Privacy Policy

Last updated: October 25, 2026

Pacecal ("we", "us", "our") is committed to protecting your privacy. This policy explains what data we collect, how we use it, and your rights under applicable data protection laws, including the EU General Data Protection Regulation (GDPR / BDAR) and the California Consumer Privacy Act (CCPA).

1. Data Controller

The data controller is Voras Digital, MB, a limited partnership (maža bendrija) registered in the Republic of Lithuania (company code: 307551703). For any privacy-related inquiries, contact us at [email protected].

2. What Data We Collect & Legal Basis

Under GDPR Article 6, we process personal data only when we have a lawful basis. Below we describe each category of data, its purpose, and the legal basis for processing:

• Email address - provided when you create an account, or earlier if you joined our waitlist, which is now closed. Legal basis: contract performance (Art. 6(1)(b)) for your account; consent (Art. 6(1)(a)) for the waitlist. Waitlist emails were submitted via Google Apps Script (a Google LLC service acting as our data processor) and are stored in Google Sheets.
• Account and profile - your name, your password (stored only as a one-way hash), a profile picture if you upload one, your date of birth if you have given it to us, your time zone and country (detected from your browser), a city if you enter one, and your settings, such as the time format and the day of your weekly review. If you sign in with Google or Apple, we receive your name and email address from them (from Apple this may be a private relay address), and from Apple also a stable account ID. Legal basis: contract performance (Art. 6(1)(b)).
• Calendar data - synced from the calendars you connect: Google Calendar, iCloud Calendar, a calendar you add by link, or the calendars on your phone through our mobile app. Legal basis: contract performance (Art. 6(1)(b)) - necessary to provide the planning service you signed up for. See Sections 4 and 4a.
• Goal and chat content - the goals you create, their sessions and the notes you add to them, and the messages you exchange with Pace are stored in our database so your plans and conversation history persist between sessions. Legal basis: contract performance (Art. 6(1)(b)).
• Memories - short notes about you that Pace saves during a conversation, or that you add yourself, for example an injury to plan around. You can see, edit and delete them on the "What Pace remembers" page in the app. Legal basis: contract performance (Art. 6(1)(b)).
• Attachments - images and documents (PDF, Word, text, Markdown or CSV files, up to 10 MB each) you send to Pace in the chat. We store the file on our server and, for documents, the text extracted from it. Legal basis: contract performance (Art. 6(1)(b)).
• Usage data and activity log - goals, progress, and interactions within the app. Each action, such as creating a goal or moving or completing a session, is logged with its details, which can include the session name or goal title. The log powers your history, the patterns Pace notices and the weekly review. Legal basis: contract performance (Art. 6(1)(b)) for delivering the service; legitimate interest (Art. 6(1)(f)) for product improvement.
• Chat traces - for each message you send Pace, a technical record of how the reply was produced: which AI model and tools ran, how long each took, what each tool was given and returned (which can include goal titles, session names or the text of a memory), and any words that were shown and then withdrawn. It does not store the text of your messages or the contents of your memories and attachments. Only our administrators can read traces, to find out why a reply went wrong, and they are deleted after 30 days. A separate record of each AI request (the model, token counts, cost and timing) holds no content. Legal basis: legitimate interest (Art. 6(1)(f)) in keeping the service reliable and its costs under control.
• Feedback - messages you send through the feedback form in the app. They are stored with your account and emailed to our inbox at [email protected] with your name and email address, so we can reply. Legal basis: legitimate interest (Art. 6(1)(f)) in answering you and improving the product.
• Browser notifications - if you turn on notifications for the weekly review, we store the push address your browser gives us and its user agent (the browser's name and version). Legal basis: contract performance (Art. 6(1)(b)).
• Analytics - via PostHog, without cookies or anything stored in your browser: page views, clicks on buttons and links, page load times, and product events such as "goal created". On this website, and in the app until you sign in, these carry a random identifier. Once you are signed in, they are tied to your internal account ID, never to your email or name. Legal basis: legitimate interest (Art. 6(1)(f)) in understanding how the product is used; you can opt out at any time in Settings. See Section 9.
• Session recordings - from September 30 to October 25, 2026, the web app recorded masked replays of sessions through PostHog: which pages people opened, what they clicked and where they scrolled. Everything typed into a field, the text of the chat with Pace, and goal titles and session names in the goal and plan views were masked before they left the browser; other text on screen was recorded as shown. Recordings were tied to the same identifier as the rest of analytics. Nothing was recorded on this website, in the mobile app, or in a browser where analytics was switched off. Recording is now switched off. We keep the recordings already made for no longer than PostHog's retention period for recordings, and you can ask us to delete yours at [email protected]. Legal basis: legitimate interest (Art. 6(1)(f)) in finding and fixing the places where people get stuck.
• Payment data - handled by Stripe. We store only a customer reference, subscription status, billing period and whether a card is on file; we never see or store your card number. If you withdraw from a subscription, we keep the withdrawal statement you submitted (name, email address and date). Legal basis: contract performance (Art. 6(1)(b)).
• IP address - received by our servers, by Cloudflare (which sits in front of them) and by our analytics provider with every request, as with any website, and not stored by analytics (PostHog is configured to discard it). Fonts are served from our own site, so no font provider sees your visit. Legal basis: legitimate interest (Art. 6(1)(f)) in running and securing the service.

3. How We Use Your Data

• To provide and improve the Pacecal service - building your adaptive roadmap, scheduling, and replanning.
• To communicate with you about your account, updates, and support.
• To understand how the product is used, so we can improve it (see Section 9).
• To find and fix errors and failed replies (see error monitoring in Section 6 and chat traces in Section 2).

4. Calendar Data & AI Processing

Your calendar data is handled with strict privacy safeguards:

• Calendar data is encrypted in transit.
• We cache the calendar events we read (title, description, location, time and a link back to the original event) so the app can show your schedule and plan around it without re-querying your provider on every request. This cache is deleted when you disconnect the calendar or delete your account.
• If you connect iCloud Calendar, the app-specific password you give us is stored encrypted and used only to read your calendars and write the sessions you ask for.
• Sessions you ask Pace to add are written to one calendar: the first calendar account you connected that Pace can write to (Google, iCloud or your phone). For a Google account this is its primary calendar. There is currently no setting to choose a different one. A calendar added by link is only ever read.
• If you create a subscription link for your plan, anyone who has the link, including the calendar service you add it to, can read the sessions in it (their names and times). Turning the link off in Settings stops the old address from working.
• Our AI backend only sees anonymized calendar entries. Before any event reaches a model, a sanitization layer strips the title, description, location and link, and replaces them with a generic category (for example "Meeting" or "Exercise") plus the start and end time. Participant names and email addresses are never forwarded.
• The goals you write and the messages you send to Pace are sent to the AI provider as written, because that is what the coaching conversation consists of. With them goes the context Pace needs: your name, your age (worked out from your date of birth if we have it; the date itself is not sent), your city, country and time zone, your goals and sessions with your notes on them, the memories Pace has saved, patterns from your activity, and any file you attach (images as images, documents as their extracted text). Your email address is not sent. Please don't put information in the chat that you wouldn't want processed by a third-party AI service.
• AI processing is provided by Microsoft Azure OpenAI Service (Microsoft Corporation) and Google Gemini (Google LLC), each acting as a data processor under our instructions. Which of them handles your requests is a configuration setting on our side. Both are contractually prohibited from using your data to train their models.

4a. Google user data

When you connect Google Calendar, Pacecal requests three scopes and uses each one only for the purpose below:

• calendar.events - reads the events already on your calendar so sessions are placed in time that is genuinely free, and writes the planned sessions back when you ask. Read and write are a single Google scope; there is no read-only variant that also allows writing.
• calendar.calendarlist.readonly - lists the names of your calendars so you can choose which ones Pace reads. It does not read their contents. Sessions you ask Pace to add go into your primary calendar (see Section 4).
• userinfo.email - identifies which Google account the connection belongs to, so the right calendar is linked to the right Pacecal account.

Pacecal's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

• Google user data is used only to provide and improve the scheduling features you connected the calendar for.
• We do not transfer Google user data to third parties except as needed to provide the service (see Section 6), for security purposes, or to comply with applicable law.
• We do not use Google user data for advertising, and we do not sell it.
• No human reads your Google user data, except where you have given explicit permission (for example when you ask us to look at a specific problem), for security purposes, or where the law requires it.
• Event titles, descriptions, locations and links are stripped before any calendar data reaches an AI provider; only a generic category and a time range are sent (see Section 4).
• Disconnecting Google Calendar in Settings deletes the stored tokens and the cached events, so we can no longer reach your calendar. It does not withdraw the permission on Google's side: Pacecal stays listed under third-party access in your Google Account until you remove it there (myaccount.google.com/permissions). Deleting your account removes the synced calendar data with it (see Section 13).

5. Automated Decision-Making

Pacecal uses AI (see Section 4 for the providers) to generate personalized plans and schedules based on your goals and calendar availability. This constitutes automated processing but does not produce legal or similarly significant effects - it generates suggestions that you can review, modify, or ignore. You have the right to request human review of any AI-generated recommendation by contacting us at [email protected].

6. Data Sharing & Sub-processors

We do not sell, rent, or otherwise transfer your personal data or derived data to third parties for their own purposes. We share data only with the following sub-processors, solely to operate the service:

• Microsoft Corporation - Azure OpenAI Service, one of our two AI providers, used to generate your plans and power the Pace conversation. Receives the content described in Section 4: your goals, messages and attachments, the context that goes with them, and anonymized calendar categories.
• Google LLC - Google Gemini (our other AI provider, same data as above), Google Calendar API (reading your calendar and writing sessions to it when you connect it), Sign in with Google (your name and email address, when you use it), and Google Apps Script & Google Sheets (waitlist email storage).
• Apple - Sign in with Apple, when you use it, and iCloud Calendar, which we reach with the app-specific password you give us when you connect it.
• Stripe, Inc. - payment processing and subscription management. Stripe receives your email and payment details directly; we never handle your card number.
• PostHog (EU instance, Frankfurt, Germany) - product analytics, on our website and in the app, and the masked session recordings described in Section 2. Receives usage events tied to a random identifier or your internal account ID, never your email address or name as an identifier. Events our servers send have free text such as goal titles and messages removed; click events from your browser can include the visible text of what was clicked, and the recordings show the parts of the screen that were not masked. No cookies.
• Functional Software, Inc. (Sentry) - error monitoring for the app and our servers. May incidentally receive technical error context, such as the page or request that failed.
• Cloudflare, Inc. - DNS and the network in front of our website, app and API. Every request passes through Cloudflare, which decrypts and re-encrypts it on the way to our servers, so it handles your IP address and the content of that traffic.
• Purelymail - hosts our [email protected] mailbox, where the emails you send us and your in-app feedback arrive.
• Our email provider - delivers the emails the app sends (verification, sign-in links, password reset, reminders and billing notices). Receives your email address and the message content.
• Telegram - our internal operations bot, which alerts us when the service is down and can show us the latest in-app feedback messages with the sender's name or email address.
• Netcup GmbH (Germany) - hosting provider for our application servers, our database and the files you upload.

If you turn on browser notifications, they are delivered through your browser's own push service, run by the company that makes your browser. The notification is encrypted, so that service cannot read it.

We require each of these providers to process personal data only on our instructions, and none of them are permitted to use your data to train AI models or for their own marketing.

We do not sell your personal information as defined by the CCPA. We have not sold personal information in the preceding 12 months.

7. International Data Transfers

Your account data, goals, chat history and uploaded files are stored on servers in Germany (European Union). However, several of our processors, including both AI providers, are United States companies, and some processing may therefore take place in the United States. These transfers are protected by the following safeguards:

• Microsoft Corporation, Google LLC and Stripe, Inc. are certified under the EU-U.S. Data Privacy Framework (DPF), which the European Commission recognized as providing an adequate level of protection in its adequacy decision of 10 July 2023.
• Where applicable, transfers are additionally covered by Standard Contractual Clauses (SCCs) approved by the European Commission.
• Data sent for AI processing is minimized first: calendar events are reduced to a generic category and a time range before they leave our servers (see Section 4).

We only transfer data to third countries where adequate safeguards are in place, as required by GDPR Chapter V (Articles 44-49).

8. Data Storage & Security

• Our application servers and database are located in Germany (European Union). Some processors operate in the United States - see Section 7.
• Data is encrypted in transit (TLS).
• We apply the principle of data minimization - we only collect and retain what is necessary to provide the service.

9. Cookies & Tracking Technologies

We set no analytics or tracking cookies, on the website or in the app, which is why there is no cookie banner. Specifically:

• Essential storage - in the app, your login token, your preferences (for example the time format) and the email address you last signed in with are kept in your browser, so you stay signed in and the sign-in form can fill in your address. While you connect Google Calendar, a security cookie that expires after 10 minutes checks that the connection was started from your browser. These are required for the service to function and do not require consent.
• Analytics (PostHog) - helps us understand how the website and the app are used, for example how many people who arrive on the site go on to set up a first goal, and how fast pages load. It runs without cookies and without writing to your browser's storage. On the website, and in the app until you sign in, each visit gets a random identifier that is forgotten when you close the tab; when you follow a link from the website into the app that identifier is passed along in the link once, so the visit and the sign-up count as one. Once you are signed in, events are tied to your internal account ID instead, so your visits count as one person. Our servers also send product events for your account, such as "goal created", with free text like goal titles removed. Analytics is configured not to record your IP address and not to capture what you type into fields. You can opt out under "Usage analytics" in the app's Settings. The opt-out is saved on your account, so it applies on every device you sign in on and stops the events our servers send as well as those from your browser. A copy is also kept in your browser, so analytics does not load there on your next visit. The app's own activity log (Section 2) is part of how the service works and is kept either way.
• Session recordings (PostHog) - switched off. From September 30 to October 25, 2026 the web app recorded masked replays, described in Section 2.

We do not use advertising, marketing, or social media tracking cookies, and we do not use Google Analytics.

10. Your Rights Under GDPR (EEA Users)

If you are in the European Economic Area, under the GDPR you have the right to:

• Access (Art. 15) - request a copy of the personal data we hold about you.
• Rectification (Art. 16) - request correction of inaccurate or incomplete data.
• Erasure (Art. 17) - request deletion of your personal data ("right to be forgotten").
• Restriction (Art. 18) - request that we limit processing of your data.
• Portability (Art. 20) - receive your data in a structured, commonly used, machine-readable format.
• Objection (Art. 21) - object to processing based on legitimate interests. We will cease processing unless we demonstrate compelling legitimate grounds.
• Withdraw consent (Art. 7(3)) - at any time, without affecting the lawfulness of processing carried out before withdrawal.
• Lodge a complaint - you have the right to lodge a complaint with a data protection supervisory authority, in particular in the EU country where you live or work. Our lead authority is the State Data Protection Inspectorate of Lithuania (Valstybinė duomenų apsaugos inspekcija, vdai.lrv.lt).

To exercise any of these rights, email us at [email protected]. We will respond without undue delay and in any event within one month, as required by GDPR Article 12(3).

11. Your Rights Under CCPA (California Residents)

If you are a California resident, the California Consumer Privacy Act (CCPA) and the California Privacy Rights Act (CPRA) provide you with the following rights:

• Right to know - you may request that we disclose the categories and specific pieces of personal information we have collected about you, the sources of that information, the business purposes for collection, and the categories of third parties with whom we share it.
• Right to delete - you may request deletion of your personal information.
• Right to correct - you may request correction of inaccurate personal information.
• Right to opt out of sale/sharing - we do not sell or share your personal information for cross-context behavioral advertising. No opt-out is necessary.
• Right to non-discrimination - we will not discriminate against you for exercising any of these rights.

To exercise your CCPA rights, email us at [email protected]. We will verify your identity before fulfilling your request and respond within 45 days.

12. Children's Privacy

Pacecal is not directed at children. We do not knowingly collect personal data from anyone under the age of 16 (or under 13 in the United States). If you believe we have inadvertently collected data from a child, please contact us at [email protected] and we will promptly delete it.

13. Data Retention

We retain your personal data only as long as necessary to provide the service or as required by law:

• Waitlist emails - retained until we contact you or you request removal.
• Account data - retained for the duration of your account. If you delete your account, we will erase your personal data within 30 days. Deleting it in the app removes your data from our database straight away; our nightly database backups are kept for 14 days.
• Goals and chat history - retained for the life of your account, so your plans and past conversations remain available to you. You can delete a conversation at any time. Deleted with your account.
• Attachments - retained for the life of your account, including after you delete the conversation they were sent in.
• Memories - retained until you delete them on the "What Pace remembers" page, or with your account.
• Activity log and detected patterns - retained for the life of your account. Deleted with your account.
• Chat traces - deleted after 30 days. The separate records of each AI request (model, token counts, cost and timing) hold no content and are kept after you delete your account, without any link to you.
• Feedback - stored with your account and deleted with it. The copy emailed to our inbox stays there like any other email you send us.
• Cached calendar events - deleted when you disconnect the calendar or delete your account.
• Analytics data - retained by PostHog according to our project retention settings.
• Session recordings - kept no longer than PostHog's retention period for recordings. You can ask us to delete yours sooner at [email protected].

14. Changes to This Policy

We may update this policy from time to time. Changes will be posted on this page with an updated "Last updated" date. For material changes, we will notify you by email if you have an account with us.

15. Contact

If you have questions or concerns about this privacy policy or our data practices, contact us at:
[email protected]