Privacy policy

You have the right to object to us showing your results (GDPR Article 21). Write to hei@trisonen.no. We offer two options:

• Anonymisation. The name is replaced with «N.N.», the year of birth, profile photo, bio and profile address are removed, and the profile disappears from search, athlete lists, result lists and rankings. The results remain without a name and still count in aggregate statistics and the clubs' points. New results under the same name end up on the same hidden profile.
• Deletion. The athlete profile and all results are deleted. We keep only a one-way code (hash) of the name, not the name itself, so the name is not added again at the next import. If the name appears in a new result list, the row is not imported.

Both are permanent. The organiser's own result list is outside our control; if you want to be removed there, contact the organiser.

What we store: email address, name, password (stored as a cryptographic hash at Supabase; we never see it), your answer to the age question at sign-up, which of the sites you signed up on, language choice and sign-in times.

Legal basis: contract, GDPR Article 6(1)(b): we need the data to give you the account.

Retention: until you delete the account. We do not delete accounts automatically when they are not used; the account is kept until you delete it.

If you ask to link your account to an athlete profile, we store the request: email, name, the profile or profiles concerned and any message. We review every request by hand and may contact you if the name and email do not match. Once the profile is linked, you can add a photo, bio, club and year of birth. What you add is shown publicly on the profile. If you delete the account, the photo, bio and club are deleted, and the year of birth if you entered it yourself, and the profile is released.

Legal basis: contract (point b).

• Athletes, clubs and races you follow, and the notifications you have turned on.
• The season plan: the races and distances you add are shown on your athlete profile. Priority, target time and note are private and visible only to you. The whole plan is deleted when you delete the account.
• Predictions: your picks and points. The account name is shown on the predictions leaderboard.
• My statistics and the season card, which are calculated from the results on your profile.

Legal basis: contract (point b).

Retention: until you remove it yourself or delete the account.

If you turn on notifications in the browser, we store the subscription the browser gives us (an address at the browser's push service and two keys). In the app we store a push token from Expo and whether the phone is iOS or Android. We also store your notification settings and a log of notifications sent, so you do not get the same notification twice.

Legal basis: consent, GDPR Article 6(1)(a).

Retention: until you turn off notifications, delete the account or the service reports that the token no longer works.

What you write in the contact form (name, email and message) is sent as an email to hei@trisonen.no. It is not stored in our database. Email to us is kept in our mailbox for as long as we need it to follow up the matter.

Legal basis: legitimate interest in answering you (point f).

Cases you open under support or suggestions are stored with subject, messages and times, linked to your account. They are deleted when you delete the account.

Legal basis: contract (point b).

If you use «Report an error», we store the message, the page it concerns and your email address if you give it. The legal basis is legitimate interest in fixing errors (point f).

If you sign up for the newsletter, we store the email address and when you signed up and confirmed. You get an email with a link you must tap before we send anything. Every newsletter has a link to unsubscribe.

Legal basis: consent (point a). You can withdraw it at any time.

Retention: until you unsubscribe. We then mark the address as unsubscribed, so we send no more letters and do not sign you up again without a new confirmation. If you want the address deleted entirely, tell us.

If you choose «Accept all» in the cookie banner, we use Vercel Analytics for visitor statistics and Vercel Speed Insights to measure how fast pages load. If you choose «Necessary only», or do not answer, neither is loaded. They set no cookies, but record which pages are viewed, country, browser and device type, and use a short-lived, hashed identifier made from IP address and browser, not the IP address itself. The legal basis is your consent (point a), which you can withdraw at any time (see section 10).

We count how often an athlete profile is viewed. To count one view per visitor per day we store a salted hash of IP address and browser type together with the date, never the IP address itself. The hash is deleted automatically after 400 days. This happens on the server and stores nothing on your device. Article views are counted only if you have chosen «Accept all», with a cookie that lasts 30 minutes so the same visit is not counted more than once (see section 10). In the app an article view is counted only if you have chosen «Accept statistics», and without storing anything on the phone for it.

The ads on TriSonen are sold directly by us. We use no ad networks, no advertising cookies and build no profile of you. If you have chosen «Accept all», we count views and clicks per ad per day as plain numbers, and clicks are also sent as an event to Vercel Analytics. Without consent nothing is counted on the website. The app counts views and clicks per ad the same way, but only if you have chosen «Accept statistics» in the app, and without storing anything on the phone for it. Advertisers get only these numbers.

When you use the service, our providers log technical data such as IP address, time and the address requested. We use it to keep the service running, find errors and stop abuse. To limit the number of requests we store a hash of the IP address for a short period. The legal basis is legitimate interest (point f). The logs are deleted under the providers' fixed routines.

• Sign-in (cookies whose names start with «sb-»): keeps you signed in. Set when you sign in, removed when you sign out, and otherwise lasts up to 400 days.
• trisonen_lang: the language you chose in the menu. Lasts 365 days.
• trisonen_translate_preview: only for volunteer translators previewing a translation.
• In the browser's local storage: your answer to the cookie banner, accessibility settings such as text size and contrast, your shopping cart in the shop, which country site you chose, and whether you have dismissed the prompt to install TriSonen as an app or to turn on notifications.

• Vercel Analytics and Vercel Speed Insights (see section 6). The scripts are not loaded without consent.
• Counting of views and clicks on ads and training camps (see section 6).
• av_*: a cookie that stops the same article from being counted more than once when you reload the page. Lasts 30 minutes and contains no personal data.
• In the browser's local storage: athletes and races you have looked at recently, when you last opened the activity feed (to show whether there is something new), and your delivery details in the shop, for the next time you buy.

You can change your choice at any time with the button below or the «Cookie settings» link at the bottom of every page. If you choose «Necessary only», the statistics and counting stop at once, and what was stored with consent is deleted from your browser.

Cookie settings

What is stored stays in your browser. You can also delete it at any time in the browser settings. The website may also keep pages and files in the browser cache so it opens faster and works offline.

The app keeps your sign-in in the phone's secure storage and remembers settings, language, the season plan, which news you have seen and the delivery details in the shop, locally on the phone. The first time you use the app, it asks whether you want to «Accept statistics» or choose «Necessary only». Only with «Accept statistics» does the app count article views and ad views and clicks, as plain numbers and without storing anything on the phone for it; the ads are shown either way. The choice is stored on the phone, and you can change it at any time under Settings → Privacy or in About the app. The choice covers article views and ads: athlete profile views are also counted in the app on the server, without consent and without storing anything on the phone, exactly as on the website (see «Views of athlete profiles and articles» above).