Privacy Policy

Last updated: 27 September 2026

This is a translation of the Norwegian original. If the versions differ, the Norwegian version applies.

Trolda is a Norwegian e-bike app that logs your rides. This policy explains what personal data we process, why we do so, where it is stored and what rights you have.

1.Data controller

Trolda is the data controller for the information described here. If you have questions about privacy, contact us at support@trolda.com.

2.What information we process

• Account: your email address and a password (stored encrypted). If you choose “Continue with Google”, we receive your name, email address and, where applicable, profile picture from your Google account. If you choose “Continue with Apple”, we receive only your email address — not your name or profile picture — and if you choose “Hide My Email” with Apple, what we receive is a forwarding address, not your own.
• Profile: a display name and profile picture that you yourself choose to add (optional).
• Ride data: GPS positions (approximately every 5 seconds during an active ride), time, speed, distance and elevation. Tracking only takes place while a ride has been started.
• Sensor data: if you connect the bike or a heart rate monitor via Bluetooth, measurements are logged such as watts (your own effort and motor), pedal strokes per minute, torque, battery level and battery health, odometer reading and riding mode. The device’s Bluetooth ID is stored so that the app can connect automatically next time, and the bike’s own type plate (manufacturer, model, firmware and hardware version) is read on connection — never the serial number.
• Heart rate: your heart rate is health data. It is only processed if you yourself actively connect a heart rate monitor — we regard that as your explicit consent. You can disconnect the monitor and delete rides with heart rate data at any time.
• Bike and maintenance: information you register about your bikes and their maintenance.
• Segments and groups: segments you create yourself, your attempt times and attempt watts, and — if you join a group — your display name, your attempt figures on the group’s shared segments, the summary of the rides you yourself choose to share, and — for as long as you take part in the group’s monthly competition — the totals of your rides per month (pedalling work, motor work, distance, elevation gain, time and number of rides).
• Friends: your friend code, who you are friends with, and the rides you yourself choose to share with your friends: the figures from the ride (date, distance, time, speed, watts, energy, battery use, riding mode and the bike’s name) and a simplified map of the route with 500–1000 metres removed at each end. Never heart rate, never the ride’s name, and rides you do not share are not shown.
• The route base: your rides are counted into a shared, anonymous map of where Trolda users ride, which the route planner uses to prefer roads people actually use. What is stored is the number of passes per grid cell of approximately 28 metres — not who rode, not when, and never entire rides or GPS tracks. Before a ride is counted, 500–1000 metres are removed at each end of it (the length varies from ride to ride), so that the map does not lead to where you start or finish. The figures cannot be traced back to you. The contribution is on from when you create an account, and can be turned off under Profile → Settings → Routes; no new rides are then counted.
• The motor statistics: the figures from the motor on your rides are kept in an anonymous dataset used to understand how different motor systems actually behave — motor watts against your own effort per riding mode, battery use against elevation gain, battery health against charge cycles. For each ride, the following is stored: motor system, motor and controller model, the type plate (manufacturer, model, firmware and hardware version), distance, time, speed, elevation gain, watts, pedal strokes per minute, torque, riding mode and battery figures, as well as a time series of the same measurements with seconds from the start of the ride, distance covered and elevation relative to the starting point. Your weight is rounded to the nearest 5 kg and the bike’s odometer reading to the nearest 500 km, because the watt figures could not otherwise be compared. What is not stored: who you are, GPS positions or maps, date and time of day (only the month), the ride’s name, the bike’s name or Bluetooth ID, and never heart rate. The rows are given a new random ID and cannot be traced back to you or to the ride. The contribution is on from when you create an account, and can be turned off under Profile → Settings → Motor data; no new rides are then counted.
• Live sharing (“Follow me”): if you start a share, your position, a simplified track of the ride, speed, distance and the bike’s battery level are processed for as long as the share is active.
• Demo application: if you apply to test the app through the demo form, we store the email address you provide and which platform you chose (Android or iPhone). To limit misuse of the form, we also store a cryptographic checksum of your IP address — not the address itself, and the checksum cannot be reversed to an IP.
• Technical: when you sign in and register, the form is protected by Cloudflare Turnstile (bot protection), which processes your IP address. The website is delivered by Vercel, which keeps ordinary server logs. The app contains no advertisements and no analytics or tracking tools.

3.Where the data is stored

Trolda is built “offline-first”: your rides, bikes and measurements are stored primarily in a local database on your own device. They do not leave the phone until you sign in.

If you sign in, the data is backed up to our cloud provider Supabase in the region eu-north-1 (Stockholm, Sweden) — that is, within the EEA. The cloud copy is protected by row-level access control: only your own account can read your rows.

Live shares are stored only in the cloud, and the row is deleted automatically no later than 12 hours after the share started — even if you forget to stop it.

4.Purpose and legal basis

• Providing the service (ride log, statistics, backup and synchronisation between your devices): the contract with you, GDPR Article 6(1)(b).
• Heart rate measurement (health data): your explicit consent, GDPR Article 9(2)(a). You give consent by connecting a heart rate monitor yourself, and you can withdraw it at any time by disconnecting it.
• Groups and live sharing: the contract with you — both are started only by an active action on your part.
• Demo application: your consent, GDPR Article 6(1)(a). You give consent by ticking the box in the form, and you can withdraw it at any time by asking us to delete the application.
• Security and protection against misuse (bot protection when signing in, and limiting the number of demo applications per IP address): legitimate interest, GDPR Article 6(1)(f).

5.Who the information is shared with

We never sell personal data, and we do not share it for marketing purposes. The following providers process data on our behalf (data processors):

• Supabase — database and sign-in (EEA, Stockholm).
• Vercel — delivery of the website. Content is delivered via a global CDN, which may mean that your IP address is processed outside the EEA. The transfer is safeguarded by the European Commission’s standard contractual clauses (SCCs).
• Cloudflare — bot protection (Turnstile) when signing in and registering.
• Google — only if you yourself choose to sign in with Google.
• Apple — only if you yourself choose to sign in with Apple.

In addition, you yourself share data in the following situations, all of them voluntary:

• Groups: the members of a group you join see your display name and your attempt figures on the group’s shared segments. Your rides are never shared automatically — you choose one ride at a time, from the ride itself. If you share a ride, the group sees a summary of it: date, distance, duration, watts, pedalling cadence, riding mode, battery use, elevation gain and the name of the bike. The rest of your ride log remains private, and you can withdraw the share at any time from the same place. The monthly competition additionally shows the group the totals of your rides per month — pedalling work, motor work, distance, elevation gain, time and number of rides — without individual rides, maps or heart rate. Participation is on from when you join, and can be turned off in the group settings; your figures are then removed from the leaderboard. What you share are the figures from the ride — never the map or the GPS track, which remains private in all cases.
• Friends: the person you become friends with – by one of you opening the other’s invitation – sees only the rides you yourself share. A shared ride is shown with date, distance, duration, speed, watts, pedalling cadence, riding mode, battery use, elevation gain and the name of the bike, together with your display name and profile picture, and with a map of the route with 500–1000 metres removed at each end (the length varies from ride to ride), so that the map does not show where you start or finish. Heart rate is never included, nor is the ride’s name. The weekly summary counts only shared rides. You share a ride from the ride itself or when you finish it, and you can withdraw the share at any time; it then disappears for your friends. Rides you do not share are seen by no one. Your friend code is shared only with those you yourself send it to; no one can search for you.
• Ride cards you share yourself: when you share a ride as an image, the image goes wherever you send it. It shows the route as a line without a map, and 500–1000 metres are removed at each end (the length varies from ride to ride), so that the image does not show where you live. In the app you always see your entire ride.
• The route base: all signed-in users can read the anonymous map of passes — this is how their route planner prefers roads people ride. No one can read which rides lie behind a figure.
• The motor statistics: are read only by us, for analysis and development of the app. They are anonymous: no one can read who or which ride a row came from — not even us.
• Condition report: if you create a condition report for a bike, anyone who has the link can see the information about the BIKE — odometer reading, battery health, charge cycles, the motor’s operating time, the battery’s own measurements (including internal resistance, self-discharge, time in extreme temperatures and when the battery was manufactured), motor and controller model, when it was registered in the app and the number of rides. The report contains nothing about you: no name, no email, no positions or ride details — nor what you have paid for servicing or your notes. The content is frozen when the report is created, the link lasts for 30 days, and you can close it at any time under Bike.
• Live sharing: anyone who has the link you share can see your position and ride data in real time until the share stops or expires. Share the link with care.

6.How long we store data

• Ride, bike and profile data: until you yourself delete them or delete the account.
• The route base and the motor statistics: indefinitely. Both are anonymous and fall outside the Norwegian Personal Data Act; a ride that is deleted is not withdrawn from them, because the figures cannot be linked to it.
• Live shares: a maximum of 12 hours, after which they are deleted automatically.
• Condition reports: 30 days from when you create them. You can close a report earlier, and it is deleted entirely when you delete the account.
• Demo applications: until the test period is over, or until you ask us to delete the application. The checksum of the IP address is deleted automatically when it is no longer needed for counting — no later than a couple of hours after the application.
• If you delete the account in the app, the account and all cloud data are removed immediately. If you request deletion by email, this takes place within 30 days. Residual data in rotating backups disappears shortly afterwards.
• Trolda is not included in Google’s backup of the Android phone, so no copy of your rides remains with Google after you have deleted the account. On iPhone, you yourself control whether the phone’s iCloud backup includes app data (Settings → [your name] → iCloud).

7.Your rights

Under the GDPR you have the right of access to, rectification of and erasure of your information, as well as the right to restriction, data portability and to object to processing. You can withdraw consents at any time. Contact us at support@trolda.com, and we will respond within one month.

You also have the right to lodge a complaint with Datatilsynet (the Norwegian Data Protection Authority) if you believe the processing breaches the regulations. If you live in another EU/EEA country, you can also lodge a complaint with the data protection authority in the country where you live or work, or where you believe the infringement took place (Article 77 GDPR).

8.How to delete data

• Individual rides, bikes and segments: are deleted directly in the app. The deletion also applies to the cloud copy.
• The entire account: go to Settings → Account → “Delete account” in the app (or at trolda.com/app after signing in). The account and all cloud data are deleted immediately. Note: groups you have created are then deleted for all members. The anonymous contribution to the route base and the motor statistics is retained — it contains nothing about you.
• Without access to the app: send an email to support@trolda.com from the address the account is registered to, and we will delete the account and all associated cloud data within 30 days.
• Local data: what is stored locally on your phone is removed by uninstalling the app. Account deletion does not affect the local data.

9.Age limit

You must be at least 13 years old to create an account in Trolda, in accordance with section 5 of the Norwegian Personal Data Act. If you live in another EU/EEA country, the age at which you can consent yourself to an online service in that country applies – for example 14 in Austria, Italy and Spain, 15 in France and 16 in Germany and the Netherlands. If you are younger than the limit where you live, you can use the app without an account; everything is then stored only locally on your phone.

10.Changes to this policy

If we make material changes to how we process personal data, we will notify you in the app or by email before the change takes effect. The date at the top shows when the policy was last updated.