Privacy Policy

Data controller

Hafnor Investment AS is the data controller for the personal data processed in connection with TREN. Contact details:

• Hafnor Investment AS
• Trollkleiva 58E, 4638 Kristiansand, Norway
• Email: prebenhafnor@gmail.com

About the TREN service

TREN is a training service for runners, available as a website and an app. TREN lets you connect your training data from Strava and Garmin, and calculates things such as training load, injury risk (ACWR), fitness level (VDOT) and training plans. Using TREN is voluntary, and you can stop using the service at any time and request that your account be deleted.

TREN provides training guidance and is not medical advice. Calculations of recovery, injury risk and similar are estimates and do not replace advice from a doctor or other healthcare professional.

What personal data we process

Account and identity data

• Email address, name and, where applicable, profile picture.
• Sign-in information: either a password (stored encrypted) or sign-in via Google or Apple.
• Technical data related to sign-in, such as IP address, browser type (user agent) and session information.

Training data from Strava and Garmin

When you connect Strava and/or Garmin, we retrieve your activities on your behalf. This may include:

• Activity type, date, duration and distance.
• GPS route and location data for your activities.
• Heart rate, pace, cadence, elevation, power and running dynamics.
• Activity files (e.g. FIT files) and raw data from the provider.

Training data from Apple Health

If you choose to connect Apple Health in the iOS app, Tren asks iOS for read-only access and sends the following from your device to our servers:

• Workouts: type, start time, duration, distance, indoor/outdoor and elevation gain.
• Heart rate and step counts recorded during those workouts.

Tren never writes to Apple Health. We use this data only to calculate your training load and plan, and show it back to you; we do not use it for advertising or marketing, do not sell it, and do not share it with data brokers. You can disconnect at any time in the app (Profile → Connected services) and revoke access in the iOS Health settings; workouts already imported can be removed by deleting your account.

Health and physiological data

To provide you with training guidance, we process data that is considered a special category of personal data (health data). This may include:

• Resting heart rate, sleeping heart rate, heart rate variability (HRV) and sleep.
• Self-reported information about form, soreness, motivation and injuries.
• Lactate measurements and physiological tests.
• Weight, maximum heart rate, and any health-related marker you choose to record yourself (e.g. low energy availability / Red-S).

Profile and preferences

• Age, sex, running experience, training goals and previous race results.
• Availability, training preferences, units (metric/imperial) and time zone.

Derived data

• Calculated values such as VDOT, training load, ACWR, recovery/readiness and training plans.

Usage and analytics data

• Error logs and basic, cookieless page counts for the website, in order to operate the service.
• Product analytics about how you use the app and website, but only if you opt in. See “Product analytics” below for exactly what is and is not collected.

Product analytics

We use PostHog, hosted in the EU (Frankfurt), to understand how TREN is used and where it can be improved. Product analytics is opt-in:

• Website: a banner asks you to accept or decline. If you decline, or have not yet chosen, we collect anonymous, cookieless page views only. There is no profile, no click tracking and no recording.
• iOS and Android apps: a one-time “Help improve Tren” prompt. Nothing is collected until you allow it.
• Changing your mind: you can change your choice at any time in Settings (“Share usage analytics”). The choice is synced across your devices.

What we collect if you opt in

• Which screens you view and for how long, what you tap or click, and which features you use.
• Session recordings of the screens you use (linked to your analytics profile). Text inputs and all health and physiological values (such as heart rate, HRV, lactate, weight, injury details and sleep or wellness values) are masked and never recorded.
• Your answers to optional in-app surveys.
• Device and app information (app version, operating system, screen size) and a pseudonymous ID linked to your account. Your account email is stored on your analytics profile so that we can link survey answers to you. It is never included inside events.

What is never sent to analytics

• Health values and free text you type. No exact distances or times, paces, heart rate or exact fitness scores (only coarse bands and standard race distances such as 5k) or other health values are sent as event data; we record session types and outcomes (e.g. a threshold session completed or skipped) to understand whether the plan works for you. Screens such as the planner can appear in session recordings, where health values are masked.
• We don’t send your location. PostHog derives an approximate country from the connection and does not store the IP address.

Server-side events

If you have opted in, we also record events on our servers, never including exact distances or times, paces, heart rate or exact fitness scores:

• Account and integration milestones: account created, connection to a device or service succeeded or failed, activity synced and training plan generated. A failed connection attempt that cannot be tied to an account is counted anonymously, without any personal data.
• Which planned sessions you complete, skip or swap, and whether you kept or used a rest day (session type only), and when you change the engine’s suggestion.
• Whether notifications are allowed, delivered and opened.
• When the planning service fails to build or simulate your plan.
• Connection health: expired connections and history imports.
• Milestones: a race logged, a personal best at a distance, your fitness level moving up a band and training streaks.
• How quickly a synced activity arrived and the day’s readiness colour (no distances, paces or heart rate).
• Summary attributes on your analytics profile (refreshed daily and when your plan is recalculated): activity recency, active weeks, plan adherence band, connection status and which services are connected, whether notifications are on, whether you have activity history from before you joined, whether onboarding is complete, your training tier, your goal race distance and whether you have a race goal, and coarse bands for fitness level and weekly training volume.

Retention and deletion

Analytics events are kept for 12 months and session recordings for 90 days. If you delete your account, your analytics profile, its events and its recordings are deleted as well.

Purposes and legal bases

We process your personal data for the following purposes:

• Providing the TREN service — creating and managing your account and giving you training plans, analyses and predictions. Legal basis: performance of our contract with you (Article 6(1)(b)).
• Processing health and physiological data — to calculate training load, recovery and injury risk. Legal basis: your explicit consent (Article 9(2)(a)).
• Retrieving training data from Strava, Garmin and Apple Health on your behalf. Legal basis: your consent and performance of the contract.
• Product analytics (usage events, session recordings and surveys) to improve and develop the service. Legal basis: your consent (Article 6(1)(a)), which you can withdraw at any time in Settings.
• Security and operations — error monitoring, logging, preventing misuse and basic cookieless website page counts, including the anonymous, cookieless PostHog page counts we make if you decline or have not chosen analytics. Legal basis: our legitimate interest (Article 6(1)(f)).
• Complying with legal obligations (Article 6(1)(c)).

Consent

Where we process data based on consent — in particular health data, the connection of Strava/Garmin/Apple Health and product analytics — you can withdraw your consent at any time. This does not affect the lawfulness of processing carried out before withdrawal.

You can withdraw your consent to product analytics yourself in Settings (“Share usage analytics”). To withdraw another consent, disconnect a service or stop a specific processing activity, email prebenhafnor@gmail.com. We are working on a feature that will let you manage this directly within the service.

Processors and third parties

We do not sell your personal data, and we do not share it with others for their own purposes. We use certain providers that process data on our behalf (processors), under data processing agreements:

• Supabase — database and file storage.
• Fly.io — server hosting (Stockholm, EEA).
• Vercel — website hosting and basic cookieless page counts for the website.
• PostHog (PostHog Inc., EU data residency) — product analytics, only if you opt in.
• Sentry — error monitoring.
• Strava and Garmin — sources of the training data you choose to connect.
• Google and Apple — sign-in, if you use them.
• Map providers — Apple Maps in the iOS app, Google Maps in the Android app and OpenStreetMap on the website draw the map under your routes. To do that they receive the map area being shown and, as with any request over the internet, your device's IP address — not your Tren account. Google Maps is subject to the Google Privacy Policy.

Where data is stored and transfers outside the EEA

We aim to store and process personal data within the EU/EEA. Some of our providers may nevertheless process data outside the EEA, for example in the United States. Where this happens, the transfer is safeguarded by a valid transfer mechanism, such as the European Commission’s Standard Contractual Clauses (SCC).

Retention

We store your personal data for as long as you have an active account. Product analytics data follows the shorter periods described under “Product analytics” (events 12 months, recordings 90 days). You can request deletion of your account and your data at any time (see “Your rights”). If your account has been inactive for more than 3 years, we may delete the data. Certain data may be kept longer where required by law.

Your rights

Under the GDPR you have the right to:

• access the data we process about you,
• have inaccurate or incomplete data corrected,
• have your data erased (the “right to be forgotten”),
• request restriction of processing,
• receive your data in a machine-readable format and transfer it to another service (data portability),
• object to processing based on legitimate interest,
• withdraw consent.

To exercise your rights, email prebenhafnor@gmail.com. We will respond as soon as possible, and within the time limits set by law.

Cookies

We use a necessary sign-in cookie to keep you logged in; this is required for the service to work. If you accept analytics in the website banner, we additionally use cookies and similar browser storage for product analytics (PostHog). If you decline or have not chosen, PostHog runs in a cookieless mode that collects anonymous, cookieless page views only. Vercel Analytics provides basic cookieless page counts. Some settings, such as your chosen theme, are stored locally in your browser.

How we protect your data

We take your privacy seriously and have implemented technical and organisational measures to protect your data. Examples of measures:

• encryption of data in transit (HTTPS/TLS),
• access controls so that only authorised personnel have access, subject to a duty of confidentiality — also after their relationship with us ends,
• hosting with reputable providers within the EEA,
• monitoring and logging to detect errors, misuse and intrusion attempts.

Children

TREN is intended for adults. We do not knowingly collect personal data from children under the age of 16.

Changes to this privacy policy

We may update this privacy policy. For material changes, we will give notice at tren.run with reasonable advance notice before the change takes effect. If we discontinue all or part of the service, we will inform you in good time.

Complaints to a supervisory authority

If you believe that our processing of your personal data breaches data protection law, you have the right to lodge a complaint with the supervisory authority. In Norway this is the Norwegian Data Protection Authority (Datatilsynet), and complaints can be submitted via their website.

Contact

If you have questions about how we process your personal data, or you wish to exercise your rights, you can contact us at prebenhafnor@gmail.com.