Privacy Policy

Last updated: 17 October 2026

This policy explains what PaceMates (“we”) collects when you use the PaceMates app and website, why, and the choices you have. We follow the data-protection laws that apply to you. Questions: support@pacemates.in.

What we collect

Account: your email address and a password (stored only as a secure hash by our sign-in provider), or your Google account (below). We email you a code only when you reset your password.
Sign in with Google (if you choose it): Google shares your name, email address and profile photo with us. We use them only to create and sign in to your account and to fill in your profile (you can change the name and photo). We don’t get your Google password, contacts or anything else from your Google account.
Profile: name, username, optional photo, city, bio, running style, sports and goal, an optional Instagram username, and that you confirmed you are 18 or older.
Activities: GPS routes, distance, time, pace, splits, elevation, steps, heart rate (if you connect a sensor or import from Health Connect), calories, notes, photos you add, and how the activity felt. Location is only recorded while you record an activity (“While using the app”); we never ask for background location.
Steps: with your permission (“Physical activity”), the phone’s step counter while you record, to show steps and cadence for that activity. Your daily step count is read from Health Connect if you connect it.
Heart rate: if you connect a Bluetooth heart-rate sensor (chest strap or watch), we read your heart rate while you record and save the average, maximum and a simple heart-rate graph with the activity. Bluetooth is used only to talk to the sensor you choose — never to find your location. Heart-rate zones are a training guide, not medical advice.
Body weight (optional): if you enter it (Goals → Calories or Edit profile), we use it only to estimate the calories of your activities. It is private: only you can see it, it is never shown on your profile or to anyone else, and it is never used for ads. Calories are always an estimate (from your sport, distance, time, weight and heart rate when available); without a weight an average is used. Empty the field to delete it.
Live location you share: only if you turn on Live share during a recording, or share your live location for a run plan, see Live share below.
Social: follows, cheers, comments, posts, chats and messages (with reactions and, if you allow it, “Seen” read receipts), run plans and meeting pins, clubs, events, challenges, blocks and reports.
Camera: used only while you scan a friend’s QR code; no picture is saved or uploaded.
Device: a push-notification token (if you allow notifications) and your app version.
Purchases: if you buy PaceMates Pro (a monthly or yearly subscription, with a free trial for new subscribers on the yearly plan), Google Play handles the payment, the trial, renewals and cancellations. Google Play and RevenueCat (our subscription service) tell us only whether your subscription is active, so Pro turns on or off on your account. We never see your card or payment details. Manage or cancel any time in Play Store → Subscriptions.
Diagnostics: crash reports (Sentry) and anonymous usage counts (PostHog). These never include your location, routes, email, name, notes or messages.
Training (Pro): if you start a training plan, we store its goal, length, the planned runs and which ones you completed; interval workouts save each interval’s distance and time with the activity. Run analysis is worked out from your own activity data and is only shown in the app.
Ads (free plan): Google AdMob shows small “Sponsored” cards in some lists and, only when you choose to watch one, a short rewarded video (for example to save your streak). Never while you record. AdMob may use your device’s advertising ID. Ads are non-personalised unless you turn on “Personalised ads” in Settings → Ads & data. When you watch a rewarded ad we store which reward you got and when, to apply the limits (for example one streak freeze a month).

Health Connect

If you choose Connect your watch (Settings → Data sources), PaceMates asks Android’s Health Connect for permission to read these data types: exercise sessions, distance, heart rate, total calories burned and steps. We never write to Health Connect.

Why: to import the workouts your watch or fitness app saves (shown as activities “From <app>” in your training log, streak and goals, with distance, pace, heart rate, calories and steps), and to show today’s steps and your daily steps goal.
When: only while the app is open (you tap Sync, or the app checks for new workouts when you open it). No background reading: the first time, workouts from the last 30 days; after that, only new ones.
Who sees it: an imported workout follows the same visibility as your other activities (everyone, followers or only you; you can change it). Daily steps are only shown to you.
You can remove the permission at any time in Health Connect, and delete imported activities in the app.

Limited Use: PaceMates’ use of information received from Health Connect adheres to the Health Connect Permissions policy, including the Limited Use requirements. Health Connect data is used only to provide the features above; it is never used for advertising, never sold, never shared with ad networks or data brokers, never used to decide credit or insurance, and people at PaceMates do not read it except with your consent, for security, or where the law requires it.

Live share is off unless you turn it on for a recording. Then your phone sends your current position (about every 20 seconds), your route so far, time, distance, pace and battery level to a private link (pacemates.in/live/…) that only the people you send it to can open. It stops when you finish or discard the recording or turn sharing off, and the page closes shortly after. Your privacy zone is cut from the shared route.
Run plans: the meeting pin you choose is shown to the people invited to the plan. If you tap “I’m here” we check you are near the pin; if you share your live location on the way, it uses the same Live share link and stops when you arrive or turn it off.

Early access sign-up (website)

What we collect: if you sign up for early access on pacemates.in, we store your first name, the Google account email you enter, when you signed up and where your request is (waiting, approved, invited). We also keep a one-way scrambled code of your internet address for one day, only to stop spam sign-ups; never the address itself.
What we use it for: only to send your test invite (we add your email to the testers list on Google Play so you can install the app) and to tell you when PaceMates launches. Nothing else: no newsletters from others, no ads, never sold or shared for marketing.
Emails: sent through Resend, our email service, from hello@mail.pacemates.in.
Deleting it: reply to any of our emails or write to support@pacemates.in and we delete your sign-up (and remove you from the testers list) within 7 days. We delete all early access sign-ups when testing ends.

How we use it

To run the app: show your activities, streaks, levels, feed, clubs, events, challenges, plans and messages.
To keep it fair and safe: anti-cheat checks, reports and moderation.
To send notifications you switched on (cheers, comments, messages, streak reminders, events, plans).
To fix crashes and improve the app.

We do not sell your personal data, your location or your health and fitness data.

Who can see what

You choose who sees each activity: everyone, followers, or only you. A private account limits everything to approved followers.
Privacy zones cut your route near a place you choose (e.g. home), and you can hide the start and end of every route.
The full GPS track stays on your phone; only a simplified, privacy-trimmed route is uploaded.
You can delete your own chat messages for everyone, or hide any message just for yourself (“Delete for me”).
Chats are seen only by the people in them. Turn off “Show when I’ve read messages” (Settings → Privacy) and nobody sees “Seen” from you.
Blocked people can’t see your activities, profile details or message you.

Where it is stored

Your data is stored with Supabase on Amazon Web Services (region ap-south-1), encrypted in transit and at rest. Service providers we use: Supabase (database, sign-in, storage), Expo (app updates and push delivery), Google (Sign in with Google, maps, Smart route, AdMob, Google Play in-app updates, Firebase push), RevenueCat (subscriptions), Sentry and PostHog (diagnostics), Resend (emails, including early access invites). Each only gets what it needs.

How long we keep it

As long as you have an account. When you delete your account, your data is deleted straight away and removed from backups within 30 days. See Delete your account.

Your rights

You can see and edit your data in the app, withdraw consent (for example turn off notifications, personalised ads, location, physical activity, Bluetooth or Health Connect access), and delete your account at any time. To make any request or a complaint, email support@pacemates.in. We reply within 7 days.

Children

PaceMates is for people aged 18 and older. We don’t knowingly collect data from children.

Changes

If we change this policy we’ll update the date above and tell you in the app for important changes.