Skip to main content
Privacy

Last updated: October 2026

Läs på svenska

Privacy Policy

This policy describes how Traqeo processes your personal data when you use our service, and what rights you have under the General Data Protection Regulation (GDPR) and Swedish data protection law. We have written it to be easy to understand — get in touch if anything is unclear.

This is an English translation of our Swedish privacy policy. If the two versions differ, the Swedish version prevails.

1. Data controller

The controller of the processing is TRNX Venture AB, corporate identity number 559571-6019, Barfotsgatan 1, 442 39 Kungälv, Sweden (“Traqeo”, “we”, “us”). This means that we decide why and how your personal data is processed and are responsible for ensuring that it is done in accordance with the law.

Contact for data protection matters: hej@traqeo.se. We have not appointed a data protection officer, as we are not required to, but the address above is your direct channel for all questions and requests concerning your data.

2. What personal data we process

We collect as little as possible and only what is needed to run and personalise the training service. Depending on how you use the app, the following categories may be processed:

  • Account data: email address, an optional name/display name, an optional profile picture, and a securely hashed version of your password (never in plain text). If you sign in through an external service (e.g. Google or Apple), we process the identifier and account details that service provides.
  • Profile and onboarding data: target race and race date, training background, available equipment, number of sessions per week, and the physiological measurements you enter yourself — e.g. date of birth, sex, height, weight, maximum heart rate, threshold heart rate and estimated VO₂max. If you tell us which region you train in, we use it to estimate when the snow arrives.
  • Training and log data: completed and skipped sessions, sessions you log yourself outside the plan, rating of perceived exertion (RPE), your own notes, periods when you are travelling, generated training plans, and your answers when a stage ends (e.g. how long you want your long sessions to be in the next stage).
  • Sessions you record in the app: if you record a session with your phone’s GPS, we store the time, distance, elevation gain and a simplified version of the route you moved along. We read your location only while a recording is running, never otherwise. The positions stay on your phone until the session has been saved and are then deleted there. The route is shown only to you and is deleted when your account is deleted.
  • Health and wellbeing data (see section 3): heart rate, heart rate variability (HRV), resting heart rate, sleep, and periods of illness and injury with severity, symptoms and notes. This is sensitive data and is processed only with your explicit consent.
  • Data from connected services: if you connect Strava, we retrieve your training activities — sport type, time, distance, elevation gain, heart rate and power data, and heart rate curves — to match them against your plan and fine-tune your zones. If you instead connect intervals.icu, we retrieve the same data from the watch you have linked there (but no recovery data — sleep, resting heart rate and HRV are not retrieved that way); if you switch it on, we also add your upcoming planned sessions to your intervals.icu calendar so they can be transferred to your watch (see section 6). If you connect Polar, we retrieve your training sessions from Polar Flow — sport type, time, distance, heart rate and heart-rate curve — and recovery data (sleep, resting heart rate and Polar’s Nightly Recharge with HRV); Polar only releases sessions uploaded after you connected, at most 30 days back. If you disconnect, we deregister you with Polar. If you connect Whoop or Oura, we retrieve only recovery data — resting heart rate, HRV and sleep — since those services do not carry training sessions (they can no longer be connected anew, but an existing connection continues). In these cases we also store encrypted access tokens for the connected service.
  • Data from Apple Health: if you connect Apple Health in the iPhone app, we read workouts with heart rate curves as well as resting heart rate, heart rate variability (HRV) and sleep from the Health store on your own phone. During onboarding we also read your most recently saved weight, so you don’t have to type it in. This source differs from the others: the data goes from your device directly to us, no third party stands in between, and we store no access tokens for it. We only read — the app never writes anything to Health. You control access yourself in iOS under Settings → Privacy & Security → Health, and you can disconnect from within the app.
  • Execution score: when a planned session has a connected activity with heart rate data, we calculate a score (0–100) for how closely you followed the plan — time in the right heart rate zone, evenness and duration. The score is compared with a modelled reference group and, once enough people have done the same session, with other users’ scores for that session. You see the result as a share (e.g. “better than 87%”). No other user sees your score, your name or your heart rate data — your score is included only anonymously in the basis for other people’s comparisons. The score is calculated from heart rate data and is therefore only produced with your health data consent (section 3).
  • Payment data: when you make a purchase, we process purchase and subscription status and identifiers from our payment provider — the Apple App Store or Google Play (purchases are currently made only in the app). We never store the card number itself — it is handled directly by the store.
  • The goal guarantee: if you register for the goal guarantee, we process your bib number and your full name. If you choose money back, we also process the name and the bank account (clearing and account number) you give us for the payout. The bank details are stored encrypted.
  • Data in “Traqeo Group Training”: if you create or join a training group, we process group membership, proposals and responses to shared sessions. The group’s members can also see how a confirmed shared session fits into your plan and whether you have logged it as completed. The rest of your plan is not shown to the group; it is used only to work out which days suit everyone. If you invite someone, we process the email address or phone number you enter for the invitation.
  • The race forecast on the web: if you take the race forecast before you have an account, we store the email address you enter, your answers (including race, goal, training habits, age and sex) and the forecast you received, and send the forecast to that address. If you tick the box for tips, we also store that consent, with the time and the wording you saw.
  • The waiting list: if you sign up on the front page to hear when the app launches, we store the email address, when and on which page you signed up, the wording you saw at the form, and when you confirmed the address via the link in our email.
  • Technical data and communication: settings and notification preferences, a notification token for your phone if you allow notifications in the app, coach letters we send you, technical operations and security logs, error reports from the app and the website (stripped of name, email and IP address), and — only if you have accepted it in the cookie banner — statistics on how the website is used (section 11).

3. Sensitive data (health data)

Several of the data points above — heart rate, HRV, sleep, resting heart rate, and periods of illness and injury — are data concerning health and constitute a special category of personal data under Article 9 of the GDPR. We process them only in order to deliver and personalise your training plan and to show how your sessions went, including the execution score and the anonymous comparison in section 2. The legal basis is your explicit consent (Article 9(2)(a)). Consent is voluntary — the app works without it, but your plan cannot then be adapted to your heart rate and recovery data, and sick days are saved as ordinary absence without any information about illness.

We ask for consent the first time health data comes in: when you connect a service or a watch, report yourself sick, or save your own heart rate or a heart rate test. We do not ask about health when you create an account or during onboarding. We store when you gave consent, the wording you saw, and the IP address and device information (user agent) the request came from, as proof of the consent.

You can withdraw your consent at any time under Account → Withdraw consent to health data in the app. We then delete stored heart rate values, heart rate curves and time in zone, recovery data (resting heart rate, HRV and sleep), the execution score, your own heart rate in the profile, heart rate tests and calibration values. Sick periods become ordinary absence with the same dates, without information about illness, symptoms or notes. No new health data is retrieved until you consent again. You can also disconnect connected services or delete your account. Withdrawing consent does not affect the lawfulness of processing that has already taken place.

4. Purposes and legal basis

  • Providing the service — creating your account, generating and personalising training plans, showing progress and forecasts. Legal basis: performance of the contract with you (Art. 6(1)(b)), and for health data explicit consent (Art. 9(2)(a)).
  • Handling payment, subscriptions and the goal guarantee. Legal basis: performance of the contract (Art. 6(1)(b)) and legal obligation for bookkeeping (Art. 6(1)(c)).
  • Improving and securing the service — troubleshooting, abuse prevention, and evaluating and improving our training engine. Legal basis: our legitimate interest (Art. 6(1)(f)) in running a secure and functioning service. Our quality evaluation of the engine runs against synthetic test profiles, not against your personal data.
  • Website statistics — understanding how the website is used, e.g. which steps of sign-up work. Legal basis: consent (Art. 6(1)(a)) via the cookie banner, which you can change at any time (section 11).
  • The race forecast — sending the forecast to the address you enter. Legal basis: performance of the contract (art. 6.1 b). We only send tips and offers by email if you ticked the box for it; the legal basis is then your consent (art. 6.1 a), which you can withdraw at any time via the link in every email or by emailing us.
  • The waiting list — sending an email where you confirm the address, and then an email when the app launches. Legal basis: consent (art. 6.1 a). If you do not confirm the address, we do not email it again. You can unsubscribe at any time via the link in the emails or by emailing us.
  • Communication — answering questions and sending service-related messages and coach letters. Legal basis: performance of the contract and legitimate interest respectively (Art. 6(1)(b)/(f)).

5. Automated processing

Your training plans are produced by our rule-based training engine, based on the information you provide and the training you complete. The engine suggests content; you decide yourself whether and how to follow the plan. The processing is therefore a decision-support tool and not a decision based solely on automated processing that produces legal effects or similarly significantly affects you within the meaning of Article 22 of the GDPR. If you would like to speak with a human about how your plan is produced, you can always get in touch with us.

6. Recipients and processors

We never sell your personal data and do not share it for marketing. To run the service, we use a small number of carefully selected service providers that process data on our behalf (processors), each bound by a data processing agreement:

  • Neon — database hosting (storage of all account data). Region: EU.
  • Vercel — application and web hosting, and storage of the profile and group pictures you upload.
  • Anthropic — translates free text in your training plan (e.g. session descriptions) into English when you use the app in English. Only the text to be translated is sent, without your name, email or other account details. The plan itself is built by our own engine, without AI. Under the provider’s terms, data sent through the API is not used to train their models.
  • Resend — sending transactional emails (sign-in and verification codes, notifications).
  • Inngest — running background jobs (e.g. plan generation).
  • Sentry — error reporting from the app and the website. Reports are stripped of name, email, IP address and request content before they are sent. Region: EU.
  • PostHog — statistics on how the website is used, only if you have accepted it in the cookie banner. Region: EU.
  • Expo — delivering app updates and notifications to your phone.
  • Google Workspace — our email, e.g. when you write to hej@traqeo.se.
  • Strava — retrieving your activities after you have explicitly connected it.
  • Polar (Polar Electro Oy, Finland) — retrieving your training sessions and recovery data from Polar Flow after you have explicitly connected it.
  • Whoop and Oura — retrieving recovery data (resting heart rate, HRV and sleep) from the strap or ring you wear, after you have explicitly connected it. This applies only to a connection you already have; new connections cannot be made.

Apple Health is not a processor. That connection works the other way round from the others: the Health store sits on your own iPhone, the app reads from it locally and sends the data directly to us. Apple therefore does not process any data on our behalf in that chain and does not receive what we retrieve. There is thus no data processing agreement to sign for it, and no access tokens to store — the data ends up with the same providers as all other account data, i.e. those listed above.

intervals.icu is not a processor either. It is an independent service you hold your own account with, on its own terms. When you connect it, we retrieve your activities from it on your instruction — not your recovery data (sleep, resting heart rate and HRV), which we do not use today. If you switch on Send the sessions to your watch in the app, we also add your planned sessions for the next two weeks to your intervals.icu calendar so that intervals.icu can transfer them to your watch. What is sent is each session’s name, date, sport, duration and steps, and — only if you have given your consent to health data and train by heart rate — the heart rate targets for the steps, calculated from your heart rate zones. Strength and mobility sessions are not sent. To make the heart rate targets match, we read your threshold heart rate in intervals.icu when the sessions are calculated, and to tell you whether your watch receives the sessions, we read whether uploading to your watch is switched on there; neither is stored by us. If you switch it off, disconnect or delete your account, we remove the upcoming sessions we added. We never touch anything else in your calendar. You disconnect under Connections in the app, and we then ask intervals.icu to revoke our access.

We may also disclose data if we are required to do so by law or by a decision of a public authority. Should the business be transferred (e.g. in a business transfer), data may be transferred to the acquirer, who will then be bound by this policy.

7. Transfers to third countries

Neon, Sentry and PostHog process the data within the EU. Some of the other providers (including Anthropic, Resend, Vercel, Inngest, Expo, Google, Strava and Whoop) may process data in countries outside the EU/EEA, mainly the United States. When this happens, we ensure a level of protection equivalent to the GDPR through appropriate safeguards — primarily the European Commission’s standard contractual clauses and, where applicable, the provider’s certification under the EU–US Data Privacy Framework. You can contact us for more information about these safeguards.

intervals.icu is not established in the EU/EEA. The only things we send there are what you ask for: your planned sessions once you have switched sending on, with heart rate targets only with your consent to health data (see section 6); the data you hold there is covered by intervals.icu’s own terms, which you accepted when you created the account.

8. How long we keep your data

We keep your data for as long as you have an active account, in order to deliver the service and your training history. In addition:

  • When you delete your account, your personal data is permanently removed from our production and backup environments within 30 days.
  • Accounting records are kept for as long as the Swedish Bookkeeping Act requires (normally seven years), even after the account has been deleted. For in-app purchases the bookkeeping is based on Apple's and Google's reports; a payout under the race guarantee is recorded with recipient and amount.
  • When you withdraw from a purchase we keep the record: which purchase, when the withdrawal reached us, the name and email address you gave and what happened to the refund (legal obligation and legal claims, Art. 6(1)(c) and (f)). If you delete your account the record is kept without name and email for 3 years and 2 months, like the purchases below.
  • Your purchases (race passes, Flex weeks and race guarantee claims) are kept after the account is deleted, without any link to you: no name, no email and no bank details, only the store's order number, product, amount, dates and whether the purchase was refunded. The purpose is to handle complaints and disputes (legitimate interest, Art. 6(1)(f) and 17(3)(e)). Race passes and guarantee claims are kept for 3 years and 2 months after the last day of access or the latest decision, Flex weeks for 1 year and 2 months after the week ended. They are then deleted automatically. You have the right to object to this processing.
  • The race forecast without an account — the address, answers and forecast are kept for at most 24 months, or until you ask us to delete them or withdraw your consent to tips.
  • The waiting list — the address is kept until we have sent the launch notice, and at most 24 months. If you unsubscribe, it is deleted at once.
  • Limited security and operations logs may be kept for a shorter period to prevent abuse and errors.

9. Your rights

Under the GDPR, you have the right to:

  • access the data we process about you,
  • have inaccurate data rectified,
  • have data erased (“the right to be forgotten”),
  • request restriction of or object to certain processing,
  • receive your data in a machine-readable format and move it (data portability), and
  • withdraw any consent you have given, at any time.

You can export your data and delete your account directly in the app (see traqeo.se/radera for the steps, in Swedish), or contact us at hej@traqeo.se. We respond to your request without undue delay and within one month at the latest. If you believe that we are processing your data incorrectly, you have the right to lodge a complaint with the Swedish Authority for Privacy Protection (IMY), imy.se.

10. Security

We take technical and organisational measures to protect your data. Passwords are stored only as secure hashes, access tokens for connected services are encrypted at rest (AES-256-GCM), and all traffic runs over encrypted connections. Access to production data is restricted. No system is entirely free of risk, but we work continuously to maintain a high level of protection.

11. Cookies and local storage

On the website we use necessary, functional cookies and equivalent local storage in your browser — to keep you signed in and remember your settings, including your choice in the cookie banner (kept for 180 days). These do not require consent.

In addition, we use analytics cookies from PostHog (EU region), but only if you have accepted them in the cookie banner. They show how the website is used, e.g. which pages are visited and where people get stuck during sign-up. Invitation codes and other sensitive parts of addresses are removed before anything is sent. If you decline, PostHog is not loaded at all. You can change your choice at any time via the Cookieinställningar (cookie settings) link at the bottom of the web pages.

The app uses no analytics cookies and no tracking; it only sends error reports as described in section 6. We use no ad networks and no behavioural profiling for marketing, and we share no data with advertisers.

12. Age limit

The service is aimed at adults and is not intended for children under 18. We do not knowingly collect data about children. If you are a parent or guardian and believe that a child has provided data to us, contact us and we will delete it.

13. Changes to this policy

We may update this policy as the service develops or legal requirements change. In the event of material changes, we will inform you in the app or by email. The “Last updated” date at the top shows when the current version took effect.

14. Contact

For questions about how we process your personal data, or to exercise your rights: hej@traqeo.se.