Privacy Policy

Isopace is operated by Marek Paňko, an independent entrepreneur (OSVČ) established in the Czech Republic. We are committed to protecting your privacy and ensuring that your personal data is handled safely and responsibly. In this policy, “we,” “our,” or “us” refers to this data controller.

• Data controller. Marek Paňko (OSVČ), IČO 23702524, DIČ CZ0709066886, registered in the Czech Trade Licensing Register (živnostenský rejstřík); the registered place of business is on file in the public register. Contact the controller at privacy@isopace.run.
• This Privacy Policy explains how we collect, use, and protect your information when you use the Isopace application and website.
• By using Isopace, you agree to the collection and use of information in accordance with this policy. It is governed by the laws of the Czech Republic and the EU General Data Protection Regulation (GDPR).

To provide you with personalized endurance coaching and training plans, we collect the following types of information:

• Account information. When you join the waitlist or create an account, we collect your email address. If an account is created, we store a hashed password or a magic-link sign-in token, alongside session tokens to keep you authenticated. If you signed up with an invite code, we store which code it was, to count sign-ups per partner; it is deleted with your account.
• Activity data. When you upload or sync activity files (such as .fit or .gpx files), we collect and store the file and extract a normalized summary.
• Metrics extracted. This summary includes sport type, time, distance, elevation, GPS data, heart rate, power, cadence samples, and the device/brand the activity was recorded on (e.g. Garmin, Coros, Suunto), when present in the file.
• Future race data. We collect goal-race routes and web pages you provide to us so that we can accurately model the course terrain and specific demands of your target event.
• Public GPX readout. The public /read page lets you drop a race GPX without an account. We process the file in memory to show distance, climbing, and an elevation profile, then discard it. We do not store that file or tie it to you unless you later create an account and upload a course yourself.
• Map tiles. When you open the race map on /races or in the onboarding map, your browser loads vector map tiles from OpenFreeMap (tiles.openfreemap.org). Like any web request, OpenFreeMap receives your IP address and browser user-agent string to serve the tiles. No cookies are set and no account or training data is sent.
• Website analytics. On the public website we use Google Analytics (Google Ireland Limited) to measure page visits and traffic sources. Analytics cookies are off by default and are only set if you allow them in the cookie banner.
• App usage analytics. Inside the app we use PostHog (PostHog Inc., data stored in the EU, in Frankfurt) to understand how the app is used: which pages you open, what you click, how long a visit lasts and whether you come back. These events are linked to your account ID and email address. We also record masked session replays: all text and every form field are hidden, so a replay shows where you clicked, not what you typed or your training data. When the app hits an error, PostHog also receives an error report: the error message, where in the code it happened and the page, linked to your account ID when you are signed in, so we can fix it. PostHog stores nothing on your device (no cookies, no local storage). The legal basis is our legitimate interest in improving the app. You can object at any time by email; we will then stop analysing your use and delete what was collected.
• Emails about Isopace. We occasionally email the address on your account about Isopace (new features, tips for getting started, testing news) through Resend (Resend, Inc., USA, under the EU–US Data Privacy Framework or EU standard contractual clauses). Every such email has a one-click unsubscribe link; unsubscribing does not affect sign-in emails. The legal basis is the existing-customer exception in Section 7(3) of Czech Act No. 480/2004 Coll.

Connecting Strava is optional. It is the automatic way to get your training into Isopace — most watches (Garmin, Coros, Suunto, Polar) already push their activities to Strava — and you can use Isopace without it by uploading files yourself. If you choose to connect your Strava account:

• Scope of access. We request the activity:read_allscope. This is read-only and covers your activities, including those you have marked “Only You” on Strava, so your plan is built on your whole training history rather than a public subset. We never request permission to write to your Strava account, and we never post, edit, or delete anything there.
• What we import. For each activity we store Strava's summary — sport type, start time, elapsed and moving time, distance, elevation gain, average and maximum heart rate, and the device it was recorded on — alongside the original response, so a later improvement to our processing can be applied to it. For a small number of your hardest efforts we also fetch the time, heart-rate, and cadence samples, which is the only way to tell a genuine sustained maximum from a heart-rate strap glitch.
• Connection details we store. To keep the sync running we store your Strava athlete ID, the access and refresh tokens Strava issues us, their expiry, and a marker of how far your history has been synced. These are held in our database and are used solely to fetch your activities.
• Active connection requirement. We only sync while your connection remains active. Nothing is sent from Isopace back to Strava.
• Revoking access. You may disconnect Strava from Settingsat any time. This immediately deletes the tokens we hold and stops all future syncing; activities already imported stay in your Isopace account until you delete them or your account. You can additionally revoke Isopace’s access from your own Strava settings under My Apps.
• Data deletion. Deleting your Isopace account permanently removes your Strava connection and all activities synced from it, on the terms set out under Retention below.
• Strava's own terms. Strava is an independent data controller for the data held in your Strava account. Its handling of that data is governed by the Strava Privacy Policy, not this one.

Connecting Polar Flow is optional and separate from Strava. Polar only shares exercises from the last 30 days, and only those uploaded after you connect — it is not a year of history. If you choose to connect your Polar account:

• Scope of access. We request the accesslink.read_all scope. This is read-only. We never write workouts back to Polar Flow.
• What we import. For each exercise we download Polar's FIT file when available (GPS, heart rate, and other samples) and otherwise Polar's exercise summary — sport, start time, duration, distance, average heart rate, and device. We keep the original payload so a later improvement to our processing can be applied to it.
• Connection details we store. To keep the sync running we store your Polar user ID, the access token Polar issues us, its expiry, and a marker of how far your history has been synced. Polar does not issue a refresh token; when the access token lapses you reconnect. These are held in our database and used solely to fetch your activities.
• Active connection requirement. We only sync while your connection remains active. Nothing is sent from Isopace back to Polar.
• Revoking access. You may disconnect Polar from Settings at any time. This de-registers you with Polar AccessLink, deletes the tokens we hold, and stops all future syncing. Activities already imported stay in your Isopace account until you delete them or your account.
• Data deletion. Deleting your Isopace account permanently removes your Polar connection and all activities synced from it, on the terms set out under Retention below.
• Polar's own terms. Polar is an independent data controller for the data held in your Polar Flow account. Its handling of that data is governed by the Polar Privacy Notice, not this one.

We use the data we collect exclusively to provide and improve the Isopace coaching service. Specifically, we use your data to:

• Estimate your current fitness level and terrain readiness.
• Model your target race course.
• Generate a customized weekly training plan.
• Adjust and adapt your ongoing plan based on the actual runs you complete.
• Retain and reprocess uploaded files periodically to improve the accuracy of our coaching models as our algorithms evolve.

Isopace can write short plain-language notes that explain your week and your form. The plan itself is always produced by our own deterministic engine; the AI only puts its numbers into words.

• Provider. The notes are written by Claude, a model from Anthropic, PBC (United States), which processes the data below on our behalf. Data is transferred under the EU Standard Contractual Clauses or the EU–US Data Privacy Framework. Anthropic does not use data sent through its API to train its models.
• What is sent. Your fitness, fatigue and form numbers, the sessions of the current week (type, length, pace and heart-rate targets), the distance of your goal race, and your training phase. For runs you uploaded as a file or synced from Polar, the summary of the run (distance, duration, average heart rate, pace and training load) may be included.
• What is never sent. Your name, email address, GPS tracks or routes, raw recordings and files, race names, injury or health answers, or anything imported from Strava.
• Your control. Notes are on by default. You can turn them off at any time in Settings; doing so stops all transfers and deletes the notes we stored. Stored notes are also deleted after 30 days and when you delete your account.
• Not medical advice. A note explains your training numbers. It is not medical advice, and we filter out replies that stray into injury, medication or diet; see our Terms.

We are deeply committed to the privacy of your training and health data.

• No selling or renting. We do not sell, rent, or trade your personal data, training history, or Strava or Polar data to any third parties or advertisers.
• Service providers. We may share your information strictly with trusted third-party vendors who perform critical services on our behalf (such as cloud hosting, email delivery, product analytics and the AI model provider named in the AI coach notes section).
• Vendor agreements. These third parties operate under strict confidentiality agreements and are permitted to use your data only to the extent necessary to provide their specific services to us.

We apply practical safeguards to keep your account and training data secure:

• Encryption in transit. All traffic between your device and Isopace is served over HTTPS/TLS.
• Credential hygiene. Passwords are stored using the bcrypt one-way hash. Sign-in and magic-link tokens are stored only as SHA-256 hashes — the original token is never written to our database.
• Access control. Activity and GPS data is scoped to your account; every read or write requires a valid, unexpired session token.
• Managed storage. Data is held in managed cloud Postgres with access restricted to the Isopace service.

We retain your personal data and activity history only for as long as you maintain an active account with Isopace.

• Active accounts. Data is kept while your account is active to ensure the continuous functioning and adaptation of your training plans.
• Deletion on request. When you delete your account, your data is removed from our active systems immediately and purged from encrypted backups within 30 days — except where we are legally required to retain specific records.
• Inactive accounts. Accounts with no activity for 24 months are automatically deleted.

Depending on your location, including under the General Data Protection Regulation (GDPR), you hold specific rights regarding your personal data:

• Right to access. You may request a copy of the personal data we hold about you at any time.
• Right to erasure (right to be forgotten). You may request the deletion of your personal data.
• Right to rectification. You can request that we correct any inaccurate or incomplete personal data.
• Right to withdraw consent. Where we rely on your consent to process personal data (such as Strava or Polar), you may withdraw that consent at any time.
• Right to lodge a complaint. If you believe we have mishandled your personal data, you may lodge a complaint with the Czech supervisory authority, the Office for Personal Data Protection (Úřad pro ochranu osobních údajů, uoou.gov.cz).

We may update our Privacy Policy from time to time.

• If we make material changes to this policy, we will update this page and, where appropriate, notify you directly via email or an in-app prominent notice prior to the change becoming effective.