Legal

Privacy Policy

Effective date: 28 October 2026 · Version 1.5 · Applies to the Triku iOS and Android apps, the Triku API and this website.

1. Who we are

Triku is operated by BV Froteq, established at Gasmeterstraat 36, 9100 Sint-Niklaas, Belgium, enterprise number BE 1010.062.697 (“Triku”, “we”, “us”). We are the data controller for the personal data described in this policy under the EU General Data Protection Regulation (GDPR).

You can reach us about privacy at privacy@triku.app. We have not appointed a data protection officer because we are not legally required to; the same address reaches the person responsible for data protection.

2. What this policy covers

This policy applies to:

• the Triku app for iPhone and Android;
• the Triku API, the server the app talks to;
• this website.

It does not cover third-party services you connect to Triku or use alongside it, such as Apple Health, Health Connect, Stridee, Garmin Connect and the other device makers’ services, the App Store, Google Play, or the app you use to record workouts on your watch. Those have their own policies.

3. Data we collect

We collect only what the features you use need. Nothing below is collected until you create an account, and health data is only read after you explicitly allow it on your phone or on the device maker’s own sign-in page.

3.1 Account data

If you use Sign in with Apple and choose Hide My Email, we only receive Apple’s private relay address. If you sign in with Google, Google shares your name, email and picture with us; we do not receive your Google password.

3.2 Workout and health data

When you connect Apple Health (iPhone) or Health Connect (Android), the app reads your workouts and the readings recorded during them, and sends them to the Triku API. For each workout that is:

• the activity type, start and end time, time zone, duration, distance, energy burned and elevation gain;
• average and maximum heart rate, time spent in each heart-rate zone, and a heart-rate curve over the workout;
• where your watch or sensors recorded them, speed, power, cadence, altitude and distance every 5 seconds;
• for outdoor workouts recorded with GPS, the route you took (a latitude and longitude every 5 seconds);
• the recording device and app name, and a source identifier so the same workout is not imported twice.

When you first connect, the app imports up to the last 12 months of workouts. It only reads the categories you allow on the permission screen; anything you decline is simply left out. Data from Garmin, COROS, Polar and other devices is described in section 4.2. Section 4 explains the rules we follow for all health data.

From this data we compute and store derived values: a training load and a 0–21 strain score per workout, splits and effort analysis, daily and weekly summaries, fitness estimates and training paces.

3.3 Fuel (nutrition)

• Meals you log: the name, date, meal type, the foods with their estimated calories and nutrients, the portion and any note.
• Meal photos and descriptions: when you ask for an estimate, the photo you take, the words you type or the voice memo you record are sent to OpenAI to identify the food and estimate portions (section 7); a voice memo is transcribed to text first. The photo is never stored, by us or in your account; only the meal you confirm is saved.
• Barcodes: when you scan a product’s barcode, only the barcode number is sent to Open Food Facts to look up the product (section 7). Nothing about you is sent with it.
• Targets: your daily energy and macronutrient goals, calculated from the body data in section 3.1 and your training volume, and any adjustment you make.

Calorie and nutrient values in Fuel, from a photo, a description, a barcode or our own calculation, are estimates, not measurements.

3.4 Training plans and coach messages

• Plan answers: goal distance, target time, race date, days per week, days you cannot train, experience level and any notes you type in the plan quiz.
• The plan itself and its history: each session, whether you marked it done or skipped, and every adjustment with the reason.
• Messages to your coach: the text you write, or a voice memo you record, in the coach chat, in a plan check-in or when you ask for a plan change, and the coach’s replies. Voice memos are transcribed to text; the transcript and, briefly, the audio are handled as described in section 7.
• Activity reviews and the journal digest: a short written review of an activity you did, and a digest of your last four weeks, written with OpenAI from summaries of your workouts (section 4) and stored with your account. For context on your heart rate, a review can include the weather at the start of the activity, looked up with the start location rounded to about 10 km (section 7).
• The weekly report: if the Monday email is on, or when you ask for a report, a summary of your week’s training is emailed to you (section 7). You can switch the Monday email off in Profile, and every email has a one-click unsubscribe.

3.5 Routes and location

• Routes you draw: the route name, the points you place on the map, and the path between them computed by a routing service (section 7). These are stored with your account so you can reopen and export them.
• Places you search for while building a route: the place name you type is sent to Stadia Maps to find it (section 7). We do not keep your searches.
• Your live device location while you draw a route: used only to centre the map on where you are. It is read on your device when you tap the locate button or open the route builder, shown as a dot, and is not sent to our servers or stored. You can decline the location permission; the map still works.
• Rides you record with the bike computer: while a ride you started is recording, the app reads your phone’s location about once a second and, where the phone has one, its barometer, to measure distance, speed and climbing. Recording continues with the screen locked or the app in the background (iOS shows a blue location indicator, Android a notification) and stops when you finish the ride. Location is not used in the background at any other time. The ride stays on your phone until you save or discard it. When you save it, its track (a position every few seconds), distance, times, climbing, laps, the planned session it was for, and how often you ate and drank are sent to the Triku API and stored as a workout (section 3.2). A ride you discard is deleted from the phone.
• The way back to your route: when you leave a route you are following, your current position and a point further along the route are sent to the routing service (section 7) to find the way back. They are not stored by us.
• Routes of recorded workouts are different: they come from your workout data, not your phone’s live location, and are stored with the workout as described in section 3.2.

3.6 Live tracking links

On the bike computer you can share a ride while you ride it. Only when you ask, the app creates a link and opens your phone’s share sheet; you choose who receives it. Triku sends it to no one. While the link is on, the app sends your position, distance, moving time, speed and whether you are riding or paused about every 20 seconds. Anyone with the link sees these on a map at triku.app/live/…, with the route you are following and your first name only. We store only a scrambled (hashed) form of the link, so the database alone cannot open it. You can stop sharing at any time; the link stops at the end of the ride, and everything about it is deleted 24 hours after the ride (or after the last position, if the app could not say the ride ended). The live page uses no cookies or analytics, and OpenStreetMap serves its map tiles.

3.7 Technical data

• Server logs: when the app calls our API we log the time, the endpoint, the response status and the request’s IP address, for security and debugging. Logs are kept for a short period (section 9).
• Push token: if you allow notifications, your phone’s push token, so we can tell you about big changes to your plan through Expo’s push service (section 7). Notifications that your plan is ready and trial reminders are created on your phone itself and need no token. The token is deleted when you sign out or delete your account.
• App and device information Apple and Google provide to developers about crashes and installs through App Store Connect, TestFlight and the Google Play Console, in aggregated or pseudonymised form, according to your device’s analytics settings.

The app contains no advertising SDK, no analytics SDK and no tracking pixels. We do not build advertising profiles. It does contain the RevenueCat SDK, which handles purchases of Triku Plus (section 3.8).

3.8 Subscription

Triku Plus is a subscription you buy through the App Store or Google Play. Apple or Google handles the payment; Triku never sees your card or bank details. RevenueCat, our subscription provider, receives your Triku account identifier (the random identifier from section 3.1, used as your RevenueCat user id), your purchases, your subscription status, trial and renewal dates, and the store receipts from Apple or Google. It uses them to unlock Triku Plus in the app and to tell our server whether your subscription is active, which we store with your account.

4. Health data and connected services

Health data is sensitive, and we treat it under stricter rules than the rest, in line with Apple’s HealthKit requirements, Google’s Health Connect policy, the device makers’ developer terms and the GDPR rules for health data. These rules apply to everything we receive from Apple Health, Health Connect and the devices you connect through Stridee:

• We read health data only with your explicit permission, given on the permission screen of your phone or on the device maker’s own sign-in page. You choose what to share and can change it at any time (section 4.1 and 4.2).
• We use health data solely to provide Triku’s features to you: showing and analysing your workouts, computing strain, zones and trends, and building or adapting your training plan.
• We never use health data for advertising, marketing, or any purpose other than the features you use; never sell it; never share it with data brokers, insurers, employers or advertisers; and never use it to make decisions with legal or similarly significant effects.
• Only with your agreement. Nothing goes to OpenAI until you agree in the app (Agree or Not now). You can switch the AI features off at any time in Profile → AI features; from then on nothing is sent to OpenAI and the AI parts of the app (coach chat, meal estimates, activity reviews, the journal digest, AI plan check-ins and the AI-written text of your plan) are off.
• What goes to OpenAI. Each AI feature sends only what it needs:
  • Coach chat: your messages and voice memos (audio, for transcription), the last part of your conversation, your active plan, a summary of your recent workouts and of any workout you ask about, with your training totals for the last four weeks, your recent activity reviews, and Coach’s notes about you (below);
  • Coach’s message after a workout: the activity review of that workout, the last few messages of your conversation and Coach’s notes about what you told it;
  • Meal estimates: the meal photo, description or voice memo you send;
  • Activity reviews and the four-week journal digest: summaries of your workouts;
  • Plan check-ins: your typed or spoken message, so it can be transcribed and understood;
  • The explanatory text of your plan: your plan answers and notes, session descriptions and the paces derived from your recent workouts.
  A workout summary contains the type, date, duration, distance, elevation gain, average and maximum heart rate, training load, pace, how it felt and your notes. Your age and maximum heart rate are sent too, to judge effort. Per-second readings, heart-rate curves, GPS routes, your name and your email are never sent to OpenAI. OpenAI processes this for us under a data-processing agreement and does not use it to train its models.
• What Coach remembers. When you tell Coach about something that affects your training, such as a pain or injury, being ill, a busy week or a preference, it keeps a short note so it can ask about it later. These notes can contain health information and are used only for Coach and your activity reviews. You can see and delete every note in Coach → ⋯ → What Coach remembers. A note closes when you tell Coach it is over, or on its own after a while (3 weeks for life events, 90 days for an injury, 6 months for a preference); closed notes are no longer sent to OpenAI.
• Disconnecting a source stops new imports immediately. Workouts already imported stay in your account until you delete them individually or delete your account.

4.1 Apple Health and Health Connect

• Permission is requested through the standard iOS Health screen or the Android Health Connect screen. Change it at any time in iOS Settings → Health → Data Access & Devices → Triku, or in Android Settings → Health Connect → App permissions → Triku.
• We read your workouts as described in section 3.2. Triku writes only one thing: a ride you recorded with the bike computer, as a cycling workout with its route and distance, when you save it with Also save to Apple Health / Health Connect switched on. You are asked for this permission the first time; you can turn the switch off, or revoke writing in your phone’s Health settings. Triku recognises its own rides there and does not import them back.
• Health data is read on your phone and sent directly to the Triku API. Apple and Google do not receive it from us.

4.2 Garmin, COROS, Polar and other devices (through Stridee)

• Connecting. Triku connects to Garmin, COROS, Polar, Wahoo, Suunto, Zepp, Hammerhead and Fitbit through Stridee, a connection service. You start the connection in Profile and sign in on the device maker’s own page through Stridee, where you choose what to share. We never see your password for that service.
• What we receive: for each service you connect, Stridee passes us your activities, with the same workout details as in section 3.2, including the activity file recorded by your device (heart rate, speed, power, cadence and the GPS route where recorded). We use them exactly like workouts from Apple Health or Health Connect.
• What we send. We send Stridee your Triku account identifier, so the activities reach the right account, and your app language for its sign-in pages. Nothing about your training is sent to Stridee or the device maker.
• Separate companies. Stridee and the device makers hold your data under their own privacy policies; what you share with Triku through them is governed by this policy.
• Disconnecting. Disconnect a device service in Profile. We stop receiving its activities straight away. Activities already imported stay in your account until you delete them or your account; tell us if you want all data from a device service removed and we will do it within 30 days.

5. How we use your data

We do not use your data to train machine-learning models, and our contracts with providers forbid them from doing so with your data (section 7).

6. Legal bases (GDPR)

• Performance of a contract (Art. 6(1)(b)): account, workouts, plans, routes and everything needed to deliver the app you asked for, including your Triku Plus subscription and the purchase and subscription data handled through RevenueCat.
• Explicit consent (Art. 6(1)(a) and Art. 9(2)(a)) for health data, given through the Apple Health or Health Connect permission screen or on the device maker’s sign-in page, and for location through your phone’s location prompt. You can withdraw consent at any time in your phone’s settings, in the device maker’s service, or by disconnecting the source in Triku; withdrawing does not affect processing that already happened.
• Explicit consent (Art. 6(1)(a) and Art. 9(2)(a)) for sending your data, including summaries of your workouts, to OpenAI for the AI features, given when you choose Agree in the app. You can withdraw it at any time in Profile → AI features; withdrawing does not affect processing that already happened.
• Legitimate interests (Art. 6(1)(f)): security logging, abuse prevention, debugging and cookieless analytics of this website (section 13). We have balanced these against your interests and keep the data minimal and short-lived.
• Legal obligation (Art. 6(1)(c)): where we must keep or disclose data by law.

7. Who we share data with

We share data only with the providers below, and only what each needs. Those that process personal data on our behalf do so under our instructions, with data-processing agreements in place; Apple, Google, Stridee and the device makers also act under their own privacy policies. We do not sell personal data.

Nothing goes to OpenAI until you agree in the app (Agree or Not now). If you switch the AI features off in Profile → AI features, nothing is sent to OpenAI and the AI parts of the app are off.

We may also disclose data if required by law, to protect the rights and safety of users or the public, or as part of a merger or acquisition, in which case this policy continues to apply and you will be told.

8. Where data is stored and transferred

Your account, workouts, plans and routes are stored in the European Union. Some providers listed above process data outside the EU, notably OpenAI, RevenueCat, Expo and Resend in the United States. For those transfers we rely on the European Commission’s Standard Contractual Clauses and, where the provider is certified, the EU-US Data Privacy Framework. You can ask us for a copy of the relevant safeguards.

9. How long we keep data

10. Your rights and choices

In the app and on your phone

• Disconnect Apple Health or Health Connect in Profile, or revoke access in your phone’s settings (section 4.1).
• Disconnect Garmin, COROS, Polar or another device service in Profile.
• Switch the AI features off in Profile → AI features; nothing is sent to OpenAI from then on.
• Switch the Monday report email off in Profile, or use the unsubscribe link in any report.
• Manage or cancel Triku Plus in your phone’s subscription settings (Apple Account or Google Play).
• Delete a workout from its detail screen, archive or delete a plan, delete a route from its page, and delete a meal from your Fuel log.
• Export a route as a GPX file, and a recorded ride as a GPX or FIT file, at any time.
• Stop a live link from the bike computer at any time; it also ends with the ride.
• Sign out or delete your account in Profile.
• Location is optional; decline or revoke it in your phone’s location settings.

Under the GDPR

You have the right to:

• access the personal data we hold about you and receive a copy;
• rectify inaccurate data;
• erase your data (“right to be forgotten”), including deleting your whole account;
• restrict or object to processing based on legitimate interests;
• data portability: receive your data in a structured, machine-readable format;
• withdraw consent at any time for health and location data, and for the AI features (Profile → AI features);
• lodge a complaint with a supervisory authority. In Belgium that is the Data Protection Authority (Gegevensbeschermingsautoriteit / Autorité de protection des données), Rue de la Presse 35, 1000 Brussels. You may also complain to the authority of the EU country where you live.

To exercise any of these, email privacy@triku.app from the address linked to your account, or tell us which sign-in you use so we can verify it is you. We respond within one month; for complex requests we may extend by two further months and will tell you why. Requests are free unless they are clearly unfounded or excessive.

Account deletion. Open Profile → Delete account in the app. Your account and every record linked to it (profile, workouts, plans, routes, meals, coach conversations, reviews, push tokens, subscription records, any device connection) are deleted immediately; copies in backups expire within 30 days. We also ask Apple to revoke Sign in with Apple for the account, delete the RevenueCat customer record, and ask Stridee to delete your connections. Deleting your account does not cancel a subscription in the App Store or Google Play; cancel it there. You can also email us with the subject “Delete my account” and we will do it for you within 30 days. Deletion is permanent; we cannot restore a deleted account.

If you are outside the EU

We give everyone the rights above regardless of where they live. If you are a California resident, they correspond to your rights to know, delete, correct and to non-discrimination under the CCPA/CPRA; we do not “sell” or “share” personal information as those terms are defined there. If you are in the United Kingdom, the UK GDPR gives you equivalent rights and you may complain to the ICO.

11. Security

• All traffic between the app, the API and our providers is encrypted with TLS. Data is encrypted at rest by our hosting providers.
• The API verifies a signed token on every request and only ever returns the data of the signed-in account. The database additionally enforces row-level access rules so one user’s rows cannot be read by another.
• Sign-in normally uses Apple, Google or a one-time email link. A password is only used for the few accounts that sign in with email and password (such as the account App Store and Google Play reviewers use), and is stored only as a salted hash by our authentication provider (Supabase), never in plain text. Connecting a device happens on the device maker’s own page, so we never see your password for that service.
• Access to production systems is limited to the people who operate Triku, protected by multi-factor authentication.
• If a breach affecting your data ever occurs, we will notify the supervisory authority within 72 hours and inform you without undue delay when the law requires it.

No system is perfectly secure. Keep your Apple ID and Google account protected, and tell us immediately at the address below if you suspect unauthorised access.

12. Children

Triku is not directed at children. You must be at least 16 years old to create an account (or the lower age of digital consent in your EU country, but never under 13). We do not knowingly collect data from children; if you believe a child has created an account, contact us and we will delete it.

13. This website

This website uses PostHog to measure how visitors use it, so we can see which pages and features help and which don’t. It runs in cookieless mode: it sets no cookies and stores nothing in your browser.

• What is measured: the pages you view, the buttons, links and sample features you use, how far you scroll, the site that referred you and any campaign tags in the link, your browser, operating system, device type, screen size, language and time zone, and how quickly the page loaded.
• What is not: your answers in the starting-point finder, your name or email address, and anything from your Triku account. We do not use website analytics for advertising.
• Counting visitors: to count unique visitors without a cookie, PostHog briefly combines your IP address, browser details and the website’s name with a random value that is discarded every day, and keeps only the resulting code. Your IP address is not stored, and visits on different days cannot be linked to each other.
• Your choice: if your browser sends a Do Not Track or Global Privacy Control signal, the analytics script does not load. You can also object to this processing by emailing us.

Fonts and images are loaded from the website’s own server. The hosting provider keeps a standard request log, which includes your IP address and browser type, for a short period for security.

14. Changes to this policy

We will update this policy when the app changes in ways that affect your data, for example when a new data source such as Strava is added. Material changes are announced in the app before they take effect, and the effective date at the top is always the date of the current version. Earlier versions are available on request.

15. Contact

BV Froteq
Gasmeterstraat 36, 9100 Sint-Niklaas
Belgium
Enterprise number BE 1010.062.697
privacy@triku.app