Your privacy is our priority. Calcpace is a tool built by runners, for runners — we collect only what is strictly necessary to provide the service, and we never sell your data to anyone.

Who We Are

Calcpace is an independent project providing free running performance calculators, including pace calculation, race prediction, VO2max estimation, and performance by age. You can reach us at [email protected] for any privacy-related questions.

Who Controls Your Data

Calcpace is operated as an independent project by its maintainer, who is the data controller for everything described in this policy (controlador, LGPD art. 5, VI; controller, GDPR art. 4(7)). Every request in this policy — access, correction, deletion, portability, withdrawal of consent — goes to [email protected], and we will provide our full legal identification and postal address on request.

Data Protection Officer

Calcpace has no separate privacy department. The maintainer performs the role of data protection officer (encarregado, LGPD art. 41) and answers privacy requests personally at [email protected]. We reply within 30 days.

What Data We Collect

We collect different data depending on how you use the site: (1) Visitors without an account — the calculators and guides run in your browser, and we store nothing about you beyond the ordinary server logs every website keeps and the anonymous steps described below. (2) Registered users — your email address and your password (stored only as a hash); the profile you fill in (first and last name, username, bio, city, country, date of birth, sex, maximum heart rate, language and unit preference, and a photo if you upload one); the activities you log or import (date, name, distance, duration, pace, elevation, temperature, altitude, place, the effort you mark (easy, moderate, hard or max), average and peak heart rate, and the GPS route when you upload an activity file (GPX, FIT or TCX) or connect Strava); your active sessions (IP address, browser, date); your phone's notification token, only if you turn on notifications in the Android or iPhone app; and the record of the consents you gave. Heart rate, VO2max, date of birth and sex are health data and are stored only if you consent — see "Health data" below. We also store when you last used Calcpace while signed in, recorded at most once an hour. We also record a few steps in how the site and the apps are used: whether a sign-up worked or which field it failed on, when the profile was completed, where the first run came from, when a recording starts in the Android app, and which tab of the bottom bar or button of the welcome screen was tapped. Each record holds only that, the date and time, the language and whether it happened in the browser, the Android app or the iPhone app; we do not store your IP address, your device or anything you typed. Records tied to an account are deleted with it, and all of them are deleted after 180 days. On the public pages that show ads, Google additionally processes the data described under Advertising.

Health Data (Sensitive Data)

If you use the training features, Calcpace stores health data about you: your average and peak heart rate for each run, your maximum heart rate, your date of birth and your sex. From these we estimate VO2max, heart-rate zones and age-graded results. This is sensitive personal data under LGPD art. 11 and a special category of personal data under GDPR art. 9, and our only legal basis for it is your explicit consent — asked for separately when you set up your profile, never bundled with anything else, and recorded with its date, its version and the language you read it in. You can withdraw it at any time in Settings. When you do, we permanently delete every heart-rate and VO2max value we hold and stop calculating new ones, while the rest of your runs — distance, time, pace, elevation and map — stays exactly as it was. Calcpace keeps working without the physiological estimates.

Location and GPS Data

Your profile can hold a city and a country that you type in yourself. When you upload an activity file or import a run from Strava, we also store the route — the individual track points with their latitude and longitude, and the encoded map line. If you record a run with the recorder in the Android app, the app reads your phone's precise location only from Start to Finish — with the screen off too, which is why Android shows a notification for as long as it records — and at no other time. The route stays on your phone until it reaches your account, is deleted from the phone once it has, and becomes a run with its GPX file, like a file you upload; a run you discard is deleted without being sent. A route usually starts and ends where you started and ended your run, which for most people is their home. Your activities and their maps are visible only to you unless you make your profile public and the activity public, in which case the map, including its starting point, becomes visible to anyone with the link. You can delete an activity, remove its activity file, or make your profile private again at any time.

Activity Files (GPX, FIT, TCX)

You can attach to a run the file your watch or app recorded it in — GPX, FIT or TCX, as Garmin, Coros, Polar, Suunto and others export them, also compressed (.gz). We keep the file as you uploaded it, and read from it the start time, distance, duration, elevation and route, the laps the device marked, the maker of the device, and the series it measured along the way (heart rate, cadence, power, speed and temperature, one sample every five seconds). Heart rate is health data: without the consent described above it is discarded when the file is read, and withdrawing the consent deletes it. The original file, which we keep as you uploaded it, still contains the heart rate your device recorded — even without the consent, and after you withdraw it — until you remove the file or delete the run. The file and what was read from it stay until you remove the file from the run, delete the run or delete your account; the run is shown only to you unless you make it public. A file attached to a run imported from Strava, once it has been read successfully, becomes that run's recording and stays when Strava's copy expires — see the section on Strava.

Legal Basis for Each Purpose

We process each category of data for a specific purpose and on a specific legal basis: running your account (email address, password, sessions) — performance of the contract you enter into by accepting the Terms (LGPD art. 7, V; GDPR art. 6(1)(b)); storing and displaying the activities you log — the same contract; health data, meaning heart rate, VO2max, date of birth and sex — your explicit consent and nothing else (LGPD art. 11, I; GDPR art. 9(2)(a)); importing activities from Strava — your explicit consent, given when you connect the account; keeping the service secure and available, including abuse prevention — our legitimate interest (LGPD art. 7, IX; GDPR art. 6(1)(f)); responding to legal orders — compliance with a legal obligation. Recording when you last used Calcpace while signed in, to understand whether the service is being used — our legitimate interest (LGPD art. 7, IX; GDPR art. 6(1)(f)). Recording the sign-up and first-use steps described under "What Data We Collect", to understand where people give up — our legitimate interest (LGPD art. 7, IX; GDPR art. 6(1)(f)). Advertising on the public content pages runs on your consent (GDPR art. 6(1)(a)) where that consent is required, and on our legitimate interest in funding a free tool elsewhere. Importing runs from Health Connect in the Android app runs on your explicit consent, given when you connect it in the app. Importing runs from the Health app in the iPhone app runs on your explicit consent, given when you connect it in the app.

How We Use Your Data

Your email address is used exclusively for account authentication, password reset, and transactional notices about your account. We never send marketing email. Your activity data is used to compute and display your own performance history. Your activities are visible only to you unless you make your profile public and mark an activity as public — see "Location and GPS data".

Strava Integration

If you connect Strava, we request the activity:read_all scope, which includes the activities you keep private on Strava so that your training history is complete, and import your runs: date, name, distance, duration, elevation, city and country, the route, the device that recorded them and, when your device recorded them, heart rate (average, peak and the second-by-second series), cadence, power, temperature, laps and splits, and the workout type Strava records (race, long run, workout). Heart rate imported from Strava is health data and follows the consent described above. Runs imported from Strava are shown only to you: they can never be made public and never appear on your public profile. Strava access tokens are stored encrypted and are never shared or exported. Strava may collect usage data about how Calcpace uses its API, under Strava's own privacy policy. Disconnecting Strava, in Settings or from Strava itself, revokes our access and permanently deletes every activity we imported from it, together with its heart-rate and VO2max values, and we email you a confirmation once it is done. The link between your Calcpace account and your Strava athlete ID is deleted too, so signing in with Strava stops working until you connect again. Deleting your account does the same. Activities you logged by hand are not touched. Data imported from Strava is kept for up to 7 days and refreshed from Strava while the connection exists: each run is read again from Strava before it is 7 days old, and its laps, splits and second-by-second series are removed 7 days after they were fetched and fetched again the next time you open the run. An activity file (GPX, FIT or TCX) you attach to a run imported from Strava is your own: when that run expires, it stays as an activity of yours, rebuilt from the file. A photo attached to a run imported from Strava without an activity file is removed with the run when it expires.

Strava export file

You can send the ZIP file Strava emails you when you ask it for a copy of your account. From it we read only the list of activities (activities.csv) and the files of your runs and walks (GPX, FIT or TCX), plus the file of an activity whose sport the list does not give, only to tell whether it is a run: for each one, its date, name, type, distance, time and its number on Strava, so the same one is never brought in twice. The rest of the ZIP (messages, followers, login records with IP addresses, photos and the account's other spreadsheets) is never opened. The ZIP stays in our storage (Cloudflare R2) and on the server reading it only while it is read: it is deleted as soon as the import ends, whether it worked or not, and, if it never ends, about two days after it was sent. Each imported run becomes your own run, like the ones you log here, and its file follows the activity file rules above: without your consent, heart rate is discarded when the file is read, but the stored file still holds what the device recorded until you remove the file or delete the run. Imported runs start out visible only to you, and you can make them public like your other runs. Because they came from your file and not from Strava's API, they stay here if you disconnect Strava: to delete them, delete the runs or your account.

Garmin export file

You can send the ZIP file Garmin lets you download when you ask it for a copy of your account's data (Export Your Data). From it we read only the activity files your Garmin devices recorded (FIT) and, from the activities' summary, each activity's name and start time, so it comes with the name you gave it. To tell the activity files from the others, we read only the beginning of each FIT file, where it says what kind of file it is: the files of your days (steps, sleep, stress and the like) are never read further. The rest of the ZIP (your profile, health and sleep data, devices and everything else) is never opened. The ZIP, and the parts of it copied out to be read, stay in our storage (Cloudflare R2) and on the server reading it only while it is read: they are deleted as soon as the import ends, whether it worked or not, and, if it never ends, about two days after it was sent. Each imported run becomes your own run, like the ones you log here, and its file follows the activity file rules above: without your consent, heart rate is discarded when the file is read, but the stored file still holds what the device recorded until you remove the file or delete the run. Imported runs start out visible only to you, and you can make them public like your other runs. When the same run also came through the Strava connection, Strava's copy is kept hidden behind yours and follows the Strava rules above.

Health Connect (Android app)

If you connect Health Connect in the Calcpace Android app, the app reads from Health Connect on your phone only your runs and walks (exercise sessions of type running, treadmill running and walking) from the 30 days before you connected, your runs from the 3 years before that (if your phone supports it and you allow access to past data), and every new one after you connected: the start and end time, the app and device that recorded each one, its title, distance, active duration, elevation gained and, during the session, your average and maximum heart rate. For a run whose app marked no pauses, it also reads the steps your phone counted during it, only to estimate how long you stood still; the steps themselves are not stored. Only while the app is open, and only if you allow it on Health Connect's own question (for one run or for all), it also reads a run's route, to show its map; it does not read sleep, weight or any other type of data. Heart rate is health data and is kept only with the consent described above; without it, it is discarded on arrival. The app sends these values to Calcpace over an encrypted connection (HTTPS), and each run is stored like one you logged yourself: private unless you make it public, editable, and deletable. A run you delete here is not imported again. The import runs in the background only if you allow Health Connect to let Calcpace read in the background. Data from Health Connect is used only to show you your runs and what is computed from them (pace, VO2max, age-graded results, training zones, the "your run is in" notification); it is never sold and never used for advertising. Like the rest of your account, it is processed only by the providers listed under "Who Processes Data For Us"; the "your run is in" notification, with the run's distance, time and pace, is delivered through Google Firebase Cloud Messaging. Disconnecting, in Settings or by removing Calcpace's access in Health Connect, stops the import immediately; signing out on the phone does the same. Runs already imported stay until you delete them or your account, and their heart rate until you withdraw the health-data consent, even if you later remove a permission in Health Connect. While you are connected, a run deleted in Health Connect is deleted here too, unless you edited it in Calcpace or added a photo or a GPX file to it. If you turn on "Send runs recorded here to Health Connect", the app also writes each run you record with it to Health Connect on your phone (start and end time, pauses, distance and route), where the other apps you allow can read it; turning it off stops this, and what was written stays in Health Connect until you delete it there. Calcpace's use of information received from Health Connect follows Google Play's policy for Health Connect, including its limits on use.

Apple Health (iPhone app)

If you connect Apple Health in the Calcpace iPhone app, the app reads from the Health app on your iPhone, through Apple's HealthKit, only your runs and walks (workouts of type running, outdoors or on a treadmill, and walking) from the 30 days before you connected, your runs from the 3 years before that, and every new one after you connected: the start and end time, the duration, the distance, the elevation gained when the workout has it and, during the workout, your average and maximum heart rate, plus the name of the app and of the device that recorded each one. When the workout has a route (the path recorded by the watch's or phone's GPS), the app also reads the route, only to show the run's map; if you don't allow routes on Apple's permission screen, the run arrives without a map. It does not read steps, sleep, weight or any other type of health data, and it never writes anything to the Health app. Heart rate is health data and is kept only with the consent described above; without it, it is discarded on arrival. The app sends these values to Calcpace over an encrypted connection (HTTPS), and they are stored on our servers, in your account: each run like one you logged yourself, private unless you make it public, editable, and deletable. A run you delete here is not imported again. After the first import, iOS wakes the app in the background to send new workouts, at most about once an hour; opening the app sends them right away. What Calcpace receives through HealthKit is used only to import your runs into your own account and to show you what is computed from them (pace, VO2max, age-graded results, training zones, the "your run is in" notification). It is never used for advertising or marketing, never used for data mining, never sold, and never shared with third parties for advertising or marketing; like the rest of your account, it is processed only by the providers listed under "Who Processes Data For Us". If you turn on notifications on the iPhone, the "your run is in" notification, with the run's distance, time and pace, is delivered by Apple's own notification service (Apple Push Notification service). Disconnecting, in Settings › Apple Health, stops the import on all your iPhones immediately; signing out on the iPhone does the same on that iPhone. You can also remove Calcpace's access in the Health app (your picture › Apps, under Privacy › Calcpace); nothing more is read after that. Runs already imported stay until you delete them or your account, and their heart rate until you withdraw the health-data consent, even if you later remove a permission in the Health app. While you are connected, a workout deleted in the Health app is deleted here too, unless you edited it in Calcpace or added a photo or a GPX file to it. Calcpace's use of information received from HealthKit follows Apple's rules for HealthKit, including section 5.1.3 of the App Store Review Guidelines.

Signing In with Google

If you sign in with Google, Google sends us your email address, confirms that it has verified it, and gives us an identifier for your Google account. We keep the email address as your account's address and the identifier to recognize you the next time you sign in with Google. We do not ask Google for your name, photo, contacts or anything else, and we keep no Google access token. Signing in with Google is also covered by Google's own privacy policy.

Sign in with Apple (iPhone app)

If you sign in with Apple in the iPhone app, Apple sends us an identifier for your Apple account and an email address: yours or, if you choose to hide it, an Apple address that forwards our messages to you. We keep the email as your account's address, the identifier to recognize you the next time you sign in with Apple, and an Apple code we use only to tell Apple when you delete your account. We don't ask Apple for your name or anything else. Sign in with Apple is also governed by Apple's own privacy policy.

Cookies

Calcpace uses a minimal number of cookies and sets no tracking or profiling cookie. A signed session cookie identifies you after you log in and lasts until you log out or revoke that session in Settings. Your unit preference (km/mi) and temperature preference are kept in that same session cookie — not in your browser's local storage. Nothing else is stored on your device by Calcpace. On pages that show ads, Google's consent management platform sets its advertising identifiers — the __gads and __gpi cookies — on the calcpace.app domain itself, and Google may set further cookies from its own domains; in the EEA, the UK and Switzerland none of this happens before you consent. Beyond those advertising cookies, Calcpace sets nothing but the session cookie described above.

Analytics

To count visits and see how fast pages load, we use Cloudflare Web Analytics, a privacy-first analytics service that Cloudflare runs on our behalf. It uses no cookies, stores nothing on your device and does not track individuals across sites; it gives us only aggregate figures — which pages are visited, the referring site, the country, the device type and page-load performance. Cloudflare's privacy policy is at cloudflare.com/privacypolicy.

Advertising

Calcpace shows Google AdSense ads to signed-out visitors on its public tool pages — the calculators, the result pages (/result), the race calendar, the converter and the guides — and they may also appear when those pages are opened inside the Calcpace Android app. Signed-in users never see ads, anywhere, and no page that shows data from your account — your profile, your runs, your heart rate or your VO2max — carries ads or ad slots; neither do the landing page and the policy pages. In the EEA, the UK and Switzerland, Google's certified consent platform asks for your consent before any personalized ad or ad cookie loads, and you can refuse. Google serves these ads as an independent controller and may use cookies and device identifiers on those pages to serve, measure and, where you allow it, personalize ads; how Google uses that information is explained at policies.google.com/technologies/partner-sites. You can change or withdraw your consent at any time through the "Privacy and cookie settings" link in the footer of any page that shows ads.

Extra info on result pages

The result breakdown pages let you add your age, sex, max heart rate, race-day temperature and altitude to see your age grade, heart-rate zones and what the result is worth without that heat and altitude. That is calculated in your browser: Calcpace never sends those fields anywhere — they are not in the page address or in any request the page makes. Your browser keeps what you typed (localStorage) so the next result opens with it; the Clear button in that block erases it, and so does clearing this site's data in your browser. Signed in with health-data consent, the fields start from your profile, and that is not copied into your browser.

Who Processes Data For Us

We rely on a small set of providers, each acting only on our instructions: Heroku (application hosting and the PostgreSQL database), Cloudflare (the CDN and proxy that every request to calcpace.app passes through, which sees your IP address and request metadata; Web Analytics, cookieless and aggregate — see "Analytics"; R2 object storage for photos and activity files, and Turnstile, which receives your IP address on the sign-up page to tell humans from bots), Resend (transactional email — verification, password reset, account notices), AppSignal (application performance monitoring, which processes request metadata including IP addresses), and Strava (only if you choose to connect it). Google Firebase Cloud Messaging delivers the Android app's notifications, only to those who turn them on: it receives the phone's notification token and the text of the notification. Apple's notification service (Apple Push Notification service) delivers the iPhone app's, also only to those who turn them on: it receives the iPhone's notification token and the text of the notification. Each provider operates under its own privacy policy and a contract that limits it to processing data on our behalf.

California Privacy Rights

We do not sell or share personal information as those terms are defined by the California Consumer Privacy Act, and we do not process it for cross-context behavioural advertising. If you are a California resident, the rights listed above — to know, to access, to correct, to delete, and not to be discriminated against for exercising them — apply to you as well. Write to [email protected] to exercise any of them.

Children

Calcpace is not intended for children under 13, and we do not knowingly collect data from them. We do not verify age at sign-up. If you believe a child has created an account, write to [email protected] and we will delete the account and its data.

Data Sharing

We do not sell, rent or trade your personal data, and we never hand your account data to anyone for advertising. We share it only with the providers listed under "Who processes data for us", strictly so they can run the service on our instructions, and with authorities when a valid legal order requires it. Ads on public pages are served by Google directly in your browser, as described under Advertising — we do not hand Google your account data.

International Transfers

Our servers and providers are located outside Brazil — mainly in the United States and the European Union — so using Calcpace involves an international transfer of your data. Transfers rely on the contractual safeguards offered by each provider, including the European Commission's standard contractual clauses where they apply. Write to [email protected] if you want to know which provider holds which category of data.

Data Retention

Your account and everything attached to it are kept for as long as your account exists. Data imported from Strava is the exception: it is kept for up to 7 days and refreshed from Strava while the connection exists — see the section on Strava. You can delete your account yourself at any time from Settings — it asks for your password (or, if you signed up with Google or Strava and don't know it, your email address) and then permanently removes your profile, activities, heart-rate and VO2max values, GPS track points, photos, activity files, sessions and Strava connection. Deleting the account also deletes your phones' notification tokens, and signing out on a phone deletes that phone's token. Disconnecting Strava deletes everything imported from it immediately. Database backups are kept by our hosting provider, so a deleted record can survive in a backup for a while; backup copies are deleted within 30 days. We do not delete inactive accounts automatically; if we start doing so, we will announce it here and by email before it takes effect. The one exception is an account started without signing up (no email or password): after 90 days without use — not opened, and no run or sync arriving from a phone — it is deleted automatically, with everything in it. Signing out on a phone, or deleting your account, also deletes that phone's Health Connect link; disconnecting Health Connect stops the import, and the runs it already brought stay until you delete them or your account. The same goes for Apple Health in the iPhone app: signing out on the iPhone, or deleting your account, deletes that iPhone's link; disconnecting stops the import, and the runs it already brought stay until you delete them or your account.

Delete your Calcpace account and data

Automated Estimates

VO2max, heart-rate zones, age-graded percentages and race predictions are calculated automatically from the data you give us, using published formulas (Riegel, Cameron, Daniels & Gilbert, Alan Jones/USATF 2025 road age-grading tables). They are training estimates, not decisions about you: nothing about your account, your access or your treatment depends on them, and no profile derived from them is sold or shared. You can still ask us how a number was produced or ask for it to be reviewed (LGPD art. 20) at [email protected].

Your Rights (LGPD and GDPR)

Wherever you live, you can: confirm that we process your data and get a copy of it; correct incomplete or inaccurate data; ask for the anonymisation, blocking or deletion of unnecessary or excessive data; take your data elsewhere (portability); withdraw a consent you gave, at any time and without losing the parts of Calcpace that do not depend on it; know with whom we share your data; be told what happens if you refuse a consent; ask for a review of an automated estimate; object to or restrict processing based on legitimate interest; and complain to a supervisory authority. Deleting your account is one click in Settings, exporting your activity history as CSV is one click on the Activities page (runs imported from Strava are not included — export those from Strava), and health-data consent is a switch in Settings. For a full copy of everything we hold, or for anything else, email [email protected] — we answer within 30 days.

Complaints

If you think we mishandled your data, write to [email protected] first — we would rather fix it. You can also complain to a supervisory authority: in Brazil, the Autoridade Nacional de Proteção de Dados (ANPD, gov.br/anpd); in the European Economic Area or the United Kingdom, the data protection authority of the country where you live.

Changes to This Policy

We may update this policy from time to time. When we do, we will update the date at the top of this page. If a change affects how we handle health data or any other processing based on your consent, we will ask you to accept the new version before it applies to you.

Privacy Policy