Treoq Support

Privacy policy

How Treoq handles your information in the app, on treoq.com and when you write to us: what we collect, why, who we share it with, and how you delete all of it.

Effective 22 October 2026 · Version 7 · Dansk

Contents

In short

  • We use your information to build and adapt your training, and we don't sell it. Your health and training data are never used for advertising. To measure our own ads, the app tells Meta and TikTok when it's installed and when you start a trial or subscription – with your phone's advertising ID only if you allow tracking.
  • We process health data from Apple Health and your watch only with your explicit consent, and cycle data only with a separate opt-in. If you withdraw your consent, we delete the health data.
  • The coach's replies are written by a language model from OpenAI, which may not train its models on your data.
  • You delete your account and all data directly in the app under Profile → Delete account.

1Who is responsible for your information

Treoq is run by Kasper Lau Hejgaard, who is the data controller for the information described here.

Kasper Lau HejgaardDenmarkEmail: support@treoq.com

Write to the same address if you have questions about this policy or want to use your rights (see section 11).

2What this policy covers

This policy covers the Treoq app for iPhone, the website treoq.com and the messages you send us. If you connect Treoq to Apple Health, intervals.icu or your Garmin, Wahoo, Polar, COROS or Suunto account, their own privacy policies apply to the data they hold.

3The information we process

We collect what it takes to coach you, and nothing more. Here is all of it, grouped by where it comes from.

Your account

Your email, your password and the name you want to be called. The password is stored only as a one-way encrypted value (a hash), so neither we nor anyone else can read it.

Sign in with Apple. If you use Sign in with Apple, we get an ID from Apple, the email you choose to share (this can be a hidden address that Apple forwards) and your name the first time. We also get a key from Apple, which we store encrypted, so we can revoke Treoq's access at Apple when you delete your account.

Forgotten password. If you ask for a new password, we send a code to your email. The code is valid for 5 minutes and can be used only once.

Your profile and your goals

  • About you: date of birth and sex (both optional), weight, height, experience, language and time zone.
  • Your thresholds: FTP, 5-minute power, threshold heart rate, max and resting heart rate, threshold pace and swim CSS, and whether each value was entered, measured in a test, taken from your watch or estimated. We can estimate your threshold pace from your runs at your threshold heart rate until you have measured it.
  • Your week: how many hours you have per week, fixed rest days and regular club sessions.
  • Injuries: the type, whether it is current, and the notes you write yourself.
  • Your races: name, date, distance, priority, goal time, course, location and notes.
  • Notifications: which ones you want, and when.

From this, Treoq calculates your plan, your sessions, the weekly summary, your readiness and your training load.

Health and training data from Apple Health

With your permission, Treoq reads these types from Apple Health: HRV, resting heart rate, sleep, workouts, heart rate, active energy, distance (walking and running, cycling and swimming), cycling power and cadence, running speed and power, cycling speed, steps (used to calculate running cadence) and the route of your workouts. If your sex is set to female in your profile and you have said yes to cycle data (a separate opt-in that you give and withdraw under Profile), Treoq also reads your menstrual flow (the days you have logged). If you say no, Treoq reads, stores and sends no cycle data.

The app sends a summary of each workout and your daily HRV, resting heart rate and sleep to our server and, if you have said yes to cycle data, your period days from roughly the last 180 days (date and flow). They are used only to interpret your readiness (late in the cycle, resting heart rate is typically a few beats higher) and do not change your plan. For workouts from the last 14 days, it also sends the second-by-second measurements: heart rate, power, cadence, speed, distance and elevation. From the route, the app uses only elevation and speed; where you trained never leaves your iPhone. The first time, the last 56 days are fetched.

You choose in iOS which types Treoq may read, and you can change it in the Health app under your profile picture → Apps → Treoq.

Data from your watch

Watches from Garmin, Wahoo, Polar, COROS and Suunto are connected through the service Stridee, which fetches data from your watch for us. You sign in with the watch maker on their own page, so Treoq never sees your password there. Stridee gets a random user ID from us, never your name or email, and your planned sessions for the next week (7 days), so they can be put on your Garmin, Wahoo, COROS or Suunto watch.

If you connect intervals.icu, we put your planned rides and runs for the next week (7 days) on your calendar there: the session's name, day, purpose and targets in watts and pace. intervals.icu can then send them on to Zwift and other apps you have connected there yourself. You give permission on intervals.icu's own page, and Treoq fetches no data from intervals.icu. If you disconnect, we remove the coming sessions from the calendar and revoke our access.

We get your activities and each night's sleep, HRV and resting heart rate, up to 60 days back. From the watch's original file we use laps, second-by-second data and the thresholds the watch has measured (FTP and heart rate). We do not read or store the GPS positions in the file.

Your calendar

Under Profile → Connections → Your plan in your calendar you can make a private link, so your sessions show in Google Calendar, Apple Calendar or Outlook. The link shows your planned sessions from two weeks back to eight weeks ahead: name, day, time, description and purpose. Anyone who has the link can see the sessions, including the calendar service you add it to, which fetches it on its own schedule. We store only a one-way encrypted value (SHA-256 hash) of the link's key, not the link itself. If you make a new link, the old one stops working, and you can stop the link altogether.

Conversations with the coach

What you write to the coach, and the coach's replies, are stored so you can find the conversation again. What is sent to OpenAI is described in section 6.

Notifications

If you allow notifications, we store the address (a token) Apple uses to deliver them to your iPhone, and the messages we have sent you. You get at most two a day.

Subscription

You buy through Apple. We are told the product, status, expiry date and Apple's transaction ID, so we know you have access. The purchase is linked to your account with a random ID. We pass the purchase and Apple's messages about it on to RevenueCat, which shows us how subscriptions are doing (section 7). We never see your card details.

How the app is used

To make the app better, we record a few events: which onboarding steps you have seen, whether you completed onboarding, whether you have seen the subscription page and bought, what you answered when asked about notifications, whether you kept or undid a change to your plan, and whether you opened an explanation. The events carry a random ID that the app creates each time it starts and that is never stored on the phone. When you are signed in, they are also linked to your account.

We use no third-party analytics.

Measuring our ads

We advertise Treoq on Facebook and Instagram. To see whether the ads work, the app includes Meta's measurement tool (the Meta SDK). It tells Meta when the app is installed and opened, and when you start a trial or buy a subscription in the App Store, together with technical information about the phone (model, iOS version, language and IP address). Only if you allow tracking when iOS asks is your phone's advertising ID (IDFA) also sent, so Meta can see which ad you came from. If you say no, ads are measured only in aggregate through Apple's own system (SKAdNetwork). Your health and training data, your conversations, your name and your email are never sent to Meta. You can turn tracking off at any time in iOS under Settings → Privacy & Security → Tracking.

We also advertise on TikTok, so the app includes TikTok's equivalent tool (the TikTok Business SDK). It tells TikTok when the app is installed and opened, whether you open it again the next day, and when you start a trial or subscription, together with the same technical information about the phone. The advertising ID is sent only if you allow tracking; otherwise ads are measured only in aggregate through SKAdNetwork. Your health and training data, your conversations, your name and your email are never sent to TikTok.

Technical data

Our server logs technical events and errors with internal IDs, not your name, email or health values. Our hosting provider may record IP addresses in its network logs. To protect your account, we lock it for 15 minutes after five wrong passwords.

The app asks Expo's servers whether there is an update. Expo thereby receives technical information such as IP address, app version and phone model.

On your iPhone

Your login key is kept in the iOS keychain. The app also keeps a copy of your profile and your latest plan and readiness data on the phone, so it opens quickly and works offline. The copy is kept in a folder that is not included in iCloud backup, and it is deleted when you sign out. If you choose a photo as the background of a share card, the photo stays on the phone.

When you write to us

We keep your email and what you write, so we can help you.

4Purposes and legal basis

The General Data Protection Regulation (GDPR, and UK GDPR for users in the UK) requires a legal basis for each kind of processing. This is how it looks at Treoq:

Providing Treoq

What
Your account, your plan and its adjustments, the coach, notifications, syncing with your watch and, if you make one, the calendar link.
Basis
The contract with you when you create an account (Art. 6(1)(b)).

Health data

What
Sleep, HRV, heart rate, injuries, weight and your workouts. This is health data and therefore a special category of personal data.
Basis
Your explicit consent (Art. 9(2)(a) and Art. 6(1)(a)), which you give in the app before you get started. The consent has a version: if we change what the data is used for, the app asks you again.

Cycle data

What
Your logged period days from Apple Health and the cycle phase Treoq works out from them. Only if your sex is female in your profile.
Basis
Your explicit consent, given separately (Art. 9(2)(a) and Art. 6(1)(a)). It is optional: without it Treoq uses no cycle data, and you can turn it off under Profile, and then we delete it.

Notifications

What
Morning briefing, news of changes to your plan and feedback after sessions.
Basis
Your consent when you say yes in iOS (Art. 6(1)(a)). You turn them off in the app or in iOS.

Measuring ads

What
The events sent to Meta and TikTok described in section 3 and, if you allow it, your phone's advertising ID.
Basis
For the advertising ID, your consent when you allow tracking in iOS (Art. 6(1)(a)). For the other events, our legitimate interest in measuring whether our ads work (Art. 6(1)(f)). You can object.

Making the app better

What
The few usage events listed in section 3.
Basis
Our legitimate interest in understanding what works (Art. 6(1)(f)). You can object.

Security and operations

What
Technical logs and protection against login abuse.
Basis
Our legitimate interest in a secure and stable service (Art. 6(1)(f)).

Support

What
Your email and your message.
Basis
The contract with you and our legitimate interest in answering you (Art. 6(1)(b) and (f)).

Requests from authorities

What
Only what the law requires, for example if an authority asks for information.
Basis
Legal obligation (Art. 6(1)(c)).

Treoq adapts your plan automatically based on your data, and that is the service itself. It has no legal effect on you, and you can always undo a change.

5Apple Health

Data from Apple Health (HealthKit) has its own rules, and we follow them:

  • We only read. Treoq never writes data to Apple Health.
  • Data from Apple Health is used only to plan and follow your training. Never for advertising, marketing, data analysis for other purposes, or sale.
  • It is shared only with the processors needed to provide Treoq (section 7), and only with your consent.
  • We don't store health data in iCloud.
  • You can remove Treoq's access in the Health app and withdraw your consent in Treoq at any time.

6The coach and artificial intelligence

The coach's replies and the feedback after your sessions are written by a language model from OpenAI. So the reply fits you, we send the information that is relevant:

  • In every conversation: the name you want to be called, your level, your weight, your thresholds, hours per week, regular sessions and rest days, current injuries, your plan and your race, today's session, your readiness (and your cycle phase, if you have said yes to cycle data), the weekly summary and the last 20 messages in the conversation.
  • When the coach needs it: your sessions, your sleep, HRV and resting heart rate, your activities with your own notes and perceived effort, and your race plan. If the coach looks something up in our training library, the search text is sent too.
  • Feedback after a session: your name, your thresholds and injuries, the session's numbers and notes, and the day's HRV and sleep. Only for sessions from the last 14 days.

We never send your email or your date of birth to OpenAI.

OpenAI is our processor and may not use data from us to train its models. We ask OpenAI not to store the conversations, but OpenAI may keep them for up to 30 days to detect abuse, after which they are deleted. OpenAI processes data in the US (see section 8).

The coach is a training tool and can be wrong. If you have pain, illness or symptoms, see a doctor.

7Who we share information with

We never sell your information. We share it only with the companies needed to provide Treoq. The processors process data only on our instructions, and they are bound by a data processing agreement that requires them to protect your information at least as well as this policy and Apple's rules.

Railway Processor

What
Runs our server and database, where the information in section 3 is kept.
Where
US-based company

OpenAI Processor

What
Writes the coach's replies and the feedback after your sessions (section 6).
Where
US

Stridee Processor

What
Only if you connect a watch through Stridee: fetches data from your watch for us and puts your sessions for the next week on the watch. Gets a random user ID and your planned sessions, never your name or email.

Apple Processor

What
Delivers notifications to your iPhone. A notification can contain your readiness and is shown on the lock screen unless you turn off previews in iOS. Without your consent to health data, we send none.

Expo Processor

What
Delivers updates to the app and receives technical information such as IP address, app version and phone model.
Where
US

Resend Processor

What
Sends the email with the code when you have forgotten your password. Gets your email and the code.
Where
US

RevenueCat Processor

What
Shows us how subscriptions are doing (trials, cancellations and renewals). Gets your purchase from Apple (product, status, dates and transaction ID) and the random ID the purchase is linked to, never your name, your email or your health and training data.
Where
US

Meta Independent controller

What
Measures our ads on Facebook and Instagram. The app sends events for install, app open, trial and purchase plus technical information about the phone, and the advertising ID only if you allow tracking (section 3). Never health or training data, conversations, name or email. Meta Platforms Ireland Limited processes the information under its own privacy policy.
Where
Ireland and USA

TikTok Independent controller

What
Measures our ads on TikTok. The app sends events for install, app open, trial and subscription plus technical information about the phone, and the advertising ID only if you allow tracking (section 3). Never health or training data, conversations, name or email. TikTok Technology Limited in Ireland processes the information under its own privacy policy.
Where
Ireland, USA and Singapore

Apple, Garmin, Wahoo, Polar, COROS, Suunto and intervals.icu Independent controllers

You have your own agreement with them. Apple is responsible for the App Store, your purchase, Apple Health and Sign in with Apple, and the watch makers and intervals.icu are responsible for the data in your account with them. Their own privacy policies apply to that.

Your calendar service Independent controller

Only if you add the calendar link to, for example, Google Calendar, Apple Calendar or Outlook: the service fetches your planned sessions from the link and shows them in your calendar under its own privacy policy.

8Transfers to countries outside the EU/EEA

Some of our processors are American. We transfer information to a country outside the EU/EEA only on a lawful basis: the European Commission's decision on the EU-US Data Privacy Framework, when the recipient is certified under it, or the European Commission's standard contractual clauses. Write to us if you want a copy of the basis.

9How long we keep the information

Account, profile, plan and training data

As long as you have an account. If you delete the account, we delete all of it immediately. If you disconnect Apple Health or a watch, we immediately delete what came from it (section 10).

Conversations with the coach

Until you delete the conversation, withdraw your consent or delete your account. You can delete your conversations even if you have not given consent.

Health data when you withdraw consent

We delete it immediately (see section 10), and no more notifications are sent.

Notifications

Sent notifications are deleted automatically after 30 days.

Usage events

At most 13 months, then they are deleted automatically.

Technical logs

Contain internal IDs and errors, not your name, email or health values. We don't delete them ourselves; how long they are kept by our hosting provider depends on the provider's settings.

At OpenAI

At most 30 days, see section 6.

Support requests

Until the matter is resolved, and at most 12 months.

If your information is in a database backup when you delete your account, it disappears when the backup is overwritten.

10How to delete your data and withdraw consent

Delete your account

In the app: Profile → Delete account. Your account, profile, plan, workouts, conversations, connections, calendar link and notifications are deleted immediately and cannot be restored.

If you have connected a watch, we also end the connection at Stridee and remove your planned sessions from the watch. If you have connected intervals.icu, we remove the coming sessions from your calendar there and revoke our access. If you signed in with Apple, we revoke Treoq's access at Apple.

Your subscription continues with Apple until you cancel it in iOS under Settings → your name → Subscriptions.

Withdraw your consent

In the app: Profile → Withdraw consent. The app asks before anything is deleted. Then your workouts, sleep, HRV and resting heart rate, cycle data, injuries, conversations with the coach, numbers calculated from them, and your notifications are deleted immediately. This cannot be undone.

Your account, your profile (for example weight and thresholds), your races and your plan remain but are not used, and the plan and the coach are locked until you give consent again. If you want them gone too, delete the account. This does not affect the lawfulness of the processing before.

Turn off cycle data

In the app: Profile → Cycle data (shown when your sex is female in your profile). Your cycle days are deleted immediately, and Treoq reads and sends no more. The rest of your consent is unchanged.

Disconnect Apple Health

In the app: Profile → Connections → Apple Health → Disconnect Apple Health. Workouts, sleep, HRV, resting heart rate and period days that came from Apple Health are deleted immediately, and nothing more is fetched. If you only remove access in the Health app, we fetch nothing more, but what was fetched stays until you disconnect in the app or delete your account.

Disconnect a watch

In the app: Profile → Connections → your watch → Disconnect. Workouts from the watch are deleted immediately, and if it is your last watch, the nights' sleep, HRV and resting heart rate from it are deleted too, and upcoming sessions are removed from the watch.

Stop the calendar link

In the app: Profile → Connections → Your plan in your calendar. If you stop the link, it no longer works, and the sessions disappear from your calendar the next time it fetches the link.

Can't get into the app?

Write to support@treoq.com from the email your account was created with, and we will delete the account within 30 days.

11Your rights

Under data protection law you have the right to:

  • access the information we hold about you, and get a copy of it,
  • have incorrect information corrected. You can correct most of it yourself under Profile,
  • have your information erased,
  • restrict processing, for example while we look into an objection,
  • receive your data in a machine-readable format (JSON), so you can take it to another service,
  • object to processing based on our legitimate interest, for example the usage statistics,
  • withdraw your consent at any time.

You download a copy of your data yourself in the app under Profile → Download my data: everything we hold about you as a JSON file, except the second-by-second measurements from your workouts. We send those if you write to us.

Write to support@treoq.com. We reply within one month, and it is free. We may ask you to confirm that it is your account before we hand over or delete anything.

12Security

  • All traffic between the app and our server is encrypted (TLS).
  • Passwords, login keys and the key in your calendar link are stored only as hashes on the server. On the phone, the login key is kept in the iOS keychain.
  • The key from Sign in with Apple is stored encrypted with AES-256.
  • The code for a new password is valid only for a short time, and after five wrong codes we lock the account for 15 minutes.
  • Only Kasper Lau Hejgaard has access to the database.
  • If a security breach happens that could harm you, we tell you and the supervisory authority, as the law requires.

13Age

Treoq is for people aged 13 and over, as the app's age rating in the App Store. If you are younger, you may not create an account. If we find out that an account belongs to someone under 13, we delete it.

14The website treoq.com

The website uses no cookies and no statistics and loads nothing from other services: the typeface is your device's own, and the App Store QR code is on the page itself. The website is hosted at Railway, like our server.

15Changes to this policy

We update the policy when Treoq changes. For significant changes, we tell you in the app before they take effect. The date at the top shows when the policy was last changed. The Danish version and this English version say the same thing.

Version 7, 22 October 2026. The app also measures our ads on TikTok with TikTok's tool (sections 3, 4 and 7), in the same way as with Meta. Health and training data are never sent to TikTok.

Version 6, 20 October 2026. Your App Store purchases are passed on to RevenueCat, which shows us how subscriptions are doing (sections 3 and 7).

Version 5, 20 October 2026. Your plan can go in your calendar (Google, Apple or Outlook) with a private link, which you can stop or replace yourself (sections 3, 7 and 10).

Version 4, 19 October 2026. Suunto watches can be connected through Stridee. If you connect intervals.icu, we put the coming week's rides and runs on your calendar there, so they can reach Zwift.

Version 3, 18 October 2026. The app measures our ads with Meta's tool (sections 3, 4 and 7): events for install, trial and purchase, and your phone's advertising ID only if you allow tracking. Health and training data are never sent to Meta. The app is also available in English.

Version 2, 9 October 2026. Cycle data has its own opt-in. The consent has a version, and the app asks again when the purpose changes. When you withdraw consent, your health data is deleted. You can delete your conversations without consent. No notifications are sent without consent. The section about your watch now says 7 days ahead, as the app does, and the promise that technical logs are deleted after 30 days has been removed, because we don't delete them ourselves. Sent notifications are deleted after 30 days, and you can download a copy of your data in the app. The site no longer loads fonts from Google.

16Contact and complaints

If you have questions or want to use your rights, write to support@treoq.com.

If you are unhappy with how we handle your information, you can complain to a data protection authority: the Danish authority, Datatilsynet, where Treoq is based, or the one where you live. We would like to hear from you first, though, so we can put it right.

Datatilsynet (Denmark)Carl Jacobsens Vej 35, 2500 Valbydt@datatilsynet.dk · datatilsynet.dk