Privacy Policy

1. Who we are

Trbo ("Trbo", "we", "us", "our") is an indoor cycling training application operated by Trbo of 301/19-21 Wilson St, Botany NSW 2019, Australia.

Contact us about privacy at help@trbo.bike.

This policy explains what personal information we collect, why, who we share it with, and what rights you have. It reflects the Australian Privacy Principles under the Privacy Act 1988 (Cth) and, where they apply to you, the EU and UK General Data Protection Regulation ("GDPR").

2. We do not store health or biometric data

This is the most important thing to know about Trbo, so we have put it first.

Trbo does not store your heart rate. If you pair a heart rate monitor, your heart rate is read directly from the strap to your device over Bluetooth, shown on screen while you ride, and then discarded. Bluetooth heart rate is never transmitted to our servers, never written to our database, and never sent to Strava or any other third party.

The only place your heart rate persists is inside the workout file (.tcx or .fit) that you choose to export to your own device. That file is generated in your browser and downloaded by you. We never receive a copy.

If you choose to import an outdoor ride from Strava, Strava may include heart-rate fields in its activity response even though Trbo does not need them. Our server removes those fields immediately. They are never returned to the app, logged, or stored. The imported Trbo record contains only the activity name, date, duration and the effort rating you choose.

We also do not collect: biometric identifiers, physiological measurements other than the transient heart rate described above, medical history, your weight, Apple Health / HealthKit data, Google Fit data, or your location.

We treat the training metrics we do store (power, FTP, Training Stress Score, calories, duration) as athletic performance data, not health information. They describe how hard you pedalled, not your physical condition.

3. What we do collect

3.1 Information you give us

• Account information. Your email address and a securely hashed password, or (if you sign in with Google) your email address, name and Google account identifier.
• Training profile. Your Functional Threshold Power (FTP), FTP history, training plan settings and workout preferences.
• Support correspondence. Anything you send us by email or in-app feedback, including any screenshots you attach and (if you report a training plan as wrong from the planner) a copy of that plan and the answers it was built from. Feedback you send from inside the app reaches us as an email to our support inbox, sent with your account email address so we can reply to you.

3.2 Information generated when you train

• Workout records. For each completed session: the workout name and category, duration, average and maximum power, Training Stress Score, estimated calories, whether you finished, and the date.
• Mini Games records. Personal bests are stored only in your browser on your device. They never reach our servers, and are lost if you clear your browser data.

3.3 Limited product events

To check whether activation and the planner are useful and understandable, Trbo records a short, fixed list of account-linked actions. These cover the first-ride setup steps, generating or changing a plan, starting or completing a planned workout, enabling plan reminders, and choosing to import an outdoor summary. A record may include the plan date, week, day, workout and training purpose needed to understand that action.

These are first-party product records stored in Supabase. We do not record general page views, every tap, free-text notes, device fingerprints, advertising identifiers, heart rate or health and wellness information in these events. They are used only to validate and improve activation and the planner, are available in your data export, and are automatically deleted after 180 days or when you delete your account, whichever happens first.

3.4 Device connections (Bluetooth)

Trbo talks to your smart trainer and heart rate monitor directly from your browser to the device. We never receive or store Bluetooth device identifiers. Your browser asks your permission before each connection. Power and cadence are processed on your device; only the summary metrics in 3.2 are saved.

3.5 Payments

Subscriptions are processed by Stripe. We never see or store your card number, CVC or expiry date. Stripe tells us only your customer ID, subscription status, plan and billing period, so we can unlock paid features. Stripe handles your card details as an independent controller under its own policy.

3.6 Strava

If you connect Strava, we store the access and refresh tokens it issues so we can upload your completed indoor workouts and, when you ask, fetch recent outdoor activities. Indoor uploads include the workout name, date, per-second power and cadence, duration and estimated calories, not heart rate. For an outdoor import, our server returns only the activity name, date, duration, distance, elevation and power summary to your device. If you import it, Trbo stores only the name, date, duration and the RPE you choose. We do not store the route, location or any Strava heart-rate field. Disconnect at any time and we delete the tokens.

3.7 Technical information

Our hosting providers automatically log IP address, browser and device type, pages requested and timestamps, for security and fault diagnosis.

We use no advertising cookies and no third-party advertising trackers. Browser storage is used only for essentials: keeping you signed in, remembering settings and Mini Games bests, and protecting unsynced changes until they reach your account.

4. Why we use it

We use your information to run your account; deliver workouts, Rides, Mini Games and training plans; control your trainer in ERG mode; calculate training metrics and show your history and progress; process subscriptions; upload to or import summaries from Strava when you ask; provide support; keep the Service secure; comply with the law; and validate and improve whether activation and the planner work as intended.

We do not sell your personal information. We do not use your data for advertising. We do not use it to train machine learning models.

Legal bases (EU/UK users)

We do not store heart rate or any other health or biometric data. A Strava activity response may briefly contain heart-rate fields before our server removes them as described in section 2. That import happens only after you connect Strava and deliberately request recent outdoor rides.

5. Automated decisions

Trbo generates workout suggestions, training plans and FTP estimates automatically from your training history. These are recommendations only. They produce no legal effect and no similarly significant effect on you, you are free to ignore them, and no human profiling, scoring or eligibility decision is made about you. You may request a human explanation of any suggestion by emailing us.

6. Who we share it with

We may also disclose information where required by law, to enforce our Terms, or to protect the safety of our users or the public. If Trbo is sold or merged, your information may transfer to the acquirer, who will remain bound by this policy or one at least as protective; we will tell you first.

7. Overseas transfers

We operate from Australia. Our providers store and process data overseas, primarily in the United States. For transfers of EU and UK personal data we rely on Standard Contractual Clauses incorporated into our data processing agreements with each provider. For Australian users, we take reasonable steps under APP 8 to ensure overseas recipients handle your information consistently with the Australian Privacy Principles.

8. How long we keep it

• Account and training data: while your account is open; deleted within 30 days of you deleting your account, and purged from backups within 90 days.
• Billing records: as required by Australian tax law, generally 7 years.
• Strava tokens: until you disconnect.
• Planner product events: up to 180 days, or until you delete your account.
• Technical logs: a short retention period set by our providers.
• Heart rate: never retained. Strava heart-rate fields are discarded immediately during an import response.

You can clear your ride history, clear your FTP test history, delete custom workouts and saved queues, and disconnect Strava at any time, without deleting your account. See Delete your account for the full picture.

9. Security

We use HTTPS/TLS in transit, encryption at rest, row-level security so you can only ever read and write your own records, and hashed passwords managed by our authentication provider. Card details never touch our servers.

No system is perfectly secure. If a data breach is likely to cause you serious harm, we will notify you and the Office of the Australian Information Commissioner under the Notifiable Data Breaches scheme, and, where the GDPR applies, the relevant supervisory authority within 72 hours.

10. Your rights

Wherever you live, you can access your information, correct it, export your workouts as TCX or FIT, delete your account and its data, withdraw consent to Strava, and complain to us.

If you are in the EU or UK, you additionally have the rights to data portability, to object to or restrict processing, and to lodge a complaint with your local supervisory authority.

If you are in Australia, you may complain to the Office of the Australian Information Commissioner at oaic.gov.au.

If you are in California, we confirm we do not sell or share your personal information, and we will not discriminate against you for exercising any privacy right.

Email help@trbo.bike to exercise any right. We respond within 30 days.

11. Children

You must be at least 16 years old to use Trbo. We do not knowingly collect information from anyone under 16. If you believe a child has given us their information, contact us and we will delete it.

12. Changes

We may update this policy. If a change is material, we will notify you in the app or by email before it takes effect. The version and date at the top always reflect the current text.

13. Contact

Trbo
Email: help@trbo.bike
Address: 301/19-21 Wilson St, Botany NSW 2019