Privacy Policy

Last updated: 30 September 2026

This is a translation of the Norwegian original. If the versions differ, the Norwegian version applies.

Trolda is a Norwegian e-bike app that logs your rides. This policy explains what personal data we process, why we do so, where it is stored and what rights you have.

1.Data controller

Trolda is the data controller for the information described here. If you have questions about privacy, contact us at support@trolda.com.

2.What information we process

• Account: your email address and a password (stored encrypted). If you choose “Continue with Google”, we receive your name, email address and, where applicable, profile picture from your Google account. If you choose “Continue with Apple”, we receive only your email address — not your name or profile picture — and if you choose “Hide My Email” with Apple, what we receive is a forwarding address, not your own.
• Profile: a display name and profile picture that you yourself choose to add (optional).
• Ride data: GPS positions (approximately every 5 seconds during an active ride), time, speed, distance and elevation. Tracking only takes place while a ride has been started.
• Sensor data: if you connect the bike or a heart rate monitor via Bluetooth, measurements are logged such as watts (your own effort and motor), pedal strokes per minute, torque, battery level and battery health, odometer reading and riding mode. The device’s Bluetooth ID is stored so that the app can connect automatically next time, and the bike’s own type plate (manufacturer, model, firmware and hardware version) is read on connection — never the serial number.
• Heart rate: your heart rate is health data. It is only processed if you yourself actively connect a heart rate monitor — we regard that as your explicit consent. You can disconnect the monitor and delete rides with heart rate data at any time.
• Bike and maintenance: information you register about your bikes and their maintenance.
• Segments and groups: segments you create yourself, your attempt times and attempt watts, and — if you join a group — your display name, your attempt figures on the group’s shared segments, the summary of the rides you yourself choose to share, and — for as long as you take part in the group’s monthly competition — the totals of your rides per month (pedalling work, motor work, distance, elevation gain, time and number of rides).
• Friends: your friend code, who you are friends with, and the rides you yourself choose to share with your friends: the figures from the ride (date and start time, distance, time, speed, watts, energy, battery use, riding mode and the bike’s name) and a simplified map of the route with 500–1000 metres removed at each end. Never heart rate, never the ride’s name, and rides you do not share are not shown.
• Public ride link: if you yourself choose to share a ride as a public link (trolda.com/ride/…), a copy of the ride as it was when you shared it is stored: date (not time of day), distance, moving time, speed, elevation gain, watts (your own effort and motor), pedal strokes per minute, energy, battery level at start and finish, distance per riding mode, whether the watt figures were measured by the bike, the name of the motor system (only for systems Trolda shows publicly), the route as a line with 500–1000 metres removed at each end, and the elevation profile along the clipped route. Never heart rate, never the ride’s name, never your name or your account. The link contains a random 10-character code — not the ID of the ride or of you.
• Invitations and referrals: your invitation links (trolda.com/invite/… for friends, trolda.com/group/… for groups) show your first name — the first word of your display name — or the group’s name and number of members. If someone creates a new account after opening such an invitation, a public ride link or a campaign link (for example a QR code or an advertisement), we store who or what they came through, and when: the new account, the account that invited them (if any), the type (friend, group, ride or campaign), the group, the campaign name and the time. This is stored only for accounts created within the last 30 days, and only once per account. The person who invited can see which accounts they brought in.
• The route base: your rides are counted into a shared, anonymous map of where Trolda users ride, which the route planner uses to prefer roads people actually use. What is stored is the number of passes per grid cell of approximately 28 metres — not who rode, not when, and never entire rides or GPS tracks. Before a ride is counted, 500–1000 metres are removed at each end of it (the length varies from ride to ride), so that the map does not lead to where you start or finish. The figures cannot be traced back to you. You are asked once whether you want to contribute, and nothing is counted until you have said yes. Only rides you take after saying yes are counted. You can change this at any time under Profile → Privacy and sharing; if you say no, no new rides are counted.
• The motor statistics: the figures from the motor on your rides are kept in an anonymous dataset used to understand how different motor systems actually behave — motor watts against your own effort per riding mode, battery use against elevation gain, battery health against charge cycles. For each ride, the following is stored: motor system, motor and controller model, the type plate (manufacturer, model, firmware and hardware version), distance, time, speed, elevation gain, watts, pedal strokes per minute, torque, riding mode and battery figures, as well as a time series of the same measurements with seconds from the start of the ride, distance covered and elevation relative to the starting point. Your weight is rounded to the nearest 5 kg and the bike’s odometer reading to the nearest 500 km, because the watt figures could not otherwise be compared. What is not stored: who you are, GPS positions or maps, date and time of day (only the month), the ride’s name, the bike’s name or Bluetooth ID, and never heart rate. The rows are given a new random ID and cannot be traced back to you or to the ride. You are asked once whether you want to contribute, and nothing is counted until you have said yes. Only rides you take after saying yes are counted. You always see your own motor figures. You can change this at any time under Profile → Privacy and sharing; if you say no, no new rides are counted.
• Live sharing (“Follow me”): if you start a share, your position, a simplified track of the ride, speed, distance and the bike’s battery level are processed for as long as the share is active.
• Demo application: if you apply to test the app through the demo form, we store the email address you provide and which platform you chose (Android or iPhone). To limit misuse of the form, we also store a cryptographic checksum of your IP address — not the address itself, and the checksum cannot be reversed to an IP. You can also state which motor system your bike has, and we store which campaign you came from, if any (for example a QR code or an advertisement).
• Anonymous measurement: the website and the app count anonymous events, such as a page being viewed, the result of a compatibility search (the answer — never what you typed), a download click, the app being opened, a sign-up being started or completed, a ride being shared, an invitation being created or used, and a first ride being started or completed. Each event is stored only with coarse properties: platform, page type, language, country derived from the language setting on the device (not from the IP address or location), campaign or source, and motor system. We use no cookies and no browser storage for this, and store no user ID, device ID or IP address, so the events cannot be linked to you. If your browser sends the Global Privacy Control or “Do Not Track” signal, nothing is sent.
• Technical: when you sign in and register, the form is protected by Cloudflare Turnstile (bot protection), which processes your IP address. The website is delivered by Vercel, which keeps ordinary server logs. The website and the app contain no advertisements, no cookies for measurement or tracking, and no third-party analytics or tracking tools.

3.Where the data is stored

Trolda is built “offline-first”: your rides, bikes and measurements are stored primarily in a local database on your own device. They do not leave the phone until you sign in.

If you sign in, the data is backed up to our cloud provider Supabase in the region eu-north-1 (Stockholm, Sweden) — that is, within the EEA. The cloud copy is protected by row-level access control: only your own account can read your rows.

Live shares are stored only in the cloud, and the row is deleted automatically no later than 12 hours after the share started — even if you forget to stop it.

Public ride links, referral information and the anonymous measurement are stored only in the cloud, with Supabase in Stockholm. We use no external analytics provider.

4.Purpose and legal basis

• Providing the service (ride log, statistics, backup and synchronisation between your devices): the contract with you, GDPR Article 6(1)(b).
• Heart rate measurement (health data): your explicit consent, GDPR Article 9(2)(a). You give consent by connecting a heart rate monitor yourself, and you can withdraw it at any time by disconnecting it.
• Groups and live sharing: the contract with you — both are started only by an active action on your part.
• Demo application: your consent, GDPR Article 6(1)(a). You give consent by ticking the box in the form, and you can withdraw it at any time by asking us to delete the application.
• Security and protection against misuse (bot protection when signing in, and limiting the number of demo applications per IP address): legitimate interest, GDPR Article 6(1)(f).
• Public ride link: the contract with you, GDPR Article 6(1)(b) — the link is created only when you yourself choose to share a ride.
• Invitations and referrals: legitimate interest, GDPR Article 6(1)(f) — understanding how Trolda spreads, and possibly rewarding those who invite others later on. The information is limited, and you can object or ask us to delete it.
• Anonymous measurement: legitimate interest, GDPR Article 6(1)(f) — understanding which pages and features work, without identifying anyone. The events contain no identifier, and are not sent when the browser asks not to be tracked (Global Privacy Control or “Do Not Track”).

5.Who the information is shared with

We never sell personal data, and we do not share it for marketing purposes. The following providers process data on our behalf (data processors):

• Supabase — database and sign-in (EEA, Stockholm).
• Vercel — delivery of the website. Content is delivered via a global CDN, which may mean that your IP address is processed outside the EEA. The transfer is safeguarded by the European Commission’s standard contractual clauses (SCCs).
• Cloudflare — bot protection (Turnstile) when signing in and registering.
• Google — only if you yourself choose to sign in with Google.
• Apple — only if you yourself choose to sign in with Apple.

The app also looks up data in the following services. None of them receives your name, account or ride data from us, but as with any request on the internet they see the IP address your phone uses:

• Kartverket (the Norwegian Mapping Authority) — when you open a ride, the app fetches the elevation along the route from Kartverket’s terrain model, so the elevation gain and the climbs on the ride are correct. The lookup sends only the points along the ride, rounded to the nearest metre — no name, account, time or other ride data — and happens once per ride on each phone. As with any request on the internet, Kartverket sees the IP address your phone uses. Without a connection, and for rides that mainly take place outside Norway, nothing is sent — the phone’s own GPS elevation is used instead.
• The map — the map in the app is fetched as map images: from Kartverket (the Norwegian Mapping Authority, Norway) when you look at an area in Norway, otherwise from Thunderforest (Gravitystorm Limited, United Kingdom), and from OpenStreetMap (OpenStreetMap Foundation, United Kingdom) if you choose the standard map. The service sees which part of the map your phone asks for, that is, the area you are looking at, but not your track or who you are.
• The route planner — when you search for an address or tap a point on the map, the search text or the point is sent to Kartverket, and to OpenStreetMap’s search service Nominatim for places outside Norway or that Kartverket does not find. When you ask for a route, the start and destination points are sent to a routing service: openrouteservice (HeiGIT, Germany) or BRouter (brouter.de, Germany). If you do not use the route planner, nothing is sent there.

In addition, you yourself share data in the following situations, all of them voluntary:

• Groups: the members of a group you join see your display name and your attempt figures on the group’s shared segments. If you share a segment in a group, the members see the segment’s track on the map. The app asks before it shares, and tells you if the segment is close to where your ride started or ended. Your rides are never shared automatically — you choose one ride at a time, from the ride itself. If you share a ride, the group sees a summary of it: date, distance, duration, watts, pedalling cadence, riding mode, battery use, elevation gain and the name of the bike. The rest of your ride log remains private, and you can withdraw the share at any time from the same place. The monthly competition additionally shows the group the totals of your rides per month — pedalling work, motor work, distance, elevation gain, time and number of rides — without individual rides, maps or heart rate. Participation is on from when you join, and can be turned off in the group settings; your figures are then removed from the leaderboard. What you share are the figures from the ride — never the map or the GPS track, which remains private in all cases.
• Friends: the person you become friends with – by one of you opening the other’s invitation – sees only the rides you yourself share. A shared ride is shown with date and start time, distance, duration, speed, watts, pedalling cadence, riding mode, battery use, elevation gain and the name of the bike, together with your display name and profile picture, and with a map of the route with 500–1000 metres removed at each end (the length varies from ride to ride), so that the map does not show where you start or finish. Heart rate is never included, nor is the ride’s name. The weekly summary counts only shared rides. You share a ride from the ride itself or when you finish it, and you can withdraw the share at any time; it then disappears for your friends. Rides you do not share are seen by no one. Your friend code is shared only with those you yourself send it to; no one can search for you.
• Ride cards you share yourself: when you share a ride as an image, the image goes wherever you send it. It shows the route as a line without a map, and 500–1000 metres are removed at each end (the length varies from ride to ride), so that the image does not show where you live. In the app you always see your entire ride.
• The route base: when you plan a route, the app looks up the number of passes in the cells along the routes it is considering. No one can download the whole map, and no one can read which rides lie behind a figure.
• The motor statistics: are read only by us, for analysis and development of the app. They are anonymous: no one can read who or which ride a row came from — not even us.
• Condition report: if you create a condition report for a bike, anyone who has the link can see the information about the BIKE — odometer reading, battery health, charge cycles, the motor’s operating time, the battery’s own measurements (including internal resistance, self-discharge, time in extreme temperatures and when the battery was manufactured), motor and controller model, when it was registered in the app and the number of rides. The report contains nothing about you: no name, no email, no positions or ride details — nor what you have paid for servicing or your notes. The content is frozen when the report is created, the link lasts for 30 days, and you can close it at any time under Bike.
• Live sharing: anyone who has the link you share can see your position and ride data in real time until the share stops or expires. Share the link with care.
• Public ride link: anyone who has the link can see the ride without an account — what is listed under section 2, with the route clipped by 500–1000 metres at each end. The page is marked so that search engines should not include it (noindex), but whoever has the link can pass it on. If you stop sharing, the link stops working immediately.
• Invitations: anyone who has your invitation link sees your first name (the first word of your display name); a group invitation shows the group’s name and number of members. If someone joins through your link, you can see that their account came through you.
• Anonymous measurement: is read only by us, and is kept with Supabase in Stockholm like the rest of the data. No external analytics provider has access.

6.How long we store data

• Ride, bike and profile data: until you yourself delete them or delete the account.
• The route base and the motor statistics: indefinitely. Both are anonymous and fall outside the Norwegian Personal Data Act; a ride that is deleted is not withdrawn from them, because the figures cannot be linked to it.
• Live shares: a maximum of 12 hours, after which they are deleted automatically.
• Condition reports: 30 days from when you create them. You can close a report earlier, and it is deleted entirely when you delete the account.
• Demo applications: until the test period is over, or until you ask us to delete the application. The checksum of the IP address is deleted automatically when it is no longer needed for counting — no later than a couple of hours after the application.
• Public ride links: until you stop sharing, delete the ride or delete the account.
• Referral information: until you delete the account. If the person who invited you deletes their account, the link to them is removed.
• Anonymous measurement: 400 days, after which the events are deleted automatically.
• If you delete the account in the app, the account and all cloud data are removed immediately. If you request deletion by email, this takes place within 30 days. Residual data in rotating backups disappears shortly afterwards.
• Trolda is not included in Google’s backup of the Android phone, so no copy of your rides remains with Google after you have deleted the account. On iPhone, you yourself control whether the phone’s iCloud backup includes app data (Settings → [your name] → iCloud).
• If you move to a new Android phone using direct transfer between the phones (cable or Wi-Fi, Android 12 and later), your rides and your sign-in come along to the new phone. The transfer goes between your own devices, and neither Trolda nor Google receives a copy. Delete the app from the old phone before you pass it on.

7.Your rights

Under the GDPR you have the right of access to, rectification of and erasure of your information, as well as the right to restriction, data portability and to object to processing. You can withdraw consents at any time. Contact us at support@trolda.com, and we will respond within one month.

You also have the right to lodge a complaint with Datatilsynet (the Norwegian Data Protection Authority) if you believe the processing breaches the regulations. If you live in another EU/EEA country, you can also lodge a complaint with the data protection authority in the country where you live or work, or where you believe the infringement took place (Article 77 GDPR). If you live in Switzerland, the Swiss Federal Act on Data Protection (FADP) also protects you, and you can lodge a complaint with the Federal Data Protection and Information Commissioner (FDPIC).

8.How to delete data

• Individual rides, bikes and segments: are deleted directly in the app. The deletion also applies to the cloud copy.
• Public ride link: stop sharing from the ride in the app; the link stops working immediately. If you delete the ride, the link is deleted too.
• The entire account: go to Settings → Account → “Delete account” in the app (or at trolda.com/app after signing in). The account and all cloud data are deleted immediately. Note: groups you have created are then deleted for all members. Public ride links and the information about who invited you are also deleted. The anonymous contribution to the route base and the motor statistics, and the anonymous measurement events, are retained — they contain nothing about you.
• Without access to the app: send an email to support@trolda.com from the address the account is registered to, and we will delete the account and all associated cloud data within 30 days.
• Local data: what is stored locally on your phone is removed by uninstalling the app. Account deletion does not affect the local data.

9.Age limit

You must be at least 13 years old to create an account in Trolda, in accordance with section 5 of the Norwegian Personal Data Act. If you live in another EU/EEA country, the age at which you can consent yourself to an online service in that country applies – for example 14 in Austria, Italy and Spain, 15 in France and 16 in Germany and the Netherlands. If you are younger than the limit where you live, you can use the app without an account; everything is then stored only locally on your phone.

10.Changes to this policy

If we make material changes to how we process personal data, we will notify you in the app or by email before the change takes effect. The date at the top shows when the policy was last updated.