Version: 1.0 (Machine Translation) | Reference date: 2026-09-18 (Traditional Chinese original) | Status: Machine-translated, pending human legal review
1. Scope and Contact
This Policy explains how GTG (Go. Train. Grow.) collects, processes, uses, retains, and deletes personal data. GTG is currently operated by an individual, Hung Ming-Tse (passport name: HUNG MING-TSE), who acts as the operator and data controller. For data rights, privacy questions, or complaints, please contact: [email protected].
GTG currently offers a free beta service and does not process paid transactions. The shared community, real-time chat, AI Coach, AI translation, video uploads, and ad tracking are not part of the initial public features; before any new data use or processor is enabled, GTG will update the relevant notices and obtain consent as required.
2. Data Collected, Sources, and Uses
| Data Category | Source and Use | User Choice and Visibility |
|---|---|---|
| Account ID, email, display name, avatar, selected country/region | Account creation and management, login, member identification, customer support, and security handling | Email is not public; display name, avatar, and the self-selected flag are shown only within the corresponding features |
| Date of birth and age-verification records | Determining whether the 18-year-old threshold is met | Date of birth is sent only to a controlled service for verification and is not written to production tables; only the pass/fail status, threshold version, and verification time are stored |
| Workouts, plans, sets, weight, reps, RPE/RIR, rest, and activity time | Storing records and providing history, autofill, trends, and training analysis | General records are the member's private data; they are only sent to a user-selected external platform when the user actively shares them |
| Weight, body composition, body measurements, heart rate, calories, and other health-related data | Voluntarily entered or authorized by the user, used for personal progress tracking and estimation | Optional data may be withheld; declining non-essential permissions does not affect unrelated basic features |
| Cardio, diving, and location data | Recording distance, pace, and dive activity; location is only obtained when the user actively initiates and authorizes it | No continuous background location tracking; users should review location-tagged content themselves before sharing |
| Equipment, notes, preferences, language, notification, and permission status | Storing personal settings and enabling the selected features | Most settings are stored on the device; approved private records may sync depending on login status |
| Policy version, acceptance time, and source | Demonstrating that the member accepted the current policy | Stored using member binding and server time; does not record date of birth, full device information, or unnecessary IP data |
| Customer support, deletion, and rights-request content | Responding to inquiries, verifying the requester, and handling complaints and rights requests | Please do not provide passwords, full payment information, or medical records unrelated to the case |
| Necessary IP, connection, security, and error information | Maintaining the service, troubleshooting, preventing abuse, and handling security incidents | Actual items depend on the infrastructure in use, accessible only to necessary personnel and for necessary purposes |
If the shared community is formally launched in the future, GTG may separately process public personal data, posts, comments, images, reactions, favorites, blocks, reports, and moderation records. Corresponding feature, process, and policy updates will be completed before launch.
3. Purposes and Legal Basis for Processing
GTG processes data to the extent necessary to provide account, private record, sync, customer support, and security features, based on performing the service relationship, obtaining valid consent, complying with legal obligations, or maintaining a legitimate security interest. Collection, processing, and use will not exceed what is necessary for the specific purpose.
Health checkups, medical records, or other data subject to special legal protection will only be processed where there is a legal basis and appropriate safeguards under applicable law. Device permissions and legal consent may differ; enabling a system permission does not mean you have consented to GTG using the data for other purposes.
GTG does not sell personal data and does not use health data for ad targeting, credit scoring, or marketing unrelated to the core fitness service.
4. Device Permissions and Health Data
- Photo library: for selecting an avatar, exporting a training share image, or, once available, selecting media for community features; GTG prioritizes accessing only the items the user selects.
- Camera and microphone: only requested when the corresponding feature is actually available and the user initiates capture or recording.
- Location: only obtained when the user actively logs a dive location and authorizes it; not used for background tracking.
- Notifications, sound, and vibration: used for reminders such as rest-interval alerts, and can be turned off in the app or system settings.
- Apple Health / Health Connect: only reads or writes the data categories the user explicitly selects and authorizes.
Withdrawing a permission stops the corresponding future access but does not automatically delete records already stored by GTG or a health platform. Users must manage data separately through GTG and the corresponding health platform.
5. Data Storage Location and Cross-Border Processing
GTG follows an offline-first design and stores member-scoped training, measurement, and preference data on-device using AsyncStorage. For logged-in, age-verified members, approved private records may be synced to a production cloud service protected by access controls and row-level security rules.
GTG's production environment uses Supabase for accounts, age verification, private sync, policy consent, and account deletion, with the project located in Tokyo, Japan. Customer support email is handled via Gmail. Cloudflare Pages hosts the public website, Terms of Use, Privacy Policy, and account-deletion instructions, and does not host member health data. Apple and Google process data under their own respective policies when a user actually uses their sign-in, store, health, or system features.
The above providers may process data outside the user's location. GTG will apply vendor management, contractual, and security measures to the extent required by applicable law. If a new provider is introduced, or the processing location or purpose changes materially, this Policy will be updated and handled in accordance with the law.
6. Sharing, Recipients, and Public Content
GTG only provides data to service providers or other lawful recipients to the extent necessary to deliver a user-selected service, with consent, to comply with the law, to respond to an authorized authority, or to maintain necessary security.
When a user actively shares training results to another app through the system share feature, the receiving platform will process the data under its own policy. Public content may be viewed, screenshotted, downloaded, or reshared by others; GTG cannot control copies lawfully retained by external platforms or other individuals.
The shared community remains closed in the initial release. Once it is launched, private body photos will not be made public simply by being uploaded; media will use controlled objects and short-lived access, and visibility, reporting, blocking, and deletion options will be provided according to the features available at that time before anything becomes public. A public community or chat room should not be treated as an end-to-end encrypted private health database.
7. Retention Period and Deletion
- Account, age-verification status, and private cloud data: retained while the account is active; removed once identity verification is completed and account deletion is executed, except for limited data that must be retained by law or for handling disputes.
- On-device data: retained until the user deletes it, clears app data, removes the app, or performs account deletion; whether an operating-system backup retains the data depends on the user's device settings and platform rules.
- Sync-deletion markers: retained while the account is active to prevent an offline device from re-uploading already-deleted data; removed together with the account upon deletion.
- Customer support, complaints, and rights requests: retained until the case is closed and for a necessary follow-up period; if a dispute, fraud, or legal proceeding is involved, use and access will be restricted and retained until no longer necessary.
- Security and error logs: retained for the period necessary for troubleshooting, abuse prevention, and security-incident handling; if an incident investigation or legal requirement necessitates an extension, use and access will be restricted.
- Community, transaction, and subscription data: the initial release does not include these features, so no formal content or transaction records are created for unlaunched features; corresponding retention rules will be published before launch.
When the purpose of the data no longer applies, the retention period expires, or deletion is legally required, GTG will delete, cease processing, or de-identify the data. Backup data may be cleared with a limited delay; if data is restored from a backup, GTG will re-execute any confirmed deletion request.
8. Account Deletion and Rights Requests
Users may delete their account within the app's account settings, after login credential verification and explicit confirmation. This process deletes the GTG Auth account, attributable private cloud data, and that member's GTG data on the device, except for limited data that must be retained by law or is necessary for handling disputes.
Users who cannot log in or who have removed the app may submit a request via the official account-deletion webpage or the customer support email. To prevent impersonation, GTG may require minimal necessary identity confirmation, but will never ask for your account password.
Under applicable law, users may be entitled to request access, review, obtain a copy, supplement, correct, stop the collection, processing, or use of, delete, object to, restrict, port, or withdraw consent regarding their data. The specific rights and exceptions are governed by applicable law. Under Taiwan's Personal Data Protection Act, requests to access, review, or obtain a copy are generally decided within 15 days; requests to correct, stop processing, or delete are generally decided within 30 days. Where an extension is legally permitted or a request cannot be fully satisfied, GTG will explain the reason and the available remedies.
9. Information Security and Data Incidents
GTG takes reasonable and risk-appropriate measures, including encryption in transit, member data segregation, least-privilege access, controlled server operations, access restrictions, and necessary incident handling. No system can guarantee absolute security; users should also protect their device, email, and login credentials.
If GTG becomes aware that personal data has been stolen, tampered with, damaged, lost, or leaked, it will take the necessary control and investigation measures and notify affected users and the competent authority as required by applicable law.
10. Age Restriction and Policy Updates
The initial release of GTG is available only to users who are at least 18 years old. The registration process sends the date of birth to a controlled service, which determines eligibility using server time; the date of birth is not written to production tables. If an account is found ineligible, GTG will restrict the account and handle related data in accordance with this Policy and applicable law.
GTG may update this Policy due to feature changes, vendor changes, legal requirements, or security needs. Material changes will be announced via the app, the official website, or other appropriate means; where legally required, renewed consent will be obtained. Each language version should provide consistent and easily understandable information; translation differences do not exclude the protections users are entitled to under the law.