Privacy Policy

PaceVelo ("PaceVelo", "we", "us") is a workplace platform that lets a company's HR admin run branded running, walking, and cycling challenges for their employees, using activity data synced from Strava and/or Google Health. This policy explains what information we collect through the PaceVelo service (the "Service"), how we use it, and the choices you have.

If you have questions about this policy or want to exercise any of the rights described below, contact the PaceVelo owner at me@khaw.cc.

We collect the following categories of information:

• Company & HR admin information — company name, URL slug, uploaded logo, an optional Slack webhook URL, and an HR admin's name, work email, and a bcrypt-hashed password. We never store passwords in plain text.
• Employee/participant information — name, email address, department, and which company and challenges you've joined.
• Strava data — if you connect Strava, we receive your Strava athlete ID and OAuth access/refresh tokens, and we sync the activity type, distance, moving time, elevation gain, and date of workouts you record on Strava that match a challenge you've joined. We do not receive your Strava password.
• Google Health data — if you connect Google Health, we receive a stable Google account identifier and OAuth access/refresh tokens, and we sync your daily step counts. We do not receive your Google password.
• Login & session data — we record the fact and time of each sign-in (to power basic usage stats for HR admins and our own support/back-office tooling) and issue an httpOnly session cookie to keep you signed in. We do not use third-party analytics or advertising trackers.

We use the information above to:

• Operate challenge leaderboards and match synced activity/step data to the right challenges;
• Authenticate you and maintain your session;
• Verify company membership (e.g. matching your email domain to your employer's challenge);
• Send one-time verification codes to confirm your email when you join a challenge;
• Prevent duplicate or fraudulent accounts (e.g. one Strava or Google account can't be linked to two PaceVelo profiles at once);
• Provide customer support and troubleshoot the Service.

Leaderboard standings (name, department, and your challenge metric — e.g. total distance or steps) are visible to everyone at your company via your company's leaderboard page, since that's the core purpose of the Service. Your HR admin and PaceVelo's own back-office support staff can see your account details (name, email, department, connection status) to help run and support your company's challenges.

We do not sell your personal information. We share information only with:

• Strava and Google — to authenticate you and fetch the activity or step data you've authorized us to access;
• Neon (database hosting) and Vercel (application hosting and file storage) — to run the Service;
• Resend — to deliver the email verification codes we send when you join a challenge;
• Where required by law, or to protect the rights, safety, or property of PaceVelo, our users, or others.

We retain your information for as long as your account and your company's access to PaceVelo remain active. You can disconnect Strava or Google Health at any time from your dashboard, which revokes our access and stops further syncing (previously synced activity/step data is not automatically deleted).

To delete your account entirely, ask your company's HR admin or email me@khaw.cc — deleting a profile removes your account, synced activity/step history, and challenge participation records.

• Disconnect Strava and/or Google Health at any time from your employee dashboard.
• Sign out at any time; sessions also expire automatically.
• Request access to, correction of, or deletion of your data by contacting us at the email above.

We use industry-standard practices to protect your information, including encrypted connections (HTTPS) between your browser and our servers, bcrypt password hashing, and httpOnly session cookies that aren't accessible to client-side scripts. No method of transmission or storage is 100% secure, and we can't guarantee absolute security.

PaceVelo is a workplace product intended for use by employees of participating companies and is not directed at children. We do not knowingly collect information from anyone under 16.

We may update this policy from time to time. If we make material changes, we'll update the "Last updated" date above. Continued use of the Service after a change constitutes acceptance of the updated policy.

Questions about this policy or your data? Email me@khaw.cc.