Privacy Policy

Last revised: 27 October 2026

Thank you for using bakken.run. Your privacy is important to us. This Privacy Policy explains how we collect, use, store, share, and protect personal information in connection with bakken.run, including the bakken.run mobile application, supporting website, server-side backend, Garmin integration, Intervals.icu integration, workout synchronization, connected training data, recovery-related data, and digital endurance training services operated by Bakken Performance AS.

1. bakken.run app and connected training platforms

bakken.run is a native mobile running coaching application with a supporting website and secure server-side backend. The app provides individualized running plans, structured workouts, threshold-based intensity guidance, completed-workout analysis, recovery-aware recommendations, and adaptive training adjustments for runners training from 10 km to the marathon. A web version also uses the same backend and user accounts.

bakken.run is operated by Bakken Performance AS, a Norwegian company founded by Marius Bakken, MD, a physician, former Olympic 5000-meter runner, and endurance training author based in Norway.

bakken.run works alongside the training devices, wearable platforms, and workout-analysis tools that runners already use. This may include Garmin Connect, Intervals.icu, Strava, Polar, COROS, Apple Health, and similar services, but only when the user explicitly chooses to connect such a service. We do not access data from any connected platform unless the user has authorized that connection through the relevant authorization process.

Connected-platform data is used to provide your bakken.run training service and the optional sharing features you choose, as described in section 11. We do not sell connected-platform data, broker it, resell it, use it for advertising, or share it for third-party profiling.

2. Who we are

Bakken Performance AS operates bakken.run. Since 2009, Bakken Performance AS has operated online running and marathon training services, including the 100 Day Marathon Plan. bakken.run modernizes this training system into a native mobile running coaching application supported by a secure server-side backend.

3. Information we may collect

Depending on the service used and the permissions granted by the user, we may collect the following categories of information:

• Account information: name, email address, login-related information, subscription status, account identifiers, and communication preferences.
• Training information: selected training plans, workout schedules, completed sessions, user feedback, training notes, race goals, training history, and related performance information.
• Connected-service data: data received from services or devices that the user explicitly connects, including Garmin Connect, Intervals.icu, Strava, Polar, COROS, Apple Health, and similar services. This may include activity summaries, workout data, training-load data, heart rate data, HRV summary values, resting heart rate, sleep summaries, stress summaries, distance, duration, pace, cadence, elevation, and similar training-related metrics.
• Technical information: IP address, browser type, device type, operating system, log data, security-related events, and service-performance information.
• Information you enter: daily check-ins (for example how your legs feel, soreness and sleep), injuries, pain and illness you report, lactate and test results, notes, and the photos and voice notes you choose to add in Pack.
• Location from your phone: with your permission, the app uses your phone's location while you record a run, when you choose to check in at a Pack meeting point, and to fetch the local weather for today's session. For the weather, the position is rounded to about 100 metres, sent through our server to the weather service Open-Meteo and not stored by us; your phone may look up the place name with its own location service. The app does not track your location in the background.
• Consent records: when you create an account, we record that you confirmed your age and accepted this policy, and your explicit consent to the use of health information, with the policy version and the time.
• Reports in Pack: if you report another runner or a message in Pack, we store the report, the reason you chose, your optional note and a copy of the reported name, @username and message, and we send it to our support inbox so that we can review it within 24 hours. A report is used only to keep Pack safe, the reported runner is not told who reported, and a report is deleted when the account of either runner is deleted. Names, @usernames and texts in Pack are also checked automatically against a short list of offensive words before they are saved.
• Support information: information provided when contacting us for support, account help, or service-related questions.

We only collect connected-service data when the user has explicitly authorized that connection through the relevant third-party authorization process.

4. Garmin Connect data

If you connect Garmin Connect, bakken.run uses Garmin's authorization flow to receive the activity and health data you permit and, if you permit workout sharing, to send structured workouts to Garmin Connect. The app does not ask for your Garmin password. Garmin data is associated with your bakken.run account and used for your training log, planned-versus-completed comparisons, programmed training calculations and workout delivery. The legal bases and your choices about retained activity history are described in section 10.

The data categories and uses are described below. Our infrastructure providers and processing locations are described in section 11 and section 12; retention, disconnection and deletion in section 14; and programmed training calculations in section 15. Garmin processes data under its own Garmin Connect privacy notice: Garmin Connect Privacy Notice.

The current Garmin integration covers Activity, Health and Training. Women’s Health is not included in this production scope. Menstrual-cycle and pregnancy data are not used by the current training calculations.

4.1 Garmin Activity API

Garmin activity data includes the activity summary (activity type, start time, duration, distance, pace, speed, heart rate, cadence, elevation and the recording device), the activity details with time-series samples, potentially at one-second intervals (including heart rate, pace, cadence, position, elevation and power where available), the activity file as recorded by the device, and edits you make to an activity in Garmin Connect, such as its name.

This data is used to compare planned versus completed training, assess threshold intensity, calculate training load, understand adherence, grade-adjust pace on hilly sessions, detect missed or unusually hard sessions, support progression decisions, and adapt future workouts for the individual user.

4.2 Garmin Health API

Where you have authorized Health API access, bakken.run receives three kinds of Garmin health summaries: daily summaries, sleep summaries and HRV summaries. A daily summary contains resting heart rate, heart-rate samples over the day, steps, distance, floors, calories, intensity minutes, and stress and Body Battery values where your device records them. A sleep summary contains sleep duration, timing, sleep stages and sleep-quality values. An HRV summary contains the overnight HRV values. Each summary is stored as received, so that a value can be recalculated or shown again.

The training calculations use resting heart rate, HRV and sleep values for readiness assessment and recovery-aware training adjustment. An elevated resting heart rate, suppressed HRV or poor sleep may lead bakken.run to recommend an easier session, reduced intensity or additional recovery. Other values are retained with the summary; they are not inputs to the current training calculations.

bakken.run does not request separate respiration, blood-oxygen, all-day epoch or user-metrics summary types. Adding a summary type requires an update of this Privacy Policy and Garmin's approval first.

4.3 Garmin Training API

bakken.run may use Garmin’s Training API to send structured workouts and training-plan items to the user’s Garmin calendar and compatible devices where the user has connected Garmin and authorized this functionality.

This is the only Garmin integration where bakken.run writes data outward to Garmin. bakken.run does not repost, modify, or delete user activities inside Garmin Connect.

When a user authorizes this functionality, workout and training-plan data is transferred to Garmin. Garmin processes this data under the Garmin Connect privacy notice, available at https://www.garmin.com/privacy/connect.

5. Intervals.icu data

If a user chooses to connect Intervals.icu, bakken.run may receive training and performance data authorized by the user, such as completed workouts, activity summaries, training load, intensity distribution, workout calendar information, heart rate or power-related summaries where available, and related performance metrics.

Intervals.icu data is used to support training analysis, plan adjustment, workout interpretation, coaching recommendations and optional sharing features chosen by the user. It is not sold, brokered, resold, used for advertising, or shared for third-party profiling.

Users may disconnect Intervals.icu inside bakken.run where available or revoke access through Intervals.icu. When access is disconnected or revoked, further syncing stops.

6. Other connected training platforms

bakken.run may support other connected training platforms or health services, such as Strava, Polar, COROS, Apple Health, and similar services. These integrations are used only when the user explicitly chooses to connect them.

Data from other connected platforms may include completed activities, activity summaries, workout calendar data, distance, duration, pace, heart rate, cadence, elevation, training-load summaries, and similar training-related metrics, depending on the platform and the permissions granted by the user.

Data from connected platforms is used to provide training analysis, workout planning, recovery-aware recommendations, coaching functionality and optional sharing features chosen by the user. It is not sold, brokered, resold, used for advertising, or shared for third-party profiling.

Polar: if you connect Polar, bakken.run uses Polar AccessLink with your permission to receive your exercises (including the recorded file with heart-rate and other samples), your sleep and your Nightly Recharge values (overnight heart rate and HRV). The data is used for your training log, the training calculations and recovery-aware adjustment. When you disconnect Polar in bakken.run, we deregister you at Polar, which revokes our access, and delete the stored connection; runs already imported stay in your training log unless you remove them from it.

Apple Health: if you connect Apple Health on your iPhone, bakken.run reads, with your permission in iOS, your running workouts (with their heart-rate curve), resting heart rate, heart-rate variability and sleep. Apple's heart-rate variability value (SDNN) is stored but is not used by the current training calculations. You can withdraw access in the iOS Health settings or disconnect in bakken.run.

7. Third-party integration summary

8. What we do not do with connected-platform data

Bakken Performance AS does not sell, broker or resell connected-platform data, or use it for advertising or third-party profiling. The current training service uses your authorized data for your own training calculations and recommendations. It does not send Garmin data to an external AI coaching or language-model service to generate those recommendations. This production scope does not include using Garmin data to train, evaluate or improve AI models, including using anonymized, aggregated or derived Garmin data for those purposes.

bakken.run does not repost, modify, or delete activities inside Garmin Connect. The outbound Garmin functionality is sending structured workouts or training-plan items to Garmin when the user has connected Garmin and authorized that functionality.

For other connected platforms, bakken.run will only perform write or synchronization actions where the user has clearly authorized that feature.

9. How we use personal information

We may use personal information to:

• provide digital training services and training-related resources;
• create, adapt, and deliver structured training plans and workouts;
• synchronize workouts with connected services where authorized;
• compare planned versus completed training;
• interpret training feedback and training-related metrics;
• provide readiness and recovery-aware training recommendations;
• support threshold-based intensity guidance and progression decisions;
• provide customer support and respond to inquiries;
• maintain account security and prevent misuse;
• monitor service performance and reliability;
• comply with legal obligations; and
• maintain and improve service reliability and correct errors in the programmed training calculations, subject to the purposes and restrictions described in this policy. This does not authorize AI model training or development using Garmin data.

10. Legal basis for processing

For users in the EU/EEA, we use the following legal bases for the purposes described in this policy:

• Account and requested service: contractual necessity under Article 6(1)(b) GDPR for processing necessary to provide your account and the training services you request. This basis alone does not permit processing health information.
• Connected health information: consent under Article 6(1)(a) and explicit consent under Article 9(2)(a) for receiving, storing and using health information for the training purposes you authorize. This includes heart-rate measurements within imported activities as well as daily, sleep and HRV summaries. The connection notice explains the data exchange and what happens to your data when you disconnect.
• Imported activity history: imported runs are used for your training log, activity analysis and training calculations. When disconnecting Garmin inside bakken.run, you can choose to keep these runs or delete the Garmin-imported runs too. Retained runs include their recorded measurements, which may include heart rate and location. Keeping them continues their use for the same training purposes; it does not authorize new uses. Section 14 explains disconnection in Garmin Connect and how to request deletion later.
• Optional sharing and communications: consent applies to the features or communications you choose. Sharing health information requires explicit consent covering that sharing. Section 11 describes the sharing choices and recipients.
• Security and essential operations: legitimate interests under Article 6(1)(f) for proportionate account-security, abuse-prevention and service-reliability processing where those interests are not overridden by your rights. This is not a fallback basis for retaining health information after its applicable consent is withdrawn.
• Legal obligations: Article 6(1)(c) where a specific legal obligation requires processing, limited to the information and period concerned.

You can stop further Garmin synchronization by disconnecting in bakken.run or Garmin Connect. To withdraw consent for retained Garmin activity history, choose to delete the runs when disconnecting in bakken.run, or contact support@bakken.run to request their deletion, including after a disconnection. A request to withdraw all Garmin-data consent includes the retained activity history. We do not treat a privacy-policy update as permission for a new use. Withdrawal does not affect the lawfulness of processing carried out before withdrawal.

11. Sharing of personal information

We do not sell personal information. We may share personal information only where necessary and appropriate, including with:

• Connected services: such as Garmin Connect, Intervals.icu, Strava, Polar, COROS, Apple Health, or similar services, when a user authorizes data exchange or workout synchronization.
• Service providers: trusted providers that help host, secure, process, analyze, or support the service, including hosting, database, payment, analytics, logging, customer-support, and email providers where applicable. Today these are Vercel (server), Supabase (database, sign-in and private file storage), Cloudflare (Garmin notifications), Resend (sign-up and password e-mails), Open-Meteo (weather for a rounded position), OpenFreeMap and unpkg (when you open the map of a run, its map tiles and map library are loaded from them, which shows them your device's IP address and the map area), Expo (app updates) and Sentry (error reports, when switched on, with personal data removed from the report).
• Legal authorities: where disclosure is required by law, legal process, or a valid governmental request.
• Business transfers: if needed in connection with a merger, acquisition, restructuring, or transfer of assets, subject to appropriate safeguards.

Service providers may process data only for the purposes of providing services to bakken.run and are not permitted to use personal information for their own independent purposes unless separately disclosed or legally required.

Garmin data is processed using three infrastructure providers: Cloudflare (Workers and R2) for receiving and holding notifications, Vercel for the server functions, and Supabase (PostgreSQL) for the application database. The endpoints Garmin delivers to are configured and controlled by Bakken Performance AS in its own accounts with these providers.

Sharing you choose: photos and voice notes you add in Pack are kept in private storage and shown only to the people you share them with, through time-limited links. With Pack, you can share a daily card with friends you have accepted in bakken.run. The card shows your planned session, whether you have checked in, whether the run is done, and its distance and duration; your pace band and average pace, and your morning state, are included only if you switch those on. The card can also show training comparisons and week summaries derived from your recorded runs. Sharing is available between accepted friends who have enabled it. Morning-state details are further limited by the check-in controls. Stopping sharing deletes your stored day cards and stops new cards being shared; it cannot recall screenshots a recipient has already saved. Garmin disconnection is separate from stopping Pack sharing. Sharing remains subject to the valid data-use consent and deletion rules in sections 10 and 14.

12. Data storage and region

Bakken Performance AS operates the Garmin integration through cloud services configured in its own accounts. Health and activity PUSH notifications arrive at our Cloudflare Worker and are held in Cloudflare R2 for reliable processing. Activity-file notifications, disconnection notices and permission changes go directly to our backend hosted on Vercel. Our backend stores the resulting application records in Supabase/PostgreSQL.

The application database is provisioned in an EU region (Ireland), and Supabase keeps daily backups of it. R2 notification storage is configured for Cloudflare's EU jurisdiction. The Vercel server functions currently process Garmin data in a United States region. Cloudflare Workers use its distributed network; selecting EU storage for R2 does not restrict all Worker execution, support access or operational logs to the EU. International processing is described in section 19.

Bakken Performance AS is based in Norway and is the controller for personal information processed within bakken.run. Garmin is an independent controller for its own services.

13. Data protection and security

We use technical and organizational measures designed to protect personal information, including:

• encrypted data transfer using HTTPS/TLS;
• server-side handling of Garmin OAuth credentials and tokens;
• server-side handling of connected-platform access tokens where applicable;
• server-side storage of access tokens where applicable;
• encryption of Garmin access and refresh tokens before database storage;
• secure server-side environment variables for client secrets, service keys, and encryption keys;
• restricted access to systems and data;
• role-based access controls where relevant;
• per-user data separation;
• security monitoring and logging, including error reports with personal data removed before they leave our server;
• regular software updates and server maintenance; and
• backup and recovery procedures.

No method of transmission or storage is completely secure, but reasonable steps are taken to protect personal information against unauthorized access, loss, misuse, alteration, or disclosure.

14. Data retention, disconnection, and deletion

We retain personal information only for the stated purposes, while a valid legal basis applies, and for no longer than necessary. Disconnecting a service, deleting imported activities, stopping Pack sharing and deleting your account have different effects, as explained below.

Garmin disconnection: once processed, disconnection removes the stored connection and OAuth tokens, Garmin health-summary observations (including daily, sleep and HRV summaries), and raw activity-event records associated with your account. Further Garmin synchronization stops. Apple Health observations and the original recorded activities in Garmin Connect are not deleted by this action. Operational notification copies and backups are not immediately erased by disconnection; their retention is explained below.

Disconnecting inside bakken.run: you can choose Keep my runs or Delete my Garmin runs too. Keeping runs leaves the previously imported activities in your training log, including their heart-rate measurements, routes and other recorded samples, for the same training-log, analysis and training-calculation purposes. Choosing to delete removes the Garmin-imported training-log records and the training engine's stored copies of those activities. Runs from other sources are not targeted by this deletion.

Disconnecting in Garmin Connect: Garmin sends us a deregistration notification. On processing it, we delete the connection, health-summary observations and raw activity-event records as described above. Runs already imported into the bakken.run training log remain. You can request deletion of those runs and their associated data by contacting support@bakken.run; you do not need to reconnect Garmin to make that request.

Workouts sent to Garmin: when you disconnect inside bakken.run, we attempt to remove workouts the app added to Garmin Connect before revoking the connection. This may not be possible if Garmin access has already been withdrawn or you choose to proceed despite incomplete cleanup. This concerns workouts sent by bakken.run, not your recorded activities in Garmin Connect.

Changes to individual Garmin permissions: withdrawing health-data sharing stops that import and deletes stored Garmin health-summary observations. This does not itself delete imported activity records or their heart-rate samples. Other still-authorized functions may remain connected. Withdrawing permission to receive workouts stops workout delivery; it does not itself request deletion of health observations. A broader withdrawal or deletion request is handled according to its scope, not only the technical permission name.

Pack and derived records: Garmin disconnection and the in-app run-deletion option do not automatically delete existing Pack day cards or all previously stored training calculations. Pack's Stop sharing control deletes your stored day cards and stops further sharing. For deletion of retained Garmin-derived calculations or shared records, contact support@bakken.run. We handle these records as part of the relevant deletion or consent-withdrawal request. Pack sharing is not a separate justification for retaining information after its applicable consent has been withdrawn.

Operational notification copies and backups have separate retention rules:

• Processing inbox: successfully processed messages become eligible for cleanup three days after processing. Messages marked as permanently failed become eligible fourteen days after that status is recorded. Cleanup runs as part of the background worker when it has sufficient time; these are cleanup thresholds, not guarantees of deletion at an exact hour.
• R2 notification copies: after a notification has been accepted into the processing queue, its object is moved to the archive area. That area has a fourteen-day expiry rule, counted from the move. This can occur before the queued data finishes processing. Deletion is performed by Cloudflare's lifecycle service and is not immediate at the expiry time.
• Unfinished messages: messages still awaiting processing or retry do not fall under the inbox's completed/permanently-failed cleanup rules. R2 objects not yet moved into the archive area have no automatic expiry rule. They require operational handling and are also within the scope of an applicable deletion request.
• Database backups: daily backups are configured with seven-day retention. A record deleted from the live database can remain in an existing backup until that backup expires. Garmin disconnection does not immediately erase those backups.

You can request account deletion or deletion of connected-platform data by contacting support@bakken.run. These requests are handled through support, not through an automatic thirty-day account-deletion timer. Where the right to erasure applies, we delete the relevant personal information without undue delay. We respond without undue delay and normally within one month of receiving the request. If an extension permitted by law is needed, we explain the reason within that month. We may need to verify your identity. We explain any lawful reason for retaining particular information.

An account-deletion or full Garmin-data deletion request covers the relevant imported history, stored derived personal information, shared records under our control and operational copies, not only the records visible on screen. Backup copies follow the retention period above. Automatic expiry rules do not replace handling an applicable deletion request. We cannot recall copies or screenshots another person has already saved.

15. Programmed training calculations

The current bakken.run training service uses programmed training rules and numerical calculations based on Marius Bakken's training method. These calculations use your training history, goals, feedback and authorized activity and recovery data to set training intensity, assess completed training and adjust your plan. They do not use an external AI coaching or language-model service to generate your training advice. No AI coaching feature is enabled in the current production scope.

Any future proposal to process Garmin data with AI will be reviewed against Garmin's requirements and applicable data-protection law before it is introduced. Required Garmin written authorization, updated privacy information and any required explicit user consent must be in place first. Connecting Garmin now does not consent to a future AI coaching feature or authorize restricted uses such as AI model training.

16. User rights

Depending on location and applicable law, users may have the right to:

• request access to personal information held about them;
• request correction of inaccurate information;
• request deletion of personal information;
• object to or restrict certain processing;
• withdraw consent where processing is based on consent;
• request data portability;
• disconnect Garmin, Intervals.icu, or other connected-platform access;
• request deletion of connected-platform-derived data; and
• lodge a complaint with a relevant data protection authority.

To exercise these rights, contact us using the details below.

17. Third-party services

bakken.run may integrate with or link to third-party services, including Garmin Connect, Intervals.icu, Strava, Polar, COROS, Apple Health, and other training-related platforms. Those third-party services have their own privacy policies and terms. Users should review those policies before authorizing any connection. Garmin’s privacy practices are described in the Garmin Connect privacy notice at https://www.garmin.com/privacy/connect.

When a user authorizes Garmin Connect, Garmin may show the data categories and permissions that the user can control from their Garmin Connect account.

18. Children’s privacy

bakken.run is not intended for children under the age of 16. We do not knowingly collect personal information from children under 16 without appropriate consent. If such information is collected without appropriate consent, steps will be taken to delete it.

19. International transfers

Personal information may be processed outside your country of residence. For the Garmin integration, the database and R2 notification storage locations are described in section 12, while server processing currently takes place in the United States and Cloudflare Workers operate on a distributed network. EU storage does not mean that all processing takes place in the EU.

Where international transfers require safeguards under applicable data-protection law, those safeguards must be in place. Depending on the provider and transfer, these may include an applicable adequacy decision or the European Commission's standard contractual clauses and any required supplementary measures. We do not rely on an EU storage location alone as a safeguard for processing elsewhere.

20. Medical and training disclaimer

bakken.run provides training guidance, readiness interpretation, workout planning, and running-performance support. It does not provide medical diagnosis, medical treatment, or emergency health monitoring.

Health, HRV, sleep, stress, and recovery data are used only as training context. Users should consult a qualified healthcare professional for medical concerns, injuries, illness, pregnancy-related questions, or health symptoms.

21. Updates to this policy

This Privacy Policy may be updated from time to time. The updated version will be posted on this page with a revised effective date.

Changes concerning Garmin data will be submitted to the Garmin Connect Developer Program team for written approval before implementation, as required by the program. We will also update this policy and provide any required user notice or consent process before introducing new Garmin data uses, additional data categories, AI processing or material changes to third-party processing. An updated policy does not itself grant permission for a new use of Garmin data.

Material changes will be communicated through the app, website, or on first login after the update where required.

22. Contact

For questions about this Privacy Policy or how personal information is handled, contact:

Bakken Performance AS
Marius Bakken
Borghilds vei 15a
4633 Kristiansand
Norway
Email: support@bakken.run
Website: https://bakken.run

This policy describes privacy practices for bakken.run and connected-service integrations, including Garmin Connect, Intervals.icu, and other connected training platforms where authorized by the user.