PaceShaper ← Back to PaceShaper

LEGAL PACE SHAPER

Privacy Policy

Last Updated: November 4, 2026Effective Date: November 4, 2026

This Privacy Policy explains how CharlieChaCha (“we”, “us”, or “our”) collects, uses, discloses, and safeguards your personal information when you access or use our website at charliechacha.com (the “Website”) and our AI-driven adaptive marathon and endurance training platform, PaceShaper (the “Product” or “Services”).

By accessing or using our Website and Services, you acknowledge that you have read, understood, and agreed to the practices described in this Privacy Policy.

1. Information We Collect

To deliver personalized running macrocycles, microcycle reviews, and VDOT pace guidance, we collect only the information necessary for operating and optimizing the Services.

A. Account & Contact Information

Account Credentials: When you register or authenticate via Google OAuth or email, we collect your name, email address, and unique user authentication ID.

Customer Support: Information you provide when communicating with our support or coaching inquiries.

B. Athletic, Training & Physiological Data (User-Provided)

To generate and adapt your running plans, you may voluntarily record:

  • Training Metrics: Current and target VDOT scores, goal race distances (e.g., 5K, 10K, Half Marathon, Full Marathon), target event dates, and finish time goals.
  • Workout Logs: Actual pacing, elapsed run durations, completed/skipped workouts, and subjective exertion ratings (RPE).
  • Physiological Indicators: Self-reported average heart rates, estimated maximum heart rate (HRmax), and pain/fatigue logs (e.g., soleus tightness, ITB strain) used strictly for injury prevention and workout adjustment.

C. Billing and Payment Information (Processed via Creem.io)

Merchant of Record (Creem.io): All checkout transactions, credit purchases, and paid plans are processed directly by our authorized Merchant of Record (MoR) and payment gateway, Creem.io.

Zero Storage of Payment Details: We do not collect, store, or process complete credit/debit card numbers or bank information on our servers. Creem.io handles all payment data under strict PCI-DSS compliance standards.

Order Records: We receive only transaction metadata from Creem.io (such as Order ID, purchased credit package, payment timestamp, and transaction status) to credit your account balance.

D. Technical & Usage Data

Application Logs: Device type, operating system, browser configuration, IP address, and interaction analytics within the training dashboard.

Local State Data: Technical cache keys stored locally on your device (e.g., active language preference, cached race strategy guides) to ensure offline resilience and fast rendering.

2. Legal Basis for Processing (GDPR Compliance)

If you reside in the European Economic Area (EEA), the United Kingdom, or jurisdictions with similar protections, we process your personal data based on the following legal grounds:

  • Contractual Performance: To deliver your AI training schedules, credit balances, workout logs, and race pace recommendations pursuant to our Terms of Service.
  • Legitimate Interests: To prevent unauthorized credit exploitation, secure our authentication layers, and optimize algorithmic pace calculations.
  • Compliance with Legal Obligations: To satisfy statutory accounting, tax reporting, and anti-fraud mandates associated with commercial transactions.
  • User Consent: Where you have explicitly opted in to receive non-essential product announcements or training insights.

3. How We Use Your Information

We process your data exclusively for the following operational purposes:

  • Training Plan Generation: To calculate microcycle workloads, rest distribution, and pace thresholds (Easy, Marathon, Sub-Threshold, Threshold, Intervals) matched to your current capacity.
  • Credit Ledger Management: To track credit deductions for weekly AI microcycle settlements, plan revisions, and race strategy analyses.
  • Adaptive Injury Deloads: To evaluate pain reports and heart rate drift, dynamically down-regulating training volume or suggesting VDOT adjustments.
  • Customer Support & Service Alerts: To assist with account recovery, billing inquiries, and mission-critical platform notifications.
  • Platform Security: To detect abnormal request volumes, mitigate abuse, and maintain database integrity.

We do not sell, rent, or monetize your personal or athletic data to third-party data brokers or marketing networks.

4. Third-Party Service Providers

We share necessary data elements with trusted third-party service providers solely to maintain our technical infrastructure and commercial operations:

  • Payment Processing & MoR: Creem.io (Facilitates secure payment checkout, billing compliance, customer tax calculations, and transaction settlement under their respective Privacy Policy).
  • Cloud & Authentication Infrastructure: Supabase (Provides encrypted PostgreSQL database hosting, user session authentication, and Edge Function computation).
  • AI Model Computation: Third-party Large Language Model APIs (Inputs are anonymized workout context and physiological metrics sent strictly for JSON training schedule generation).
  • Application Hosting: Secure cloud hosting networks for web asset delivery.

All third-party partners are vetted to ensure data protection standards compliant with international privacy frameworks.

5. Cookies and Local Storage

We utilize session tokens, cookies, and browser local storage strictly for essential functional operations:

  • To maintain persistent user authentication and session state.
  • To store your interface language selection (en or zh).
  • To cache temporary workout drafts and prevent data loss during network interruptions.

You can manage or disable cookies via your browser settings, though doing so may prevent seamless authentication and schedule drafting.

6. Data Retention and Account Deletion

We retain your athletic profile, workout logs, and transaction history for as long as your account remains active or as needed to:

  • Maintain your ongoing multi-season training archives and VDOT progression history.
  • Fulfill legitimate financial, tax, and audit compliance requirements.

You may request the full deletion of your profile, training logs, and personal details at any time by contacting support@charliechacha.com. Upon confirmation, data will be permanently wiped or irreversibly pseudonymized within 30 days, subject to legal record-retention requirements.

7. Your Data Protection Rights

Depending on your geographical location (e.g., GDPR, UK GDPR, CCPA/CPRA), you may exercise the following rights regarding your personal information:

  • Right of Access: Request confirmation and a copy of the personal and athletic data we maintain about you.
  • Right to Rectification: Update or correct inaccurate profile details or physiological parameters.
  • Right to Erasure: Request the permanent deletion of your account and associated microcycle records.
  • Right to Restriction or Objection: Restrict or object to specific processing workflows of your data.
  • Right to Data Portability: Obtain your training logs and profile metrics in a structured, machine-readable format.
  • Right to Withdraw Consent: Revoke previously granted permissions without affecting the legality of prior processing.

To initiate any privacy request, please contact our data team at support@charliechacha.com.

8. Data Security Safeguards

We enforce robust organizational and technical safeguards, including HTTPS/TLS encryption in transit, strict database Row Level Security (RLS) policies isolating user records, and tokenized API authorizations. While we implement rigorous industry standards, no method of transmission over the Internet or electronic storage can be guaranteed 100% impenetrable.

9. International Transfers

Your data may be processed on secure cloud infrastructure located outside of your state, province, or country of residence. By utilizing our Services, you consent to the transfer and storage of your information in accordance with this Privacy Policy, governed by standard contractual clauses and appropriate cross-border data protection safeguards.

10. Protection of Minors

PaceShaper is designed for adult athletes and is not directed to individuals under the age of 18 (or the applicable age of majority in your territory). We do not knowingly harvest personal information from minors. If you believe a minor has supplied us with personal data, please inform us immediately for expedited data removal.

11. Policy Modifications

We reserve the right to amend this Privacy Policy as our training features, legal obligations, or payment flows evolve. Any revisions will be reflected on this page with an updated "Last Updated" timestamp. Continued engagement with our Services following posted modifications constitutes acceptance of the updated terms.

12. Contact Information

For inquiries, compliance verifications, or data privacy requests concerning this Policy or PaceShaper, please contact us: