Privacy policy

PaceIQ is an independent project operated from South Africa that predicts Comrades Marathon finish times from a runner's own training data. It is not associated with, endorsed by, or affiliated with the Comrades Marathon Association.

For any question about your data, or to exercise any of the rights set out below, write to privacy@paceiq.co.za. We aim to respond within 30 days, which is the period the Protection of Personal Information Act (POPIA) allows.

Account information you give us directly: your email address, and optionally your date of birth and gender. Date of birth and gender are used only to compare you against the right age and gender cohort in the historical results; both are optional and the prediction works without them.

Training data from Strava, if you choose to connect it. This is the substance of the service. For each activity we read the date, distance, duration, elevation gain and loss, average pace, activity name and type, and - where your device recorded it - average heart rate and the altitude trace of the run.

Race history. Where you tell us your race number, or where a name and result match you to a published Comrades result, we link your past finishes so the model can learn from them.

Technical records needed to run the service: authentication tokens for Strava, timestamps of syncs and predictions, and error logs.

We do not collect payment information, because the service is free. We do not use advertising trackers.

Heart rate says something about your health, so POPIA classes it as special personal information and the GDPR as a special category of data. Both set a higher bar for processing it than for ordinary data.

We process it on the basis of your explicit consent, given when you connect Strava, and for one purpose only: estimating your aerobic fitness as an input to your predicted finish time. It is never shared, sold, or used to make any decision about you beyond that prediction.

If you would rather we did not hold it, disconnect Strava or delete your account and it goes with everything else.

Your consent, which you give when you create an account and again when you connect Strava. You can withdraw it at any time by disconnecting Strava or deleting your account.

Our legitimate interest in operating and improving the service - for example, measuring how accurate past predictions turned out to be. Where we do this we use aggregated figures, and any published statistic describes the field as a whole rather than an identifiable person.

Your data is held in two places. A primary copy sits on a private server in South Africa. A synchronised copy sits in a managed PostgreSQL database hosted by Supabase in Ireland (AWS eu-west-1), which is what serves the website.

That second location means your personal information is transferred outside South Africa. POPIA permits this where the receiving country has comparable protection. Ireland is in the European Economic Area and subject to the GDPR, which provides a level of protection substantially similar to POPIA.

By using PaceIQ you consent to that transfer. If you are not comfortable with it, please do not create an account.

Strava, to the extent you authorise us to read your activities. Their handling of your data is governed by Strava's own privacy policy, not this one.

Supabase, as the hosting provider for the cloud database described above, and Vercel, which serves the website. Both act on our instructions as processors.

Resend, which delivers transactional email such as sign-in and password-reset messages. It sees your email address and nothing else.

We do not sell your data. We do not share it with advertisers. We have never given it to a third party for their own purposes and will not do so without asking you first.

For as long as your account exists. Training data has to persist for the service to work at all - a prediction is built from months of history, and a prediction history is worth nothing if last year's data is gone.

When you delete your account we remove your user record, your linked race identity, your activity history and your queued jobs from both the primary and the synchronised database. Deletion is immediate and is not reversible.

Aggregated statistics that cannot identify you - the kind quoted on our social media, such as how many people finish in the final hour - may remain, because they are no longer personal information.

Published Comrades results are a matter of public record and are held independently of any account. Deleting your account unlinks you from them; it does not erase the race result itself, which was never ours to remove.

Under POPIA and, where it applies to you, the GDPR, you may:

•Ask what we hold about you, and get a copy.

•Correct anything that is wrong.

•Delete your account and everything attached to it, from Settings, without asking us.

•Withdraw consent by disconnecting Strava, which stops any further reading of your activities.

•Object to processing, or ask us to restrict it.

To exercise any of these beyond the buttons in the app, write to privacy@paceiq.co.za.

If you believe we have mishandled your information you may complain to the Information Regulator of South Africa at inforegulator.org.za, or to your local supervisory authority if you are in the EEA or the UK.

PaceIQ is not for anyone under 18. POPIA treats anyone under 18 as a child and does not permit us to process their personal information without the consent of a competent person, which we are not set up to obtain or verify.

You must confirm you are 18 or older to create an account. If we learn that an account belongs to someone under 18 we will delete it and the data attached to it.

Traffic is encrypted in transit. Access to the databases is restricted and authenticated, Strava tokens are held server-side and never exposed to your browser, and row-level security limits each account to its own records.

No system is perfectly secure, and we will not pretend otherwise. If a breach occurs that puts your rights at risk we will notify you and the Information Regulator, as POPIA requires.

If we change what we collect, where it goes, or who sees it, we will update this page and the date at the top, and tell you in the application before the change takes effect.