Your privacy is our priority. Calcpace is a tool built by runners, for runners — we collect only what is strictly necessary to provide the service, and we never sell your data to anyone.

Who We Are

Calcpace is an independent project providing free running performance calculators, including pace calculation, race prediction, VO2max estimation, and performance by age. You can reach us at [email protected] for any privacy-related questions.

Who Controls Your Data

Calcpace is operated as an independent project by its maintainer, who is the data controller for everything described in this policy (controlador, LGPD art. 5, VI; controller, GDPR art. 4(7)). Every request in this policy — access, correction, deletion, portability, withdrawal of consent — goes to [email protected], and we will provide our full legal identification and postal address on request.

Data Protection Officer

Calcpace has no separate privacy department. The maintainer performs the role of data protection officer (encarregado, LGPD art. 41) and answers privacy requests personally at [email protected]. We reply within 30 days.

What Data We Collect

We collect different data depending on how you use the site: (1) Visitors without an account — the calculators and guides run in your browser, and we store nothing about you beyond the ordinary server logs every website keeps. (2) Registered users — your email address and your password (stored only as a hash); the profile you fill in (first and last name, username, bio, city, country, date of birth, sex, maximum heart rate, language and unit preference, and a photo if you upload one); the activities you log or import (date, name, distance, duration, pace, elevation, temperature, altitude, place, the effort you mark (easy, moderate, hard or max), average and peak heart rate, and the GPS route when you upload a GPX file or connect Strava); your active sessions (IP address, browser, date); your phone's notification token, only if you turn on notifications in the Android app; and the record of the consents you gave. Heart rate, VO2max, date of birth and sex are health data and are stored only if you consent — see "Health data" below. On the public pages that show ads, Google additionally processes the data described under Advertising.

Health Data (Sensitive Data)

If you use the training features, Calcpace stores health data about you: your average and peak heart rate for each run, your maximum heart rate, your date of birth and your sex. From these we estimate VO2max, heart-rate zones and age-graded results. This is sensitive personal data under LGPD art. 11 and a special category of personal data under GDPR art. 9, and our only legal basis for it is your explicit consent — asked for separately when you set up your profile, never bundled with anything else, and recorded with its date, its version and the language you read it in. You can withdraw it at any time from your profile settings. When you do, we permanently delete every heart-rate and VO2max value we hold and stop calculating new ones, while the rest of your runs — distance, time, pace, elevation and map — stays exactly as it was. Calcpace keeps working without the physiological estimates.

Location and GPS Data

Your profile can hold a city and a country that you type in yourself. When you upload a GPX file or import a run from Strava, we also store the route — the individual track points with their latitude and longitude, and the encoded map line. A route usually starts and ends where you started and ended your run, which for most people is their home. Your activities and their maps are visible only to you unless you make your profile public and the activity public, in which case the map, including its starting point, becomes visible to anyone with the link. You can delete an activity, remove its GPX file, or make your profile private again at any time.

Legal Basis for Each Purpose

We process each category of data for a specific purpose and on a specific legal basis: running your account (email address, password, sessions) — performance of the contract you enter into by accepting the Terms (LGPD art. 7, V; GDPR art. 6(1)(b)); storing and displaying the activities you log — the same contract; health data, meaning heart rate, VO2max, date of birth and sex — your explicit consent and nothing else (LGPD art. 11, I; GDPR art. 9(2)(a)); importing activities from Strava — your explicit consent, given when you connect the account; keeping the service secure and available, including abuse prevention — our legitimate interest (LGPD art. 7, IX; GDPR art. 6(1)(f)); responding to legal orders — compliance with a legal obligation. Advertising on the public content pages runs on your consent (GDPR art. 6(1)(a)) where that consent is required, and on our legitimate interest in funding a free tool elsewhere. Importing runs from Health Connect in the Android app runs on your explicit consent, given when you connect it in the app.

How We Use Your Data

Your email address is used exclusively for account authentication, password reset, and transactional notices about your account. We never send marketing email. Your activity data is used to compute and display your own performance history. Your activities are visible only to you unless you make your profile public and mark an activity as public — see "Location and GPS data".

Strava Integration

If you connect Strava, we request the activity:read_all scope, which includes the activities you keep private on Strava so that your training history is complete, and import your runs: date, name, distance, duration, elevation, city and country, the route, the device that recorded them and, when your device recorded them, heart rate (average, peak and the second-by-second series), cadence, power, temperature, laps and splits, and the workout type Strava records (race, long run, workout). Heart rate imported from Strava is health data and follows the consent described above. Runs imported from Strava are shown only to you: they can never be made public and never appear on your public profile. Strava access tokens are stored encrypted and are never shared or exported. Strava may collect usage data about how Calcpace uses its API, under Strava's own privacy policy. Disconnecting Strava, from your account page or from Strava itself, revokes our access and permanently deletes every activity we imported from it, together with its heart-rate and VO2max values, and we email you a confirmation once it is done. The link between your Calcpace account and your Strava athlete ID is deleted too, so signing in with Strava stops working until you connect again. Deleting your account does the same. Activities you logged by hand are not touched. Data imported from Strava is kept for up to 7 days and refreshed from Strava while the connection exists: each run is read again from Strava before it is 7 days old, and its laps, splits and second-by-second series are removed 7 days after they were fetched and fetched again the next time you open the run. A GPX file you attach to a run imported from Strava is your own: when that run expires, it stays as an activity of yours, rebuilt from the file. A photo attached to a run imported from Strava without a GPX file is removed with the run when it expires.

Health Connect (Android app)

If you connect Health Connect in the Calcpace Android app, the app reads from Health Connect on your phone only your runs and walks (exercise sessions of type running, treadmill running and walking) from the 30 days before you connected and every new one after that: the start and end time, the app and device that recorded each one, its title, distance, active duration, elevation gained and, during the session, your average and maximum heart rate. It does not read routes, steps, sleep, weight or any other type of data. Heart rate is health data and is kept only with the consent described above; without it, it is discarded on arrival. The app sends these values to Calcpace over an encrypted connection (HTTPS), and each run is stored like one you logged yourself: private unless you make it public, editable, and deletable. A run you delete here is not imported again. The import runs in the background only if you allow Health Connect to let Calcpace read in the background. Data from Health Connect is used only to show you your runs and what is computed from them (pace, VO2max, age-graded results, training zones, the "your run is in" notification); it is never sold and never used for advertising. Like the rest of your account, it is processed only by the providers listed under "Who Processes Data For Us"; the "your run is in" notification, with the run's distance, time and pace, is delivered through Google Firebase Cloud Messaging. Disconnecting, on the account page or by removing Calcpace's access in Health Connect, stops the import immediately; signing out on the phone does the same. Runs already imported stay until you delete them or your account, and their heart rate until you withdraw the health-data consent, even if you later remove a permission in Health Connect. Calcpace's use of information received from Health Connect follows Google Play's policy for Health Connect, including its limits on use.

Signing In with Google

If you sign in with Google, Google sends us your email address, confirms that it has verified it, and gives us an identifier for your Google account. We keep the email address as your account's address and the identifier to recognize you the next time you sign in with Google. We do not ask Google for your name, photo, contacts or anything else, and we keep no Google access token. Signing in with Google is also covered by Google's own privacy policy.

Cookies

Calcpace uses a minimal number of cookies and sets no tracking or profiling cookie. A signed session cookie identifies you after you log in and lasts until you log out or revoke that session from your account page. Your unit preference (km/mi) and temperature preference are kept in that same session cookie — not in your browser's local storage. Nothing else is stored on your device by Calcpace. On pages that show ads, Google's consent management platform sets its advertising identifiers — the __gads and __gpi cookies — on the calcpace.app domain itself, and Google may set further cookies from its own domains; in the EEA, the UK and Switzerland none of this happens before you consent. Beyond those advertising cookies, Calcpace sets nothing but the session cookie described above.

Analytics

To count visits and see how fast pages load, we use Cloudflare Web Analytics, a privacy-first analytics service that Cloudflare runs on our behalf. It uses no cookies, stores nothing on your device and does not track individuals across sites; it gives us only aggregate figures — which pages are visited, the referring site, the country, the device type and page-load performance. Cloudflare's privacy policy is at cloudflare.com/privacypolicy.

Advertising

Calcpace shows Google AdSense ads to signed-out visitors on its public tool pages — the calculators, the result pages (/result), the race calendar, the converter and the guides — and they may also appear when those pages are opened inside the Calcpace Android app. Signed-in users never see ads, anywhere, and no page that shows data from your account — your profile, your runs, your heart rate or your VO2max — carries ads or ad slots; neither do the landing page and the policy pages. In the EEA, the UK and Switzerland, Google's certified consent platform asks for your consent before any personalized ad or ad cookie loads, and you can refuse. Google serves these ads as an independent controller and may use cookies and device identifiers on those pages to serve, measure and, where you allow it, personalize ads; how Google uses that information is explained at policies.google.com/technologies/partner-sites. You can change or withdraw your consent at any time through the "Privacy and cookie settings" link in the footer of any page that shows ads.

Extra info on result pages

The result breakdown pages let you add your age, sex, max heart rate, race-day temperature and altitude to see your age grade, heart-rate zones and what the result is worth without that heat and altitude. That is calculated in your browser: Calcpace never sends those fields anywhere — they are not in the page address or in any request the page makes. Your browser keeps what you typed (localStorage) so the next result opens with it; the Clear button in that block erases it, and so does clearing this site's data in your browser. Signed in with health-data consent, the fields start from your profile, and that is not copied into your browser.

Who Processes Data For Us

We rely on a small set of providers, each acting only on our instructions: Heroku (application hosting and the PostgreSQL database), Cloudflare (the CDN and proxy that every request to calcpace.app passes through, which sees your IP address and request metadata; Web Analytics, cookieless and aggregate — see "Analytics"; R2 object storage for photos and GPX files, and Turnstile, which receives your IP address on the sign-up page to tell humans from bots), Resend (transactional email — verification, password reset, account notices), AppSignal (application performance monitoring, which processes request metadata including IP addresses), and Strava (only if you choose to connect it). Google Firebase Cloud Messaging delivers the Android app's notifications, only to those who turn them on: it receives the phone's notification token and the text of the notification. Each provider operates under its own privacy policy and a contract that limits it to processing data on our behalf.

California Privacy Rights

We do not sell or share personal information as those terms are defined by the California Consumer Privacy Act, and we do not process it for cross-context behavioural advertising. If you are a California resident, the rights listed above — to know, to access, to correct, to delete, and not to be discriminated against for exercising them — apply to you as well. Write to [email protected] to exercise any of them.

Children

Calcpace is not intended for children under 13, and we do not knowingly collect data from them. We do not verify age at sign-up. If you believe a child has created an account, write to [email protected] and we will delete the account and its data.

Data Sharing

We do not sell, rent or trade your personal data, and we never hand your account data to anyone for advertising. We share it only with the providers listed under "Who processes data for us", strictly so they can run the service on our instructions, and with authorities when a valid legal order requires it. Ads on public pages are served by Google directly in your browser, as described under Advertising — we do not hand Google your account data.

International Transfers

Our servers and providers are located outside Brazil — mainly in the United States and the European Union — so using Calcpace involves an international transfer of your data. Transfers rely on the contractual safeguards offered by each provider, including the European Commission's standard contractual clauses where they apply. Write to [email protected] if you want to know which provider holds which category of data.

Data Retention

Your account and everything attached to it are kept for as long as your account exists. Data imported from Strava is the exception: it is kept for up to 7 days and refreshed from Strava while the connection exists — see the section on Strava. You can delete your account yourself at any time from Account settings — it asks for your password (or, if you signed up with Google or Strava and don't know it, your email address) and then permanently removes your profile, activities, heart-rate and VO2max values, GPS track points, photos, GPX files, sessions and Strava connection. Deleting the account also deletes your phones' notification tokens, and signing out on a phone deletes that phone's token. Disconnecting Strava deletes everything imported from it immediately. Database backups are kept by our hosting provider, so a deleted record can survive in a backup for a while; backup copies are deleted within 30 days. We do not delete inactive accounts automatically; if we start doing so, we will announce it here and by email before it takes effect. Signing out on a phone, or deleting your account, also deletes that phone's Health Connect link; disconnecting Health Connect stops the import, and the runs it already brought stay until you delete them or your account.

Delete your Calcpace account and data

Automated Estimates

VO2max, heart-rate zones, age-graded percentages and race predictions are calculated automatically from the data you give us, using published formulas (Riegel, Cameron, Daniels & Gilbert, Alan Jones/USATF 2025 road age-grading tables). They are training estimates, not decisions about you: nothing about your account, your access or your treatment depends on them, and no profile derived from them is sold or shared. You can still ask us how a number was produced or ask for it to be reviewed (LGPD art. 20) at [email protected].

Your Rights (LGPD and GDPR)

Wherever you live, you can: confirm that we process your data and get a copy of it; correct incomplete or inaccurate data; ask for the anonymisation, blocking or deletion of unnecessary or excessive data; take your data elsewhere (portability); withdraw a consent you gave, at any time and without losing the parts of Calcpace that do not depend on it; know with whom we share your data; be told what happens if you refuse a consent; ask for a review of an automated estimate; object to or restrict processing based on legitimate interest; and complain to a supervisory authority. Deleting your account is one click in Account settings, exporting your activity history as CSV is one click on the Activities page (runs imported from Strava are not included — export those from Strava), and health-data consent is a switch in your profile settings. For a full copy of everything we hold, or for anything else, email [email protected] — we answer within 30 days.

Complaints

If you think we mishandled your data, write to [email protected] first — we would rather fix it. You can also complain to a supervisory authority: in Brazil, the Autoridade Nacional de Proteção de Dados (ANPD, gov.br/anpd); in the European Economic Area or the United Kingdom, the data protection authority of the country where you live.

Changes to This Policy

We may update this policy from time to time. When we do, we will update the date at the top of this page. If a change affects how we handle health data or any other processing based on your consent, we will ask you to accept the new version before it applies to you.

Privacy Policy