Trivo privacy policy

What Trivo keeps about you, why, who else handles it, and what you can do about it. In plain words; if anything is unclear, write to privacy@jointrivo.com.

Last changed

2026-10-30

Status

Draft the operator's, before a lawyer's read

Panreon s.r.o. runs Trivo and decides what happens to your data: the controller, in the GDPR's words.

Name

Panreon s.r.o.

Address

Kafkova 1133/10, Moravská Ostrava, 702 00 Ostrava, Czechia

Company ID

IČO 10733787

Register

Entered in the Commercial Register kept by the Regional Court in Ostrava, section C, insert 85380

Email

privacy@jointrivo.com

• Your login: your email address, your passkeys, your sessions

  Why

  To sign you in, and to send you codes

  Basis

  Contract

• Your identities: handle, display name, date of birth

  Why

  How others see you. The date of birth is never shown: it only decides whether you're a minor, and the coach's adult age

  Basis

  Contract

• Clubs, teams and families you're in, activities you post or go to, races you say you're running, routes you upload

  Why

  That's what Trivo is

  Basis

  Contract

• Messages, threads, friends, friend and message requests, blocks

  Why

  To talk to the people you run with

  Basis

  Contract

• Your log: workouts, tracks, times, heart rate and power

  Why

  Your own training record

  Basis

  Explicit consent (the log's agreement)

• A device account you connect (Garmin): its user id there, the tokens it gives (encrypted), what you let it share, and the recordings it sends

  Why

  So your watch's recordings arrive in your log by themselves

  Basis

  Explicit consent (yours at Garmin, and the log's agreement)

• Anonymous statistics from your log: averages of heart rate by pace and by age, over groups of five people or more

  Why

  So the people who run Trivo see how members train; and a club, team or organization you choose sees its sharing members' together

  Basis

  Explicit consent (the log's agreement says so); a club's only once you switch it on, on its page

• The coach: a summary of your training, sent to the model provider

  Why

  So the coach can plan your weeks and answer you

  Basis

  Consent (the coach's agreement)

• A child's handle, name and date of birth

  Why

  So a guardian can add a child to their family

  Basis

  The guardian's consent

• Moderation: limits, reports, the classifier reading posts and names, restrictions

  Why

  To keep spam and abuse out with one person reviewing

  Basis

  Legitimate interest

• Notifications in the app, and emails (codes, invitations, notices)

  Why

  To tell you what happened

  Basis

  Contract

• Security records: rate limits by IP address, who acted for whom

  Why

  To keep accounts safe and know who did what

  Basis

  Legitimate interest

Nothing is collected for advertising, and nothing is sold. There is no marketing email.

Contract

What Trivo needs to do what you signed up for: your login, your identities, your groups, chats and friends.

Consent

What you agreed to and can take back at any time: your log's health data, the coach, a child's identity (the guardian's).

Legitimate interest

What keeps the place usable and safe, weighed against your interests: limits, reports, the spam classifier, security records.

Legal obligation

What the law makes Trivo keep: the record that consent was given, after the person is gone.

• Linode (Akamai Connected Cloud), on a server in the European Union

  Runs the app and its job worker, and keeps the database, the files you upload (GPX, TCX and FIT) and its server logs on that server.

• Mailgun (Sinch), in its EU region

  Sends the emails: codes, invitations, notices and the notifications you switched on. It keeps the addresses, when each email went and what became of it, and tells us when an address bounces or marks an email as spam, so we stop writing to it. It doesn't track opens or clicks.

• Anthropic, the model provider

  Reads text to spot spam (posts, names, a stranger's first message, a child's messages included), reads organizers' race pages, and runs the coach for those who switch it on. Under its commercial terms, which don't let it train on what it's sent.

• Cloudflare

  Stands in front of the app: encryption in transit (TLS) and limits on how often one address may ask for codes.

Some of these are US companies, so data leaves the EU: under the EU–US Data Privacy Framework or the European Commission's standard contractual clauses. TODO: confirm each processor's safeguard Each handles data only on the operator's instructions, under a data processing agreement.

Garmin, when you connect your Garmin account on your log's Devices page, sends Trivo each recording your watch syncs there, from then on. It's a source you choose, not a processor of Trivo's: what Garmin keeps about you is under Garmin's own privacy policy, and what you share with Trivo is yours to choose at Garmin.

Disconnect on the same page, taking the log's agreement back, and deleting your account each remove Trivo's access at Garmin; the workouts that arrived stay in your log until you delete them. Trivo never sends Garmin anything about you but what connecting and disconnecting need.

• What you made: posts, activities, routes, groups

  How long

  Until you delete it or your account

• A copy of your data you asked for

  How long

  7 days, then the file and its record

• Your account, once you ask to delete it

  How long

  14 days, in which nobody can sign in and you can cancel; then erased, keeping only the record that it was asked and done

• Your workouts and their files

  How long

  Until you delete them, or take the log's agreement back

• A device account you connected

  How long

  Its tokens until you disconnect it (or take the log's agreement back); the record of the connection until your account is erased

• What a device platform sent (its deliveries, not the workouts they made)

  How long

  30 days once done; 90 if one failed

• What the email provider reported back (a bounce, a complaint, a delivery)

  How long

  30 days once done; 90 if one failed

• An address that said “Don't email me again”, bounced or complained

  How long

  Until its owner says “Email me again”, so nothing reaches it meanwhile

• Notifications

  How long

  12 months

• Logins never verified

  How long

  30 days

• A login made for a handover that never added a passkey

  How long

  7 days

• A login that never made an identity, with the age it gave

  How long

  12 months (for a minor, from the last invitation to a guardian)

• Background jobs (including email sends)

  How long

  30 days

• Rate-limit counters

  How long

  A day

• A declined message request's messages

  How long

  12 months

• Model usage (tokens and cost, never the text)

  How long

  24 months

• Server logs and backups

  How long

  30 days; backups encrypted

• Consent records, and the record of who did what (ids only)

  How long

  Kept, as proof; the person is anonymised when erased

A daily clean-up applies these limits.

You can ask to see what Trivo keeps about you, have it corrected, have it deleted, take a copy, limit or object to what's done with it.

In the app

Edit your identities and what you posted; delete workouts; take the log's agreement back on your log; switch the coach off on your profile; make the coach forget a note; a guardian deletes a child from the family page. On your account page, take a copy of everything about your login and its identities (a zip of JSON files and your uploads, once a day, kept 7 days), and delete your whole account, after a grace of 14 days in which you can cancel. What you ask there is answered by email even if you said “Don't email me again”.

By email

Everything else: write to privacy@jointrivo.com from your login's address.

Complaints

To the operator first, and always to the Czech data protection authority, ÚOOÚ (uoou.gov.cz), or your own country's.

Nothing here decides about you on its own with legal effect. The spam classifier only flags for a person to decide, limits only say “not so fast”, and three declined requests in a week pause your friend and message requests for a week, which the operator lifts on request.

Under 16, a person can't sign up on their own: a guardian adds them to their family, with the guardian's consent, and acts for them. Nothing more is collected about a child than a handle, a name and a date of birth: no email, no photo, no address. A child's own sign-in only reads.

A child is seen only by the people in their groups, and talks privately only with their guardians. In a family living in the US, a child under 13 posts nowhere but to their guardians and appears in no list a stranger reads; their guardian gets an email confirming the consent, with a link to revoke it.

A guardian reviews everything by acting as the child, and deletes the child from the family page at any time: the consent is withdrawn and their details erased.

Heart rate and power count as health data. Trivo keeps them only with your explicit agreement, asked before your first upload, and shows them to nobody but you. Taking the agreement back deletes every workout from a file and every heart rate you typed in.

The same agreement says anonymous statistics are made from your log: averages over five people or more, never you alone, and nobody under 18. The people who run Trivo see them for everyone who agreed to its current text; a club, team or organization sees its own only for the members who switched “Count my training” on, on its page, and you can switch it off there at any time.

The coach, if you switch it on, sends Anthropic a summary of your training (numbers, never your recordings) and isn't for anyone under 18.

Only the ones the app needs to work, so there's no cookie banner:

Session

better-auth.session_token: that you're signed in.

Identity

active_identity: which of your identities you act as.

Flash

flash: what your last action did, cleared once shown.

Language

locale and units: the language you read Trivo in and how it shows distances, for a year, signed out too; signed in, they follow your login's choice.

No analytics, no advertising, no tracking across sites.

This page last changed on 2026-10-30. A change that matters is announced in the app, and the agreements it affects are asked again. Earlier versions are kept with the code.

These pages, at panreon.cz and jointrivo.com, set no cookies, run no script but their own and load nothing from anywhere else; Cloudflare serves them. Your choice of Day or Night is kept in your browser's own storage and nowhere else, and nothing is sent.