How we handle your data

• Runs you upload (GPX/FIT files)
• Stats derived from those runs (pace, heart rate, cadence, bonk risk, weather at run time)
• Your email and account row
• Strava OAuth tokens, if you sign in via Strava

The whole point of pancit.run is learning your tropical bonk signature so we can tell you when you're going to blow up before you blow up. That requires keeping your data. We use it for: (1) calibrating our bonk model on your specific runs, (2) generating debriefs and titles for your runs, (3) showing you your training history. Nothing else.

• We never sell your data. To anyone, ever.
• We never share it with third parties for advertising or analytics.
• We never use it to train AI models for anyone but you.

To run the product, your data passes through a small set of infrastructure services. They process data on our behalf under contract — they are not allowed to use it for their own purposes:

• Cloudflare — hosting, database, edge cache
• Anthropic — we send the data needed to generate your run debriefs and titles (statistics, conditions). Per Anthropic's commercial API terms, this data is not used to train their models.
• Resend — sends you emails (sign-in links, notifications)
• Stripe — handles subscription payments. We never see your card details.

If you connect Strava, we use Strava's API to fetch your activities — Strava is a service you have a separate account with, not our processor.

Cloudflare, Anthropic, Resend, and Stripe operate primarily in the US and EU. Where legally required, transfers happen under Standard Contractual Clauses.

Your data stays until you delete your account. We don't keep the original GPX/FIT files you upload — we parse them into stream data and discard the originals. If we ever change this, we will update this page before the change happens.

You can delete your account in /settings/delete. Deletion is immediate and complete — we don't anonymize-and-retain, we don't hold deleted data for later use. Cloudflare retains automated 30-day point-in-time backups that we can't delete on demand; after 30 days, gone.

Under GDPR, UK GDPR, PDPA 2010 (Malaysia), CCPA, and similar laws, you can:

• Access your data — email privacy@pancit.run
• Rectify it — change your email in /settings/email
• Erase it — delete your account in /settings/delete
• Export it — download your runs in /settings/export
• Restrict or object to processing — email privacy@pancit.run

EU/UK users have the right to lodge a complaint with their national data protection authority.

We process your data under contract (GDPR Art. 6(1)(b)) — it's necessary to provide the running analytics service you signed up for.

Session cookies only — to keep you signed in. No tracking, no analytics, no advertising cookies. If we ever add anything non-essential, we will update this page first.

pancit.run is for people 16 and older. We don't knowingly collect data from anyone younger. If you believe we have, email privacy@pancit.run and we will delete it.

Privacy questions: privacy@pancit.run

Controller: Paulrydrick Puri, sole proprietor operating as pancit.run, Kuala Lumpur, Malaysia.

If we materially change this page, we will update the "Last updated" date and notify existing users by email.