Last updated: 26 October 2026
We respect your privacy and are committed to protecting it. This policy explains how Strōq, operated by Atropical AS, handles your information.
We collect minimal information:
We use your information to:
We use trusted third-party services for analytics and website functionality. These services are required to protect your information and use it only for the services they provide.
Accounts and their workouts are stored with Neon (Databricks, Inc.), which provides our database and sign-in service. Data is stored in the European Union (Frankfurt, Germany). Neon processes it only on our behalf, under a data processing agreement.
So the free signup credits go once per mailbox, we keep a one-way SHA-256 hash of your email address in its standard form (lower case, without a +tag, and for Gmail without dots). The hash is not your address and is kept after an account is deleted, only to stop the free credits being claimed again.
Credit purchases are handled by Stripe Payments Europe, Ltd. Stripe collects your card details and the information needed to process the payment and prevent fraud, as an independent controller under its own privacy policy. We receive the payment's status, amount and date, never your card number.
Emails from Strōq (sign-in codes, purchase confirmations and credit expiry reminders) are sent through Lettermint B.V., an email delivery service in the Netherlands that keeps data in the EU. Lettermint processes your email address and the content of these emails only to deliver them, as our processor. For more information, see the Lettermint privacy policy.
If you connect Strava in your account, Strōq stores your Strava athlete id and name and the access tokens Strava issues (encrypted). Strōq only asks to upload activities. A workout goes to Strava only when you post it, or after each workout if you turn on automatic posting: its summary and samples (distance, pace or speed, power, cadence and heart rate) are sent as a .FIT file. Once posted, the activity is handled by Strava, Inc. under its own privacy policy and stays on Strava until you delete it there. Disconnecting Strava, or deleting your account, revokes the access and deletes the tokens. The connection is set up through Recce (api.recce.bike), a sister app by Atropical AS that shares the Strava app registration; it passes the authorisation back to Strōq and keeps none of your Strava data.
A session host can add a YouTube or Twitch link, and you can paste one for your own workouts. Strōq then shows that service's player inside the app. Strōq keeps only the video's id (with the session, or on your device), never your viewing. The player loads from YouTube (Google, in its privacy-enhanced mode, youtube-nocookie.com) or Twitch (Twitch Interactive, Inc.), which receive your IP address and browser details and may set their own cookies or storage under their privacy policies (Google, Twitch). Nothing loads from them unless a video is set.
If you choose "Continue with Google", Google shares your name, email address and Google account ID with us so you can sign in. We receive no other Google data.
For web analytics we use Pirsch Analytics, run by Emvi Software GmbH in Germany and hosted by Hetzner in Germany, under a data processing agreement. Pirsch sets no cookies and stores nothing on your device. We rely on our legitimate interest in knowing how the site and app are used (GDPR Article 6(1)(f)). You can opt out at any time with the button below.
With each page view Pirsch receives the page address, the referring page, your screen size and browser, and your IP address. We also count anonymous events such as starting a workout, signing in or buying credits, with details like the sport or the pack, never your email or account.
To analyse visitor flows, Pirsch Analytics uses a hashing algorithm to generate a 16-digit number as the visitor ID when the page request is received. The input values are the IP address, the user agent, the date and a salt.
The visitor's IP address is not persisted in whole or in part, and is anonymised completely and non-reversibly by the hash. The inclusion of the date and the use of one salt per website ensures that website visitors cannot be recognised for more than 24 hours and cannot be tracked across multiple websites. A rough localisation (country/city) is performed via a locally integrated database.
Analytics data uses 24-hour identifiers that reset daily and are not linked to individuals.
We use Cloudflare Turnstile to prevent spam and abuse, including a bot check when you ask for an email sign-in code. Cloudflare processes your IP address and signals from your browser to tell people from bots, as our processor, and sets no tracking cookies. This service is necessary for website security. For more information, see the Cloudflare privacy policy.
Strōq stores your workout data locally in your browser using IndexedDB. This data includes:
Without an account, or without consent to store workouts: Only the summary of each workout is kept, on your device. It is never transmitted to our servers and we have no access to it. If you clear your browser data, it is permanently deleted. The second-by-second detail is used for the live display during the workout and then discarded.
With an account: Each workout is sent to your account in Strōq so it is available on your other devices. Until it is sent, it waits on your device. We do not look at, analyse, share or sell it. Summaries are kept until you delete your account. The second-by-second detail of workouts done with credits (World, Map, sessions) or unlocked with a credit is kept as long as the summary. For free Classic workouts it is kept for 14 days after the workout, then deleted, leaving the summary. Your browser only keeps summaries; the detail is loaded from your account when you open a workout. Your profile (age, sex, resting heart rate, weight) and app settings are stored with your account so other devices can use them.
FIT export: To create a FIT file, the workout is sent to our server, converted and returned to you. It is not stored by this step.
Heart rate and resting heart rate are health data under Article 9 of the GDPR. We store them only if you give explicit consent when you create an account (or later in the app, for an account that did not consent at sign-in). You can withdraw consent at any time by deleting your account with "Delete account" in the app or by asking us by email: your account, workouts and profile are then deleted from our servers straight away. Strōq works fully without this consent.
You can delete your account at any time with "Delete account" in the app (⌘K, Account). This permanently deletes your account, profile and every workout from our servers straight away, and removes them from that device. You can also ask us to do it by email.
Strōq uses the Web Bluetooth API to connect to compatible rowing devices. Bluetooth connections are established directly between your browser and your device. No data from these connections is transmitted to our servers or third parties.
Under the General Data Protection Regulation (GDPR), you have the following rights regarding your personal data:
To exercise these rights, please contact us using the details provided in the Contact section below.
We retain your personal data only for as long as necessary to fulfill the purposes outlined in this policy:
We will delete your personal data when it is no longer needed or when you request deletion, subject to any legal obligations to retain certain information.
Analytics runs without a banner because it is anonymous and cookie-free. If you would rather not be counted, use the button below. Your choice is saved in this browser's local storage and applies to the website and the app. You can change it here at any time.
Required for website functionality - Always Active
If you have questions about this policy or want to exercise your privacy rights, contact us at hey-ho@atropical.no
We process your personal data in accordance with the Norwegian Personal Data Act and the General Data Protection Regulation (GDPR) of the European Union. Our legal basis for processing includes:
You have the right to lodge a complaint with the Norwegian Data Protection Authority (Datatilsynet) or your local supervisory authority if you believe we have not handled your personal data in accordance with applicable law.
We may update this privacy policy from time to time to reflect changes in our practices or for legal, regulatory, or operational reasons. We will notify you of significant changes by updating the "Last updated" date. Your continued use of the Service after changes constitutes acceptance of the modified policy.
© 2026 Atropical AS. All rights reserved.