1. Data we collect
- Account: email and password (hashed by Supabase).
- Runner profile: weight, resting and maximum heart rate, sweat level. These data are health-related in nature and are used exclusively to generate your personalized plan.
- Races: name, distance, date, city, target time, elevation.
- Reference times: distance, time, date and optional heart rate.
- Nutrition products: gels, salts and other products you add.
- Payment: Stripe manages card data. We only store the Stripe customer and subscription ID.
2. How we use your data
- To generate your personalized race plan.
- To send you race reminders by email (you can disable these).
- To manage your subscription via Stripe.
- To improve the service (anonymized metrics).
3. Who we share your data with
We do not sell or rent your data. We only share it with:
- Supabase — database and authentication.
- Stripe — payment processing.
- Resend — transactional email sending.
- Open-Meteo — weather forecast (we only send the city, no personal data).
4. Data retention
We retain your data while your account is active. If you delete your account, we delete all your data within 30 days.
5. Your rights
You can request access, correction or deletion of your data at any time by writing to us at hello@racecopilot.com. We respond within a maximum of 30 days.
6. Cookies
We use session cookies to keep you authenticated (managed by Supabase Auth). We do not use third-party or advertising tracking cookies.
7. Security
Your data is stored on Supabase servers with encryption at rest and in transit (HTTPS/TLS). Passwords are never stored in plain text.
8. Users in the European Union (GDPR)
If you are in the European Union, you have the following additional rights under the GDPR:
- Portability: you can request a copy of your data in a structured format.
- Objection: you can object to the processing of your data in certain circumstances.
- Restriction: you can request that we limit processing while a complaint is being resolved.
- Complaint: you have the right to lodge a complaint with your local data protection authority.
Minimum age: we do not collect or process data from individuals under 16 years of age.