Privacy Policy & Data Security
How we safeguard your location, athletic telemetry, and personal privacy. Each section begins with a plain-language summary for total transparency.
1. Who We Are & Scope of Policy
SUMMARY: PaceMatch Inc. is the data controller responsible for your personal information.
This Privacy Policy explains how PaceMatch Inc. ("PaceMatch", "we", "us", or "our") collects, uses, shares, and protects your personal data across our mobile applications, web portals, APIs, and associated services. PaceMatch Inc. acts as the data controller. For any privacy inquiries, reach our Data Protection Officer at privacy@pacematch.com.
2. Information We Collect
SUMMARY: We collect data you provide directly (profile, pace, photos), device information automatically, and optional linked services (Google, Strava).
We collect information in three categories: (a) Information you provide directly, including display name, birthdate (used exclusively for age calculation and 18+ verification), gender, athletic metrics (target pace, weekly mileage, running style), prompt responses, photos, voice notes, and live verification selfies; (b) Information collected automatically, including coarse device location, device model, OS version, push tokens, and in-app telemetry; and (c) Information from third parties, such as authentication tokens from Google, Apple, or Facebook, and authorized activity splits from Strava.
3. Location Data & Approximate Geospatial Fuzzing
SUMMARY: Your exact GPS coordinates are NEVER exposed or stored. We fuzz your location to approximate ~1.1km grid cells to protect your running routes.
To protect your daily routine, home address, and running routes, PaceMatch NEVER exposes your exact GPS coordinates or live running paths to other athletes. Locations are mathematically fuzzed using random offsets and rounded to ~1.1 km coarse grid cells. Other members only see distance approximations (e.g. "Within 3 km") without revealing where you live or train.
4. Biometric & Computer Vision Verification Transparency
SUMMARY: Selfie verification checks facial presence ephemerally to prevent bots. We DO NOT store permanent biometric templates or train public AI models on your photos.
When you verify your athlete profile, automated on-device computer vision models verify that your live camera selfie matches the person in your uploaded profile photos. This verification is processed ephemerally. PaceMatch DOES NOT retain permanent biometric templates, and your photos are NEVER shared with third-party advertisers or used to train external generative AI models.
5. How We Use Your Information
SUMMARY: We use your data solely to operate the app: calculate pace compatibility, display cards, enable secure chat, and prevent spam.
We process personal data to calculate pace compatibility scores, match you with nearby runners, display your profile card, enable real-time messaging, verify user authenticity, send match notifications, and ensure platform safety and security.
6. How We Share Information & Strict No-Sale Guarantee
SUMMARY: We NEVER sell your personal data. We only share data with matched athletes and vetted technical infrastructure providers.
PaceMatch DOES NOT SELL personal data to data brokers or third-party advertisers. Data is shared only with: (a) other members viewing your public profile; (b) SOC2/ISO-certified cloud providers (Supabase, Firebase, Cloudflare, Resend, PostHog); and (c) law enforcement when legally compelled.
7. Cross-Border International Data Transfers
SUMMARY: Data is protected by Standard Contractual Clauses and encryption when transferred internationally.
Your data may be processed in secure facilities in the US and EU. Cross-border transfers comply with international data protection frameworks, including European Commission Standard Contractual Clauses (SCCs) and TLS 1.3 / AES-256 encryption.
8. Your Rights & Choices (GDPR, UK GDPR & CCPA/CPRA)
SUMMARY: You have full rights to access, correct, export, or permanently delete your data at any time.
You have full legal rights to access, export, rectify, and permanently delete your data. You can delete your account and all associated records directly in Profile > Settings > Safety > Delete Account, or by emailing privacy@pacematch.com.
9. Data Retention & Erasure Schedule
SUMMARY: Active profiles are kept while your account exists. Deleted accounts are completely purged within 30 days.
When you delete your account, your profile is immediately removed from discovery feeds. Encrypted safety logs are retained for up to thirty (30) days solely to enforce safety bans and prevent fraud, after which all records are permanently destroyed.
10. Children's Privacy (Strict 18+ Policy)
SUMMARY: PaceMatch is strictly for adults 18+. We never knowingly collect information from minors.
PaceMatch is strictly forbidden to individuals under eighteen (18) years of age. If we learn that an account has been registered by a minor, it will be deleted immediately along with all associated data. Report suspected minor accounts to safety@pacematch.com.
11. Security Safeguards
SUMMARY: We utilize TLS 1.3 encryption, database row-level security, and rate limiting to defend your data.
We maintain comprehensive technical safeguards, including TLS 1.3 encryption, Row Level Security (RLS) on cloud databases, and anti-scraping rate limits.
12. Contact Us & Data Protection Officer
SUMMARY: Contact our privacy team directly at privacy@pacematch.com.
For any privacy inquiries or DPO correspondence, contact us at: PaceMatch Inc., Attn: Data Protection Officer, Email: privacy@pacematch.com or dpo@pacematch.com.