Privacy Policy

Last updated: 21 June 2026

We care about protecting your privacy. It’s your data, and you’re in control. You should be able to trust that we handle your personal data securely. All processing of personal data is carried out in accordance with the General Data Protection Regulation (GDPR) and Norwegian law. Personal data is information that can be linked to you as an individual — for example your name, email address, training data and health information.

Data controller

Hafnor Investment AS is the data controller for the personal data processed in connection with TREN. Contact details:

About the TREN service

TREN is a training service for runners, available as a website and an app. TREN lets you connect your training data from Strava and Garmin, and calculates things such as training load, injury risk (ACWR), fitness level (VDOT) and training plans. Using TREN is voluntary, and you can stop using the service at any time and request that your account be deleted.

TREN provides training guidance and is not medical advice. Calculations of recovery, injury risk and similar are estimates and do not replace advice from a doctor or other healthcare professional.

What personal data we process

Account and identity data

  • Email address, name and, where applicable, profile picture.
  • Sign-in information: either a password (stored encrypted) or sign-in via Google or Apple.
  • Technical data related to sign-in, such as IP address, browser type (user agent) and session information.

Training data from Strava and Garmin

When you connect Strava and/or Garmin, we retrieve your activities on your behalf. This may include:

  • Activity type, date, duration and distance.
  • GPS route and location data for your activities.
  • Heart rate, pace, cadence, elevation, power and running dynamics.
  • Activity files (e.g. FIT files) and raw data from the provider.

Health and physiological data

To provide you with training guidance, we process data that is considered a special category of personal data (health data). This may include:

  • Resting heart rate, sleeping heart rate, heart rate variability (HRV) and sleep.
  • Self-reported information about form, soreness, motivation and injuries.
  • Lactate measurements and physiological tests.
  • Weight, maximum heart rate, and any health-related marker you choose to record yourself (e.g. low energy availability / Red-S).

Profile and preferences

  • Age, sex, running experience, training goals and previous race results.
  • Availability, training preferences, units (metric/imperial) and time zone.

Derived data

  • Calculated values such as VDOT, training load, ACWR, recovery/readiness and training plans.

Usage and analytics data

  • Information about how the service is used (page views, events, performance) and error logs, in order to operate and improve the service.

Purposes and legal bases

We process your personal data for the following purposes:

  • Providing the TREN service — creating and managing your account and giving you training plans, analyses and predictions. Legal basis: performance of our contract with you (Article 6(1)(b)).
  • Processing health and physiological data — to calculate training load, recovery and injury risk. Legal basis: your explicit consent (Article 9(2)(a)).
  • Retrieving training data from Strava and Garmin on your behalf. Legal basis: your consent and performance of the contract.
  • Improving and developing the service through usage analytics. Legal basis: consent where the analytics tool requires it, otherwise our legitimate interest (Article 6(1)(f)).
  • Security and operations — error monitoring, logging and preventing misuse. Legal basis: our legitimate interest (Article 6(1)(f)).
  • Complying with legal obligations (Article 6(1)(c)).

Consent

Where we process data based on consent — in particular health data and the connection of Strava/Garmin — you can withdraw your consent at any time. This does not affect the lawfulness of processing carried out before withdrawal. To withdraw a consent, disconnect a service or stop a specific processing activity, you can email prebenhafnor@gmail.com. We are working on a feature that will let you manage this directly within the service.

Processors and third parties

We do not sell your personal data, and we do not share it with others for their own purposes. We use certain providers that process data on our behalf (processors), under data processing agreements:

  • Supabase — database and file storage.
  • Fly.io — server hosting (Stockholm, EEA).
  • Vercel — website hosting and performance analytics.
  • PostHog — product analytics.
  • Sentry — error monitoring.
  • Strava and Garmin — sources of the training data you choose to connect.
  • Google and Apple — sign-in, if you use them.

Where data is stored and transfers outside the EEA

We aim to store and process personal data within the EU/EEA. Some of our providers may nevertheless process data outside the EEA, for example in the United States. Where this happens, the transfer is safeguarded by a valid transfer mechanism, such as the European Commission’s Standard Contractual Clauses (SCC).

Retention

We store your personal data for as long as you have an active account. You can request deletion of your account and your data at any time (see “Your rights”). If your account has been inactive for more than 3 years, we may delete the data. Certain data may be kept longer where required by law.

Your rights

Under the GDPR you have the right to:

  • access the data we process about you,
  • have inaccurate or incomplete data corrected,
  • have your data erased (the “right to be forgotten”),
  • request restriction of processing,
  • receive your data in a machine-readable format and transfer it to another service (data portability),
  • object to processing based on legitimate interest,
  • withdraw consent.

To exercise your rights, email prebenhafnor@gmail.com. We will respond as soon as possible, and within the time limits set by law.

Cookies

We use a necessary sign-in cookie to keep you logged in; this is required for the service to work. If you consent, we additionally use cookies and similar technologies for usage analytics (PostHog and Vercel). Some settings, such as your chosen theme, are stored locally in your browser.

How we protect your data

We take your privacy seriously and have implemented technical and organisational measures to protect your data. Examples of measures:

  • encryption of data in transit (HTTPS/TLS),
  • access controls so that only authorised personnel have access, subject to a duty of confidentiality — also after their relationship with us ends,
  • hosting with reputable providers within the EEA,
  • monitoring and logging to detect errors, misuse and intrusion attempts.

Children

TREN is intended for adults. We do not knowingly collect personal data from children under the age of 16.

Changes to this privacy policy

We may update this privacy policy. For material changes, we will give notice at tren.run with reasonable advance notice before the change takes effect. If we discontinue all or part of the service, we will inform you in good time.

Complaints to a supervisory authority

If you believe that our processing of your personal data breaches data protection law, you have the right to lodge a complaint with the supervisory authority. In Norway this is the Norwegian Data Protection Authority (Datatilsynet), and complaints can be submitted via their website.

Contact

If you have questions about how we process your personal data, or you wish to exercise your rights, you can contact us at prebenhafnor@gmail.com.