Home

Privacy Policy

Last updated: 18 October 2026

Data Controller

Norvin is run by Daniel Chabr, U Dívčích hradů 343/19b, 150 00 Praha 5, Czech Republic, IČO 03310001, who is the controller of your personal data. Contact us about anything in this policy at support@norvin.fit, by phone on +420 705 942 354, or by post at the address above.

1. What Data We Collect

  • Account information: your email address and the name you give us. If you sign in with Apple or Google, the name and email they share with us (with Apple, possibly a private relay address).
  • Training data: rows you record live from your rower over Bluetooth, rows you log by hand or upload as files, and workouts imported from services you connect (Concept2 Logbook, Intervals.icu, Strava). This includes time, distance, pace, power, stroke rate, calories, heart rate, how hard each session felt and, for some imports, the original workout file.
  • Health-related data: heart rate (from your rower or a heart-rate strap, or imported), resting and maximum heart rate and weight if you enter them, whether you're coming back from an injury or a break, and when you tell us you're away or unwell (and why). We only use this with your explicit consent (see section 2).
  • Notes you add to a session: kept with the session, and sent to Anthropic only if you allow AI coaching.
  • Training profile and plan: your year of birth, experience level, goals, benchmarks such as your 2k, your plan, and the analyses and notes Norvin writes for you. Also your phone's time zone, so your plan's days and your reminders follow your local time.
  • Starting-estimate records: for each estimate of your starting 2k, a summary of each step of your first row and how hard it felt, your experience level and year of birth, and the 2k you later row or enter. Heart rate is included only if you've given health-data consent.
  • Social data: friends, rowing partners, shared rows and leaderboard entries, your profile photo if you add one, invitations you send or accept, athletes you block, and reports you make or that are made about you.
  • Membership information: your plan, trial and renewal dates, the status of your membership, offer codes and referral rewards, and the App Store or Google Play transaction identifiers for them. We never receive your card or payment details.
  • Messages to us: feedback you send from the app (with the screen it came from, the app version, your device model and operating system, linked to your account), and messages you send us through the contact form or by email (with your email address).
  • Trying Norvin without an account: if you upload a rowing workout file at norvin.fit/try, we read it to analyse it, with the experience level and optional 2k pace you enter. We don't use the heart rate in the file. If you rate the analysis, we keep your rating, any comment, the analysis, the file's name and type, the experience level and 2k pace you entered, and a one-way hash of your IP address. We don't keep the file itself.
  • Device and technical data: your IP address and browser or device type when you sign in (kept in security logs), a push-notification token and device name if you allow notifications, and crash reports.
  • Usage analytics: which screens and features you use and membership steps such as starting a trial, linked to your Norvin account ID only.
  • Website visits: when you visit norvin.fit without signing in, the pages you view, the buttons and links you click and where on the page, how far you scroll, how long you stay, and the site or campaign that sent you. These visit analytics get a new random ID on every page load and aren't linked to an account or to your other visits.

We need your email to create your account, and your year of birth and experience level to build a plan. Everything else, including heart rate, weight and connected services, is optional; without health data Norvin coaches you from pace and power only.

2. How We Use Your Data

  • Run your account, build and adapt your plan, record and analyse your rows, and show your history and trends. (Art. 6(1)(b) GDPR: performance of our contract with you)
  • Use health-related data (section 1) to coach you, for example to set heart-rate zones and adjust training when you're returning from injury or unwell. (Art. 9(2)(a) GDPR: your explicit consent, given in the app; withdraw it at any time in Profile › Account & privacy)
  • Write your session analysis and the Coach's note with AI (Anthropic's Claude). (Art. 6(1)(a) and 9(2)(a) GDPR: your consent, given in the app; without it you still get your plan and its adjustments, which don't use AI)
  • Manage your membership, remind you before a free trial ends, and run the founding offer and referral rewards. (Art. 6(1)(b) GDPR)
  • Send service emails and notifications: sign-in codes, training reminders, plan and membership notices. You choose which notifications you get in Profile › Notifications; sign-in, security and billing messages always go out. (Art. 6(1)(b) GDPR)
  • Tell members about new Norvin features and offers by email, with an unsubscribe link in every message. Non-members get this only if they opt in. (Art. 6(1)(f) GDPR and §7(3) of Czech Act 480/2004, or your consent)
  • Show the parts of your profile and training that other athletes can see (section 3b). (Art. 6(1)(b) GDPR)
  • Check and improve how we estimate a starting 2k, using the starting-estimate records. (Art. 6(1)(f) GDPR: our legitimate interest in accurate estimates; heart rate only with your consent)
  • Understand how Norvin is used and fix crashes, using pseudonymous analytics and crash reports. (Art. 6(1)(f) GDPR: our legitimate interest in a working, improving product)
  • Keep Norvin secure and prevent abuse, using security logs and bot checks. (Art. 6(1)(f) GDPR)
  • Moderate athletes' names and leaderboard entries, including reviewing reports about them: act where needed, tell the athlete what we did and why, and recognise repeated abuse. (Art. 6(1)(f) GDPR: our legitimate interest in keeping the Norvin community safe)
  • Keep a record of your membership purchases after your membership ends, to deal with claims and meet consumer-law record-keeping. (Art. 6(1)(c) and (f) GDPR)
  • Read and answer feedback you send from the app and messages you send us through the contact form or by email, and use feedback to improve Norvin. (Art. 6(1)(b) GDPR where your message is about your account or membership; otherwise Art. 6(1)(f) GDPR, our legitimate interest in answering you and improving Norvin)
  • Analyse a workout you upload on the try page, and use the ratings people give to improve our coaching. (Art. 6(1)(b) GDPR for the analysis you ask for; Art. 6(1)(f) GDPR, our legitimate interest in improving our coaching, for keeping rated analyses)

Where we rely on legitimate interests, you can object (section 5). Where we rely on consent, you can withdraw it at any time without affecting what we did before.

3. Third-Party Data Sharing

We do not sell your data or share it for advertising, and there is no ad tracking in Norvin. These providers process data for us, under data processing agreements that require them to protect it as this policy and the GDPR do:

  • Vercel (USA): hosts the website and the app's server, which runs in the EU (Frankfurt), and processes every request, with short-lived server logs.
  • Neon (Databricks, USA; data stored in the EU, Frankfurt): hosts our database.
  • Anthropic (USA), only if you allow AI coaching: receives your workout data, how hard sessions felt, notes you add, and your training profile, to write your analysis and notes. Never your name or email. Anthropic uses it only to provide the service and check for misuse, deletes it within 30 days (or keeps it up to 2 years if it's flagged for misuse), and does not use it to train its models. It also receives workouts uploaded on the try page, without heart rate, to write their analysis.
  • PostHog (data stored in the EU, Frankfurt): usage analytics, linked to your Norvin account ID only, never your name, email or health data, and website visit analytics that aren't linked to anyone.
  • Sentry (data stored in the EU, Frankfurt): crash and error reports with your device model, operating system, app version, what the app was doing (which can include parts of the row you were on), and your Norvin account ID.
  • Resend (USA): sends our emails, so it receives your email address and the content of each email.
  • Proton (Proton AG, Switzerland): hosts our support mailbox, so it stores messages you send to our contact form or support address.
  • Expo (650 Industries, USA): passes push notifications on to Apple's push service on iPhone and to Firebase Cloud Messaging on Android, and serves app updates. It receives your push token and the text of each notification.
  • Firebase Cloud Messaging (Google, USA), only on Android: delivers push notifications to your phone. It receives your push token, an ID Firebase creates for Norvin on your phone, and the text of each notification.
  • RevenueCat (USA): manages App Store and Google Play memberships for us. It receives your Norvin account ID, your App Store or Google Play purchase and subscription records (product, dates, renewals, refunds, offer codes, store country and price) and basic app and device information (app version, device model, operating system, language, IP address). Not your name, email or training data.
  • Cloudflare (USA): Turnstile checks that our website's sign-in, contact and early-access forms are used by a person, using your IP address and browser information. Cloudflare also uses some of these signals as a controller, under its own privacy policy, to improve its bot detection.

These receive data as independent controllers, under their own privacy policies:

  • Apple: sells and bills App Store memberships and tells us their status (never your payment details), lets you sign in with Apple, and delivers push notifications.
  • Google: if you buy a membership in the Android app, sells and bills it through Google Play and tells us its status (never your payment details). Google also lets you sign in with Google.
  • Concept2 Logbook, Intervals.icu and Strava, only if you connect them: we import your workouts (and from Intervals.icu, wellness data such as resting heart rate). When you choose to send a finished row to one of them, we upload it there, and it stays there under that service's policy even if you later delete your Norvin account.

3a. International Data Transfers

Some of the providers above are in the United States, and Databricks (Neon), PostHog, Sentry and Vercel are US companies even though they store and process our data in the EU. For these transfers we rely on the EU–US Data Privacy Framework where the provider is certified, and otherwise on the European Commission's Standard Contractual Clauses. Proton is in Switzerland, which the European Commission recognises as protecting personal data adequately. You can ask us for a copy of the relevant safeguards.

3b. What Other Norvin Athletes Can See

  • Friends: when you accept or share a friend invitation, you and that friend see each other's profile name and weekly and monthly rowing distance.
  • Public leaderboard: only if you join it. Every signed-in Norvin athlete can then see your profile name, distance and rank. You can leave at any time.
  • Rowing partner: while paired, you each see the other's name and 2k baseline (pace, where it came from and when it was set). During a shared row you also see each other's live pace, distance, stroke rate and workout step, and how each of you is tracking your own target pace (how much of the current step is on target and how far off it you are, not the target itself). Shared rows stay in your partner's history under the name you used then, even after you delete your account.
  • Invitations: if you join Norvin through a friend's link, they're told when you join and when you first pay for membership, and nothing else about your account.

3c. Apple Health

If you turn on Save rows to Apple Health, Norvin saves each row you finish to Apple Health as an indoor rowing workout, with its time, distance and active calories. Norvin never reads data from Apple Health, and nothing in Apple Health is sent to our servers or to any third party or used for marketing. You can turn this off in Norvin or in the Health app at any time. Workouts already saved stay in Apple Health until you delete them there; discarding a session in Norvin also removes it from Apple Health.

4. Data Retention

  • Your account and training data, including analyses and notes Norvin wrote: kept while your account exists. When you delete your account, it is deleted 30 days after you confirm (signing in again before then cancels the deletion), and the deletion is completed within a day after that. Copies in Neon's restore history are overwritten within 2 days.
  • Membership records: kept while your account exists and for 3 years after your membership ends, then deleted. Our tax records of Apple's and Google's sales reports are kept for 10 years under Czech law and don't identify you.
  • Usage analytics and website visits: 12 months, then deleted.
  • Crash and error reports: 90 days.
  • Security logs (sign-ins, with IP address and device type): 12 months.
  • Moderation records: if we act on your profile (for example resetting your name or removing you from the public leaderboard, whether or not someone reported you), we keep the action, the reason we gave you, the date and a one-way hash of your email for 2 years, including after you delete your account, so we can show what we did and why and recognise repeated abuse. Reports about you are deleted with your account.
  • Messages to us: feedback you send from the app is deleted 2 years after you send it, or with your account if that's sooner. Messages to our contact form or support address are kept as long as we need them to deal with your request and any follow-up.
  • Early-access list: if you joined it without creating an account, until you create one or for 12 months.
  • Try-page ratings: 30 days, then deleted. If you don't rate the analysis, nothing from your upload is kept.

When you delete your account we also delete your analytics profile and your RevenueCat record, and withdraw Norvin's access to any service you connected. Concept2 Logbook gives us no way to withdraw access, so we delete our access to it on our side; you can also remove Norvin under connected applications in your Logbook.

5. Your Rights

Under the GDPR you have these rights. You can use most of them yourself in Profile › Account & privacy, in the app or on the web; for anything else, email support@norvin.fit. We reply within one month.

  • Access & Export: Download your data gives you a machine-readable file of your account and training data. For a complete copy of everything we hold about you, email us.
  • Rectification: correct your profile and training details in the app. To change the email address or sign-in method on your account, email us.
  • Erasure: delete your account at the bottom of Profile in the app, or in Profile › Account & privacy on the web (see section 4).
  • Restriction: ask us to restrict how we use your data in certain circumstances.
  • Portability: receive your data in a structured, machine-readable format.
  • Object: object to processing based on legitimate interests. Turn analytics off in Profile › Account & privacy, and unsubscribe from feature news in any email.
  • Withdraw consent: turn off AI coaching or health-data use in Profile › Account & privacy at any time.
  • Complain: to the Czech data protection authority (ÚOOÚ, uoou.gov.cz) or the authority where you live or work. In the UK, to the Information Commissioner's Office (ico.org.uk).

6. Cookies and Device Storage

On the website we use one cookie, to keep you signed in. Our analytics there run in memory only, with no cookies or local storage, and session recording is off. Cloudflare Turnstile runs only on forms that need a bot check.

In the iPhone and Android apps, your sign-in session and app settings are stored securely on your phone, and analytics keep nothing on your device between launches. Turning off notifications or signing out removes your push token from our servers.

7. GDPR Compliance

We follow the GDPR wherever you live. Norvin is not intended for anyone under 18; if we learn that we hold data of someone under 18, we delete the account. If you live in the United States, our Consumer Health Data Privacy Policy also applies to you.

8. Contact

For privacy questions or requests, email support@norvin.fit, call +420 705 942 354, write to Daniel Chabr, U Dívčích hradů 343/19b, 150 00 Praha 5, Czech Republic, or use our contact form.

9. Automated Decisions & Profiling

Norvin builds and adapts your plan automatically from fixed training rules: your recent rows, how hard they felt, your benchmarks and, with your consent, heart rate and the injury or illness information you give us decide how hard and how long upcoming sessions are. If you allow AI coaching, Anthropic's Claude writes the explanations and notes, but doesn't decide your plan. This is profiling, but it has no legal or similarly significant effect on you, and you can change or skip any session. You can ask a person to review any plan decision or AI-written text by emailing us.