Legal

Privacy Policy

Effective: October 27, 2026 · Last updated: October 29, 2026

In short: We use your data only to make your overlays and keep your projects safe. We never sell it, show you no ads, and don’t use it to train AI. Your videos are made on your device, and you can delete anything at any time.

1. Who we are

PaceOverlay (“PaceOverlay”, “we”, “us”) is an app that puts your run and ride stats on your photos and videos. It is made and run by KoSolutions PH, a business registered in the Philippines. This policy covers the website paceoverlay.com, the PaceOverlay web app, our iPhone and Android apps when they come out, and our emails.

We handle personal data in line with the Philippine Data Privacy Act of 2012 (Republic Act No. 10173). Wherever you live, if your local law gives you more protection (for example the GDPR in Europe or the CCPA in California), we follow it for your data.

2. What we collect

You give us:

Account: your email address. Your name starts as the part of your email before the @. With Google we also get your name and profile picture; with Apple, your email (or a private relay address if you choose “Hide My Email”).
No passwords: you sign in with Google, Apple or a 6-digit code we email you. We never ask for or keep a password. Codes last 10 minutes, and codes and sessions are kept only in a scrambled (hashed) form.
Activities: the GPX and FIT files you upload and the activities you type in. Files can include your GPS route and places, times, distance, pace or speed, heart rate, cadence, elevation and power, plus the device that recorded them. We keep the original file.
Projects: what you make in Photos, Clips and Live Sync: your edits (templates, widgets, colours, timing), the finished picture or video, the photo you used, and for clips a clean copy of the parts of each video you used.

Collected automatically:

Device and log data: IP address, browser or app version and device type, used to keep the service working and secure.
Filming time and length of the videos you add, read on your device to sync them with your activity and to find a missing video again.

Heart rate and location are sensitive. We only use them to make the overlays and features you ask for.

3. What stays on your device

Your photos and videos are processed on your own device: exporting, converting, cutting and sound levelling all happen in the app, not on our servers. Your original videos are not uploaded. What is backed up is listed above (the finished file, the photo, the GPX file and clean copies of the parts you used).

The app keeps your projects in this browser or on this phone so they open fast, each account in its own space. Signing out keeps them there for when you sign in again.

4. How we use your data

To run PaceOverlay: draw your stats, maps and charts on your photos and videos, keep your activities and projects in your account, and open them on your other devices.
To back up your projects so they aren’t lost if your device is.
To contact you: sign-in codes, and important changes to the service or these policies.
To keep PaceOverlay safe and working: prevent abuse and fix problems.
To follow the law when we must.

We don’t sell your data, we don’t show ads, and we don’t use your photos, videos or activities to train AI.

5. Why we’re allowed to

Contract: to provide the service you signed up for under our Terms.
Consent: for health and location data in your files, and for notifications. You can withdraw it at any time; some features then stop working.
Legitimate interests: to keep the service secure and working, in ways you would expect.
Legal obligation: for records the law requires.

6. Who we share it with

Only with service providers who help us run PaceOverlay, and only what they need:

DigitalOcean: our servers, database and file storage (in Singapore).
Cloudflare: network security and faster delivery.
Resend: sends our emails, such as sign-in codes.
Google and Apple: only if you choose to sign in with them.
Maps: map pictures come from a map server we run ourselves, using OpenStreetMap data. Your routes aren’t sent to outside map companies.
Apple App Store and Google Play: they handle payments for PaceOverlay Pro. We never see your card details.
RevenueCat: checks your App Store or Google Play purchase so Pro works in your account. It gets your PaceOverlay account ID and the purchase, not your name or email.
Sentry: crash reports, so we can fix problems. They hold the error and device type, never your name, email, photos, videos or activities.

Nobody else sees your activities or projects. PaceOverlay has no public profiles or feed: what you make is shared only when you share or save it yourself, and then the app or person you share it with has it.

We may also share data if the law requires it, to protect someone’s safety, or if PaceOverlay is sold or merged (this policy then keeps applying, and we’ll tell you).

7. Where it’s stored

On DigitalOcean servers in Singapore. Some providers (for example email) may handle data in other countries, including the United States. When data moves between countries we make sure it stays protected as the Data Privacy Act and your local law require.

8. How long we keep it

Your account, activities and projects: as long as you have an account.
A project or activity you delete: removed from your account and its backup straight away.
After you delete your account: your data is deleted within 30 days, and from our database backups within 30 more days as they roll over.
Server logs: a short time (usually up to 90 days) for security.

9. Security

Encrypted connections (HTTPS) everywhere, sign-in with no passwords to steal, hashed codes and sessions, private file storage that only your account can reach, restricted access to our servers, and nightly database backups. No system is 100% secure; if a breach puts your data at risk, we’ll tell you and the National Privacy Commission as the law requires.

10. Your rights and choices

You have the right to:

know how we use your data (this policy);
get a copy of your data, including your original activity files;
correct data that is wrong;
delete your projects, activities or whole account;
object to how we use it and withdraw your consent;
complain to the National Privacy Commission (privacy.gov.ph), or the data protection authority where you live.

You can delete projects and your whole account in the app (see below). For anything else, email [email protected]. We reply within 30 days and may ask you to confirm it’s really you.

Delete some of your data

To delete a project (a photo or video you made): open it from Home or Projects and tap Delete, or use the trash icon in Profile → Manage Cloud. It is removed from your account and Cloud straight away. To delete an activity and its GPX file, or any other data, without deleting your account, email [email protected] from your account’s email address: we delete it within 30 days (usually much sooner) and tell you when it’s done. Copies in our nightly database backups are gone within 30 more days.

Delete your PaceOverlay account

In the PaceOverlay app (iPhone, Android or app.paceoverlay.com):

Sign in and open Profile.
Under Privacy & account, tap Account, then Delete account.
Type DELETE and tap Delete.

Can’t sign in? Email [email protected] from the email address of your account and we’ll delete it for you.

Deleted straight away: your account (email, name, picture), your activities and their GPX files, your projects (Photos, Clips and Live Sync) and everything saved to Cloud. Kept: copies in our nightly database backups, which roll over and are gone within 30 days; payment records the law requires us to keep (the store purchase, without your name); and support messages you sent us, without your account. A Pro subscription is not cancelled by deleting your account: cancel it in the App Store or Google Play.

11. Notifications, browser storage and cookies

Notifications (export finished, backup problems) are shown by your browser or phone; you choose them in Profile → Notifications and nothing about them is sent to us.

The app stores data in your browser to keep you signed in, remember your settings and keep your projects. We use no advertising cookies and no ad trackers. Clearing your browser data signs you out and removes the copies kept in that browser (your backups stay in your account).

12. Children

PaceOverlay is not for children under 13, or under the minimum age where you live if it is higher. If you think a child has given us data, contact us and we’ll delete it.

13. Changes to this policy

We’ll update this policy when PaceOverlay changes, for example when paid plans or the phone apps arrive. We’ll change the date above and, for important changes, tell you in the app or by email first.

14. Contact us

For privacy questions and requests: PaceOverlay Support, KoSolutions PH, [email protected].