Privacy policy

Last updated: 7 October 2026

Who is the data controller

The controller of the data collected through app.peakpacing.com, the PeakPacing apps for Android and iOS and this website is TO_BE_COMPLETED (controller name and address). For any privacy request, write to TO_BE_COMPLETED (contact email).

This website (peakpacing.com)

The pages on peakpacing.com are static HTML: no login, no cookies, no analytics or tracking tools. The site is served by Cloudflare, which, like any host, processes your IP address and technical request data to deliver the page and protect it from abuse. Fonts are loaded from Google Fonts, which therefore receives your browser's IP address.

What data the app collects

• Account. If you sign in with Google: account identifier, name, email and profile picture, handled by Firebase Authentication. If you sign in with Strava: your Strava athlete id (Strava does not provide an email address). You can also use the app without an account, through an anonymous sign-in.
• Training profile and settings. Thresholds (FTP, threshold heart rate, pace), weight, zones, nutrition and hydration preferences, language, theme and the app's other settings.
• Workout sessions. When you save a session: date, duration, the power, heart rate, cadence, speed and distance recorded, and summary metrics.
• Courses. The GPX files you load. If you use the Race Wizard for a race, the course profile is stored in an archive shared among registered athletes, together with the race name and edition and the identifier of whoever uploaded it, so others can reuse it.
• Credentials for connected services. Access tokens for Strava and Intervals.icu and, if you enter it, your Google Gemini API key.
• Usage data. The app uses Google Analytics for Firebase for aggregate usage statistics (screens opened, device and browser type, approximate country).

Bluetooth sensor data (smart trainer, treadmill, heart rate strap, cadence and speed sensors) is read by your device during the session and leaves it only if you save the session or upload it to a connected service. The app does not use your GPS location.

Why we use it

• To provide the service you ask for: computing the pacing plan, controlling the trainer, saving and syncing sessions and settings across your devices (legal basis: performance of a contract, Art. 6(1)(b) GDPR).
• To send sessions to Strava or Intervals.icu and read thresholds and planned workouts from them, only if you connect these services (legal basis: your consent, which you withdraw by disconnecting them).
• To understand how the app is used and improve it through aggregate statistics (legal basis: legitimate interest, Art. 6(1)(f) GDPR).

We do not use your data for advertising, commercial profiling or automated decisions with legal effects.

Who it is shared with

• Google Firebase (Google LLC / Google Ireland): authentication, Firestore database and Analytics. Your account, settings and saved sessions live here.
• Cloudflare: hosting for the app and for the server that handles Strava sign-in.
• Strava: only if you connect it. PeakPacing requests permission to read your profile and upload activities (read, activity:write) and uploads the sessions you choose to send. Data on Strava is governed by Strava's privacy policy.
• Intervals.icu: only if you connect it. PeakPacing reads thresholds, wellness data, activities and planned workouts, and uploads the sessions you choose to send.
• Google Gemini: only if you enter your own API key and use the AI Coach. In that case your profile, recovery data, today's workout and an excerpt of recent sessions are sent to Google with your key, under the Gemini API terms.
• Open-Meteo: receives the course coordinates and race date to return the weather forecast. It receives nothing that identifies you.

Some of these providers also process data outside the European Union, notably in the United States; such transfers rely on the EU-US Data Privacy Framework or the standard contractual clauses adopted by the providers. We do not sell data to anyone.

Local storage

The app stores settings, preferences and tokens for connected services in your browser's or device's storage (localStorage), so it does not have to ask for them every time. Firebase uses local storage to keep you signed in, and Analytics an identifier to tell visits apart. You can clear all of it from your browser settings or by uninstalling the app.

How long we keep it

Your account, settings and saved sessions are kept for as long as your account exists. When you ask for your account to be deleted, we erase the associated data within 30 days. Courses already published to the shared race archive may remain available, stripped of the reference to your account. Data you sent to Strava or Intervals.icu stays on those services and is managed there.

Your rights

You can at any time ask to access, correct or delete your data, restrict its processing, object to processing based on legitimate interest, and receive a copy in a machine-readable format (Arts. 15-22 GDPR). To exercise these rights, or to have your account deleted, write to TO_BE_COMPLETED (contact email). You can disconnect Strava and Intervals.icu from the app at any time, and also revoke access from those services' own settings. You also have the right to lodge a complaint with your local data protection authority (in Italy, the Garante per la protezione dei dati personali).

Children

PeakPacing is not intended for people under 14 and does not knowingly collect their data.

Security

All traffic goes over HTTPS. Database rules restrict each user's data to that user alone, and the Strava integration secret stays on the server, never in the code running in the browser.

Changes

If we change this policy we update the date at the top of the page; for significant changes we will also let you know in the app.