Privacy Policy
Last updated: May 20, 2026
Kotte Consulting AB (559195-0802) ("we", "us") provides the Klassikerkollen app ("the App") and this website. This policy explains what personal data we collect, why, and your rights under the EU General Data Protection Regulation (GDPR).
1. Data Controller
The data controller responsible for your personal data is:
Kotte Consulting AB Org. nr: 559195-0802 Sundbybergs Torg 1, 172 67 Sundbyberg, Sweden Email: support@klassikerkollen.se Web: www.klassikerkollen.se
2. What Data We Collect
| Category | Details |
|---|---|
| Account information | Name, email address, gender, and year of birth when you register. Passwords are stored as a one-way cryptographic hash — we cannot read them. |
| Workout summary data | If you connect Garmin Connect or Polar Flow, we receive workout summaries from those services: activity type, date, duration, distance, average heart rate, training load, elevation, pace, and power (cycling). Any GPS coordinates present in the raw data are stripped during processing and are never stored. |
| Race and circuit data | Races you register, your selected circuit type, race results you enter manually, and predicted performance data derived by the App. |
| Training plan data | Your generated training plans, completed and missed sessions, plan adjustments, and fitness level inputs you provide during setup. |
| Subscription and payment information | Subscription tier and billing status. Payment processing is handled by Stripe, the Apple App Store, or Google Play — we do not store full card details. |
| Technical information | IP address, device type, operating system, and session data required to operate the service. We do not use advertising or analytics trackers. |
| Support communications | Messages you send to our support team. |
3. Your Training Data — We Do Not Sell It
We do not sell, license, or share your training data with third parties for commercial purposes. Your workout summaries, race results, and performance data are never sold to advertisers, data brokers, insurance companies, or any other party.
We process your training data solely to provide the features you have requested — training plan generation, progress tracking, performance analysis, and race preparation. We process this data on the legal basis of contract (to deliver the service you have signed up for).
We may use anonymized and aggregated data — data that cannot be linked back to any individual — to improve our training algorithms and analyze general usage patterns.
4. A Note on GPS Data
Klassikerkollen does not store GPS tracks or GPS coordinates. When we sync activity data from Garmin Connect or Polar Flow, the raw data may contain GPS coordinates as part of the file format. These coordinates are stripped during processing and are never written to our database or storage. What we retain is the workout summary only — the totals and averages for a session (type, duration, distance, heart rate, and similar).
5. Legal Bases for Processing
| Legal basis | What we use it for |
|---|---|
| Contract — Art. 6(1)(b) GDPR | Processing your account information, workout summaries, race data, and training plan data to deliver the App features you have signed up for. |
| Legitimate interest — Art. 6(1)(f) GDPR | Sending service-related communications (e.g. coaching nudges, registration reminders, race briefing notifications); improving the App's algorithms using anonymized and aggregated data; and protecting against fraud and abuse. |
| Legal obligation — Art. 6(1)(c) GDPR | Retaining accounting records as required by Swedish law (Bokföringslagen). |
Note on health-related data: Workout summary data including heart rate and training load may be considered health-related data under GDPR. We process this data on the basis of your explicit consent, given when you connect your Garmin or Polar account. You may withdraw this consent at any time by disconnecting your account in the App's Connections settings.
6. Third-party Service Providers
Klassikerkollen integrates with, or relies on, the following third-party services:
Garmin Connect
With your authorization, we connect to your Garmin Connect account to import workout summaries into Klassikerkollen. By connecting your Garmin account you give your express consent to this transfer of data from Garmin Connect to Klassikerkollen. Your Garmin credentials are never stored by us. Any GPS coordinates present in the raw data are stripped during processing and never stored.
Data obtained via the Garmin Connect API is not shared with, processed by, or otherwise made available to any third-party service. Garmin-sourced data is used exclusively within Klassikerkollen's own infrastructure to provide the features you have requested.
Garmin is an independent data controller for data held in their platform. Before connecting your Garmin account, we encourage you to review Garmin Connect's privacy notice.
You can withdraw your consent and revoke our access to your Garmin data at any time, either in your Garmin account settings at connect.garmin.com or in the App's Connections settings. Withdrawing consent does not affect workout summaries already imported — to remove that data, delete the relevant entries or your account.
Polar Flow
With your authorization, we connect to your Polar Flow account to import workout summaries into Klassikerkollen. By connecting your Polar account you give your express consent to this transfer of data from Polar Flow to Klassikerkollen. Your Polar credentials are never stored by us. Any GPS coordinates present in the raw data are stripped during processing and never stored.
Polar Electro Oy is an independent data controller for data held in their platform — see Polar's privacy notice for details. Where workout data displayed in the App originates from Polar Flow, Polar Ecosystem is credited as the source.
You can withdraw your consent and revoke our access to your Polar data at any time, either in your Polar Flow account settings at flow.polar.com or in the App's Connections settings. When you disconnect your Polar account, we immediately revoke and delete the access token used to connect to your account. Withdrawing consent does not affect workout summaries already imported — to remove that data, delete the relevant entries or your account.
Stripe
Payment processing for subscriptions purchased directly through our website or app. Stripe is the data controller for payment card data and operates under its own privacy policy at stripe.com/privacy. We do not store full card details.
Apple App Store and Google Play Store
If you subscribe through the Apple App Store or Google Play Store, payment processing is managed by Apple or Google respectively. We do not receive or store your payment card details. See Apple's and Google's respective privacy policies for information on how they handle payment data.
Firebase / Google Cloud
We use Google Firebase and Google Cloud for authentication, database, file storage, and hosting. Data is stored within the EU (europe-north1, Finland; europe-north2, Sweden; europe-west3, Germany). These services act as data processors under a Data Processing Agreement with us. See Google's privacy policy at policies.google.com/privacy.
Mailgun
We use Mailgun to send transactional emails such as account confirmations, password resets, and service notifications. For this purpose we share your email address with Mailgun. Mailgun's infrastructure is EU-hosted, and transfers to the US (Mailgun's parent company Sinch is US-based) are covered by Standard Contractual Clauses. See Mailgun's privacy policy at mailgun.com/privacy-policy.
All service providers acting as data processors may only use your data to perform services on our behalf.
7. How Long We Keep Your Data
We retain your personal data for as long as your account is active and as needed to provide the service.
Account deletion: When you delete your account, your personal data is deleted from our production systems immediately. Backup copies are purged within 30 days. After this period, no identifiable data remains unless required by law.
Inactive accounts: Accounts that have been inactive for more than 24 consecutive months may be subject to termination. We will make reasonable efforts to notify you before doing so.
Accounting records required by the Swedish Accounting Act (Bokföringslagen) are retained for 7 years.
8. Who We Share Your Data With
We do not sell your personal data. We share it only as follows:
- Service providers: As described in section 6, we use Google Cloud/Firebase (infrastructure), Stripe (payments), and Mailgun (transactional email) as service providers. Those acting as data processors do so under data processing agreements and may only use your data to perform services on our behalf. Garmin and Polar are independent data controllers for data held in their own platforms.
- Legal requirements: If required by applicable law or a valid court order.
9. International Transfers
We store and process data within the EU/EEA. Our infrastructure runs on Google Cloud in the europe-north1 (Finland), europe-north2 (Sweden), and europe-west3 (Germany) regions. Mailgun also stores data in EU-based infrastructure.
However, Mailgun (Sinch) is a US-based company, meaning corporate-level access to data may constitute a transfer outside the EU/EEA under GDPR. Mailgun has Standard Contractual Clauses (SCCs) in place as required by the European Commission, ensuring your data receives an adequate level of protection.
10. Cookies
We use essential cookies only — no advertising cookies, no cross-site tracking.
| Cookie | Purpose | Storage |
|---|---|---|
| Authentication cookies | To keep you logged in during your session. Set by Firebase Authentication. | Session |
| Preference cookies | To remember your in-app settings (e.g., dismissed banners). | Browser localStorage |
We do not use Google Analytics, Meta Pixel, or any other advertising or analytics tracking service. You can block all cookies in your browser settings; the only consequence is that you will need to log in again each visit.
11. Children's Privacy
The App is intended for users aged 16 and over. We do not knowingly collect personal data from anyone under 16. If you are under 16, please do not use the App or provide any personal data. If you believe we have inadvertently collected data from someone under 16, please contact us at support@klassikerkollen.se and we will delete it promptly.
12. Automated Processing
The App uses algorithms to analyze your workout data and generate personalized outputs — including training plans, coaching nudges, and race time predictions. This processing is automated but does not constitute decision-making with legal or similarly significant effects under Article 22 GDPR. The results are presented to you as tools to support your own training decisions, not to make decisions about you. You remain in full control of how you interpret and act on the information the App provides.
13. Your Rights
Under GDPR you have the right to:
- Access — request a copy of the personal data we hold about you.
- Rectification — ask us to correct inaccurate data.
- Erasure — ask us to delete your data ("right to be forgotten").
- Restriction — ask us to limit how we use your data.
- Portability — receive your data in a machine-readable format.
- Object — object to processing based on legitimate interest.
- Withdraw consent — at any time, for any processing based on consent (in particular, disconnecting your Garmin or Polar account).
To exercise any of these rights, contact us at support@klassikerkollen.se. We will respond within 30 days.
If you are not satisfied with our response, you have the right to lodge a complaint with the Swedish Authority for Privacy Protection (Integritetsskyddsmyndigheten, IMY) at imy.se.
14. Changes to This Policy
We may update this policy to reflect changes in the App or applicable law. If we make material changes, we will notify you via email or a notice in the App at least 30 days before the changes take effect. The current version is always available at /legal/privacy.