← Back to the homepage

Privacy Policy

Last updated: September 2026

1. Controller

The controller for data processing on this website is:
Jan Koester (sole proprietorship)
Neureutherstr. 16, 80799 Munich, Germany
Email: feedback@pacemate.de

2. Provision and hosting

This website is hosted by checkdomain GmbH, Große Burgstraße 27/29, 23552 Lübeck, Germany. A data processing agreement under Art. 28 GDPR is in place. When you open a page, the provider processes technically necessary connection data: the page or file requested, the time, the volume of data transferred, the referrer, browser, operating system, IP address and status or error messages.

Processing serves the secure, stable and error-free provision of the website on the basis of Art. 6(1)(f) GDPR. Our legitimate interest lies in secure technical operation and in detecting faults and misuse. According to the provider, log files are deleted after 14 days at the latest; IP addresses are anonymised after 24 hours where technically possible and sensible. We do not combine this data with other sources for marketing purposes.

3. Local fonts

The “Archivo” and “Hanken Grotesk” typefaces are served from our own web server. Opening a page therefore establishes no connection to Google Fonts or a comparable font provider.

4. Waiting list for more cities

If you ask to be notified, we process your email address, the city you selected, the time of your entry and the technical source of the form. The sole purpose is a single message once PaceMate is available in your city.

The legal basis is your consent under Art. 6(1)(a) GDPR. Consent is voluntary and can be withdrawn at any time with effect for the future by emailing feedback@pacemate.de. We delete the entry after the notification or after a withdrawal, unless statutory obligations require further retention.

5. Supabase as backend provider

The waiting-list data and the measurement events described in section 6 are processed in the PaceMate project at Supabase Inc., Oakland, California, USA. The database project is located in the EU West (Ireland) region, where the database, file storage and backups reside. A data processing addendum under Art. 28 GDPR is in place.

Where Supabase or its sub-processors process data outside the European Economic Area, the EU Standard Contractual Clauses agreed in the DPA serve as the transfer mechanism. Recipients are only those service providers involved in operation, maintenance and support, and only to the extent necessary.

6. Reach measurement without third parties

No external web analytics service is active — no data goes to Plausible, Google Analytics, Cloudflare or comparable providers. Instead we measure the reach of this website ourselves and store the events in our own database (see section 5).

What is recorded:

• the page view (page_view) with the path of the page,
• a click on a store or download button (store_click) with the destination and the position of the button,
• the campaign parameters contained in the address you opened (utm_source, utm_medium, utm_campaign, utm_content, utm_term),
• a random identifier for the individual page view (view_id). It is created afresh on every load, is neither stored on nor read from your device, and is gone when you close the page. It only links a page view to a store click within the same view.

Links to Google Play: we append the campaign parameters and the page-view identifier to the Play Store link (referrer). Google Play passes this value on to the app when it is installed, which shows which page and which button led to an installation. The Apple App Store offers no equivalent.

What is not recorded: IP address, user agent, screen size, time on page or a session identifier spanning several pages. The random identifier above covers a single view only and links no two page views. No cookies are set and no information is stored on or read from your device, so section 25 TDDDG does not apply and no consent banner is required. The events cannot be combined into a visitor profile.

The purpose is to judge which pages and which ads actually lead to a download. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest lies in designing the website to meet demand and in advertising the app economically. Given the low intensity of the processing — no cookie, no IP address, no recognisable profile — no opposing interests prevail.

Retention: measurement events are deleted automatically after 14 months. You may object to this processing at any time under Art. 21 GDPR: feedback@pacemate.de.

6a. Sign-up protection (Cloudflare Turnstile)

To fend off automated sign-up attempts, a check by Cloudflare Turnstile (Cloudflare, Inc., 101 Townsend St, San Francisco, CA 94107, USA) may precede registration. Technical details of your browser and your IP address are transmitted to Cloudflare to distinguish whether a request comes from a human or a program. According to the provider, Turnstile works without recognition cookies and without evaluating behaviour for advertising.

Legal basis: Art. 6(1)(f) GDPR (legitimate interest in preventing misuse). For transfers to the United States, Cloudflare relies on the EU Standard Contractual Clauses and its certification under the EU-U.S. Data Privacy Framework. Privacy information: cloudflare.com/privacypolicy.

7. App store links and external services

Links to the Apple App Store, Google Play, Instagram, LinkedIn or Strava are only called up once you actively click them. From that point on, the privacy information of the respective provider applies. Merely displaying our website establishes no connection to these services.

8. The PaceMate app

To provide its features, the app processes further data such as profile details, location information, sport and performance values, messages and optional profile pictures. The complete privacy information for the app is set out in the PaceMate app privacy policy and, identically, inside the app under “Profile → Legal → Privacy Policy”.

9. Your rights

You have, in particular, the following rights:

• Access under Art. 15 GDPR
• Rectification under Art. 16 GDPR
• Erasure under Art. 17 GDPR
• Restriction of processing under Art. 18 GDPR
• Data portability under Art. 20 GDPR
• Objection under Art. 21 GDPR
• Withdrawal of consent under Art. 7(3) GDPR

An informal email to feedback@pacemate.de is sufficient.

10. Right to complain

You have the right to lodge a complaint with a data protection supervisory authority, in particular in the member state of your residence, your place of work or the place of the alleged infringement.

11. Updates to this policy

We adapt this policy when features, service providers or the legal situation change. The version published on this page applies.

This English version is provided for convenience. In case of discrepancies, the German version prevails.