EvenPace privacy policy

Who processes your data

EvenPace is published by AVELTEK, sole trader Florian Pasco, SIREN 892 119 454, registered at 56240 Inguiniel, France.

Data controller: Florian Pasco. Contact: hello@aveltek.com

There is no data protection officer: the business is not required to appoint one.

What the app collects, and why

To sign you in. Your email address, and your phone number if you pick that channel. They are used only to send you a six-digit code and to find your account again. The code is never stored in the clear: the database keeps only a cryptographic fingerprint of it, and the same goes for the session token. Nobody, ourselves included, can read back a code that has been sent. Legal basis: performance of the contract.

To work out your plan. The time and distance of a recent race, or your 1500 m time if you have not raced. From those come your level and the six training paces that follow from it. Then the time you are aiming for, how many kilometres a week you are ready to run, which days you can run, how long the plan should last, and how long you have been running regularly. Without those answers the app has nothing to work out.

To follow your plan. The sessions you mark as done, and their result when you record one: distance and time, from which the pace follows. Your successive VMA measurements are kept so that you can read your progress back, and so that the plan can adjust its paces along the way. Your finished or abandoned plans stay readable.

Your level is health data, and we treat it as such. A race time is a performance, but the VMA the app derives from it is an estimate of your maximal oxygen uptake, that is to say a physiological measurement, and it is on that basis that the app prescribes training intensities. European regulation gives such data heightened protection, and processing it rests on your explicit consent, which you give by creating your plan. You can withdraw it at any time by deleting your account, which erases that data.

Two things sign-up asks for and EvenPace does not use. Account creation is shared across our apps, and it asks for your sex and your phone number. EvenPace uses neither to work anything out: sex only enters the energy expenditure calculation of Square Meal, our nutrition app, and the phone number is merely a second channel for receiving your code. So if you only use EvenPace, those two pieces of information serve no purpose. We would rather write this down than leave it unsaid, and we are working towards asking for them only where they are needed.

What the app does not collect. No location data, no GPS traces, no access to your contacts or your photos, no advertising identifier. Neither your weight nor your height. No trackers, no advertising, no sale of anything to anyone. The app contains no analytics tooling.

Who else sees this data

Brevo (Sendinblue SAS, France) delivers the sign-in codes by email or SMS. It receives only the destination address or number, and the code itself. It sees neither your level nor your plan.

Google, only if you choose "Sign in with Google", and only to verify your identity.

OVHcloud (OVH SAS, France), which hosts the server where your data lives.

No other recipient. No data is sold, rented or handed over. No data is sent to any watch manufacturer: EvenPace does not currently connect to any such third-party service, and this page will be amended before that changes.

Where it is stored

On an OVHcloud server located in the European Union. Your data therefore never leaves the European area, and no transfer to a third country takes place. Traffic between the app and the server goes over HTTPS only. Your plans live in a file that belongs to you alone, separate from those of other users and separate from those of our other apps.

For how long

• Your account and your plans: as long as your account exists. Deleting it erases them.
• Sign-in codes: ten minutes, then they expire.
• Sessions: one month, then you sign in again.
• Backups: fourteen days, then they are destroyed.
• The server's technical logs, which keep the IP address of each connection for security and diagnostics: fourteen days, then they are erased. Legal basis: the legitimate interest in protecting the service.

Your rights

The General Data Protection Regulation gives you rights of access, rectification, erasure, restriction, objection and portability over your data.

Your plan can be changed directly in the app, and a wrong VMA measurement is corrected by recording a new one.

To erase your account, go to Settings, then "Delete my account". Deletion is immediate and permanent: account, plans, logged sessions, results, VMA history, archived plans and open sessions all go together, and nothing is kept. If you no longer have access to the app, the procedure is described at aveltek.com/evenpace/en/delete-account.

For anything else, write to privacy@aveltek.com, the address dedicated to such requests: we answer within a month.

If our answer does not satisfy you, you may lodge a complaint with the CNIL, the French data protection authority, at 3 place de Fontenoy, 75007 Paris, via cnil.fr/plaintes.

Minors

EvenPace is for adults only. Account creation is refused below the age of 18, and that limit is enforced by the server, not merely displayed.

This is not a formality. The app does not simply log runs: it prescribes training intensities, up to three-to-five-kilometre race pace, and the weekly volume that goes with them. Such a plan is not written for a growing body, whose training calls for supervision we are not in a position to offer.

If you notice that an account has been created by a minor, write to us at privacy@aveltek.com and it will be deleted.

Changes

Any modification to this policy will be published on this page, with its date. A substantial change will be signalled to you in the app.

In case of discrepancy between the language versions of this policy, the French version prevails. Version française.