Privacy Policy

1. Introduction

Welcome to OutPace ("we," "our," or "us"). We are committed to protecting your privacy and personal information. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our fitness challenge platform at outpace.fit (the "Service").

By using OutPace, you agree to the collection and use of information in accordance with this policy.

2. Information We Collect

2.1 Account Information

• Email address
• Password (encrypted)
• Display name and profile information

2.2 Fitness Platform Integrations

GPS / location data (all sources): Across every connected platform — Garmin, Strava, Apple Health, Google Health, Oura, WHOOP, and Polar — OutPace stores only activity and health summaries such as steps, distance, duration, activity type, elevation gain, calories, heart rate, time-in-heart-rate-zone minutes, and nightly sleep duration. We do not store GPS routes or location coordinates, and location data is intentionally excluded from our database.

Other Supported Platforms:

2.3 Challenge Data

• Challenges you create or join
• Your participation and progress
• Leaderboard rankings
• Manual activity entries
• Optional photos and notes you attach to activities

2.4 Security and Activity Logs

When you take certain actions — signing in, connecting or disconnecting a fitness or social account, changing your username or notification settings, or deleting your account — we record the action, the time, your IP address and your browser or device identifier.

We use these records to investigate suspicious activity, resolve support requests and protect accounts from abuse. We do not use them for advertising or profiling.

When you report a profile, challenge, club or message, or send us feedback or a problem report (with an optional screenshot and your app version), we keep it to run the service and keep OutPace safe. Only OutPace staff see reports, and we never tell the person reported who reported them.

2.5 Cookies

OutPace uses a few first-party cookies, set by outpace.fit itself. We do not use advertising cookies or cookies that track you across other websites.

• op_ft (how you found us): The first time your browser visits outpace.fit, we remember how it got here: the campaign tags in the link (utm parameters), the address of the site that sent you (without any search terms), and the first page you landed on. It is kept for 90 days, it is never overwritten by later visits, and it contains no name or account. If you sign up in that browser, we save it with your new account so we know which channels bring people to OutPace.
• op_click (invite clicks): When you open an OutPace invite link, we record the click (the page that linked to it and your browser type) and set this cookie to a random ID for that click. It is kept for 30 days. If you then sign up or join the challenge in the same browser, we credit the right invite.
• Security cookies: Short-lived cookies that keep a connection step safe, for example while you connect Garmin (10 minutes) or approve an AI assistant (up to 24 hours).

If you block op_ft and op_click in your browser, OutPace works the same. We just cannot tell how you found us.

3. How We Use Your Information

• Provide the Service: Enable fitness challenges, sync activities, maintain leaderboards
• Personalization: Customize your experience and display relevant statistics
• Communication: Send challenge notifications and important service updates
• Improvements: Analyze usage patterns to improve features
• Security: Detect and prevent fraud, abuse, and security incidents

4. Data Sharing

Within Challenges

When you join a challenge, your display name, profile photo, activity data (such as distance, duration, and activity type), and leaderboard ranking are visible to other challenge participants. WHOOP data is included only if you have turned on WHOOP sharing.

Public Challenges

Some challenges may be publicly accessible via a share link. If you join a public challenge, your display name, profile photo, challenge totals and leaderboard ranking within that challenge may be viewable by anyone with the challenge link, including visitors who are not signed in. The individual activities listed in a challenge are visible only to its members. By joining a public challenge, you acknowledge and consent to this visibility. If you prefer to keep your participation private, you may join only private challenges or adjust your profile settings accordingly.

Pacers and Your Profile

Activities synced from your connected platforms are visible to your approved pacers in their Pacer feed. While Show Activities is on, they are also listed on your profile, where anyone can see them if your profile is public, and only your approved pacers can see them if it is private. Individual Strava activities are the exception: in the Pacer feed and on your profile they are visible only to you, and they still count toward your totals, challenges, and leaderboards. WHOOP data (workouts and sleep) is shared with other members only if you turn on WHOOP sharing in Connect Accounts; until then it is visible only to you and does not count toward challenges or leaderboards.

AI Assistants You Connect

If you connect an AI assistant such as Meta's Muse, Anthropic's Claude or OpenAI's ChatGPT to OutPace, it receives only the limited challenge information described in AI Assistants and Connected Apps below, and only after you approve it. It never receives your activity or health data. The company that runs the assistant is not our service provider: it handles that information under its own terms and privacy policy.

Service Providers

We use trusted third-party services for:

• Hosting, infrastructure, and website analytics (Vercel)
• Database, sign-in, and file storage (Supabase)
• Sending email, and receiving the email you send us (Resend)
• Error monitoring, so we can find and fix crashes and bugs (Sentry)
• Blocking automated sign-ups with a bot check (Cloudflare Turnstile)
• Delivering push notifications (Expo, through Apple Push Notification service and Google Firebase Cloud Messaging)
• Subscriptions and payment processing, if you buy a subscription (RevenueCat and Stripe)
• Sorting the feedback emails you send us by topic, using only the email's subject and text (Anthropic)
• Tracking the feedback you send us, including your name, email address, message, and any attachments (Notion)
• GIF search in chat, which receives only the search words you type (GIPHY)

Third-Party Platform Policies

Our use of data from connected fitness platforms is governed by their respective API terms and privacy policies:

• Strava — API Agreement · Privacy Policy
• Garmin Connect — Developer Program · Privacy Policy
• Fitbit — Platform Terms · Privacy Policy
• Apple Health — HealthKit Guidelines · Privacy Policy
• Google Health — API Services User Data Policy · Privacy Policy
• Oura — API Documentation · Privacy Policy
• WHOOP — Developer Platform · Privacy Policy
• Polar — AccessLink API · Privacy Notice

Government & Law Enforcement Requests

We may be required to disclose user data to government agencies, law enforcement, or courts in response to valid legal process (such as a subpoena, search warrant, or court order). We maintain an internal Government Data Request Policy that governs how we respond to these requests. Under that policy:

• Every request is reviewed for legal validity, jurisdictional authority, and proper scope before any data is disclosed.
• We challenge requests that are overbroad, vague, lacking in specificity, improperly served, or inconsistent with applicable law.
• We apply data minimization — we disclose only the specific data identified in the request, for the specific user named, and never in bulk.
• We log every request we receive, including issuing authority, data scope, internal review notes, actions taken, and data disclosed.
• Where permitted by law, we notify affected users before disclosure so they may seek to challenge or narrow the request themselves.

In emergencies involving an imminent threat to life, we may voluntarily disclose limited data to law enforcement in good faith as permitted by 18 U.S.C. § 2702(b)(8) and similar provisions. All such disclosures are logged and reviewed after the fact.

5. Data Security

We implement industry-standard security measures:

• Encryption of data in transit (HTTPS/TLS)
• Encryption of sensitive data at rest
• Secure password hashing
• Regular security audits
• Strict access controls

6. Your Rights

Access and Update

You can access and update your information anytime through your dashboard.

Disconnect Integrations

You can disconnect any fitness platform from your account settings. This stops future data collection from that platform immediately. What happens to the data already synced from it is described under "Disconnecting a source" in Data Retention below.

Disconnect AI Assistants

You can disconnect any AI assistant in Settings > Account > Connected apps. Its access stops immediately (see AI Assistants and Connected Apps).

Data Deletion

You can delete your account at any time. All your personal data will be permanently removed within 30 days.

Data Portability

Request a copy of your data by emailing contact@outpace.fit

GDPR & CCPA Rights

If you are a resident of the European Economic Area (EEA) or California, you have additional rights including the right to access, correct, delete, or port your personal data, the right to restrict or object to processing, and the right to withdraw consent. California residents may also request disclosure of data collected and shared. To exercise these rights, contact us at contact@outpace.fit. We will respond within 30 days.

7. Data Retention

OutPace keeps a lasting record of the challenges you take part in. A leaderboard, a finish, a streak and a badge only mean something if they are still there next season, so we retain the activities that counted toward a challenge for as long as your account exists. We do not delete them on a timer. You stay in control: you can remove a connected source or delete your account at any time, and we act on both, as described below.

• Challenge activity and results: Activities that counted toward a challenge, and the results, leaderboards, streaks and badges built from them, are kept for as long as your account exists. They are the historical record of your participation.
• Fitness data from connected sources: Activities synced from Garmin, Fitbit, Google Health, Health Connect, Oura, WHOOP, Polar and Apple Health are kept on the same basis, and are used only to run OutPace: recording your activities, scoring challenges and building your history. We do not sell this data, and we do not use it for advertising.
• Strava: Activity data received from Strava is cached for no more than 7 days and then deleted. After that we keep only the numbers a Strava activity contributed to a challenge you joined and your daily totals, as described in section 2.2.
• Disconnecting a source: If you disconnect Garmin, Google Health, Polar, Apple Health or Health Connect in OutPace, we stop collecting new data from it immediately. We keep that source's already-synced activities, daily step totals and nightly sleep totals for 30 days, hidden from other members and from you, so reconnecting the same source restores them. While they are hidden they do not count on any leaderboard, and we recalculate affected leaderboards without them. After 30 days we delete them and the challenge contributions derived from them. For Strava, Oura, WHOOP and Fitbit we delete that source's stored activities (and Oura's daily step totals, and Oura's and WHOOP's nightly sleep totals) and the challenge contributions derived from them when you disconnect, and recalculate affected leaderboards. If you revoke OutPace's access from Garmin Connect, or ask us to delete your data, we delete it without the 30-day wait. For Strava, Garmin, Google Health, Fitbit, Oura, WHOOP and Polar we also revoke our access on that platform's side. Apple Health and Health Connect access is controlled in your device settings.
• Deleting an activity at the source: If you delete an activity in the app it came from, we remove it from OutPace too, and it stops counting toward any challenge.
• Account deletion: 30-day grace period, then permanent deletion of your account and all fitness records across our systems. This is the way to have everything removed, and it always works regardless of how long ago an activity was recorded. The security and activity logs described above are the one exception and are removed within 365 days.
• Security and activity logs: Retained for 365 days, then deleted automatically. They contain the action and the time, not your fitness data. A limited record of account actions, including a deletion itself, is kept on this basis so we can investigate fraud and abuse.
• AI assistant connections: Kept until you disconnect the assistant or delete your account, and the request logs for 365 days. See AI Assistants and Connected Apps.

If you want your data removed sooner than the above, you do not have to wait for anything: disconnect the source, or delete your account, or email us at contact@outpace.fit and we will do it for you, including a disconnected source's data without the 30-day wait.

9. Children's Privacy

OutPace is for adults 18 and over in the United States and is not intended for anyone under 18. We do not knowingly collect information from anyone under 18. If we learn that we have collected information from someone under 18, we will delete their account and that information. Connecting an AI assistant (section 8) is only for users 18 and over. Anyone can use the public lookups in ChatGPT; they show only what anyone can see on outpace.fit without an account. OutPace is a fitness challenge app with no mature content. Because rules for minors' data and parental consent differ from country to country, OutPace accounts are for adults 18 and over.

10. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of any changes by posting the new Privacy Policy on this page and updating the "Last Updated" date.

11. Contact Us

If you have questions about this Privacy Policy or your data, please contact us: