Palmares is a pacing and team-management tool for Zwift TTT clubs. We take care with the data you give us. This page explains what we store, who sees it, what leaves our servers, and how to have it removed. See also our Terms of Service.
If anything here is unclear, reach out in the Palmares Discord server (link in the footer below) and we'll fix the wording.
What we collect
Everything here is collected because a feature needs it — we don't collect anything “just in case”.
| Data | Why we need it |
|---|---|
| Your email | To sign you in via a one-time code — we don't use passwords |
| Your Zwift ID | To pull your ZwiftPower stats so you don't have to type them |
| Your ZwiftPower stats (FTP, 20-min power, weight, height, category, country, ZP display name) | Powers the pacing engine and the team-build UI |
| Your display name | Appears on team sheets, race signups, and Discord posts |
| Your Discord handle | Optional; used by your club managers to tag you when posting team sheets |
| Whether you have a steering device | Helps your captain pick pull order |
| Your club memberships and role | Determines what you can see and do inside each club |
| Your race signups and team placements | The point of the app |
| Your emergency contact (name, phone, relationship) | Optional; visible only to the managers of clubs you belong to, in case something goes wrong on a ride |
We don't use analytics, cookies that track you, or advertising pixels. We don't use session replay, heatmaps, or any other behaviour monitoring.
Where we store it
All your data lives in two places:
- Supabase — our database and auth provider. It hosts the table rows listed above. Region: EU (Ireland).
- Vercel — runs the app and briefly retains request logs. Edge locations are global; logs are retained for 30 days by default.
Your club's logo and any route notes / images you upload live in Supabase Storage in the same region.
Who can see what
The app's access rules are enforced at the database level (Postgres row-level security), not just in the UI, so “who can see it” is the same regardless of how someone tries to fetch it.
| Data | You | Clubmates | Club managers | Other members |
|---|---|---|---|---|
| Your email | ✓ | — | — | — |
| Your name, Zwift ID, stats, category | ✓ | same club | ✓ | — |
| Your Discord handle | ✓ | — | ✓ | — |
| Your team placements and race signups | ✓ | same team / same slot | ✓ | — |
| Your emergency contact | ✓ | — | ✓ | — |
“Club managers” means owners and managers of the specific clubs you belong to — not any other club on the platform.
What leaves our servers
Palmares only talks to a few external services, and only for things you explicitly do:
- ZwiftPower — when you enter or refresh your Zwift ID, we fetch your public profile from zwiftpower.com. They see an incoming request from our servers; that request includes no data about you beyond your numeric Zwift ID.
- Discord — when your club manager posts a team sheet or opens signup, we send the composed message to the Discord webhook URL your club configured. Only the content your manager chose to post is sent.
- Resend — sends the one-time login code to your email address. They process the message in transit and do not retain its contents.
We do not sell, rent, share, or syndicate your data with anyone else. There are no advertising or marketing recipients.
If you're not a Palmares user
Palmares also displays race results pulled from ZwiftPower and WTRL — standings, finish times, and category placings for public TTT/ZRL races. This means a rider who has never signed up for Palmares can still appear in results shown here, if they raced against a Palmares-registered club. We process this on the basis that it's publicly-published competitive results data (the same data ZwiftPower/WTRL themselves publish), used only to show race outcomes — not linked to any other profile, and not combined with anything else about that person.
If you're in that position and want your name removed or replaced with a placeholder in results shown on Palmares, message us in the Palmares Discord server and we'll action it.
Getting a copy of your data
Download a copy of your profile, emergency contact, club memberships, and upcoming signups any time from Profile → Account — no need to ask us first.
How to have your data removed
Message us in the Palmares Discord server and ask. We'll delete every row of your data within 30 days, including:
- Your user profile and all stats
- Your emergency contact
- Your club memberships and signup history
- Any logo or image you uploaded
Anonymised race results (who was in which team on which date) may be retained if removing them would break historical team sheets for your clubmates — we'll discuss that with you before doing so. Your name in those records is replaced with a placeholder.
You can also temporarily leave a club from the member UI, which removes your club-level data without deleting your profile.
Security
Auth is email-only OTP (no passwords to leak). All database access is mediated by Supabase with row-level security policies (so a user can't read rows they shouldn't be able to, even if they try to bypass the UI). All traffic is HTTPS.
We don't claim to be audited or certified — this is a solo-built side project — but we take reasonable care. If you spot a security issue, send a direct message to @alex in the Palmares Discord server before posting it publicly.
Changes
We'll bump the “Last updated” date at the top of this page when we change anything. If a change materially affects what we collect or who can see it, we'll also surface it inside the app the next time you sign in.