Controller
PACE CULTURE
Owner: Diplom-Sportwissenschaftler Andreas Heller
Maybachstraße 7
40470 Düsseldorf
Germany
Phone: +49 177 59 68 456
E-Mail: andreas@paceculture.de
Scope
This privacy policy applies to the PACE CULTURE TRAIN app. The general website has a separate privacy policy.
Data the app processes
PACE CULTURE TRAIN processes only data required for training, analysis, synchronization, and features you actively use.
This includes profile and training information such as your goal, training days, preferences, and plan status, as well as readiness, effort, pain, illness, or injury information you enter.
If you use a PACE account, we also process account data required for sign-in, account security, and device changes. This may include your email address, optional display name or username, internal account and athlete IDs, session and installation identifiers, and, when you use Sign in with Apple or Google, the relevant provider ID and—where supplied by the provider—your email address. Passwords are stored only as cryptographic hashes; provider and session tokens are not stored in plaintext.
With your Apple Health permission, the app reads selected fitness and health data: workouts, activity type, time, duration, distance, heart rate, running speed, resting heart rate, HRV, and sleep duration. For recent runs, time-based heart-rate, speed, and distance points may also be processed for analysis and workout matching.
Apple Health remains the source. The app does not mirror your complete HealthKit history as a permanent local copy. Selected data required by the PACE Engine is transmitted to the PACE backend over an encrypted HTTPS connection.
The current app requests read access to HealthKit only and does not request permission to write health measurements to HealthKit. WorkoutKit is separate and is used to send planned structured workouts to Apple Watch.
Purposes of processing
The data is used to represent your training status and history, plan and adapt training, evaluate completed sessions, interpret recovery signals, create race and performance analyses, and synchronize structured workouts with Apple Watch.
HealthKit data is not used for advertising, marketing, advertising profiling, or sale to data brokers.
Legal bases
Where personal data is required to provide the training features you request, processing is based on Article 6(1)(b) GDPR. Where special categories of personal data, in particular health data, are processed, this takes place only with your explicit permission and consent under Article 9(2)(a) in conjunction with Article 6(1)(a) GDPR.
Technically necessary security and operational data may be processed on the basis of Article 6(1)(f) GDPR. The legitimate interest is the secure, stable, and abuse-resistant operation of the service.
Hosting and recipients
The PACE backend is currently operated on Render Services, Inc. Render processes data as a hosting and infrastructure provider. Where data is transferred to the United States, the applicable safeguards, including the EU-US Data Privacy Framework and, where relevant, Standard Contractual Clauses, are taken into account.
Apple processes data in connection with Apple Health, WorkoutKit, Location Services, and WeatherKit under Apple's applicable privacy terms. PACE CULTURE does not sell your data.
Location, route, and weather
For weather and route context, the app may—only after your permission—evaluate location and workout route data on the device. Exact GPS coordinates and the complete route are not transmitted to the PACE Engine. For WeatherKit, a location is sent to Apple Weather to retrieve weather data for that location; only the derived, minimized context is sent to the PACE backend.
Weather data is provided by Apple Weather through WeatherKit and may be modified or summarized for PACE analyses. Real-time weather guidance may be inaccurate and is not intended for emergency, warning, or life-saving decisions.
Optional research and validation
PACE may offer optional participation in a separate research and validation program to scientifically evaluate and improve the accuracy and quality of the PACE Engine. Participation is not required to use the normal app and begins only after separate explicit consent.
Only minimized, derived training and outcome data is used for this program, for example pre-event forecasts, prescribed versus completed sessions, weekly adherence, and explicitly confirmed race outcomes. Research fact data does not contain email addresses, login credentials, exact GPS routes, raw HealthKit sample streams, or arbitrary sensitive free text.
Research data is stored under a random research ID. A protected link to the PACE account is retained only so consent, export, withdrawal, and deletion can be fulfilled reliably. You can withdraw research consent separately at any time; future collection then stops and your linked research contributions are deleted without disabling your normal PACE account or training service.
Retention and security
Account data and server-side training and analysis state are generally retained for as long as your account exists and the data is required to provide the PACE training service. When account deletion completes successfully, account-linked primary data is deleted. A minimal pseudonymous deletion audit containing no HealthKit data, training state, email address, or raw account ID is retained for 365 days so that restoring an older backup cannot silently reactivate an account that was already deleted.
Technical security events are normally retained for up to 90 days. The production database uses encrypted point-in-time recovery backups with a current recovery window of 3 days. If a backup is restored, deletion reconciliation is performed before the restored data can be used in production. Temporary restore copies are deleted after the restore or verification process is complete.
Unacknowledged transmissions may be stored briefly and protected on the iPhone to support offline synchronization. These transmission payloads are removed after successful acknowledgement. The app also stores the version and time of your explicit consent locally so the consent status remains traceable.
Data transmitted between the app and the PACE backend uses encrypted HTTPS connections. Local cache and outbox data uses iOS Data Protection.
Your rights and withdrawal
Subject to the GDPR, you have rights including access, rectification, erasure, restriction of processing, data portability, and—where applicable—objection. You can withdraw consent at any time with effect for the future.
You can withdraw your consent to health-data processing directly in the app under My PACE → Legal & Privacy → Data rights & deletion. The app then stops future HealthKit access and further processing and transmission of health data for the PACE backend training service. You can additionally change Apple Health and location permissions in iOS Settings. Withdrawal does not automatically erase data that was lawfully processed before the withdrawal.
You can export the personal data held by PACE directly in the app. You can also explicitly delete your PACE account there. After successful deletion, account-linked primary data and active sessions are removed; for an Apple-linked account, the service also attempts to revoke the existing Apple authorization where technically possible using the available provider token. Alternatively, you can contact andreas@paceculture.de.
Right to lodge a complaint
You may lodge a complaint with a data protection supervisory authority. In North Rhine-Westphalia, this includes the State Commissioner for Data Protection and Freedom of Information of North Rhine-Westphalia (LDI NRW), Kavalleriestraße 2–4, 40213 Düsseldorf.
Health and safety
PACE CULTURE TRAIN is a running and fitness training application. It is not intended to diagnose, treat, cure, or prevent disease and does not replace medical examination, diagnosis, or treatment.
Analyses and recommendations depend on the data available. Wearables, HealthKit, GPS, weather data, and training models can provide incomplete or inaccurate values. In a medical emergency, use your local emergency service rather than the app.
Updates
We update this policy when data processing, features, service providers, or legal requirements change. The currently published version applies.