Skip to content

Privacy Policy

Last updated: June 2026

Overview

Route Pacer is designed with a minimal data footprint. We collect only what is necessary to provide predictions, and we do not sell, share, or monetize your data. This policy describes what we collect, how we use it, and your rights.

Who this service is for

Route Pacer is offered only to residents of the United States and is not directed to individuals in the European Union, the European Economic Area, or the United Kingdom. If you are located outside the United States, please do not use this service.

Data Collected

Strava Activities (via OAuth2)

When you connect Strava, we fetch your recent running activities (up to 120 days) to compute your Grade Adjusted Pace profile. We do not permanently store raw GPS tracks, route coordinates, heart rate time series, or personal records. What we do save is your computed pace profile (median GAP pace, interquartile range, sample count) plus, for your recent activities in that rolling window, derived per-activity training summaries (grade/pace/effort analysis) used to build and refresh it — never the underlying GPS or raw activity data.

Heart Rate Data

Heart rate data is used only for aerobic efficiency tracking via Pa:HR decoupling analysis (comparing the ratio of pace to heart rate efficiency in the first half of a run versus the second half) and fatigue monitoring, when you explicitly consent in Settings. HR data is processed transiently during activity analysis and the resulting decoupling metrics are stored to your account. Raw HR time series are not permanently stored. Consent is optional and can be withdrawn at any time.

GPX Files You Upload

Race course GPX files you upload are processed in memory and on temporary disk storage to run the prediction pipeline, then discarded — there is no mechanism that saves your uploaded course or its route coordinates. The only stored course files are the public race routes in our curated course library, which we add and maintain ourselves; user uploads never become library courses.

Prediction Results

Prediction results (split times, course distance, conditions applied) are stored in your account so you can review your saved plans. These are associated with your account — whether a guest session or a registered login (email/password, Google, or Strava).

Data Storage

Your pace profile (a few numbers) and prediction history are stored in our database. Strava OAuth tokens are encrypted at rest using AES-256 (via Fernet) and are only decrypted when fetching activities on your behalf. We do not store OAuth tokens in plaintext.

Data Retention

Individual prediction results are automatically deleted 12 months after they are generated. Your pace profile (a small set of derived statistics) is automatically deleted after 24 months with no updates. Registered accounts that have been inactive (no sign-in or Strava sync) for 24 months are deleted entirely, cascading to all associated data. You may also delete your account at any time via Settings → Delete Account, which permanently removes all associated data immediately.

Anonymous / guest accounts that have no saved predictions are automatically deleted 7 days after creation.

Your Rights

  • Erasure (CCPA § 1798.105 / OCPA / Colorado CPA / Virginia VCDPA / Connecticut CTDPA): Delete all your data at any time via the Settings page.
  • Access (CCPA § 1798.110 / OCPA / Colorado CPA / Virginia VCDPA / Connecticut CTDPA): Your prediction results are visible in the History page; a full machine-readable copy of every record we hold about you is available via Portability below.
  • Correction (CCPA § 1798.106 / OCPA / Colorado CPA / Virginia VCDPA / Connecticut CTDPA): Your pace profile is derived from your training data — to correct it, provide updated training runs via Strava or upload corrected GPX files, then re-sync. Predictions are point-in-time snapshots and can be deleted and re-run with corrected inputs. To correct personal identifiers (email address, display name), email [email protected].
  • Revoke Strava: You can disconnect Strava at any time from your Strava app settings.
  • Portability (OCPA / Colorado CPA / Virginia VCDPA / Connecticut CTDPA): Download a complete machine-readable export of all data we hold about you from Settings → Download My Data in JSON format.

To exercise any of the rights above, email [email protected] with “Data Request” in the subject line. We will respond within 45 days. If we deny your request, you may appeal by replying to our denial within 30 days and we will review and respond within a further 45 days.

Third Parties

  • Strava — OAuth2 activity access, governed by Strava's Privacy Policy. We do not share your personal data with Strava beyond the OAuth2 exchange.
  • Google Sign-In — Optional sign-in method. If you choose to log in with Google, Google receives the OAuth sign-in interaction; we receive your Google account identifier and email address, which we use to create or access your account. No other Route Pacer data is shared with Google, and nothing is sent to Google unless you actively choose this sign-in method. Governed by Google's Privacy Policy.
  • Open-Meteo — Weather forecast and archive data. Requests include only a location (latitude/longitude) and date; no personal identifiers are transmitted. Open-Meteo does not store personally identifiable request data.
  • Overpass API (Wikimedia Foundation) — OpenStreetMap surface type lookups. When you run a prediction, we send the geographic bounding box of your uploaded race course (four coordinate floats) to overpass-api.de to retrieve surface=* tags (e.g. asphalt, trail) for terrain technicality estimation. No user identifier is transmitted — only the bounding box coordinates of the course. Bounding box coordinates carry no user identifier and are not personal data. The service is operated by the Wikimedia Foundation and governed by the Wikimedia Foundation Privacy Policy. No countersigned DPA is required given the non-personal-data nature of the request.
  • CARTO (map imagery)— Base-map tiles for the route maps shown with library-course predictions. Your browser never connects to CARTO: our own servers fetch each tile — identified only by map style and tile coordinates, with no user identifier or IP address attached — then cache it on our infrastructure and serve it to you first-party. Tiles are fetched only for the shared public courses in our race library; courses you upload yourself never produce a map, because we keep no route coordinates from them. Map imagery © OpenStreetMap contributors & CARTO.
  • Cookiebot (Usercentrics A/S) — Consent Management Platform. Records your cookie-consent choices and blocks non-essential cookies until you consent; supports CCPA opt-out and Global Privacy Control (GPC) signals. See Cookiebot's Privacy Policy.
  • Mediavine Grow— Audience-engagement and advertising technology from Mediavine, Inc. Grow currently powers newsletter subscriptions and content alerts on this site. The Grow script is served from Mediavine's CDN, so loading it transmits your IP address to Mediavine as part of the ordinary HTTP request; however, Grow sets no cookies and performs no tracking or personalisation until you give consent through the banner. When you choose to subscribe via a Grow prompt, the email address you enter is collected and stored by Mediavine on our behalf. Mediavine publishes a privacy policy at mediavine.com/privacy-policy.
  • HubSpot — Used for email communications and marketing automation (race reminders, feature release announcements). Data shared: email address, page views. Data is only transmitted to HubSpot when you actively opt in to email updates via the subscription form on the upload page. The HubSpot script loads only after you accept marketing cookies in the consent banner; once loaded it records page views, and none of that activity is associated with you personally unless you identify yourself by submitting your email address. HubSpot publishes a privacy policy at hubspot.com/legal/privacy-policy.
  • Resend — Transactional email delivery. Used to send email that Route Pacer generates — the race-director partnership enquiry form and account-related messages (email-address verification, password reset), plus opt-in reminders in future. Data shared: the contents of those messages, including any name and email address you enter into a form. Resend publishes a Data Processing Addendum (DPA). See Resend's Privacy Policy.
  • Cloudflare — Domain registrar and DNS provider for routepacer.com. Cloudflare does not proxy or terminate Route Pacer user requests; it resolves the domain name only. DNS query logs may include the querying IP address. Cloudflare publishes a Data Processing Addendum (DPA). See Cloudflare's Privacy Policy.
  • Railway — Hosts the Route Pacer API and database. All persistent user data (pace profiles, prediction results, encrypted Strava tokens) resides on Railway infrastructure. Railway publishes a Data Processing Addendum (DPA). See Railway's Privacy Policy.
  • Google Workspace— Hosts Route Pacer's email inboxes (e.g. partnerships@ and privacy@). Email you send us — partnership enquiries submitted through the form, and any data-subject-rights requests — is received and stored in Google Workspace. Data shared: the contents of those messages, including your name and email address. Google LLC publishes a Cloud Data Processing Addendum. See Google's Privacy Policy.

Route Pacer is moving to an ad-supported model. Mediavine, Inc. (the company behind Grow) is our advertising and audience-engagement partner. Advertising-related processing operates only on the consent choices you make through the banner, and this policy will be updated as advertising features roll out.

Contact & Data Controller

The data controller for personal data processed by Route Pacer is:

Ridgeline Labs LLC

5441 S Macadam Ave Ste N, Portland OR 97239, USA

Email: [email protected]

For privacy questions or data requests, please email the address above.

Do Not Sell My Personal Information

Route Pacer does not sell, rent, or share your personal information with third parties for commercial purposes. This notice is provided in compliance with the California Consumer Privacy Act (CCPA/CPRA) and similar US state laws (Oregon OCPA, Colorado CPA, Virginia VCDPA, Connecticut CTDPA, and others). We also honour the Global Privacy Control (GPC) opt-out signal. If you have questions about your data, see the Contact section above.

Canadian Users (PIPEDA)

If you are located in Canada, your personal information is collected, used, and disclosed in accordance with Canada's Personal Information Protection and Electronic Documents Act (PIPEDA) and applicable provincial privacy laws. You have the right to access the personal information we hold about you and to request correction of inaccuracies. To exercise these rights, email [email protected]. We will respond within 30 days.

Age Restriction

Route Pacer is not directed at children under the age of 16. We do not knowingly collect personal information from anyone under 16. Before connecting Strava or generating a prediction, users must affirm they are at least 16 years of age via an unbundled checkbox. This threshold is well above the US Children's Online Privacy Protection Act (COPPA) threshold of 13. If we learn we have collected personal information from a person under 16, we will delete it promptly. If you believe we may have information from or about a person under 16, please contact us at [email protected].