Privacy Policy

Last updated: 18 October 2026

Who is responsible

Pendio is an independent app developed by Guglielmo Cecero, who is responsible for the processing described here. For any privacy question or request, contact hello@pendio.app.

What stays on your phone

When you connect Strava, the Pendio app reads from Strava, directly on your phone:

• Your activity list and activity details (type, date, distance, duration, elevation, average heart rate and power).
• Activity streams: GPS coordinates, altitude, heart rate, speed and power. Pendio needs these to compute terrain and gradient metrics.
• Your name and profile photo, shown on your account in Settings.

If you connect Apple Health, Pendio reads your workouts (with their route, heart rate, distance and power) and your resting heart rate, heart rate variability, sleep, body weight and VO₂ max. It never writes to Apple Health.

All of this, and every metric Pendio computes from it, is processed and stored only on your device. It is never sent to Pendio's server, to the developer, or to anyone else. Apple Health data is never used for advertising and never shared with third parties.

What Pendio's server stores

Pendio runs a small server so you can sign in, keep your race plan in your account and open it on pendio.app, and so that Strava's app credentials don't have to ship inside the app. It stores only:

• An account number. This is a random identifier created the first time you sign in.
• Your Strava athlete number, if you use Strava. This is the numeric ID Strava uses for you, and it lets the server recognize you when you sign in again. Strava also sends your name and profile details during sign-in. The server discards them without storing them.
• Your email address, if you sign in with it or add it to your account, or if Google or Apple confirms a verified address when you sign in with them. It is used only to recognize your account, so the same address finds the same account whichever way you sign in, and to send you sign-in codes. Never for news or marketing. Apple's “Hide My Email” addresses are not kept.
• Your Google account identifier, if you sign in with Google. This is the number Google uses for you at Pendio. Pendio asks Google only for your email address, never your name or photo, and keeps no Google token.
• Your Apple account identifier, if you sign in with Apple. This is a random identifier Apple creates for Pendio, not your Apple ID. If Apple shares a verified email address that isn't a “Hide My Email” address, it is kept as your account's email address (see above). Your name is never stored.
• Sign-in codes. When you ask for a code, the server keeps the address it was sent to and a one-way fingerprint of the code, never the code itself. A code works once, for 10 minutes and five tries; once used, its fingerprint is wiped and it can never work again. The record is deleted a day after the code was asked for (until then it only counts how many codes an address or a network got and how many wrong tries they had). Deleting your account removes the address it signs in with from these records at once, however it was written; a code it asked for to add another address stops working and goes a day later with the rest.
• Your sign-in tokens. Strava tokens let the app keep reading your activities without asking you to log in again. If you sign in with Apple, an Apple token is kept only to cancel Pendio's access at Apple when you delete your account. Tokens are encrypted (AES-256), and the encryption key is kept separately from the database. If you use Strava, the server also notes when it last read your Strava name and photo for pendio.app: a time only, used to limit how often it asks Strava.
• Your sign-in sessions, one for the app and one for a browser at most. Only a one-way fingerprint (hash) of each is kept, plus whether it belongs to the app or a browser — for a browser, its name and system (for example “Safari on Mac”), so you can recognize it in your list of devices — and when it was created and last used.
• Your race plan, while you're signed in: the races you add (name, date, A/B/C priority, distance and climbing), the race courses you import (the course's GPX file — a planned route, not one of your workouts), the goal time, carb rate and gel size you choose for a course, the race plans you build on pendio.app (the waypoints you place on a course, such as aid stations and cut-offs, with their names, stop times, supplies and notes, plus the start time and pacing settings you choose), and the settings you type in the app (FTP, threshold pace, heart-rate values and zones, units, training-plan settings, and your weight or resting heart rate if you typed them). Values that came from Apple Health are never sent. When you add a course from a race page, your device downloads the organiser's file from the organiser's own site, as if you had clicked their download link, and keeps it in your account; the organiser's site sees your device's address, as any site you open does.

The server does not store your workouts, their GPS tracks, heart rate or health data, your name or photos, or anything Pendio computes from your workouts (readiness, predicted times, training load). Those stay on your phone.

If you use Strava, pendio.app shows your Strava name and profile photo on your account, as the app does. When the page asks for them, the server reads them from Strava with your own Strava access and passes them straight to your browser without storing them. The page uses your browser's copy for at most seven days and deletes an older copy the next time you open it; signing out on the page removes it at once. They are shown only to you.

Your IP address is used briefly to limit repeated sign-in attempts and is not stored by Pendio. When you ask for a sign-in code, the server keeps a one-way fingerprint of your network beside the code, made with Pendio's secret key and the day's date, so without that key it can't be turned back into your IP address, and it can't be linked from one day to the next; it only counts how many codes one network asked for, and it is deleted with the code. The server keeps no access logs, only anonymous error codes.

The beta waitlist

If you join the beta waitlist on pendio.app, Pendio's server stores the email address you type, which form you used (for example the blog article it was on) and when, and whether you have confirmed the address. It sends you an email, from hello@pendio.app, with a link to confirm it; only a confirmed address is on the list. The link carries a random token, which the server keeps only as a one-way fingerprint, and it works only when you press the button on the page it opens. If you ask again, you get at most three emails a week, ten minutes apart, always to the address you first typed.

To stop the form being used to flood someone's inbox, the server also keeps a short log of requests to join: for each one, a one-way fingerprint of the address and of the network it came from (renewed daily, made like the one used for sign-in codes) and whether an email went out — never the address or the IP itself. The log is deleted after 7 days, also if you leave the list in the meantime.

A confirmed address is used only to tell you about the beta and the App Store launch; the form it came from is only counted in totals per form. It is not linked to a Pendio account, never shared, and never used for anything else. You can leave at any time with the link in any of the emails, or by writing to hello@pendio.app; the address is then deleted at once.

Why this data is processed

The data on the server is used only to sign you in (including emailing you the sign-in codes you ask for), to give the app short-lived access to your own Strava activities, and to keep your race plan in your account so it's there on pendio.app and on another phone — the service you ask for when you sign in. A waitlist address is used only to email you about the beta and the launch, because you asked for it and confirmed the address; leaving the list withdraws that at any time. The waitlist's request log is used only to limit how many emails the form can send, and the form a waitlist address came from only to count totals per form. Pendio does not sell, rent or share your data. It does not use it for advertising or profiling, nor (beyond those waitlist totals) for analytics, and it does not use it to train AI models.

How long it is kept

• Sessions expire after 90 days without use in the app, 30 days in a browser, and after one year at most. Expired sessions are deleted every hour. Signing out ends your session immediately.
• Sign-in codes stop working once used, after 10 minutes or after five wrong tries, and the record is deleted a day after the code was asked for.
• Your account, your email address, the identifiers Strava, Apple and Google use for you, and your sign-in tokens are kept until you delete your account (Strava tokens also go when you disconnect Strava, the Google identifier when you remove Google). If you revoke Pendio at Strava, the tokens stop working and are deleted the next time the app tries to use them.
• Your race plan is kept until you change or delete it in the app or on pendio.app, or delete your account. A race, course or race plan you delete is removed from the server too; deleting a course also deletes its race plan.
• The waitlist: an address that isn't confirmed is deleted 7 days after its latest confirmation email, and the log of requests to join after 7 days. A confirmed address is kept until you leave the list, and at the latest until 12 months after Pendio's App Store launch.
• Backups. The database provider keeps automatic point-in-time backups for up to 30 days. After that, deleted data is gone from the backups too.

Security

• All connections use HTTPS.
• Strava and Apple tokens are encrypted at rest, and sign-in sessions are stored only as hashes.
• Pendio has no passwords, so there are none to leak. A sign-in code only works together with a random secret held by the browser or phone that asked for it, and only a fingerprint of the two is stored. The code email never contains a link: sign-in codes only ever come from no-reply@pendio.app. The waitlist's emails come from hello@pendio.app.
• Your race plan can be read only with your own sign-in session. It is stored as you entered it (encrypted on Cloudflare's disks, but not end-to-end encrypted).
• An account can be signed in on one phone and one browser at a time. Signing in again in the app ends the previous app session, and signing in again in a browser ends the previous browser session. “Sign out everywhere” (in the app's Settings or on pendio.app) ends them all.
• Sign-in attempts are rate-limited, and an address gets at most five codes an hour and ten a day.
• On your phone, your session is kept in the iOS Keychain, where only Pendio on that device can read it.
• On pendio.app, your session is kept in your browser's storage for pendio.app, and a copy of your race plan (with its course files) in the browser's own database, so the page also works offline, and your Strava name and photo for up to seven days (an older copy is deleted the next time you open the page). Signing out on the page removes all of it. The page uses no cookies.

Service providers

• Strava is where your activities come from if you connect it, and one way to sign in, under Strava's own Privacy Policy. Pendio shows your Strava data only to you. Strava may also collect and use data about how Pendio uses its API, for Strava's own business purposes, under that same policy.
• Apple confirms who you are if you sign in with Apple, under Apple's Privacy Policy. Apple Health data is read on your phone and never reaches Pendio's server.
• Google confirms who you are if you sign in with Google, under Google's Privacy Policy. Pendio asks Google only for your email address, and uses it only when Google can vouch for it (a Gmail or Google Workspace address).
• Resend sends the sign-in code emails and the waitlist's emails. It sees your address and what the email says, under Resend's Privacy Policy. The sending region is Europe.
• Cloudflare hosts the pendio.app website, Pendio's server and its database. The database is located in Europe. Cloudflare processes this data only to run the service, under its Privacy Policy.

Pendio uses no advertising, analytics or tracking services.

Your choices and rights

• Delete your account in the app under Settings → Account → Delete account, or on pendio.app under Account → Delete account. This deletes everything on Pendio's server that belongs to your account, including your race plan and your email address (a beta waitlist address isn't part of an account: leave the list with the link in its email), revokes Pendio's access at Strava and at Apple (Pendio holds no Google token, so there is nothing to revoke at Google). Deleting in the app also erases Pendio's data on your phone; deleting on pendio.app signs your phone out and leaves its workouts there.
• Sign out in the app's Settings or on pendio.app. This ends that session. In the app, your workouts and race plan stay on your phone; on the web, the page forgets its copy and your race plan stays in your account. Sign out everywhere ends every session at once.
• Revoke Pendio's access at any time in your Strava connected apps settings or your Google account's third-party connections, or stop Apple Health access in the iOS Health app.
• Deleting the Pendio app removes your workouts and analysis from your phone. To also delete your account on the server, use Delete account first, or email us.
• You can ask to access, correct, export or delete your data by writing to hello@pendio.app. You can also complain to your data protection authority.

Children

Pendio is not directed to children and is intended for use by adults.

Changes to this policy

If this policy changes, the updated version will be posted on this page with a new “Last updated” date. If Pendio ever stores more than described here, for example to back up or sync your workouts, this page will say so before that happens.