Privacy policy

Who we are

UltraCalcPal ("we") is an ultra-marathon nutrition planner at ultracalcpal.com and in the UltraCalcPal apps. We are the data controller for the personal data described here. Write to contact@ultracalcpal.com for anything in this policy; the operator's legal name and address are given in the terms of use.

What we collect

Using the calculator without an account: nothing. The numbers you type stay in your browser and are not sent to us.

With an account:

• your email address, used to sign you in with a one-time link and to send receipts;
• a name and picture if you add them, and the numbers you choose to save on your profile: weight, sweat rate, how salty a sweater you are, experience and stomach tolerance, and your preferred units;
• the plans you save: the inputs, the resulting numbers, aid stations, race details, notes and your post-race review;
• if you buy Pro: the purchase record from the payment provider (amount, date, a transaction id), never your card details;
• technical records needed to run the service: request logs with IP addresses, kept briefly by our hosting provider, and error reports with the page involved;
• if you arrived from a link with campaign tags, those tags are stored once with your account so we can count where sign-ups come from. No cookie, no device id, no third party.

Why we use it

To sign you in, to show you your plans, to pre-fill the calculator with your numbers, to take payment for Pro and send the receipt, to answer your messages, and to keep the service working and secure. The legal basis is the contract with you for the account and Pro, and our legitimate interest in running the service safely. We do not profile you and we do not send marketing email.

Sharing a plan

A plan is private until you switch sharing on. A shared plan is reachable by anyone who has its link; the link is a long random string, is not listed anywhere and tells search engines not to index it. Everyone who opens it sees the plan's numbers, aid stations and notes, and the name you gave the plan, but not your email. Switch sharing off and the link stops working at once; you can also issue a new link.

Who processes it for us

We use a small number of providers to run the service. Each acts on our instructions:

• Supabase hosts the database, sign-in and file storage, in the European Union.
• Vercel hosts the website and runs the server code, in the European Union; request logs with IP addresses live there for a short time.
• Stripe takes payments on the website; Apple and Google take them inside their apps. Card details go to them, not to us.
• Resend sends receipt emails.
• OpenWeatherMap provides the race-day forecast for a Pro plan. It receives the race location and date, nothing about you.
• Sentry receives error reports with the page involved; plan links are removed before sending.
• Gravatar (Automattic) serves your profile picture only if you choose that option; it then receives a hash of your email.
• Google Analytics counts visits to the landing page, only if you accept it there.

We keep this list current. We never sell personal data and do not run advertising trackers.

How long we keep it

Your account and plans stay until you delete them. Deleting the account removes the profile, every plan, the picture and the sign-in email at once; short-lived backups at our database provider expire on their own. Payment records are kept as long as tax and accounting rules require. Request logs are kept for days, not months.

Your rights

You can see and change everything you gave us from your profile and your plans. You can delete a plan, stop sharing it, or delete the whole account yourself. You can also ask us to access, correct, export or erase your data, or object to a use of it, by writing to contact@ultracalcpal.com. If you are in the European Economic Area or the United Kingdom you can complain to your data protection authority.

Children

UltraCalcPal is for adults. We do not knowingly keep an account for anyone under 16. Write to us if you believe a child has made one and we will delete it.

Cookies and local storage

We set the cookies needed to keep you signed in, nothing else, unless you accept Google Analytics on the landing page, which then sets its own. The calculator keeps your unsaved numbers, your theme and your colour choice in this browser's storage; they never leave the device.

The apps

The iPhone and Android apps are the same service in a thin shell. If you turn notifications on, your device's push token is stored so we can send a reminder before a race on a saved plan; turning them off deletes it. If a saved plan has a race date, we also email one reminder in race week to the address on your account. Purchases in the apps go through Apple or Google under their own terms.

Security

Data travels over HTTPS and is stored in an EU data centre. Sign-in is by one-time email link, so there is no password to steal. Each account can only read its own rows; shared plans are read through a server route that checks the link. Tell us at contact@ultracalcpal.com if you find a weakness.

Changes

We will post any change here with a new date at the top, and tell account holders by email if the change matters to them.

Contact

Write to contact@ultracalcpal.com.