Privacy

NPO run is the companion app for Nordberg Peak, a social 10 km run in Oslo. This page explains which personal data we process, and why.

Who we are

Nordberg Peak, Doktor Holms Vei 4f, 0787 Oslo, Norway. Contact: hei@npo.run.

What we store

• Account: email address and name, for sign-in and race registration. Mobile number if you give us one — it is optional, and is used to pre-fill Vipps and to text you about the race.
• Registration: which race and which train you sign up for, and whether you have joined the sauna or the banquet — including your place in a queue and your answer to an offer.
• Allergies: if you write an allergy note for the banquet we store it and pass it to whoever makes the food. This is health data, and it is entirely up to you whether to give it.
• Orders and payment: what you ordered, what it cost, and the reference the payment was given at Vipps. The payment itself happens at Vipps — we never see card or account details, and get nothing personal back from them.
• Strava: access tokens and Strava ID if you connect Strava, plus the finish times you register (time, distance, activity name). The activity list is fetched from Strava on demand and not stored.
• Usage data: which pages you visit and which steps you complete in registration and in the shop. When you are signed in this is tied to your account. See «Measurement» below.
• Fun: which of the site's hidden things your account has found, and your best score in Anda i motvind. Your first name appears on the leaderboard to other signed-in users.
• Photos: pictures from the races in «Minner» on the front page. If you are in one you would rather not be in, tell us and we will remove it.

Why, and on what basis

• Contract: registration, orders and payment — we cannot give you the place or the item without them.
• Consent: the allergy note, the Strava connection and session recording. All three are optional, and all three can be withdrawn.
• Legitimate interest: running and improving the site — that is, the usage data, and keeping track of who found the easter eggs. We consider it a small intrusion against a real benefit: we see where people get stuck, and fix it. If you disagree, tell us at hei@npo.run and we will stop measuring you.

Measurement

We use PostHog to see how many people come by and where they give up in registration and in the shop. The data is held in the EU (Frankfurt).

• If you are not signed in, we measure without cookies: nothing is stored on your device, and no profile is built of you.
• If you are signed in, events carry your account ID so we can follow a registration from start to finish. We never send your email address, login code, allergy note or Strava tokens to PostHog.
• Session recording is off for everyone. You can switch it on yourself under «Meg» on Min side, and off again in the same place. Anything you type into a field is masked in the recording regardless.

The site uses one cookie: the one that keeps you signed in and remembers your cart. It is necessary for the site to work, and so needs no consent. We have no ads and no cross-site tracking.

Retention

Account data is kept as long as you have an account. Strava tokens are kept until you disconnect. Finish times are kept until you delete them. Orders are kept for at least five years, as Norwegian bookkeeping law requires. Your allergy note stays on your registration — ask us to delete it and we will. Usage data is kept for up to one year.

Sharing

We do not sell personal data, and do not share it for marketing. These providers process data on our behalf, under a data processing agreement:

• Google Cloud — hosting and database (EU).
• PostHog — measurement (EU, Frankfurt). See «Measurement» above.
• Resend — sending the site's email.

Vipps stands in a different position: as a payment institution they are their own controller for the payment, with obligations of their own under financial and anti-money-laundering law. They do not process on our behalf. When you pay, we send them the amount and what the order is for — and your mobile number, if you have stored a Norwegian one with us, purely so you do not have to type it again. Leave the field empty and Vipps asks you itself. We never send them your name, your email address or your allergy note, and all we learn back is whether the payment went through and for how much. What Vipps does with the data is in their own privacy statement.

In addition: if you connect Strava or sign in with Google, you share data with them on their own terms. If you join the banquet, whoever makes the food gets your allergy note.

Access, deletion and objection

Want to see, correct or delete your data, or object to us measuring your use of the site? Email hei@npo.run and we will handle it within 30 days. You may also complain to the Norwegian Data Protection Authority, Datatilsynet.

Last updated: 11 August 2026.