Privacy Policy

1. Introduction

Welcome to OutPace ("we," "our," or "us"). We are committed to protecting your privacy and personal information. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our fitness challenge platform at outpace.fit (the "Service").

By using OutPace, you agree to the collection and use of information in accordance with this policy.

2. Information We Collect

2.1 Account Information

• Email address
• Password (encrypted)
• Display name and profile information

2.2 Fitness Platform Integrations

GPS / location data (all sources):Across every connected platform — Garmin, Strava, Apple Health, Google Health, Oura, WHOOP, and Polar — OutPace stores only activity and health summaries such as steps, distance, duration, activity type, elevation gain, calories, heart rate, time-in-heart-rate-zone minutes, and nightly sleep duration. We do not store GPS routes or location coordinates, and location data is intentionally excluded from our database.

Other Supported Platforms:

2.3 Challenge Data

• Challenges you create or join
• Your participation and progress
• Leaderboard rankings
• Manual activity entries
• Optional photos and notes you attach to activities

2.4 Security and Activity Logs

When you take certain actions — signing in, connecting or disconnecting a fitness or social account, changing your username or notification settings, or deleting your account — we record the action, the time, your IP address and your browser or device identifier.

We use these records to investigate suspicious activity, resolve support requests and protect accounts from abuse. We do not use them for advertising or profiling.

3. How We Use Your Information

• Provide the Service: Enable fitness challenges, sync activities, maintain leaderboards
• Personalization: Customize your experience and display relevant statistics
• Communication: Send challenge notifications and important service updates
• Improvements: Analyze usage patterns to improve features
• Security: Detect and prevent fraud, abuse, and security incidents

4. Data Sharing

Within Challenges

When you join a challenge, your display name, profile photo, activity data (such as distance, duration, and activity type), and leaderboard ranking are visible to other challenge participants.

Public Challenges

Some challenges may be publicly accessible via a share link. If you join a public challenge, your display name, profile photo, activity data, and leaderboard ranking within that challenge may be viewable by anyone with the challenge link — including non-registered visitors. By joining a public challenge, you acknowledge and consent to this visibility. If you prefer to keep your participation private, you may join only private challenges or adjust your profile settings accordingly.

Service Providers

We use trusted third-party services for:

• Hosting and infrastructure (Vercel)
• Database management (Supabase)
• Email communications

Third-Party Platform Policies

Our use of data from connected fitness platforms is governed by their respective API terms and privacy policies:

• Strava — API Agreement · Privacy Policy
• Garmin Connect — Developer Program · Privacy Policy
• Fitbit — Platform Terms · Privacy Policy
• Apple Health — HealthKit Guidelines · Privacy Policy
• Google Health — API Services User Data Policy · Privacy Policy
• Oura — API Documentation · Privacy Policy
• WHOOP — Developer Platform · Privacy Policy
• Polar — AccessLink API · Privacy Notice

Government & Law Enforcement Requests

We may be required to disclose user data to government agencies, law enforcement, or courts in response to valid legal process (such as a subpoena, search warrant, or court order). We maintain an internal Government Data Request Policy that governs how we respond to these requests. Under that policy:

• Every request is reviewed for legal validity, jurisdictional authority, and proper scope before any data is disclosed.
• We challenge requests that are overbroad, vague, lacking in specificity, improperly served, or inconsistent with applicable law.
• We apply data minimization — we disclose only the specific data identified in the request, for the specific user named, and never in bulk.
• We log every request we receive, including issuing authority, data scope, internal review notes, actions taken, and data disclosed.
• Where permitted by law, we notify affected users before disclosure so they may seek to challenge or narrow the request themselves.

In emergencies involving an imminent threat to life, we may voluntarily disclose limited data to law enforcement in good faith as permitted by 18 U.S.C. § 2702(b)(8) and similar provisions. All such disclosures are logged and reviewed after the fact.

5. Data Security

We implement industry-standard security measures:

• Encryption of data in transit (HTTPS/TLS)
• Encryption of sensitive data at rest
• Secure password hashing
• Regular security audits
• Strict access controls

6. Your Rights

Access and Update

You can access and update your information anytime through your dashboard.

Disconnect Integrations

You can disconnect any fitness platform from your account settings. This will stop future data collection while maintaining your historical challenge data.

Data Deletion

You can delete your account at any time. All your personal data will be permanently removed within 30 days.

Data Portability

Request a copy of your data by emailing contact@outpace.fit

GDPR & CCPA Rights

If you are a resident of the European Economic Area (EEA) or California, you have additional rights including the right to access, correct, delete, or port your personal data, the right to restrict or object to processing, and the right to withdraw consent. California residents may also request disclosure of data collected and shared. To exercise these rights, contact us at contact@outpace.fit. We will respond within 30 days.

7. Data Retention

OutPace keeps a lasting record of the challenges you take part in. A leaderboard, a finish, a streak and a badge only mean something if they are still there next season, so we retain the activities that counted toward a challenge for as long as your account exists. We do not delete them on a timer. You stay in control: you can remove a connected source or delete your account at any time, and we act on both, as described below.

• Challenge activity and results: Activities that counted toward a challenge, and the results, leaderboards, streaks and badges built from them, are kept for as long as your account exists. They are the historical record of your participation.
• Fitness data from connected sources: Activities synced from Strava, Garmin, Fitbit, Google Health, Health Connect, Oura, WHOOP, Polar and Apple Health are kept on the same basis, and are used only to run OutPace: recording your activities, scoring challenges and building your history. We do not sell this data, and we do not use it for advertising.
• Disconnecting a source: If you disconnect a connected source, we delete that source's stored activities and the challenge contributions derived from them, and we recalculate any affected leaderboards. For Strava we also revoke our access on Strava's side.
• Deleting an activity at the source: If you delete an activity in the app it came from, we remove it from OutPace too, and it stops counting toward any challenge.
• Account deletion: 30-day grace period, then permanent deletion of your account and all fitness records across our systems. This is the way to have everything removed, and it always works regardless of how long ago an activity was recorded.
• Security and activity logs: Retained for 365 days, then deleted automatically. They contain the action and the time, not your fitness data. A limited record of account actions, including a deletion itself, is kept on this basis so we can investigate fraud and abuse.

If you want your data removed sooner than the above, you do not have to wait for anything: disconnect the source, or delete your account, or email us at contact@outpace.fit and we will do it for you.

8. Children's Privacy

OutPace is not intended for users under 13 years of age. We do not knowingly collect information from children under 13.

9. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of any changes by posting the new Privacy Policy on this page and updating the "Last Updated" date.

10. Contact Us

If you have questions about this Privacy Policy or your data, please contact us: