Privacy Policy

1. Who We Are and Scope

This Privacy Policy ("Policy") describes how Nicholas Patterson, trading as Origae (ABN 21 237 258 402), a sole trader based in Victoria, Australia ("PaceBrain," "we," "us," or "our"), collects, uses, discloses, and otherwise handles personal information in connection with the PaceBrain website at pacebrain.app, our mobile applications, and related services (collectively, the "Platform"). PaceBrain is the entity responsible for (and, where applicable, the data controller of) the personal information handled through the Platform.

This Policy applies to everyone who accesses or uses the Platform. By accessing or using the Platform, you acknowledge that you have read and understood this Policy. If you do not agree with our data practices, please do not use the Platform.

This Policy is incorporated by reference into our Terms of Service and should be read together with our Cookie Policy.

2. Personal Information We Collect

2.1 Information You Provide Directly

• Account Data: name, email address, password (stored only in hashed/encrypted form by our authentication provider), and profile information.
• Athletic and Health/Fitness Data: running activities, distance, pace, duration, heart rate, heart-rate variability (HRV), elevation, cadence, GPS routes and precise location, recovery and readiness metrics, mood logs, training goals, race plans, and performance metrics. This is sensitive information and we treat it accordingly (see Section 3).
• Nutrition and Dietary Data: if you use our nutrition features, we collect the bodyweight, gender, and athlete type you enter, your dietary preferences (such as vegan, vegetarian, or pescatarian), whether you require dairy-free options, any calorie target you set, and the free-text list of foods you ask to exclude. Foods you exclude may reveal a food allergy, intolerance, or medical condition. Dietary and allergy information is health information and therefore "sensitive information" under the Privacy Act 1988 (Cth) and a special category of data under the GDPR. We collect it only to generate the plan you request, we do not use it to infer or record any diagnosis, and we do not use it for advertising or profiling. You can delete a saved plan at any time, and deleting your account deletes all of it.
• Consent and Acknowledgement Records: when you tick (or decline) the acknowledgement required before generating a nutrition plan, we record your answer, the date and time, and the version of the wording shown to you. We keep this as a record that the acknowledgement was given, and it may be retained after account deletion where we need it to establish or defend a legal claim (see Section 7).
• User-Generated Content: activity notes, personal records, goals, crew/community messages, and other content you submit.
• Communications: information in your messages to us, including support requests and feedback.
• Payment Information: for paid subscriptions purchased on the web, billing details and transaction history are collected and processed by our payment processor, Stripe. Purchases made in our iOS app are processed by Apple. We do not receive or store your full card number.

2.2 Information Collected Automatically

• Device Information: device type, operating system, browser type and version, and identifiers.
• Usage Data: pages visited, features used, and interaction data, collected through our analytics providers (see Section 5).
• Log Data: IP address, access times, and system logs.
• Location Data: approximate location from your IP address, and — only where you record or connect GPS-enabled activities — precise route/location data.

2.3 Information From Connected Services and Sign-In Providers

• Sign in with Google (web) and Sign in with Apple (iOS): if you use these, we receive basic profile information (such as your name and email) from the provider to create or access your account.
• Garmin Connect: if you connect Garmin, you provide your Garmin account credentials so we can sync your activities and, at your request, send planned workouts to your device. Your Garmin password is used only to establish the connection — it is not stored or logged — and the resulting access tokens are stored in encrypted form. You can disconnect at any time in your settings.
• Strava (when available): if you connect Strava, we receive the activity and profile data you authorize. Strava access may be unavailable at times due to changes in Strava's API program. If you disconnect Strava or delete your account, we delete the Strava-sourced data we imported, and we do not use Strava-sourced data to train AI or machine-learning models.
• File uploads: you may upload activity files (e.g., GPX/FIT/TCX) exported from other platforms such as Garmin, Polar, or COROS.
• Wahoo: if you connect Wahoo, we import your runs only (rides and other activities are skipped), including heart rate, GPS route and your Wahoo user ID. On connect we import up to your 200 most recent runs, then about every 4 hours and when you open the app. Access tokens are stored encrypted. You can disconnect at any time in your settings. When you disconnect Wahoo, we delete the Wahoo-sourced activities we imported. If your Wahoo access ends another way (for example, you revoke PaceBrain in Wahoo), we tell you and delete them after 48 hours unless you reconnect. If you ask us to delete your data, we delete those activities immediately. Deleting them recalculates the insights, personal bests and training-plan ticks that depended on them. Disconnecting can also remove workouts PaceBrain scheduled on your Wahoo account. Runs from Garmin and other sources are kept.
• Wahoo waitlist: if you join the Wahoo waitlist while new connections are closed, we store your account id and the date you joined, and we use your account email for a single "Wahoo is ready" message. We delete that record when you connect Wahoo, when you leave the waitlist, or after that message is sent. We do not add you to a marketing list.

3. Sensitive Information and Consent

Health and fitness data (including heart rate, HRV, GPS location, and related metrics) and nutrition and dietary data (including bodyweight and the foods you ask to exclude, which may reveal an allergy, intolerance, or medical condition) is "sensitive information" under the Australian Privacy Act 1988 (Cth) and a "special category" of data under the GDPR. We collect and process this data for the purpose of providing the Platform's tracking, analytics, coaching, and nutrition features, and we rely on your consent to do so. You provide that consent by choosing to record, upload, or connect this data — including heart rate and GPS routes from Wahoo — or by entering it into the nutrition wizard. You can withdraw consent at any time by disconnecting integrations, deleting a saved plan, ceasing to add data, or deleting your account.

Sharing a plan by email. If you choose to email a nutrition plan, you supply the recipient's name and email address and we send the plan to them through our email provider (Resend) as PDF and spreadsheet attachments. That plan contains your dietary information. You choose the recipient and you are responsible for that choice — once sent, we cannot recall it. We use the recipient's address only to send that email and do not add it to any marketing list.

We do not sell your personal information, and we never use your health or fitness data for advertising or for any decision that produces legal or similarly significant effects about you.

Leaderboards. PaceBrain shows your first name and your weekly distance on a leaderboard other users can see. This is on by default. You can turn it off anytime in Settings. We show it on the basis of our legitimate interests (GDPR Art. 6(1)(f)): so runners can compare weekly kilometres with other PaceBrain users. We do not show your surname, your photo, your email, your location, your heart rate or your VO2 max on that board. Weeks reset Monday 00:00 UTC (10am AEST / 11am AEDT). You can appear as "Anonymous Runner", and your entry is removed within 4 hours of turning it off. Accounts that already existed when this board was introduced stay off it until they choose Join, or turn it on in Settings.

More leaderboard details (optional). These stay off unless you give explicit consent by turning them on in Settings → Data & Privacy: your profile photo, your longest run, your fastest pace, your average cadence, and your average heart rate and VO2 max (health information). That switch is your consent (GDPR Art. 6(1)(a), and Art. 9(2)(a) for average heart rate and VO2 max). If you turn them on, other PaceBrain users can see them. You can withdraw that consent at any time; those entries are removed within 4 hours.

Leaderboard section added 12 October 2026.

4. Legal Bases for Processing (GDPR/UK GDPR)

For users in the European Economic Area (EEA), United Kingdom, and other jurisdictions requiring a legal basis, we process personal data on these grounds:

• Contractual Necessity (Art. 6(1)(b)): to provide the Platform, manage your account, and fulfil subscriptions.
• Consent (Art. 6(1)(a); Art. 9(2)(a) for health data): for health/fitness data — including heart rate and GPS routes imported from Wahoo — marketing, non-essential cookies, and location tracking. Connecting Wahoo is how you give that consent for Wahoo-sourced health data. Turning on the optional leaderboard details in Settings → Data & Privacy is a separate explicit consent for other PaceBrain users to see your profile photo, longest run, fastest pace, average cadence, average heart rate and VO2 max.
• Legitimate Interests (Art. 6(1)(f)): product improvement, security, fraud prevention, and the default weekly distance leaderboard (first name and weekly distance only), where not overridden by your rights. It is on by default. You can turn it off anytime in Settings.
• Legal Obligation (Art. 6(1)(c)): to comply with applicable law.

5. How We Share Information — Service Providers

We do not sell your personal information. We share it only with the service providers (sub-processors) we use to operate the Platform, under contracts that require them to protect it and use it only as we instruct. These providers are located primarily in the United States, so using the Platform involves the international transfer of your data (see Section 6):

• Supabase: database hosting, authentication, and storage
• Vercel: website/app hosting, content delivery, and product analytics (Vercel Analytics & Speed Insights)
• Stripe: payment processing (web subscriptions)
• Apple: payment processing (iOS in-app purchases) and Sign in with Apple
• Google: Sign in with Google (web)
• Groq: AI/ML model inference for coaching and insight features
• PostHog: product analytics and usage measurement. When you sign in or create an account after accepting analytics cookies, we send PostHog your account identifier and email address so events are linked to your account. PostHog autocapture is enabled and records on-page interactions, such as clicks.
• Resend: transactional and notification email delivery
• Garmin / Strava / Wahoo: where you connect them, for activity sync and, for Garmin and Wahoo, sending the planned workouts you choose to send (as described in Section 2.3)
• Nominatim (OpenStreetMap): geocoding. For a RaceWeather lookup we send Nominatim the city you type.
• Open-Meteo: weather. We send Open-Meteo the coordinates returned for that city.

Changes to this list. This list is current as at the "Last Updated" date above and is the complete set of service providers who handle your personal information. If we add or replace one in a way that materially changes how your data is handled, we will update this Policy and, for material changes, give notice by email or in-app before it takes effect. OpenWeatherMap (api.openweathermap.org) is not on this list. We do not send it your location or any other personal information. The website may ask your browser to resolve that hostname in advance (a DNS prefetch, including on the home page). That request does not include your location.

We may also disclose personal information: (a) to comply with law, legal process, or a valid government request; (b) to protect the rights, property, or safety of PaceBrain, our users, or the public; (c) to detect or prevent fraud or security issues; (d) to enforce our Terms; or (e) in connection with a business transfer (merger, acquisition, or sale of assets), in which case we will notify you.

6. International Data Transfers

Your personal data may be transferred to, and processed in, countries other than your own, including the United States. Where we transfer data from the EEA, UK, or Switzerland to a country not recognised as providing adequate protection, we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses (SCCs) and the UK International Data Transfer Agreement (IDTA), together with supplementary measures where needed. For Australian users, before disclosing personal information overseas we take reasonable steps to ensure the recipient handles it consistently with the Australian Privacy Principles (APP 8).

7. Data Retention and Deletion

We retain personal data only as long as needed to provide the Platform and to meet legal, accounting, or reporting obligations.

• Active accounts: data is retained while your account exists.
• Account deletion: when you delete your account, we permanently and immediately delete your activity, health, nutrition, profile, and related data from our systems and cancel any active subscription. Limited records (e.g., transaction/tax records) may be retained where required by law or to resolve disputes or prevent fraud.
• Consent records: records that you acknowledged (or declined) the health and nutrition disclaimer, including the date, time, and version of the wording shown, may be retained after account deletion where we need them to establish, exercise, or defend a legal claim, or to comply with a legal obligation. These records are kept separately, are used only for that purpose, and contain no plan content.
• Anonymised data: aggregated or de-identified data that cannot reasonably identify you may be retained for analytics and product improvement.

How long, specifically. Deletion from our live database happens immediately on request. Encrypted backups roll over within 30 days, after which deleted data is gone from them too. Analytics events (PostHog) are retained for up to 12 months. Payment and tax records are kept for 5 years, the period the Australian Taxation Office requires. Consent and acknowledgement records are kept for 7 years, matching the longest limitation period for a claim we may need to defend.

8. Your Rights Under GDPR/UK GDPR

If you are in the EEA, UK, or a similar jurisdiction, you have rights to: access your data; rectify inaccurate data; erase your data ("right to be forgotten"); restrict or object to processing (including profiling and direct marketing); data portability; and withdraw consent at any time (without affecting prior processing). You may also lodge a complaint with your local supervisory authority.

You can exercise the core rights yourself in-app: export all of your data from your settings, and permanently delete your account from Settings → Data & Privacy. For any other request, email support@pacebrain.app (subject line: "Privacy"). We will respond within the time required by applicable law (generally within 30 days).

9. California Privacy Rights (CCPA/CPRA)

California residents have rights to know, delete, and correct personal information, to opt out of the "sale" or "sharing" of personal information, to limit the use of sensitive personal information, and not to be discriminated against for exercising these rights.

We do not sell your personal information, and we do not share it for cross-context behavioural advertising. We collect the categories described in Section 2 for the purposes in this Policy. To exercise your rights, email support@pacebrain.app. We will verify your identity and respond within the time required by law.

10. Australian Privacy Rights (Privacy Act 1988)

We handle personal information in accordance with the Australian Privacy Principles (APPs), including open and transparent management (APP 1), use and disclosure limits (APP 6), direct-marketing opt-out (APP 7), cross-border disclosure safeguards (APP 8), reasonable security (APP 11), and access and correction rights (APP 12–13). Where practicable, you may deal with us anonymously or by pseudonym, though some features require an account.

Complaints: if you believe we have breached the APPs, contact us at support@pacebrain.app (subject line: "Privacy") and we will respond within 30 days. If you are not satisfied, you may complain to the Office of the Australian Information Commissioner (OAIC) at www.oaic.gov.au.

11. Data Security and Breach Notification

We implement technical and organisational measures to protect personal data, including encryption in transit (TLS) and at rest, hashed passwords, row-level access controls in our database, restricted staff access, and monitoring and logging.

Breach notification: in the event of an eligible data breach likely to result in serious harm or a risk to your rights, we will notify affected users and any relevant regulator (including the OAIC under the Notifiable Data Breaches scheme) without undue delay after becoming aware of it.

Not a HIPAA covered entity: PaceBrain is not a healthcare provider and is not a "covered entity" or "business associate" under the U.S. Health Insurance Portability and Accountability Act (HIPAA). Your data is protected under this Policy and applicable privacy law, not HIPAA.

Reporting a vulnerability. If you believe you have found a security flaw in the Platform, email support@pacebrain.app (subject line: "Security"). We will acknowledge within 5 business days. We will not pursue legal action against anyone who reports a flaw in good faith, gives us a reasonable chance to fix it before disclosing it, and does not access, alter, or exfiltrate other people's data in the process.

No system is perfectly secure. While we work hard to protect your data, we cannot guarantee absolute security and are not liable for unauthorised access arising from circumstances beyond our reasonable control.

12. Children's Privacy

The Platform is for people aged 13 and over, and for people aged 16 and over in the European Union, the European Economic Area, and the United Kingdom. It is not directed to anyone younger than that. We do not knowingly collect personal information from anyone under that age. If we learn that an account belongs to someone under 13, or under 16 in the European Union, the European Economic Area, or the United Kingdom, we will close the account and delete the personal information we hold for it, except information we must keep by law, such as payment records. If you believe an account belongs to someone under that age, email support@pacebrain.app.

13. AI, Automated Processing, and Profiling

We use automated processing, including AI and machine-learning models (via our provider Groq), to generate coaching suggestions, training plans, insights, race predictions, and nutrition and meal-suggestion plans from the athletic and dietary data you provide. This processing supports the features you request and does not produce legal or similarly significant effects about you. No qualified professional reviews this output before you receive it.

To generate a plan, the relevant inputs are sent to Groq for processing — your training volume and experience level, your goal, your bodyweight and gender, your dietary preferences and any foods you exclude, and the name and date of an upcoming race if you have saved one. We do not send your name, email address, or account identifiers.

We do not train AI models on your data. Your identifiable personal data, your health and fitness data, and your nutrition and dietary data are not used to train or fine-tune any AI or machine-learning model, ours or anyone else's. Sending your inputs to Groq to produce the output you asked for is not training. We may use aggregated or de-identified information — from which you cannot reasonably be identified, and which we do not attempt to re-identify — to evaluate and improve how our features perform. This matches the licence you grant in Section 6.2 of our Terms of Service.

We do not sell your data or use your health or fitness data for advertising or automated decisions with legal or similarly significant effects. AI-generated output is for informational purposes only, may be inaccurate, and is not medical, professional coaching, or other regulated advice — see the health disclaimer in our Terms of Service. You have the right not to be subject to a decision based solely on automated processing that produces legal or similarly significant effects.

14. Cookies and Analytics

We use cookies and similar technologies for essential functionality (authentication and security), and, subject to your choices, for analytics (via PostHog and Vercel Analytics). Analytics tools are not loaded and collect nothing until you accept analytics cookies. PostHog's automatic event capture records which elements you interact with and which pages you view; it does not capture the contents of text fields you type into.

Changing your mind is easy and takes effect immediately. Use the "Cookie preferences" control in our site footer, or the button on our Cookie Policy, to change or withdraw your consent at any time. Withdrawal stops further collection without a page reload, and is no harder than giving consent was.

Global Privacy Control and Do Not Track. We do not sell or share personal information for cross-context behavioural advertising, and we run no advertising cookies, so there is nothing for an opt-out-of-sale signal to switch off. We nonetheless treat a browser-level Global Privacy Control (GPC) signal as a valid request to decline non-essential analytics cookies.

15. Third-Party Links

The Platform may link to third-party websites or services we do not operate. This Policy does not apply to them, and we are not responsible for their practices. Please review their privacy policies.

16. Changes to This Policy

We may update this Policy from time to time. We will post the updated Policy with a revised "Last Updated" date, and for material changes affecting your rights we will provide additional notice by email or in-app. Your continued use after the effective date constitutes acceptance.

17. Contact Us

18. Governing Law

This Policy is governed by the laws of the State of Victoria, Australia. Nothing in this Policy limits any rights you have under applicable data-protection laws, including the Privacy Act 1988 (Cth), the GDPR/UK GDPR, or the CCPA/CPRA.