개인정보 처리방침
이 문서는 영어로만 제공됩니다.
This policy explains what personal data we collect when you use TrainRox, why we collect it, who we share it with and what rights you have. It covers the TrainRox apps for iPhone, Apple Watch and Android, the web app at app.trainrox.com and our website at www.trainrox.com (together, “TrainRox”).
Who we are
TrainRox is run by STELLAR APPS S.L., a company registered in Spain (NIF B21711221), with its registered office at Calle Miret i Sans 7, 08034 Barcelona, Spain. We are the controller of your personal data.
For anything about your data, write to [email protected]. For help with the app, write to [email protected].
What we collect and why
Your account
When you create an account we store your email address and, if you sign in with Apple or Google, the account identifier they give us. You can add a display name and a profile photo.
Why: to give you an account and keep your training in sync across devices. Legal basis: performance of our contract with you.
Your training profile
During onboarding and in Settings you tell us things like your gender, date of birth, height, weight, race goals, training days, available equipment, preferred units and language, and how you heard about us.
Why: to build and adapt your training plan and to show results in your units and language. Legal basis: performance of our contract with you.
Your workouts
We store the workouts you create, schedule and complete: times, splits, notes, difficulty ratings and, where available, distance, pace, calories, cadence, power, elevation and GPS route.
Why: to show your history and progress and to adjust your plan. Legal basis: performance of our contract with you.
Health data
Heart rate, calories burned and the workouts we read from Apple Health are health data, which the law protects more strictly. If you allow it, we read heart rate and workouts from Apple Health, from your Apple Watch or from a Bluetooth heart rate monitor, and we save completed workouts back to Apple Health.
Why: to show heart rate zones and effort on your workouts and to adapt your plan. Legal basis: your explicit consent, which you give when you allow access to Apple Health or connect a heart rate monitor. You can withdraw it at any time by turning off access in the Health app or your iPhone’s settings, or by disconnecting the monitor.
Health data is never used for advertising, never shared with advertisers and never sold. Data read from Apple Health is used only to provide TrainRox’s training features.
Strava
If you connect Strava, we import your activities and, if you choose, post your workouts and race results to your Strava account.
Why: to bring your Strava activities into TrainRox and share to Strava at your request. Legal basis: your consent, which you can withdraw by disconnecting Strava in Settings or on Strava.
Race results and athlete pages
TrainRox shows race results for fitness races. These results come from the public results pages published by race organisers and include the athlete’s name, nationality, division, age group, bib number and split times, as the organiser published them. We use them to build athlete pages, rankings and the League leaderboard. Athletes appear whether or not they use TrainRox. If you link your account to your athlete page, we connect your results to your profile, and anything you add to your athlete page (bio, photo, social media links) becomes public.
Why: to let athletes and fans look up and compare results. Legal basis: our legitimate interest in providing a results service built on results that organisers have already made public.
If you appear in our results but don’t use TrainRox: this section is our notice to you under GDPR article 14. We don’t have contact details for the athletes in published results, and finding each of them to write to them individually would be impossible or take disproportionate effort, so we inform you here instead. You have the same rights as our users, and you can object to appearing at any time.
Fixing or removing your results. Write to [email protected]. We may ask for something that shows the results are yours, such as your race and bib number.
- Correct: if our copy is wrong (for example results merged into the wrong athlete, a wrong nationality, or two pages for the same person), we fix it. If the official result itself is wrong, the race organiser has to correct it first; we then update ours.
- Anonymise: we replace your name with an anonymous label, take you out of the League leaderboard and stop future results from creating a page under your name. Your times stay in the race results under the anonymous label, so other athletes’ places don’t change.
Claiming an athlete page. We may check that you are the athlete, for example by asking about a race you did, and we may refuse or remove a claim that doesn’t hold up. A claim lets you add to your page; it doesn’t let you hide or change accurate results. If you delete your account, the link between your account and your athlete page is removed, along with anything you added to the page. Your results stay as published, unless you ask us to anonymise them.
Following and sharing
TrainRox has a following feed. If you use it, other people on TrainRox can see some of what you do.
- Your profile. Your name, username, profile photo, the athlete page you have linked, and your follower and following counts are visible to anyone signed in to TrainRox. Your email address is never shown.
- Your workouts. Each workout has a visibility: Followers, Public or Private. New accounts start on Followers with follower approval on, so nobody sees a workout until you accept them as a follower. A shared workout shows the session, its times, splits, distance and pace. Heart rate, calories, notes and routes are only ever shown to you. A workout imported from Strava starts with the visibility you gave it on Strava and never goes wider than that. You can change the visibility of one workout, of all your past workouts, and your default in Settings, then Privacy controls.
- Likes and comments. When you like or comment on a post, your name and photo appear with it to everyone who can see that post.
- Race results, start lists and race plans. Your results, the races you are entered in and the race you are training for are shown to your followers. Results are public either way, as explained above.
- Suggestions. To suggest people to follow, we look at who follows you, who you follow, the races you have done or are training for, and your finish times. You can take yourself out of suggestions in Privacy controls.
- Friends from your contacts. If you allow access to your contacts, the app reads the email addresses in your address book, scrambles each one on your phone (a one-way hash) and sends only the scrambled values to our server, which compares them with the accounts that chose to be found by email. The addresses never leave your phone, nothing from your contacts is stored, and we never contact the people in your address book. To let friends find you this way, turn on being found by email in Privacy controls. It is off unless you turn it on.
- Notifications. With your permission we send push notifications for likes, comments and new followers. Each kind can be turned off in Settings, then Notifications. The inbox in the app keeps them for 60 days.
Why: to let you share your training with the people you choose and follow theirs. Legal basis: performance of our contract with you for the sharing features you use; your consent for contacts access and for being found by email, which you can withdraw in your phone’s settings and in Privacy controls; our legitimate interest in suggesting people to follow, which you can object to with the suggestions switch.
Accounts from before November 2026. When the feed launched, existing accounts were set to share workouts with approved followers, with follower approval and suggestions on. Nothing became visible to anyone until the account owner approved a follower. The app explains this the first time you open it and offers to keep everything private instead.
Reports and moderation
You can report a post, a comment or a profile, and block or mute a person. We keep the report, the reason you gave and the content it is about while we review it, and a record of what we decided. A comment reported by three different people is hidden automatically until someone on our team reviews it. If we hide or remove something you posted, we tell you in your inbox and why. If you think we got it wrong, write to [email protected]. The person you block is never told.
Why: to keep the feed safe and to meet our duties as a hosting service. Legal basis: our legitimate interest in keeping TrainRox safe, and our legal obligations under the EU Digital Services Act.
Purchases
If you subscribe to TrainRox Plus, the purchase is handled by the App Store, Google Play or, on the web, by Stripe. We receive your subscription status, product, price, renewal dates and an anonymous purchase identifier. We never see your card details.
Why: to unlock Plus features and handle billing questions. Legal basis: performance of our contract with you, and our legal obligation to keep tax and accounting records.
Messages you send us
When you contact support, claim an athlete page or send feedback, we keep your message and your email address.
Why: to answer you. Legal basis: our legitimate interest in replying to you and, for account matters, performance of our contract.
Emails and notifications
We send emails you ask for (such as a link to download the app) and service emails (such as sign-in links). With your permission we send push notifications for workout reminders, race alerts, live tracking of athletes you follow, and likes, comments and new followers. You can turn each kind off in Settings or in your device settings.
Legal basis: performance of our contract for service messages; your consent for push notifications.
Newsletter
When you create an account, we send you the TrainRox newsletter: training tips, race news and what’s new in TrainRox. Every newsletter has an unsubscribe link, and you can also turn it off in Settings, then Notifications.
Legal basis: our legitimate interest in telling our users about TrainRox, as Spanish law allows for people who have an account with us (LSSI, article 21.2). You can object at any time, at no cost.
Usage and diagnostics
We record how TrainRox is used (screens viewed, buttons tapped, features used) and technical data (device model, operating system, app version, approximate location derived from your IP address, crash reports and errors).
Why: to understand which features work, fix bugs and keep TrainRox secure. Legal basis: our legitimate interest in running and improving the service. On our websites, visitors in Europe are asked for consent first (see Cookies below).
Advertising and attribution
We advertise TrainRox on Google, Meta (Facebook and Instagram) and Apple. To know which ads bring people to TrainRox, and to show our ads to people who have used it, we share limited event data (such as “installed”, “started a trial”, “subscribed”) with these platforms.
- On iPhone, this uses your device’s advertising identifier only if you allow tracking when iOS asks. If you don’t, we don’t use it.
- On Android, you can reset or delete your advertising ID in your device settings.
- On our websites, visitors in Europe are asked for consent first.
Legal basis: your consent.
AI-generated training plans
Your training plans are generated with the help of an AI model (Google Gemini) using your training profile, workout history and race goals. We do not send your name or email address to the model. Your data is not used to train Google’s models.
Legal basis: performance of our contract with you.
Website games
The games on trainrox.com ask for an Instagram handle so your best run can appear on a public leaderboard. The handle is shown exactly as you typed it, with your results, and anyone can see it. Each run also records the timing of your presses or taps so the result can be verified. To limit abuse, a keyed hash of your IP address is kept for 24 hours when you start a run; the address itself is not stored. If you would like your handle and runs removed, write to [email protected].
Legal basis: your consent, given when you submit your handle.
Who we share data with
We do not sell your personal data. We share it only with the service providers that help us run TrainRox, under contracts that limit what they can do with it:
| Provider | What for |
|---|---|
| Supabase | Database, sign-in and file storage |
| Cloudflare | Website hosting, security checks and spam protection |
| Google Firebase | App analytics, crash reports, push notifications and app security checks |
| Google Analytics | Website analytics |
| Google Gemini | Generating training plans |
| Langfuse | Monitoring the quality of generated training plans (EU) |
| Amplitude | Product analytics |
| Sentry | Error reports from our websites (EU) |
| RevenueCat | Managing subscriptions |
| Apple, Google Play, Stripe | Processing payments |
| Resend | Sending emails |
| AppsFlyer | Measuring which ads lead to installs |
| Google Ads, Meta, Apple Ads | Advertising and measuring our ads |
| Google Maps | Showing race course maps |
| Strava | Importing and posting activities, only if you connect it |
We may also disclose data when the law requires it, or to protect our rights, your safety or the safety of others.
Transfers outside Europe
Some of these providers are based in, or use servers in, the United States and other countries outside the European Economic Area. When data leaves the EEA we rely on the EU-US Data Privacy Framework where the provider is certified, or on the European Commission’s Standard Contractual Clauses.
Cookies
On our websites
We use cookies and similar storage on www.trainrox.com and app.trainrox.com. The ones needed to run the sites are always on. The others are used only if you accept them. Visitors in the EEA, the United Kingdom and Switzerland are asked when they first visit. Elsewhere, statistics and ads cookies are on unless you turn them off. To change your choice, use “Cookie settings” at the bottom of www.trainrox.com or in Settings on app.trainrox.com.
Needed to run the site
| Name | Set by | Purpose | Lasts |
|---|---|---|---|
| cc_cookie | TrainRox | Remembers your cookie choice | 6 months |
| sb-*-auth-token (browser storage) | TrainRox (Supabase) | Keeps you signed in to app.trainrox.com | Until you sign out |
| cf_clearance | Cloudflare | Shows you passed the security check against bots | 1 day |
| __cf_bm | Cloudflare | Tells people from bots | 30 minutes |
| __stripe_mid, __stripe_sid | Stripe | Fraud prevention during checkout | Up to 1 year |
Statistics (only with your consent)
| Name | Set by | Purpose | Lasts |
|---|---|---|---|
| _ga, ga* | Google Analytics | Counts visits and how pages are used | 2 years |
| AMP_* (browser storage) | Amplitude | Counts how the web app is used | 1 year |
| tr_ref | TrainRox | Remembers the page you came from while a security check runs, so the visit is counted under the right source. It is set during the check, before you can answer, and deleted if you don’t accept statistics | 30 minutes |
Ads (only with your consent)
| Name | Set by | Purpose | Lasts |
|---|---|---|---|
| _gcl_au | Google Ads | Measures which Google ads lead to visits and subscriptions | 90 days |
| _fbp | Meta | Measures our Facebook and Instagram ads and shows them to past visitors | 90 days |
If you don’t consent, Google Analytics and Google Ads may still receive basic, cookieless signals (such as a page view without any identifier). Google uses these to estimate totals without identifying you.
In the apps
The apps don’t use cookies. They use device identifiers for the analytics and advertising described above, under the same rules.
How long we keep data
- Account, profile and workouts: for as long as you have an account. When you delete your account (Settings, then Delete account), we delete this data, along with your follows, likes and comments and the likes and comments other people left on your posts. Copies in our backups are removed as those backups expire.
- Purchase records: for as long as Spanish tax and accounting law requires, currently up to six years.
- Support messages: up to three years after the conversation ends.
- Reports and moderation records: until the report is closed, then for as long as we need them to answer questions about the decision.
- Analytics data: up to 14 months in Google Analytics, and up to the retention set by each provider for the others.
- Race results: for as long as we offer the results service, including periods when we don’t show them, unless you ask us to anonymise them.
Your rights
You have the right to:
- see the personal data we hold about you and get a copy of it
- correct it if it is wrong
- have it deleted
- receive it in a portable format
- object to our use of it, or ask us to restrict it
- withdraw your consent at any time, without affecting what we did before
You can delete your account yourself in Settings. In Settings, then Privacy controls, you can also change who sees your workouts, remove followers, block people and leave suggestions. For anything else, write to [email protected]. We reply within one month.
If you are not happy with our answer, you can complain to the Spanish data protection authority, the Agencia Española de Protección de Datos (www.aepd.es), or to the authority in your own country.
Children
TrainRox is not meant for anyone under 16, and we do not knowingly collect data from them. An account whose date of birth says under 16 cannot share workouts publicly and never appears in suggestions or contact matches. If you believe a child has given us personal data, write to [email protected] and we will delete it.
Security
We protect your data with encryption in transit, access controls and providers that meet recognised security standards. No system is perfectly secure, so if we learn of a breach that affects you, we will tell you and the authorities as the law requires.
Changes to this policy
We may update this policy as TrainRox changes. The date at the top shows the latest version. If a change is significant, we will tell you in the app or by email before it applies.
최종 업데이트: 2026. 11. 4.