PaceVault — Privacy Policy
Last updated: August 9, 2026
1. Introduction and scope
This Privacy Policy (the "Policy") describes how the PaceVault mobile application (the "Application") handles information in connection with its use. The Application is provided by Zach Mullen (the "Developer"). This Policy applies to each individual who installs or uses the Application (a "User").
By installing or using the Application, the User acknowledges the practices described in this Policy. Capitalized terms have the meanings given to them herein. As used in this Policy, "User Data" means any activity, wellness, or account information originating from the User, and "Personal Data" means information that identifies, relates to, or could reasonably be linked to an identifiable individual.
2. Summary
The Application operates entirely on the User's device. The Developer operates no servers and receives no User Data. All User Data — including Garmin activity and wellness information, computed records, and trends — resides on the User's device and, at the User's election, within the User's own private Apple iCloud account. User Data is transmitted from the device only in connection with functions the User expressly enables: connection to the User's Garmin account, optional retrieval of historical weather information, and optional synchronization to the User's iCloud account. The Application employs no advertising, analytics, or tracking of any kind.
This summary is provided for convenience and is qualified in its entirety by the remainder of this Policy.
3. Identity of the Developer
The Application is provided by Zach Mullen. Inquiries regarding this Policy or User Data may be directed to privacy@pacevault.app.
4. Categories of data and location of storage
The Application processes the following categories of User Data locally on the User's device:
- Garmin activity and wellness data — including activities, routes, heart-rate and other sensor streams, and, where available, sleep, heart-rate variability (HRV), resting heart rate, stress, and Body Battery metrics. Such data is obtained from the User's own Garmin account or from a Garmin export file provided by the User, and is stored on the User's device.
- Garmin authentication credentials — used on a single occasion to establish an authenticated session. The User's password is discarded following authentication; the resulting session token is retained solely within the device's iOS Keychain (device-only and excluded from backups) and is used exclusively to transmit requests to Garmin from the device. Such credentials are never transmitted to the Developer.
- Derived analytics — records, trends, and comparable outputs computed by the Application on the device from the foregoing data and stored on the device.
5. Transmission of data
The following table describes each instance in which data is transmitted from the User's device, together with the recipient, the data transmitted, and the triggering condition:
| Recipient | Data transmitted | Condition |
|---|---|---|
| Garmin (the User's own account) | The session token and the synchronization requests necessary to retrieve the User's data | Upon each connection and synchronization (in the foreground; optional background synchronization may be disabled) |
| Open-Meteo (a weather service) | An activity's approximate location and time; no identifying information | Only where the User enables the optional Weather feature, and only for activities the User opens |
| Apple iCloud (the User's own private database) | Activity and wellness summaries; never original files | Where iCloud synchronization is enabled (may be disabled within Settings) |
| The Developer | None. The Developer operates no servers and receives no data concerning the User | — |
The User's original Garmin files are retained on the device only and are not synchronized to iCloud or transmitted to any recipient.
6. The Garmin connection
The Application connects to the User's own Garmin account, at the User's request, solely to retrieve the User's own data. This connection is unofficial and may cease to function should Garmin modify the behavior of its service; in such event, User Data remains on the device and the User may continue to import Garmin export files. The Developer does not access any other individual's account and does not disclose the User's Garmin credentials or data to any third party.
7. Third parties
The Developer does not employ advertising networks, analytics providers, tracking technologies, or third-party software development kits. The only third parties involved are the services the User elects to use:
- Garmin — the source of User Data and the User's own account; governed by Garmin's privacy policy.
- Open-Meteo — receives an activity's approximate location and time in order to return historical weather information, only where the User enables the Weather feature; governed by Open-Meteo's privacy policy.
- Apple iCloud — stores summaries within the User's private iCloud database where synchronization is enabled; governed by Apple's privacy policy.
As the Developer operates no servers, it discloses User Data to no party; there exists nothing for the Developer to disclose.
8. Purposes of processing
User Data is processed solely to provide the features of the Application — including records, matched routes, trends, and wellness baselines — as computed and displayed on the User's device. User Data is not used for advertising, marketing, profiling, or sale, and health and fitness data is not used for any such purpose under any circumstances.
9. Tracking
The Application does not track Users across other applications or websites and contains no advertising identifiers. The Developer does not request App Tracking Transparency authorization, as it conducts no tracking. As the Application performs no tracking, it does not alter its behavior in response to "Do Not Track" or Global Privacy Control signals; there is no tracking to disable.
10. User privacy rights
Depending on the User's jurisdiction (including, without limitation, California, the European Union, the United Kingdom, or other U.S. states maintaining consumer-privacy statutes), the User may hold rights to access, correct, delete, or port Personal Data, to opt out of its sale or of targeted advertising, and to be free from discrimination for exercising such rights. The Application is designed such that the User may exercise each of these rights directly and immediately, without application to the Developer, for the reason that the Developer neither receives nor retains User Data:
- Access and portability — all User Data resides on the device and may be viewed within the Application and exported (in CSV, GPX, or FIT format) at any time.
- Correction and deletion — the User may edit or delete any activity within the Application; the "Erase all data" function removes all User Data from the device and, where iCloud synchronization was enabled, from the User's iCloud account.
- Opt-out of sale or targeted advertising — not applicable, as the Developer neither sells nor shares User Data and displays no advertising.
- Withdrawal of consent — the User may disconnect Garmin, disable iCloud synchronization or the Weather feature, or disable Background App Refresh, at any time within Settings.
As the Developer retains no copy of User Data, there exists no request for the Developer to fulfill and no identity for the Developer to verify; control resides at all times with the User. Notwithstanding the foregoing, a User may contact the Developer regarding privacy matters at privacy@pacevault.app.
11. Do Not Sell or Share Personal Information
The Developer does not sell Personal Data and does not share Personal Data for cross-context behavioral (targeted) advertising, and has never done so. As the Developer conducts no such activities, no opt-out mechanism is required or applicable. Health and fitness data is not sold or shared under any circumstances.
12. European Union and United Kingdom Users (GDPR)
Where Regulation (EU) 2016/679 (the "GDPR") or the UK GDPR applies, the connections effected by the Application on the User's behalf (to Garmin, Apple iCloud, and, where enabled, Open-Meteo) are performed on the legal basis of the User's consent, which is given by connecting the relevant service and may be withdrawn at any time within Settings. As the Application operates no servers and receives no User Data, there is no server-side processing, profiling, automated decision-making, or international transfer of User Data by the Developer. The User holds the rights described in Section 10 and may lodge a complaint with the competent data-protection supervisory authority in the User's jurisdiction.
13. Retention and deletion
User Data is retained on the device until removed by the User. The User retains control at all times:
- Erase all data (Settings) permanently deletes all User Data on the device — activities, derived data, original files, and preferences — and, where iCloud synchronization was enabled, deletes the corresponding data from iCloud.
- Disconnect removes the stored Garmin session and terminates synchronization.
- Disabling iCloud synchronization halts further synchronization; the "Erase all data" function removes data already synchronized.
- Deletion of the Application removes all data stored on the device.
As the Developer holds no copy of User Data, no request to the Developer is necessary; deletion is effected solely by the User and takes effect immediately.
14. User choices and consent
- Weather is disabled by default; the User elects whether to enable the off-device weather lookup.
- iCloud synchronization may be enabled or disabled at any time within Settings.
- Background updates occur only where the Application is permitted to operate in the background; the User may disable Background App Refresh for the Application within the iOS Settings application. Opening the Application always initiates synchronization.
- Data export (CSV, GPX, or FIT) is available at any time and remains on the device.
- Privacy zones redact the vicinity of the User's home or workplace from any data that leaves the device (for example, exported routes), and are enabled by default.
15. Security
The Garmin session is stored within the iOS Keychain (device-only and excluded from backups). Data stored on the device is protected by iOS Data Protection. All network requests are transmitted over encrypted connections (TLS), directly from the device, and are not routed through any server operated by the Developer.
16. Children
The Application is not directed to children, and the Developer does not knowingly collect data from children.
17. The Developer's website
The website located at pacevault.app is a static informational site that includes this Policy. It sets no cookies and employs no analytics or tracking technologies, and solicits no information from visitors. As with any website, the Developer's hosting provider (Cloudflare) may process standard technical request data, such as a visitor's IP address, in order to deliver the page and to protect against abuse, under Cloudflare's own privacy terms; such data is not used by the Developer to identify or track any individual.
18. Amendments
The Developer may amend this Policy from time to time. Any amendment will be reflected herein together with a revised "Last updated" date. Material changes will be reflected prior to taking effect.
19. Contact
Inquiries regarding this Policy or a User's privacy may be directed to privacy@pacevault.app.
20. Governing law
This Policy is governed by the laws of the State of Michigan, United States.