Privacy Policy

The short version

DropPace turns your runs into share-ready images. We process the data we need to make that image — your workout, your route, and (if you choose) your photo — and we hold on to as little as possible. The mobile app uses an account so your runs, drops, purchases, support history, and device entitlements can stay tied together. We do not sell your data, we do not use your health or workout data for advertising, and we do not use any third-party AI service to profile you or advertise to you.

We collect account identifiers such as your email address and display name when you sign in or create an account. If you buy a lifetime offer on our website, we also collect the email address you provide so we can deliver your access link. Details are in section 3 below.

1. Who we are

Nuko Nova Dynamics LLC ("DropPace," "we," "us," or "our"), a Florida limited liability company, operates the DropPace mobile application (the "app") and the websites at droppace.com and droppace.app (together with the app, the "service"). For the purposes of the EU and UK General Data Protection Regulation ("GDPR"), Nuko Nova Dynamics LLC is the data controller for personal data processed through the service.

This Privacy Policy explains what data we process, why, how long we keep it, who we share it with, and the rights you have. For any privacy question or request, contact [email protected].

2. Accounts

The DropPace app requires an account. You can sign in with email and password, Sign in with Apple, or Google. We use the account to keep your app access, support history, purchase state, and device-linked usage records together. Subscriptions and in-app purchases are still processed by Apple or Google where required; we receive only the purchase and entitlement information needed to operate the app.

If you buy a one-time lifetime offer at droppace.com, we collect the email address you provide so we can attach the entitlement to your DropPace account, and our payment processor collects your payment details. See "Website and lifetime purchases" in section 3.

3. Data we process

Workout and route data

With your permission, DropPace reads completed workout records from Apple HealthKit (iOS) or Google Health Connect (Android), which may include workout type, start and end time, distance, duration, pace, heart rate, calories, step count, elevation gain and loss, running and cycling power, running and cycling speed, cycling cadence, running stride length, running ground contact time, running vertical oscillation, VO₂ max, and the GPS polyline of your route. This is health and precise-location data, and we treat it as sensitive. We use it to show your completed workouts, render and validate your share image, and — only if you separately enable Cloud Workout Sync in Settings — keep aggregate workout summaries and simplified routes as DropPace workout records linked to your account, available on your signed-in devices and our authenticated workout-library website. You can also explicitly choose a GPX, FIT, or TCX file either to recover a missing route for a specific workout or to upload a complete workout to your DropPace Cloud library. We retain a bounded simplified snapshot from each iPhone or Android upload and may merge matching snapshots into one workout; we do not retain the raw file. Explicit file uploads may be available on signed-in iOS, Android, and web clients. We do not run continuous or real-time location tracking.

Photos you provide

For the photo-led modes, you choose a photo from your camera roll or take a new one with the camera. That photo is uploaded so our servers can compose or restyle your share image with the chosen style applied. The original photo is processed to create your image and is not retained after the share image is generated. We do not perform facial recognition and we do not use your photos to identify you or anyone else.

Generated images

The share image we create for you is cached on our infrastructure for up to 30 days so you can re-download or re-share it without re-rendering, then deleted automatically. Each generated image contains an embedded "Software" metadata tag identifying it as produced with DropPace and marking it as AI-generated. This metadata travels inside the image file you share.

Device identifier and subscription state

We generate a random, device-scoped identifier so we can attach your trial status, subscription status, credit balance, or lifetime entitlement to your installation, link it to your account, enforce usage limits, and prevent abuse.

Account information

We process the account information you provide or that your sign-in provider shares with us, such as email address, display name, provider account ID, authentication session records, and related security tokens. We use this information to sign you in, protect your account, provide support, and connect purchases and generated content to the right user.

Notifications

If you allow notifications, your device provides a push token so we can send you optional alerts, such as a reminder when a new run is ready to drop. You can turn notifications off at any time in your device settings.

Diagnostics and product analytics

We collect crash reports, performance traces, and anonymized product-usage events (for example, "a render was generated" or "a share was tapped") to find bugs and decide what to build next. These events do not contain your photo, your route, your workout data, or any information that identifies you personally.

Website and lifetime purchases

If you buy a one-time lifetime offer on droppace.com, we and our payment processor process the email address you provide, your purchase and entitlement record, the time and amount of the purchase, and your IP address (used to route the checkout and to help prevent fraud and abuse). We use this information to take payment, attach account access, provide support, keep records, and meet our tax and accounting obligations. Your full payment-card details are handled by our payment processor (Stripe); we do not receive or store your card number.

Cookies and website data

The DropPace app does not use cookies. Our websites use only the strictly necessary cookies and similar technologies needed to load pages, remember your choices, keep the site secure, and complete a purchase — including cookies our payment processor sets during checkout to process your payment securely. We do not use advertising cookies and we do not use cookies to track you across other websites. Because we rely only on essential and payment-related cookies, you can manage them through your browser settings.

What we do not collect

Through the app, we do not collect your phone number, mailing address, social-media handle, advertising identifier, contacts, calendar, microphone audio, or browsing history. We do not track you across other apps or websites, and we do not use the Advertising Identifier (IDFA) or App Tracking Transparency for tracking.

4. Why we process your data, and our legal bases

We process personal data only for the purposes described below. Where the GDPR applies, the legal basis for each purpose is noted in brackets.

• To create your share image — reading the workout, route, and photo you select and sending the route and stats (and, for photo modes, your photo) to our AI provider to generate and validate the image. [Performance of our contract with you and steps taken at your request; and, for health and precise-location data, your explicit consent, which you give through the in-app permission prompts.]
• To run subscriptions, trials, and purchases — managing entitlements and, for website purchases, taking payment and delivering access. [Performance of a contract; compliance with legal obligations such as tax and accounting.]
• To sync workouts across your devices — if you enable Cloud Workout Sync, storing account-linked aggregate workout summaries and simplified routes, reconciling bounded observations, and returning the best available record to your signed-in DropPace clients and the authenticated website. [Your explicit consent, given through the Cloud Workout Sync control in Settings.]
• To keep the service working and secure — enforcing usage limits, preventing fraud and abuse, and diagnosing crashes and performance issues. [Our legitimate interests in operating and securing the service; consent where required for analytics.]
• To improve the product — understanding anonymized usage patterns to decide what to build. [Our legitimate interests; consent where required.]
• To communicate with you — sending optional notifications and responding to your support requests. [Consent for push notifications; our legitimate interests in supporting you.]

You can withdraw consent at any time — for example, by revoking HealthKit or Health Connect access in your device settings, turning off Cloud Workout Sync or notifications, removing cloud workout copies, or deleting your data in the app — without affecting processing that already took place.

5. Health and fitness data: our commitments

Health, workout, and route data is the most sensitive data DropPace touches, and we hold ourselves to the platform health-data rules:

• We use health and fitness data obtained through Apple HealthKit and Google Health Connect only to provide the user-facing features of DropPace — generating your share image and validating its stats.
• We never use health or fitness data for advertising, marketing, or any use-based data mining, and we never sell it.
• We never use health or fitness data to determine eligibility for employment, insurance, or credit, and we do not share it for those purposes.
• We do not transfer health or fitness data to third parties except the service providers needed to render your image (see sections 6 and 7), and only for that purpose.

DropPace's access to, use, and transfer of information received from Apple HealthKit and Google Health Connect adhere to the Apple Developer Program License Agreement and App Store Review Guidelines and to the Google Play requirements for health and fitness apps, including their Limited Use requirements. Any other use or transfer of Google user data to third parties is prohibited and we do not engage in it.

6. Third-party AI

DropPace uses a third-party artificial-intelligence service to generate the image treatment applied to your run and to validate that the on-image stats match your workout. Specifically, we send your route polyline, the selected workout stats, a style prompt, and — for the photo-led modes — your photo to OpenAI's image and vision APIs, which process that data on our behalf and return a generated image and a validation result. We do not send your name, email address, account provider identifier, or authentication tokens to the AI service.

When accessed through OpenAI's developer API as we do, that data is not used to train OpenAI's models. OpenAI may retain API inputs and outputs for up to 30 days to provide the service and monitor for abuse, after which they are deleted unless OpenAI is legally required to keep them. We do not use any third-party AI service to profile you, target advertising, or make automated decisions that produce legal or similarly significant effects about you. We ask for your consent to this processing through the in-app disclosure before your first generation.

7. Service providers we rely on

We rely on a small set of vendors to operate the service. Each acts as our processor and handles only the data needed for its role, under contract:

• OpenAI — generates the share image and validates on-image stats, as described in section 6.
• Convex — hosts our backend, our database, and the temporary storage for generated images.
• RevenueCat — manages subscription state and entitlements purchased through Apple or Google.
• Apple App Store and Google Play — process in-app purchases and subscriptions. We do not receive your payment-card details.
• Stripe — processes website purchases of the one-time lifetime offer, including payment details.
• Resend — sends transactional email for website purchases and account access.
• Sentry — receives crash reports and error traces.
• PostHog — receives anonymized product-analytics events.
• Cloudflare and Vercel — host this website, route share links, and provide network and DNS services.

When you choose to share a generated image to a social network, messaging app, or other third-party platform, that platform — not DropPace — controls what happens to the image and your activity there, under its own terms and privacy policy. You are responsible for what you choose to share and where, and we are not responsible for the practices of third-party platforms or destinations you send your images to.

8. How long we keep data

• Original uploaded photos: processed to create your image and not retained afterward.
• Workout and route data: data used by a selected share is stored with that share as described above. If you enable Cloud Workout Sync, aggregate workout summaries and simplified route polylines are stored with your account until you remove the cloud copies, delete your account, or ask us to delete them. We may retain up to eight simplified source snapshots for one portable workout so later iPhone or Android uploads can repair it. Raw sensor samples and raw GPX/FIT/TCX files are not included in cloud workout storage.
• Generated share images: cached for up to 30 days, then deleted automatically.
• Device identifier and subscription state: retained while your installation or subscription is active and for a reasonable period afterward to service refunds, disputes, and abuse prevention.
• Website purchase records: retained as long as your entitlement is valid and as required to meet our tax, accounting, and legal obligations.
• Diagnostics and analytics: retained per the standard retention windows of Sentry and PostHog.

9. How we protect your data

We use technical and organizational measures appropriate to the sensitivity of the data, including encryption of data in transit and at rest with our infrastructure providers, access controls that limit who can reach production data, short retention windows, and secure development practices. No method of transmission or storage is perfectly secure, but we work to protect your data and to limit how long we hold it.

10. Account and data deletion

• Delete your account and data in the app. Open Settings → Privacy → "Delete account & data". This deletes your DropPace account, authentication sessions, linked device data, workout and generated-image records, cached photos, subscription mirror, and account-linked diagnostics. We retain only a pseudonymous deletion audit and trial-history hash for compliance and abuse prevention, plus purchase records where tax, accounting, refund, or other legal obligations require retention.
• Request account deletion without the app. Email [email protected] from your account email and ask us to delete your DropPace account and associated data. We may ask for reasonable information to verify account ownership before completing the request.
• Delete individual Drops. In My Drops, open a Drop and choose Delete to remove that generated image and its server record without deleting your account. You can also email the address above to request deletion of specific account data.
• Manage permissions. You control HealthKit / Health Connect access, photo access, camera access, and notifications from your device settings, and can revoke any of them at any time.
• Export or remove cloud workouts. When Cloud Workout Sync is available, Settings → Workouts lets you export the workout data associated with your account, turn future syncing off, or remove cloud workout copies without deleting your account. Existing shared Drops are retained unless you delete them separately. You can also view portable cloud workouts at the authenticated DropPace workout-library website.
• Skip the photo. You can create a transparent stats-and-route PNG without providing a photo by choosing Overlay.
• Other privacy requests. Email [email protected] for access, correction, deletion, or another privacy request.

11. Your privacy rights

Because the app now uses accounts, we can use your account email to help locate records tied to you. Some workout and render records may also remain tied to your device-scoped identifier, so we may ask for your in-app support ID when needed to complete a request.

California (CCPA / CPRA)

In the past 12 months we have collected the following categories of personal information: identifiers (a random device identifier and, for website purchases, an email address and IP address); commercial information (purchase and entitlement records); internet or network activity (anonymized product-analytics and crash data); geolocation data (the route of a workout you choose to render); and sensitive personal information (health and precise-location data from your authorized workouts). We collect this information for the business purposes described in section 4, from you and from your device.

We do not sell your personal information and we do not share it for cross-context behavioral advertising, as those terms are defined under the CCPA. We use and disclose sensitive personal information only to provide the service and for other purposes permitted without a right to limit. You have the right to know, access, delete, and correct your personal information, and not to be discriminated against for exercising these rights. To exercise a right, email [email protected]; you may use an authorized agent. We will verify your request using reasonable measures proportionate to the data involved.

EEA and UK (GDPR)

If you are in the European Economic Area or the United Kingdom, you have the right to access, rectify, erase, restrict, or object to the processing of your personal data, the right to data portability, and the right to withdraw consent at any time. The legal bases for our processing are set out in section 4. To exercise a right, email [email protected]. You also have the right to lodge a complaint with your local data protection supervisory authority, though we hope you will contact us first so we can help.

Washington, Nevada, and other state health-data laws

If you are in Washington, Nevada, or another state with a consumer health data law, our separate Consumer Health Data Privacy Policy describes the consumer health data we collect, the purposes, the third parties that process it, and how to exercise your rights to access, withdraw consent, and delete — including from backups. Where your state treats workout, heart-rate, or precise route data as sensitive data requiring consent (for example, Connecticut), we collect it only with your permission, through the device health permissions and the in-app disclosure, and only as necessary to provide the service you request.

Other regions

If you are elsewhere, you may have similar rights under your local law (for example, in Canada, Brazil, or Australia). Contact us and we will honor the rights that apply to you.

12. International data transfers

DropPace is operated from the United States. If you use the service from outside the United States, your data will be processed in the United States and in other countries where our service providers operate. Where we transfer personal data out of the EEA or the UK, we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses and the UK International Data Transfer Addendum. Contact us for more information about these safeguards.

13. Children

DropPace is not directed to, and we do not knowingly collect personal data from, children under 13 — or under 16 in the European Economic Area and the United Kingdom (or such other age as your local law sets for digital consent) unless a parent or guardian has provided consent. If you believe a child has provided us data, contact [email protected] and we will delete it.

14. Changes to this policy

We may update this Privacy Policy from time to time. When we make material changes, we will update the "Last updated" date above and, where appropriate, notify you in-app. Your continued use of DropPace after a change takes effect means you accept the updated policy.

15. Contact

Questions or requests about this Privacy Policy or your data? Email [email protected]. You can also review our Terms of Service and our Acceptable Use Policy.