Privacy Policy
Last updated: October 14, 2026
Kotte Consulting AB (559195-0802) ("we", "us") provides the Klassikerkollen app ("the App") and this website. This policy explains what personal data we collect, why, and your rights under the EU General Data Protection Regulation (GDPR).
1. Data Controller
The data controller responsible for your personal data is:
Kotte Consulting AB Org. nr: 559195-0802 Sundbybergs Torg 1, 172 67 Sundbyberg, Sweden Email: support@klassikerkollen.se Web: www.klassikerkollen.se
2. What Data We Collect
| Category | Details |
|---|---|
| Account information | First and last name, email address, gender, and year of birth when you register. Gender and year of birth are used to place your results in the right comparison group. Passwords are stored as a one-way cryptographic hash — we cannot read them. |
| Workout summary data | If you connect Garmin Connect or Polar Flow, we receive workout data from those services and extract the summary: activity type, date, duration, distance, average heart rate, training load, elevation, pace, and power (cycling). Where the source data includes one, we also keep the general area a session took place in — the name of a town or municipality, never coordinates — because it helps you recognize which session is which. No GPS coordinates or routes are stored. |
| Race and circuit data | Races you register, your selected circuit type, race results you enter manually, and predicted performance data derived by the App. |
| Training plan data | Your generated training plans, completed and missed sessions, plan adjustments, and fitness level inputs you provide during setup. |
| Push notification data | If you enable notifications, we store a device token so we can send them, along with the device and browser identifier your device reports. You can turn notifications off at any time in the App's settings, which removes the token. |
| Feedback and support communications | Feedback you submit in the App, and messages you send to our support team. In-app feedback is stored with your user ID, email address, and the device identifier your device reports. |
| Technical logs | Our servers record operational logs when the App talks to them — timestamps, which operation ran, whether it succeeded, and identifiers such as your user ID or an activity ID. These exist to diagnose faults, not to profile you. They are automatically deleted after 30 days. |
The App is currently in beta and provided free of charge. We do not collect or process any payment information.
3. Your Training Data — We Do Not Sell It
We do not sell, license, or share your training data with third parties for commercial purposes. Your workout summaries, race results, and performance data are never sold to advertisers, data brokers, insurance companies, or any other party.
We process your training data solely to provide the features you have requested — training plan generation, progress tracking, performance analysis, and race preparation. We process this data on the legal basis of contract (to deliver the service you have signed up for).
We may use anonymized and aggregated data — data that cannot be linked back to any individual — to improve our training algorithms and analyze general usage patterns.
4. A Note on GPS Data
Klassikerkollen does not use GPS data. No feature in the App shows, analyzes, or relies on your route. Your workout records contain no coordinates and no route data.
When Garmin or Polar sends us an activity, the file may contain a GPS track as part of its format. We read the summary figures we need and the track is discarded — it is never written to our database or storage.
Area names. Where the source data includes one, we keep the general area a session took place in — the name of a town or municipality, such as the one Garmin attaches to an activity. In practice these are names like "Stockholm", "Sundbyberg" or "Mora". This is not a coordinate and cannot be used to locate you precisely. We keep it because it makes sessions easier to tell apart in a list. If you would rather we didn't, contact us and we will remove it from your records.
Files you upload yourself. If you import your training history by uploading a data export from Garmin or Polar, that archive does contain GPS files. We read only the workout summaries from it. The uploaded file is then deleted automatically after around 7 days — long enough that if we find a bug in how we read these files, we can re-read your import correctly rather than ask you to upload it again. Deletion is handled by an automatic storage rule that runs on a schedule rather than to the exact second, so a file may persist a little beyond the seventh day before it is removed. Until then it sits in our own EU infrastructure, is not analyzed for location, and is not shared with anyone. If you delete your account, uploaded files are removed immediately rather than waiting for that rule. We keep the file on the basis of our legitimate interest in operating a reliable service (Art. 6(1)(f) GDPR).
Technical logs. Our servers log enough to diagnose a failed sync — identifiers, timings and error messages — but not the contents of an activity file. Logs are deleted after 30 days (see section 7).
This is a deliberate design choice. Klassikerkollen is built around how much you have trained and how your fitness is developing, not where you went. Your route data stays in your Garmin or Polar account.
5. Legal Bases for Processing
| Legal basis | What we use it for |
|---|---|
| Contract — Art. 6(1)(b) GDPR | Processing your account information, workout summaries, race data, and training plan data to deliver the App features you have signed up for. |
| Legitimate interest — Art. 6(1)(f) GDPR | Sending service-related notifications (integration status, workout sync confirmations, training plan suggestions, weekly summaries, and race completion updates); briefly retaining uploaded data export files so imports can be re-processed if we find a bug (see section 4); keeping short-lived technical logs so we can diagnose faults and keep the service reliable; improving the App's algorithms using anonymized and aggregated data; and protecting against fraud and abuse. |
Note on health-related data: Workout summary data including heart rate and training load may be considered health-related data under GDPR. We process this data on the basis of your explicit consent, given when you connect your Garmin or Polar account. You may withdraw this consent at any time by disconnecting your account in the App's Connections settings.
6. Third-party Service Providers
Klassikerkollen integrates with, or relies on, the following third-party services:
Garmin Connect
With your authorization, we connect to your Garmin Connect account to import workout summaries into Klassikerkollen. By connecting your Garmin account you give your express consent to this transfer of data from Garmin Connect to Klassikerkollen. We never see or store your Garmin password, only the access token Garmin issues for the connection, which we revoke and delete when you disconnect. We extract only the workout summary and discard any GPS track the activity contains (see section 4).
Data obtained via the Garmin Connect API is not shared with, processed by, or otherwise made available to any third-party service. Garmin-sourced data is used exclusively within Klassikerkollen's own infrastructure to provide the features you have requested.
Garmin is an independent data controller for data held in their platform. Before connecting your Garmin account, we encourage you to review Garmin Connect's privacy notice.
You can withdraw your consent and revoke our access to your Garmin data at any time, either in your Garmin account settings at connect.garmin.com or in the App's Connections settings. Withdrawing consent does not affect workout summaries already imported — to remove that data, delete the relevant entries or your account.
Polar Flow
With your authorization, we connect to your Polar Flow account to import workout summaries into Klassikerkollen. By connecting your Polar account you give your express consent to this transfer of data from Polar Flow to Klassikerkollen. We never see or store your Polar password, only the access token Polar issues for the connection. We extract only the workout summary and discard any GPS track the activity contains (see section 4).
Polar Electro Oy is an independent data controller for data held in their platform — see Polar's privacy notice for details. Where workout data displayed in the App originates from Polar Flow, Polar Ecosystem is credited as the source.
You can withdraw your consent and revoke our access to your Polar data at any time, either in your Polar Flow account settings at flow.polar.com or in the App's Connections settings. When you disconnect your Polar account, we immediately revoke and delete the access token used to connect to your account. Withdrawing consent does not affect workout summaries already imported — to remove that data, delete the relevant entries or your account.
Google and Apple sign-in
You can create an account and sign in using Google or Apple. If you do, that provider confirms your identity to us and shares your email address and name. We do not receive your password. Google and Apple are independent data controllers for the accounts you hold with them — see their respective privacy policies for how they handle sign-in.
Firebase / Google Cloud
We use Google Firebase and Google Cloud for authentication, database, file storage, and hosting. Data is stored within the EU (europe-north1, Finland; europe-north2, Sweden; europe-west1, Belgium; europe-west3, Germany). Firebase Authentication also sends account-related emails on our behalf, such as password resets and email address verification, and Firebase Cloud Messaging delivers push notifications. These services act as data processors under a Data Processing Agreement with us. See Google's privacy policy at policies.google.com/privacy.
Proton Mail
Our support address, support@klassikerkollen.se, is hosted by Proton AG in Switzerland. If you email us, that correspondence — your address, your message, and anything you attach — is stored in that mailbox. Switzerland is recognized by the European Commission as providing an adequate level of data protection, so no additional transfer safeguards are required. See Proton's privacy policy.
This applies only to email you send us. It is separate from the automated account emails described above, which Firebase sends, and from in-app feedback, which never leaves our own infrastructure.
We do not use any separate email marketing or newsletter provider, and we do not send marketing or newsletter email at all.
All service providers acting as data processors may only use your data to perform services on our behalf.
7. How Long We Keep Your Data
We retain your personal data for as long as your account is active and as needed to provide the service.
Account deletion: When you delete your account, your personal data is deleted from our systems. This includes your workout data, training plans, race data, feedback, and any stored integration tokens, and it happens as part of an automated process triggered when you delete your account. Your connections to Garmin and Polar are revoked first.
Uploaded data export files: If you import your training history by uploading an export file, that file is deleted automatically around 7 days after upload. See section 4 for why we keep it that long and why the timing is approximate.
Technical logs: Operational server logs are deleted automatically after 30 days. A small subset of administrative records that Google Cloud keeps for its own audit purposes is retained for up to 400 days; these record that an operation happened, not the contents of your training data.
A note on deletion timing: Deletion from our live systems is immediate. Our database also has point-in-time recovery enabled, a standard safeguard that allows recovery from accidental loss or a faulty deployment. This means a recoverable copy of deleted data exists for up to 7 days before it ages out permanently. That copy is not accessible to the App and is used only for disaster recovery.
8. Who We Share Your Data With
We do not sell your personal data. We share it only as follows:
- Service providers: As described in section 6, we use Google Cloud/Firebase for infrastructure, authentication, and push notification delivery, and Proton AG for our support mailbox. They act as data processors under a data processing agreement and may only use your data to perform services on our behalf. Garmin, Polar, Google, and Apple are independent data controllers for data held in their own platforms.
- Legal requirements: If required by applicable law or a valid court order.
9. International Transfers
Your account, training and workout data is stored and processed within the EU/EEA. Our infrastructure runs on Google Cloud in the europe-north1 (Finland), europe-north2 (Sweden), europe-west1 (Belgium), and europe-west3 (Germany) regions. This includes the internal queues that pass an incoming workout between our own services, which are pinned to those same four regions.
There is one exception. Email you send to our support address is held by Proton AG in Switzerland (see section 6). The European Commission has issued an adequacy decision for Switzerland, which means transfers there are permitted without additional safeguards. Nothing else leaves the EU/EEA.
10. Cookies and On-device Storage
We do not use cookies. No advertising cookies, no analytics cookies, no cross-site tracking. Klassikerkollen is distributed as a native app for iOS and Android, and our public website is a plain information page that sets no cookies and loads no third-party scripts.
The App stores some things locally on your device:
- A session token, so you stay signed in. Firebase Authentication keeps this in the App's local storage.
- A copy of your own training data, held in an on-device database so the App works offline and loads quickly. This is a cache of data you already have with us — it stays on your device and is not a separate collection of information about you.
- Your scroll position, briefly, so pages reopen where you left them. It is discarded when you close the App.
None of this is transmitted to us the way a cookie would be. You can clear it by signing out or removing the App; the only consequence is that you will need to sign in again and the App will re-download your data.
We do not use Google Analytics, Meta Pixel, or any other advertising or analytics tracking service.
11. Children's Privacy
The App is intended for users aged 16 and over, and the registration form will not accept a year of birth indicating you are younger. We do not knowingly collect personal data from anyone under 16. If you believe we have inadvertently collected data from someone under 16, please contact us at support@klassikerkollen.se and we will delete it promptly.
12. Automated Processing
The App uses algorithms to analyze your workout data and generate personalized outputs — including training plans, coaching nudges, and race time predictions. This processing is automated but does not constitute decision-making with legal or similarly significant effects under Article 22 GDPR. The results are presented to you as tools to support your own training decisions, not to make decisions about you. You remain in full control of how you interpret and act on the information the App provides.
13. Your Rights
Under GDPR you have the right to:
- Access — request a copy of the personal data we hold about you.
- Rectification — ask us to correct inaccurate data.
- Erasure — ask us to delete your data ("right to be forgotten").
- Restriction — ask us to limit how we use your data.
- Portability — receive your data in a machine-readable format.
- Object — object to processing based on legitimate interest.
- Withdraw consent — at any time, for any processing based on consent (in particular, disconnecting your Garmin or Polar account).
You can delete your account yourself at any time from the App's settings. For any of the other rights, including a copy or export of your data, contact us at support@klassikerkollen.se and we will handle the request manually. We will respond within 30 days.
If you are not satisfied with our response, you have the right to lodge a complaint with the Swedish Authority for Privacy Protection (Integritetsskyddsmyndigheten, IMY) at imy.se.
14. Changes to This Policy
We may update this policy to reflect changes in the App or applicable law. The date at the top of this document indicates the current version, which is always available at www.klassikerkollen.se/legal/privacy. We encourage you to review it from time to time, and we will highlight material changes in the App where we can.