share your running history with advertisers and do not use it for cross-app advertising tracking. Information is only sent to service providers when necessary for a feature you choose to use, to operate Paceory securely, or where required by law.

11. Retention, deletion and your data rights

Locally stored Paceory activities remain on your device until you remove them using available app controls or remove the app and its local data from that device. Copies held in device backups may follow your backup provider's settings. Connected services keep their own copies under their policies.

Garmin account records and encrypted Garmin activity payloads stored by Paceory remain in the backend while a connection is active; imported payloads do not currently expire automatically. Successful disconnection removes the linked Garmin account and server-side stored Garmin activity payloads as described in Section 4. Routine technical security data is processed and retained as needed for operating and protecting the service under Cloudflare's applicable settings and policies. Paceory does not promise a fixed retention period for these security records.

You may request access to, correction of, deletion of, or export of personal data Paceory controls by emailing support@paceory.app. Where applicable law provides additional rights, you may also object to processing, request restriction or portability, withdraw consent without affecting earlier lawful processing, and complain to a competent data-protection authority. You can disconnect optional providers in Paceory or revoke their permissions with the provider. Deleting the app alone does not necessarily deregister an external Garmin connection or delete server-side data; use the Garmin disconnect control or contact support.

12. Legal bases and international processing

Where the EU General Data Protection Regulation (GDPR) applies, Paceory processes information needed to deliver features you request on the basis of providing the service; uses technical information where necessary for security and prevention of misuse based on legitimate interests; relies on consent where legally required for optional data access or processing; and processes information where required to meet legal obligations. Access permissions granted in iOS, Strava or Garmin settings are managed separately from any additional consent required by data-protection law. Activity details may include sensitive health-related information, which may require additional legal safeguards.

Cloudflare and connected providers may process requests in countries outside the European Economic Area, depending on the service and route used. For information about the protections relevant to a specific request, contact support@paceory.app.

13. Children

Paceory is not intended to knowingly collect personal information from children in violation of applicable law.

14. Changes to this policy

This policy may be updated when Paceory features, integrations or services change. The effective date at the top of this page will be changed when the policy is materially updated.

15. Controller and contact

Paceory is independently operated. Privacy questions and requests concerning personal data under Paceory's control can be sent to support@paceory.app.

This policy describes Paceory's current optional integrations as of the effective date. Optional integrations process activity data only when you choose to connect or use them.