Privacy notice
This notice explains what PaceTag stores about you, why, who sees it, who else handles it, how long we keep it and what you can ask of us. It covers the PaceTag app on iPhone, Android and Apple Watch, the course builder at pacetag.app/courses/ and the spectator page at pacetag.app/s/. The PaceTag waitlist has its own privacy notice.
PaceTag in short
- Location is off until you turn it on for a group. Your coordinates never leave your phone.
- We keep only your latest position, as a distance along the course. Never a history.
- Health data from Apple Health stays on your Apple Watch and in Apple Health. We never receive it.
- Groups end within 24 hours. What they held is deleted 30 days later.
- No ads, no analytics in the app, no profiling, no selling of data.
- You can delete your account in the app at any time.
Who is responsible
The data controller is:
- Marcus Jonathan Ong, trading as PaceTag, a Swedish sole trader (enskild firma)
- Organisation number: [to be added]
- VAT number: [to be added]
- Address: [postal address to be added]
- Email: privacy@pacetag.app
Write to privacy@pacetag.app about anything in this notice. We answer within one month. We have not appointed a data protection officer; the controller handles these questions himself.
What we collect
- Your sign-in account. Your email address and the sessions and devices you sign in from. Clerk, our sign-in provider, holds this. Our own database receives a random account ID from Clerk and does not store your email address.
- Your 18+ confirmation. We ask for your date of birth once, check on our server that you are 18 or over, and keep only the time you confirmed. The date itself is not kept. We do not check ID.
- Your groups. The groups you start or ask to join, the name you show in each group, your role (host, co-lead or runner), whether the host approved you, and whether you share your location with that group. For a group you host: its name, any event name you type, its join code, its course, its rules, its end time and your two switches for spectator links.
- Your latest position, only while you share it. How far along the course you are, how accurate that reading is and when it was taken. Not your coordinates. See Your location.
- Your courses. The route line (a list of points), its name and its length. A course can come from:
- a file (GPX, KML or GeoJSON). Only the line is read. Times, heart rate and elevation in the file stay on your device.
- drawing on a map, in the app or in the course builder at pacetag.app/courses/. To follow paths, the points you tap for each leg are sent to Mapbox's directions service, which returns a path between them.
- recording a run. The track stays on your phone while you record. Only when you save it as a course is the line uploaded, after you have trimmed or reversed it if you want to.
- Spectator links you create. Who the link is for (the label you write), when it ends, whether it may show pack status, and a scrambled (hashed) copy of the link's secret. The link itself is shown to you once and we cannot read it back.
- Cheers. A short text (up to 80 characters) that someone with your link sends you, with the time. Only you see it, with the name you gave the link. You can turn cheers off for each group.
- Technical data. Our hosting, backend and map providers process your network (IP) address, device and app details and request details, to deliver the service and keep it secure.
We do not collect your coordinates or tracks on our servers, a history of where you have been, health data (see Apple Health), your contacts, your personal identity number (personnummer), ID documents or payment details. Nothing can be bought in PaceTag during the pilot. The app has no analytics and no advertising. If we add paid plans later, we will update this notice before they start.
Your location
- PaceTag uses your location only after you tap Start following my run, for a group whose sharing switch you turned on. Your phone then asks for permission, while you use the app. PaceTag never asks to use your location all the time.
- While you follow a run, your phone matches each GPS reading to the course itself. Only the result is sent: how far along the course you are, its accuracy and the time, at most every 3 seconds. When you are off the course, nothing is sent.
- With the screen locked, iPhone shows its location indicator and Android shows a notification (“PaceTag is following your run”) for as long as it runs.
- No coordinates, tracks or GPS readings are stored, on the phone or on our servers. We keep only your latest position, and delete it as soon as you stop sharing, leave the group or the group ends.
- In the course builder, Find me asks your browser for your location once, only when you press it, to move the map there. The position stays in your browser. Mapbox sees which map area is loaded.
Apple Watch, Live Activities and Apple Health
Live Activity on the lock screen and the Smart Stack
While you follow a run, your iPhone shows a Live Activity on the lock screen and in the Dynamic Island, and your Apple Watch shows it in the Smart Stack. It shows the group's name, the host's name and your gap to the host (or, for the host, how many are with you). Anyone who can see your lock screen or watch can see it. Your phone updates it itself: no push service and no PaceTag server is involved. You can turn Live Activities off for PaceTag in the iPhone's settings.
The watch app
The watch app shows the same glance. Your iPhone sends it to your paired watch over Apple's connection between your own devices. You can run in one of two ways:
- As a companion. Your own workout app records your workout as usual. PaceTag never starts a workout by itself.
- As a PaceTag workout, which you choose and start yourself on the watch. PaceTag then records the workout and saves it to Apple Health. Starting one ends any other app's workout on the watch, and the watch tells you so first.
Apple Health: health data stays on your devices
Heart rate and workouts are health data, which the law protects more strictly. PaceTag uses them only if you allow it in Apple Health's permission screen, and only on your own devices.
- Read: your heart rate, only if you turn it on in the watch app, to show it to you on the watch. In companion mode it is the heart rate your own workout app saves to Apple Health.
- Write: in a PaceTag workout only: the run as a workout, with its heart rate, active energy and distance. No route or location is saved with it.
- Health data stays on your Apple Watch and in Apple Health. PaceTag never sends it anywhere: not to the PaceTag app on your phone, our servers, your group, a spectator or any of our providers. We cannot see it, and we never use it for advertising, profiling or anything other than showing it to you and saving your workout.
- Your permission is the off switch. Change or withdraw it at any time in the Health app (your profile, then Apps, then PaceTag) or in the iPhone's settings under Privacy & Security, Health. Workouts already saved stay in Apple Health until you delete them there.
- Apple Health may sync your health data to your other devices through iCloud. That happens under Apple's terms and settings, not ours.
Why we use it, and on what legal basis
- Your account, groups, display name, courses and spectator links as a service: signing you in, letting you start, join and run groups, and keeping your courses. Basis: our contract with you (the terms of use), GDPR Article 6(1)(b). The 18+ confirmation is part of that contract.
- Sharing your position with a group. Basis: your consent, Article 6(1)(a). It is off when you join, you turn it on per group, and turning it off withdraws it and deletes your stored position. PaceTag still works without it.
- Showing your progress on a spectator link. Basis: your consent, given by creating the link for someone you choose. Revoke the link to withdraw it.
- Pack status and the course on spectator links. They reveal the host's rough position and route, so they need the host's consent (a switch per group, off by default) and, for pack status, also the runner's (per link, off by default).
- Health data on your devices. Basis: your explicit consent, Article 9(2)(a), which you give and withdraw in Apple Health. We treat it that way even though the data never reaches us.
- Keeping the service secure and preventing misuse: refusing implausible positions, limiting repeated requests and protecting accounts. Basis: our legitimate interest, and yours, in a service that cannot be used to track people, Article 6(1)(f). You can object (see your rights below).
- Answering requests about your data, and legal duties. Basis: legal obligation, Article 6(1)(c).
Withdrawing consent does not make earlier use unlawful. Gaps, zones and freshness are worked out automatically so the app can show them, but we make no decisions about you that have legal or similarly significant effects, and we do not profile you.
Who sees what in PaceTag
- Your group (its approved members): the name you show, your role, whether you share your location, and while you share, your latest distance along the course and how fresh it is. Members see the group's course, including where it starts and finishes.
- The host and co-leads also see your request to join, and can approve, decline or remove you.
- A spectator with your link sees your own progress along the course, how fresh it is and when the link ends. They see the course on a map only if the host allowed it, and “with, behind or ahead of the pack” only if both the host and you allowed it. They never see the other runners. They need no account: anyone who holds the link can follow you until the link ends, you revoke it, or the group ends. Treat it like a key. They can also send you short cheers, which only you see; you can turn cheers off.
- Anyone who can see your lock screen or watch can see the Live Activity while you follow a run.
- Nobody but you sees your heart rate or workouts in PaceTag.
Who else handles it
These providers process data for us under data-processing agreements:
- Convex, Inc.: PaceTag's backend and database, stored in the EU (Ireland). Convex is a US company; any transfer outside the EU and EEA relies on the EU's standard contractual clauses (2021).
- Clerk, Inc. (United States): sign-in, your email address and sessions. Transfers rely on Clerk's certification under the EU–US Data Privacy Framework, with the standard contractual clauses as a fallback.
- Mapbox, Inc. (United States): maps in the app, the course builder and the spectator page, and the directions service when you draw a course. Mapbox receives your IP address, device and app details, the map area you view (which can reveal where a course is) and, when you draw, the points you tap. The app switches Mapbox's telemetry off; only you can turn it on, in the map's information (i) button. The app never gives Mapbox your device's location. Transfers rely on the standard contractual clauses (2021).
- Cloudflare, Inc. (United States, global network): hosting pacetag.app, including the course builder and the spectator page. It stores no location. Transfer safeguard: [to verify]
Apple and Google distribute the app (TestFlight, the App Store and Google Play) and provide the phone and watch features PaceTag uses, such as location, Live Activities, Apple Health and the connection to your watch. They do this under their own terms and privacy policies, not as our processors. If you test PaceTag through TestFlight or Google Play's testing tracks, Apple or Google shares with us the address your invitation went to and any feedback, screenshots or crash reports you choose to send [what each store shares with developers: to verify].
We may share data with authorities when the law requires it, and with an accountant or lawyer who is bound to confidentiality. We never sell your data.
How long we keep it
- Sign-in account and 18+ confirmation: until you delete your account.
- Your position: only the latest one, deleted when you stop sharing, leave or are removed, or the group ends.
- Groups last at most 24 hours. The group, its members, their names and requests are deleted 30 days after it ends.
- Spectator links stop working when they expire, when you revoke them or when the group ends, whichever comes first. The record is deleted 30 days after the group ends.
- Cheers are deleted with the group, 30 days after it ends, or with your account if that is sooner.
- Courses: until you delete them or your account. A course cannot be deleted while an open group is running it.
- A recording you have not saved stays on your phone and is never uploaded.
- Health data: never on our servers. It stays in Apple Health for as long as you keep it there.
- Emails to privacy@pacetag.app about your data: 12 months after we have closed the matter, to show that we handled it.
- Technical logs at our hosting, backend and map providers: their standard short periods [to verify]
When you delete your account (in the app, under You), groups you host end for everyone, you leave the others and your position goes at once, and your memberships, courses, spectator links and 18+ confirmation are deleted. Then your sign-in account at Clerk is deleted. Groups you hosted that had already ended are deleted on the usual 30-day schedule.
Your rights
- See your data, and take it with you. Ask us for a copy.
- Correct it. Replace a course's line yourself, or write to us.
- Delete it. Turn sharing off, leave a group, revoke a link, delete a course, or delete your account in the app. Or write to us.
- Withdraw consent at any time with the same switch you used to give it: the sharing switch, revoking a link, the host's switches, or Apple Health's permissions.
- Restrict or object. Ask us to pause using your data while a question is settled, and object to anything we do on the basis of legitimate interest.
Write to privacy@pacetag.app. We answer within one month. If you are unhappy with how we handle your data, you can complain to IMY (Integritetsskyddsmyndigheten), the Swedish data protection authority, at imy.se, or to the authority where you live.
Cookies and storage in your browser
PaceTag uses only what it needs to work, so it asks for no cookie consent. It has no advertising cookies and no analytics cookies.
- The spectator page (pacetag.app/s/) sets no cookies and loads no analytics. The link's secret sits after the # in the address, which your browser never sends to any server. The page connects to our backend (Convex) and loads the map from Mapbox.
- The course builder (pacetag.app/courses/) uses Clerk's sign-in cookies:
__session(a short-lived sign-in token),__client_uat(whether your session is still current) and, on Clerk's sign-in domain,__client(keeps you signed in). Some names carry a short suffix. The sign-in form runs Clerk's bot and fraud protection, which checks your browser and connection, and Clerk may set other short-lived technical cookies [the full list in production: to verify]. - Maps on the web: Mapbox's map script counts each map load and keeps a random identifier for that in your browser's local storage (
mapbox.eventData) [what the count sends to Mapbox: to verify]. - Other pages on pacetag.app, such as this one, count visits with Cloudflare Web Analytics, which sets no cookies. The waitlist notice explains it.
- On your phone, the app keeps your sign-in in the iPhone Keychain or Android's encrypted storage, and your settings in the app's own storage.
Adults only
PaceTag is for people aged 18 and over. If we learn that someone under 18 has an account, we delete it as described above.
Changes
When this notice changes, we update the date at the top. For important changes, such as a new kind of data or a new provider, we tell you in the app before the change applies.