Privacy, in plain language.

Pacevera is a local-first fitness decision engine. This page is the canonical public policy for the current Desktop preview, the v0.5.7 local Google Health connector, and planned deployment boundaries. C is not a public service until its separate release gates are complete.

Controller/operator: For the current public preview, Henry Yeh is an individual operator based in Taiwan, operating under the Pacevera name. Pacevera is not a separate incorporated legal entity. Privacy requests: [email protected]. A registered service address and any successor legal entity will be published before a paid or production launch.

Local Desktop — v0.5.7 connector release

• No Pacevera account or health-data signup.
• No provider is contacted unless you explicitly connect it; v0.5.7 supports the local Google Health connection described below.
• No Pacevera server holds your health data, no analytics history, no advertising profile. The optional authorization relay holds only short-lived consent transactions and authorization codes until the local computer claims them; it does not hold health data.
• Host conversations, imported files, operating-system backups, and other software on your computer are outside this specific promise and are governed by their operators.

What the extension keeps, on your computer

Processing your evidence on your own machine is not the same as keeping nothing. The extension writes two things, both on your disk, both yours to export or delete.

• A continuity record, when you give the extension an identity: a hashed identity and the minimum state needed to carry a conversation on. It holds no raw provider payload and no provider token.
• A local store at ~/.pacevera/pacevera.sqlite, created the first time the extension starts. It is opened through node:sqlite and records the decisions it made for you, the outcomes you report back, and the derived state behind them — readiness, fatigue and training load, not the raw readings your device took.

The current SQLite schema discloses these tables explicitly: users, goals, preferences, injuries, equipment, workouts, health_metrics, semantic_fitness_states, plans, planned_workouts, decision_records, and outcome_records. They contain user context, constraints, planned and completed workouts, health-related metrics, derived fitness state, decision traces, and reported outcomes as applicable. They remain on the user's device under the local deletion and export controls described here.

Three further tables exist in the repository's migrations but are not created by the v0.5.7 bundle: connector_accounts (connector authorization state and scope), raw_provider_events (raw provider payloads), and normalized_events (normalized events). Google connector evidence is kept in the selected local folder instead, normalized: the Google Health response is normalized in memory and never written to disk.

Both are retained until you delete them: no hidden expiry, and nothing is sent anywhere. You can export a readable backup, and you can delete one identity’s complete data — or simply remove the files. Deleting them does not remove copies your AI host, your provider, or your operating-system backups keep; those are deleted where they live.

On Node.js older than 22.5 the local store cannot be opened at all. The extension keeps working without it, and nothing is written there.

What you can check yourself

Pacevera ships as one compiled file. You do not have to take the statements above on trust — each of these is checkable against the file itself, and is checked before every release.

• Search it for node:http and fetch(: these occur only for the optional local Google connector, whose provider hosts are accounts.google.com, oauth2.googleapis.com, and health.googleapis.com, plus the authorization-only auth.pacevera.com relay when QR consent is enabled.
• Search it for writeFile: it writes only owner-local continuity, encrypted connector tokens, and provider responses in the selected local folder.
• Search it for child_process: it appears only in the connector release, and only so Pacevera can hand your vault key to your operating system's own credential store. The release without the Google connector has no match at all.
• Search it for GOCSPX-: the connector release embeds its two Google client secrets, one per consent entrance. For the browser entrance that is Google's documented model for an installed app. For the QR entrance it is not, so treat that value as public — what protects the connection is PKCE and a single fixed redirect address, not that string.
• Search it for node:sqlite and you find the one place the local store is opened — the only durable store besides that continuity record, and it is on your disk, not ours.

What the page demo does

The decision cards and outcome controls on the homepage use reviewed example data. Your selections are kept only in the page session and are not submitted to Pacevera. They do not create an account or durable history.

Future deployment modes

B — local Google Health connector: available in v0.5.7. The user authorizes Google in their own browser; tokens, normalized evidence, and derived records remain on the user's device. Disconnecting is offered in the product: it revokes the grant at Google, deletes the stored credential, deletes the evidence previous syncs wrote, and clears the derived Google records from the local store. Files you placed in the export folder yourself are reported back for you to delete, never removed silently. It is not described as the no-outbound Desktop mode.

Google user data — Limited Use: Pacevera's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements. Google Health data is used only to provide the training-decision features you asked for; it is not sold, not used for advertising, not used to train any model, and not transferred to anyone except at your direction or as required by law. No human reads it: your own machine fetches it, normalizes it, and stores it in the folder you chose.

C — user-controlled mobile path: planned. A mobile AI host would reach a Pacevera engine on the user's own machine through a reviewed pairing and transport channel; plan, continuity, outcomes, provider credentials, and Evidence remain in that user-controlled environment. The “operator receives nothing” statement is conditional on end-to-end confidentiality. A tunnel, relay, reverse proxy, or other third party that terminates TLS and can read Evidence is a recipient whose role, retention, access, transfers, and deletion require review. Mobile host compatibility and the exact TLS termination point are not yet verified. A Pacevera-operated hosted remote service remains no-go.

Hosted remote activation: if the existing no-go hosted-remote mode is later activated, the policy will first identify the authorization server, client-registration records, identifiers and any per-MAU activity records, subprocessors, international transfers, and retention/deletion periods for Evidence, logs, traces, queues, backups, and authorization records. A hosted DPIA and an independent remote-image/outbound release gate are required before that mode becomes available.

User-controlled private / Enterprise: future. The user or organization controls the environment, retention, backups, access, deletion, and any DPA obligations.

Deletion and questions

To remove local preview data, export or delete the owner-scoped records, remove the local files, and delete host conversations, imported files, and backups where they live. Provider revocation is separate from local deletion. Where GDPR applies, requests may include access, rectification, erasure, restriction, portability, and objection; contact [email protected] without sending health data unnecessarily.

Read the canonical Terms of Use. The versioned GitHub mirrors are Privacy and Terms.