Privacy Policy

1. Who we are

PaceOverlay (“PaceOverlay”, “we”, “us”) is an app that puts your run and ride stats on your photos and videos. It is made and run by KoSolutions PH, a business registered in the Philippines. This policy covers the website paceoverlay.com, the PaceOverlay web app, our iPhone and Android apps, and our emails.

We handle personal data in line with the Philippine Data Privacy Act of 2012 (Republic Act No. 10173). Wherever you live, if your local law gives you more protection (for example the GDPR in Europe or the CCPA in California), we follow it for your data.

2. What we collect

You give us:

• Account: your email address. Your name starts as the part of your email before the @. With Google we also get your name and profile picture; with Apple, your email (or a private relay address if you choose “Hide My Email”).
• No passwords: you sign in with Google, Apple or a 6-digit code we email you. We never ask for or keep a password. Codes last 10 minutes, and codes and sessions are kept only in a scrambled (hashed) form.
• Activities: the GPX and FIT files you upload and the activities you type in. Files can include your GPS route and places, times, distance, pace or speed, heart rate, cadence, elevation and power, plus the device that recorded them. We keep the original file.
• Projects: what you make in Photos, Clips and Live Sync: your edits (templates, widgets, colours, timing), and the finished picture or video. Projects are kept on the device you made them on; only a summary of your project settings (which tool, template and widgets you used, never the photo or video) is sent to us so we can see how PaceOverlay is used.
• Purchases: if you buy Pro, which plan you bought, where (Paddle on the web, the App Store or Google Play), its dates, and whether it renews. Your card or bank details are collected by Paddle, Apple or Google, never by us.

Collected automatically:

• Device and log data: IP address, browser or app version and device type, used to keep the service working and secure.
• Filming time and length of the videos you add, read on your device to sync them with your activity and to find a missing video again.

Heart rate and location are sensitive. We only use them to make the overlays and features you ask for.

3. What stays on your device

Your photos and videos are processed on your own device: exporting, converting, cutting and sound levelling all happen in the app, not on our servers. Your photos, videos and finished files are not uploaded to us. Only your activity files (GPX / FIT) are kept in your account, so they open on all your devices.

The app keeps your projects in this browser or on this phone so they open fast, each account in its own space. Signing out keeps them there for when you sign in again.

4. How we use your data

• To run PaceOverlay: draw your stats, maps and charts on your photos and videos, keep your activities in your account and open them on your other devices.
• To run your Pro subscription: know whether your account has Pro, and until when.
• To contact you: sign-in codes, and important changes to the service or these policies.
• To keep PaceOverlay safe and working: prevent abuse and fix problems.
• To follow the law when we must.

We don’t sell your data, we don’t show ads, and we don’t use your photos, videos or activities to train AI.

5. Why we’re allowed to

• Contract: to provide the service you signed up for under our Terms.
• Consent: for health and location data in your files, and for notifications. You can withdraw it at any time; some features then stop working.
• Legitimate interests: to keep the service secure and working, in ways you would expect.
• Legal obligation: for records the law requires.

6. Who we share it with

Only with service providers who help us run PaceOverlay, and only what they need:

• DigitalOcean: our servers, database and file storage (in Singapore).
• Cloudflare: network security and faster delivery.
• Resend: sends our emails, such as sign-in codes.
• Google and Apple: only if you choose to sign in with them.
• Maps: map pictures come from a map server we run ourselves, using OpenStreetMap data. Your routes aren’t sent to outside map companies.
• Paddle (Paddle.com Market Limited, UK): our reseller and Merchant of Record for Pro bought on the web. Paddle collects your payment, billing details (such as your email, country and postcode) and handles tax, invoices and refunds under Paddle’s Privacy Policy, as its own data controller for that information. Paddle may also check payments for fraud. We get your PaceOverlay account ID and the purchase, never your card details.
• Apple App Store and Google Play: they handle payments for Pro bought in our phone apps. We never see your card details.
• RevenueCat: keeps track of your Pro purchase (from Paddle, the App Store or Google Play) so Pro works in your account. It gets your PaceOverlay account ID, your email for web receipts, and the purchase.
• Umami: counts visits to paceoverlay.com without cookies, on our own server, without tracking you across sites.
• Sentry: crash reports, so we can fix problems. They hold the error and device type, never your name, email, photos, videos or activities.

Nobody else sees your activities or projects. PaceOverlay has no public profiles or feed: what you make is shared only when you share or save it yourself, and then the app or person you share it with has it.

We may also share data if the law requires it, to protect someone’s safety, or if PaceOverlay is sold or merged (this policy then keeps applying, and we’ll tell you).

7. Where it’s stored

On DigitalOcean servers in Singapore. Some providers (for example email) may handle data in other countries, including the United States. When data moves between countries we make sure it stays protected as the Data Privacy Act and your local law require.

8. How long we keep it

• Your account and activities: as long as you have an account. Projects: on your device until you delete them.
• An activity you delete: removed from your account straight away. A project you delete: removed from your device straight away.
• After you delete your account: your data is deleted within 30 days, and from our database backups within 30 more days as they roll over.
• Purchase records: as long as the law requires for tax and accounting (Paddle keeps its own records as Merchant of Record).
• Server logs: a short time (usually up to 90 days) for security.

9. Security

Encrypted connections (HTTPS) everywhere, sign-in with no passwords to steal, hashed codes and sessions, private file storage that only your account can reach, restricted access to our servers, and nightly database backups. No system is 100% secure; if a breach puts your data at risk, we’ll tell you and the National Privacy Commission as the law requires.

10. Your rights and choices

You have the right to:

• know how we use your data (this policy);
• get a copy of your data, including your original activity files;
• correct data that is wrong;
• delete your projects, activities or whole account;
• object to how we use it and withdraw your consent;
• complain to the National Privacy Commission (privacy.gov.ph), or the data protection authority where you live.

You can delete projects and your whole account in the app (see below). For anything else, email [email protected]. We reply within 30 days and may ask you to confirm it’s really you.

Delete some of your data

To delete a project (a photo or video you made): open it from Home or Projects and tap Delete, or use the trash icon in Profile → Storage. It is removed from your device straight away. To delete an activity and its GPX file, or any other data, without deleting your account, email [email protected] from your account’s email address: we delete it within 30 days (usually much sooner) and tell you when it’s done. Copies in our nightly database backups are gone within 30 more days.

Delete your PaceOverlay account

In the PaceOverlay app (iPhone, Android or app.paceoverlay.com):

1. Sign in and open Profile.
2. Under Privacy & account, tap Account, then Delete account.
3. Type DELETE and tap Delete.

Can’t sign in? Email [email protected] from the email address of your account and we’ll delete it for you.

Deleted straight away: your account (email, name, picture), your activities and their GPX files, and the project summaries we keep. Projects on your devices are removed from the device you delete from; on other devices, delete them there or clear the app’s data. Kept: copies in our nightly database backups, which roll over and are gone within 30 days; payment records the law requires us or Paddle to keep (the purchase, without your projects or activities); and support messages you sent us, without your account. A Pro subscription is not cancelled by deleting your account: cancel it first in Profile → Subscription → Manage subscription (web) or in the App Store or Google Play.

11. Notifications, browser storage and cookies

Notifications (export finished) are shown by your browser or phone; you choose them in Profile → Notifications and nothing about them is sent to us.

The app stores data in your browser to keep you signed in, remember your settings and keep your projects. We use no advertising cookies and no ad trackers. When you buy Pro on the web, Paddle’s checkout window may set its own cookies needed for the payment and fraud checks, under Paddle’s Privacy Policy. Clearing your browser data signs you out and removes the projects kept in that browser (your activities stay in your account).

12. Children

PaceOverlay is not for children under 13, or under the minimum age where you live if it is higher. If you think a child has given us data, contact us and we’ll delete it.

13. Changes to this policy

We’ll update this policy when PaceOverlay changes, for example when we add features or services. We’ll change the date above and, for important changes, tell you in the app or by email first.

14. Contact us

For privacy questions and requests: PaceOverlay Support, KoSolutions PH, [email protected].