Privacy policy

This policy explains what personal data Trackbag (trackbag.eu) processes, why, and what rights you have under the EU General Data Protection Regulation (GDPR).

1. Controller#

[Operator name – fill in before launch], e-mail: [contact e-mail – fill in].

2. What we process and why#

• Athlete applications – name, e-mail, club, events, Instagram handle, results and your message. Purpose: reviewing your application. Legal basis: your consent and steps taken at your request before an agreement (Art. 6(1)(a) and (b) GDPR).
• Athlete accounts and profiles – e-mail, password (stored only as a hash), optional 2FA data, and everything you publish on your profile (name, photo, bio, personal bests, links, gear and optional sections such as season goals, a training week or a race-day setup). Purpose: providing the service. Legal basis: performance of the agreement (Art. 6(1)(b)). Profile content you publish is public.
• Newsletter – your e-mail and language, plus whether you opened or clicked an e-mail (to improve it). You confirm the subscription via a link (double opt-in). Legal basis: consent (Art. 6(1)(a)). Every e-mail has an unsubscribe link. E-mails are sent via Resend Inc.
• Following an athlete – your e-mail and language. Purpose: sending you updates about that athlete. Legal basis: consent (Art. 6(1)(a)). You can unsubscribe at any time; we then delete your e-mail.
• Anonymous statistics – profile views and clicks on links and gear, with approximate location (country and city, derived at our hosting edge – the IP address is not stored), device type, operating system, browser, referring site and language. No cookies and no identifier that would connect visits. Only collected if you click “Accept analytics”. Legal basis: consent (Art. 6(1)(a)).
• Trackbag Analyze – if you connect intervals.icu, we store your intervals.icu athlete ID and API key on our server (never shown in the browser) and summaries of your activities (date, type, distance, time, heart rate, training load, shoe). From uploaded FIT/GPX files we keep only the summary, never the GPS route. This data is private to you. Legal basis: performance of the agreement (Art. 6(1)(b)). Disconnecting deletes the synced data. We also sync daily wellness values (HRV, resting heart rate, sleep, fitness/fatigue) once a night, and store lactate tests and settings you enter.
• Analyze AI – when you ask for a weekly review or ask a question, we send Google (Gemini API) only an anonymous summary: weekly totals, averages and test results – never your name, e-mail, profile or GPS. Google may process it under its API terms. You can switch off the automatic Monday review.
• Analyze share links – you can create a read-only link for a coach or psychologist. Anyone with the link sees your Analyze overview, recovery, zones and tests until you revoke it. A signed-in coach who saved the link can add comments to your sessions.
• Analyze e-mails – only if you switch them on: a weekly summary (to you and up to 3 coach addresses you enter) and warning e-mails. Coach addresses are used only for this.
• Price alerts – if you ask to be told when a product gets cheaper, we store your e-mail and the product. One e-mail per price drop, every e-mail has a link to cancel.
• Trackbag Pro – for athletes with a paid Pro profile we keep the billing details needed for accounting (name, invoicing details, payment date and amount). Legal basis: performance of the agreement and legal obligation (Art. 6(1)(b) and (c)).
• Technical security logs kept by our hosting providers (e.g. IP address of requests) for protecting the service. Legal basis: legitimate interest (Art. 6(1)(f)).

3. Processors and recipients#

• Supabase Inc. – database, sign-in and file storage; data stored in the EU (Frankfurt).
• Vercel Inc. – website hosting; may process data outside the EU under Standard Contractual Clauses.
• Resend Inc. – sending e-mails (newsletter, sign-in links); may process data outside the EU under Standard Contractual Clauses.
• Shops you open via gear links – once you leave Trackbag, the shop’s own privacy policy applies.

We do not sell personal data.

4. How long we keep data#

• Rejected applications: deleted within 6 months.
• Accounts and profiles: until you ask for deletion or the account is closed.
• Anonymous statistics: up to 24 months.
• Newsletter: until you unsubscribe.
• Billing records: 10 years, as required by Czech accounting law.

5. Cookies and local storage#

We use only what is necessary: your language choice, your cookie choice and, for signed-in athletes, the login session (stored in your browser’s local storage). We use no advertising or third-party tracking cookies. Athlete photos are loaded from Supabase servers and product photos directly from the shops’ servers.

6. Your rights#

You have the right to access, rectify and erase your data, to restrict or object to processing, to data portability, and to withdraw consent at any time. Write to [contact e-mail – fill in]. You can also lodge a complaint with the Czech Office for Personal Data Protection (Úřad pro ochranu osobních údajů, www.uoou.cz).

7. Minors#

Athletes under 15 may only apply with the consent of a parent or legal guardian.

8. Changes#

We may update this policy. The current version is always on this page.