Privacy Policy

Account information: When you create an account, we collect your email address and display name. If you sign in with Google, we receive your basic profile information.

Usage data: We collect information about how you use PAINPLAN, including races you view, favorites you save, and lists you create. This helps us improve the product.

Device information: We collect basic device and browser information to ensure PAINPLAN works correctly on your device and to diagnose technical issues.

To provide the service: Your account data lets us sync your favorites and lists across devices. We use usage data to personalize your experience.

To improve PAINPLAN: We analyze aggregate usage patterns to understand which features are most valuable and where we can improve.

To communicate with you: We may send service-related emails (account verification, password resets) and, if you opt in, updates about new features.

We never sell your data: Your information is never sold to third parties. We don't share your data with advertisers or data brokers.

Encryption: All data transmitted between your device and our servers is encrypted using TLS. Sensitive data is encrypted at rest.

Access controls: Only essential team members have access to user data, and all access is logged and audited.

Infrastructure: We use industry-standard cloud infrastructure with regular security updates.

Incident response: In the event of a data breach, we will notify affected users within 72 hours as required by GDPR.

Essential cookies: Required for the site to function. These keep you logged in and remember your preferences.

Analytics: We use Umami, a privacy-focused, self-hosted analytics platform. It sets no cookies and all data stays on our own servers in Europe.

What analytics collects, in four groups: page views, referrer, browser, device and approximate country; race and explorer views, filters, sorts and searches with their result count; favourites, priorities, pace and FTP values; web vitals (load time, responsiveness and layout stability). IP addresses are anonymized and cannot be used to identify you.

No advertising cookies: We don't use any advertising or third-party tracking cookies.

Analytics by default: Umami sets no cookies, follows you across no other site and stores no names or email addresses, so we enable it by default under GDPR's legitimate interest basis. You can change your choice anytime under Cookie settings in the footer of every page.

Access: You can request a copy of all data we have about you at any time.

Rectification: You can update your profile information directly in Settings.

Erasure: You can delete your account and all associated data from Settings.

Portability: You can export your favorites and lists in a standard format.

Withdraw consent: You can change your analytics choice at any time under Cookie settings in the footer.

We retain your data only for as long as necessary to provide our services.

When you delete your account, we will delete your personal data within 30 days.

Some data may be retained longer where required by law or for legal purposes.

Authentication: Google OAuth for sign-in (if you choose to use it).

Email: We use email providers for transactional emails.

Hosting: Our service is hosted on secure cloud infrastructure in Europe.

Analytics: Umami is self-hosted on our own servers. No data is sent to third parties.

Discord (United States): our team chat. Five parts of the product send it data.

What Discord receives: contact form (name, email, message) · feedback (message, page, browser, screen size, and name and email when signed in) · new account (name, email, signup date) · race submission (the race details, your name and email) · incoming mail to our addresses (sender, recipient, subject, text and attachment names).

These services have their own privacy policies and may process data with appropriate safeguards.