Privacy Policy

Who we are

Pacer ("we", "us", "our") is a free running route planner for the UK, available at runpacer.co.uk. For the purposes of the UK GDPR and the Data Protection Act 2018, Pacer is the data controller for the personal data described in this policy. You can reach us about anything in this policy — including data access, correction, or deletion requests — by emailing privacy@runpacer.co.uk.

What we collect

• Account data: email address, an authentication identifier, and (optionally) a display name and profile photo if you sign in with Google.
• Your runs: routes, waypoints, distances, schedules, run logs, and any names or notes you add.
• Location data: if you grant permission, your approximate or precise location is used in your browser to centre the map. Location is not stored unless you save it as part of a route.
• Technical data: IP address, browser type, device type, language, referrer, and pages visited. This is collected automatically by our hosting and ad providers via standard server logs and cookies.
• Cookie & consent data: a record of the choices you make in our cookie banner.

How we use your data and our legal basis

Under UK GDPR we must have a lawful basis for processing your personal data. Ours are:

• Contract — to create your account, save and display your runs, and provide the planner. Without this data we can't deliver the service.
• Legitimate interests — to keep the service secure, prevent abuse, debug issues, and understand basic aggregate usage. We balance this against your rights and use the minimum data needed.
• Consent — for non-essential cookies, personalised advertising, and any location access. You can withdraw consent at any time via the cookie banner or your browser settings.
• Legal obligation — to respond to lawful requests from regulators or law enforcement.

We do not sell your personal data and we do not use your saved runs to train AI models.

Cookies & advertising

We use a small number of essential cookies (and similar local storage) to keep you signed in, remember your unit and pace preferences, and record your cookie choices. These don't require consent.

We also display advertising from Google AdSense to cover the cost of running Pacer. Google and its partners may use cookies and identifiers to serve and measure ads. If you decline non-essential cookies in our banner, ads shown to you will be non-personalised. You can change your choice at any time by re-opening the cookie banner from the footer, or opt out of personalised ads at Google Ads Settings or youronlinechoices.com.

Third-party services & data sharing

We share the minimum personal data needed with the following processors:

• Lovable Cloud (Supabase) — hosts our database, authentication, and storage. Servers may be located in the EU or other regions.
• Google — provides Sign in with Google, AdSense advertising, and (where enabled) ad measurement.
• OpenStreetMap, OSRM and BRouter — receive map tile and routing requests, which include your IP address and the map area you are viewing.
• Amazon Associates — receives click data when you follow an affiliate link, under its own privacy policy.
• Cloudflare — provides edge hosting and DDoS protection; processes request metadata such as IP address.

Where data is transferred outside the UK, we rely on UK adequacy regulations, the UK International Data Transfer Agreement, or the EU Standard Contractual Clauses with the UK Addendum as appropriate.

How long we keep your data

• Account & runs — kept until you delete your account or individual runs.
• Inactive accounts — we may delete accounts that have been inactive for more than 24 months after giving notice to the email on file.
• Server logs — typically kept for up to 30 days for security and debugging.
• Cookie consent record — kept for up to 12 months so we don't keep asking you.

Security

Data is transmitted over HTTPS and stored with our hosting provider using industry-standard access controls and row-level security so that you can only access your own runs. No system is ever 100% secure — please use a strong, unique password and let us know immediately if you suspect your account has been compromised.

Your rights (UK GDPR)

You have the right to:

• Access a copy of the personal data we hold about you
• Have inaccurate data corrected
• Have your data deleted ("right to be forgotten")
• Restrict or object to certain processing
• Receive your data in a portable format
• Withdraw consent at any time, where processing is based on consent

To exercise any of these rights, delete individual runs from the home screen or email privacy@runpacer.co.uk. We'll respond within one month.

If you are unhappy with how we have handled your data, you have the right to complain to the UK supervisory authority, the Information Commissioner's Office (ICO). We'd appreciate the chance to address your concerns first.

Children

Pacer is not directed at children under 13 and we do not knowingly collect their personal data. If you believe a child has provided us with personal data, please contact us and we will delete it.

Safety disclaimer

Routes on Pacer are planned from map data and are not safety-checked. Always be aware of traffic, road conditions, lighting, and your own fitness level when running. Consult a healthcare professional before starting any new exercise programme.

Changes to this policy

We'll update this page if our practices change and revise the "Last updated" date above. Significant changes will be highlighted in the app. Continued use of Pacer after a change means you accept the updated policy.