Privacy Policy
Last updated: 2026-10-11
Splitshape ("we", "us") provides AI-generated race-pacing plans. This page explains what data we collect, why, and what rights you have. We are a small, founder-run product, and this policy is written in plain language on purpose.
Who is responsible for your data (data controller)
Tomasz Bisek, an individual, operating Splitshape as an independent project.
Contact for any privacy question: privacy@splitshape.com
What we collect
- ā¢Waitlist sign-up and email confirmation: your email address, which race page or plan (if any) you signed up from, and, where we asked, your marketing consent choice.
- ā¢Unlocking a free plan: when you confirm your email to unlock a plan, we store your email on that plan together with the unlock time, so you keep access to it and so we can give one free plan per email address. We also record when you confirmed the address.
- ā¢Building a pacing plan: the race you select or the GPX file you upload, your target time, any recent race results you type in, your race date and start time, and your unit preferences (km/mi, Ā°C/Ā°F, km/h/mph).
- ā¢Automatically: we run our own self-hosted instance of Umami, a privacy-first, cookie-free analytics tool, on our own Vercel and Supabase infrastructure (see "Who else processes your data" below). It does not use cookies and does not collect personal data or track you across sites. We may set one small functional cookie to remember your language/unit preference; this is not used for tracking and does not require consent under EU cookie rules.
- ā¢Abuse prevention: to limit automated misuse we keep short-lived counters tied to a keyed hash of your IP address (and, when you ask us to resend a link, of your email address), never the raw value. They are deleted automatically after about two days.
Why we collect it (legal basis under GDPR)
- ā¢To generate and deliver the pacing plan you asked for: performance of a contract (Art. 6(1)(b) GDPR).
- ā¢We do not send marketing emails at the moment. If we start, we will only email you with your explicit consent (Art. 6(1)(a) GDPR), which you can withdraw at any time by writing to privacy@splitshape.com.
- ā¢To keep the service secure and prevent abuse: legitimate interest (Art. 6(1)(f) GDPR).
Who else processes your data (subprocessors)
- ā¢Supabase: database and account authentication.
- ā¢Resend: sending transactional and waitlist emails.
- ā¢Vercel: hosting.
Our Ko-fi support link goes to an external service with its own privacy policy; Splitshape never receives any payment data from it.
Some of these providers may process data outside the EU/EEA; where that happens, we rely on their Standard Contractual Clauses or equivalent safeguards. We do not sell your data to anyone, ever.
How long we keep it
- ā¢Waitlist entries: until you ask us to delete them (write to privacy@splitshape.com), or until a reasonable period after Race Shape launches.
- ā¢Plan data: for as long as your account exists, so you can return to your plans; you can ask us to delete it anytime.
Your rights
Under GDPR you can ask us to: access the data we hold about you, correct it, delete it, restrict or object to its processing, or receive it in a portable format. Email privacy@splitshape.com and we'll respond within a reasonable time. If you're unhappy with our response, you can complain to the Polish data protection authority (UODO, uodo.gov.pl) or your local equivalent.
Children
Splitshape is not directed at children under 16.
Changes to this policy
If this policy changes meaningfully, we'll update the date at the top and, for material changes, notify the people on our waitlist by email.