Privacy Policy

This English version is provided for convenience. If it differs from the Spanish version, the Spanish version prevails.

1. Data controller

PaceRivals is a service operated by Manuel Aranda Rosales. For any question about your privacy you can get in touch at hola@pacerivals.com.

2. Data we collect

2.1 Account data

• Name and email address (to identify you and send you service-related communications).
• Profile photo (optional, if you add one).
• Sign-up date and last activity.

You can sign up with your email address or with Sign in with Apple or Google. In that case we only receive your name and a contact email from Apple or Google (which may be a forwarding alias if you use Apple's "Hide My Email").

2.2 Physical activity and health data

PaceRivals reads workout data from the following sources, only with your explicit permission:

• Apple Health (HealthKit) on iOS: workout sessions (running, cycling, walking), distance and duration. This data is read on your device, with your permission, and sent to our servers to calculate rankings and statistics.
• Health Connect on Android: the Android equivalent of HealthKit.

Health data is not sold, is not shared with third parties for advertising, and is not used for any purpose other than those described in this policy.

2.3 Usage and group data

• The groups you belong to and your fellow members in those groups (name and activity statistics).
• Challenges and achievements completed.

2.4 Payment data

Premium subscriptions are handled entirely through the App Store (Apple) or Google Play (Google). PaceRivals never sees or stores your card number or any banking details. We only receive from RevenueCat a confirmation of your subscription status (active/inactive) and the user's anonymous identifier.

2.5 Push notifications

If you allow notifications, we store your device token to send you alerts about activity in your groups and challenges (for example, when a group member overtakes you in the ranking). They are delivered through Firebase Cloud Messaging (Google). You can revoke this permission at any time in your device settings.

2.6 Technical data

• IP address and device type (to diagnose errors).
• Anonymous error logs.

3. How we use your data

• Providing the service: calculating rankings, showing your progress, comparing you with your group members.
• Service communications: push notifications about your activity and your group's.
• Improving the product: aggregated, anonymous usage analysis to detect problems and improve the experience.
• Managing subscriptions: verifying your Premium status.

We do not use your data for advertising or commercial profiling, and we do not pass it on to third parties other than the technical providers described in this policy.

4. Data shared with third parties

We only share data in the following cases, and only what is strictly necessary:

• RevenueCat: subscription management. It receives an anonymous user identifier (UUID) and the subscription status.
• Apple / Google: in-app payment processing through the App Store / Google Play, and sign-in with Sign in with Apple or Google.
• Firebase Cloud Messaging (Google): sending push notifications, only if you turn them on.
• Infrastructure provider (Railway): server hosting.

All providers are bound by GDPR-compliant data processing agreements where applicable.

5. Data visible to other users

Within a group, members can see your name, profile photo and activity statistics (distance, number of workouts, ranking position). Your email address is not visible to other users.

6. Legal basis (GDPR)

• Performance of a contract (Art. 6(1)(b)): data needed to provide the service you have requested.
• Consent (Art. 6(1)(a)): health data (HealthKit / Health Connect) and push notifications. You can withdraw your consent at any time.
• Legitimate interest (Art. 6(1)(f)): improving the product through aggregated, anonymous analysis.

7. Data retention

• For as long as your account is active.
• After you delete your account, your personal data is erased within a maximum of 30 days. Aggregated, anonymous data may be kept indefinitely.

8. Your rights

If you live in the European Economic Area, you have the right to:

• Access: request a copy of your data.
• Rectification: correct inaccurate data.
• Erasure: request the deletion of your account and data.
• Portability: receive your data in a structured format.
• Objection and restriction: object to certain processing.
• Withdrawal of consent: for health data and notifications at any time, without affecting the lawfulness of prior processing.

To exercise any of these rights, get in touch at hola@pacerivals.com. We will reply within a maximum of 30 days.

9. Security

Communications between the app and our servers are encrypted with TLS. Data is stored on servers with restricted access. Although we take reasonable security measures, no system is 100% infallible.

10. Minors

PaceRivals is not intended for anyone under 16. If you become aware that a minor has given us personal data, please contact us so we can delete it.

11. Changes to this policy

We may update this policy from time to time. We will notify you of significant changes through a notice in the app or by email. The "last updated" date at the top of the document shows when it was last revised.

12. Contact

For any question about this privacy policy or how your data is processed:
hola@pacerivals.com