TH

Privacy Policy

Version 2026-09-17 · Effective 17 September 2026

[COMPANY LEGAL NAME], [COMPANY ADDRESS], is the data controller for FlexBlitz. Contact us about anything in this policy at [PRIVACY EMAIL].

If you publish content for money, the Creator Privacy Notice adds to this policy. It does not replace it.

1. What we collect

You give us

• Account: email address, username, display name, password (stored only as a bcrypt hash — we never see or store the password itself).
• Date of birth, asked once at signup. We keep it so we can re-check eligibility if a minimum age we are subject to changes, rather than having to ask everyone again. It is never shown to other players and never leaves our systems. If you are under 16 the account is not created and nothing you typed is stored.
• Profile: avatar image, body weight if you enter it, and your chosen theme.
• Content: workout videos and reels you upload, comments, team and direct messages, reports you file about other users.
• Support: whatever you write to us.

The app produces as you use it

• Workout results: exercise, repetitions, duration, form score, estimated calories, score, XP, level, streak, coins, team contribution.
• Social graph: teams you join, rooms you enter, accounts you block, videos you like or view.
• Technical: IP address, device and app version, timestamps, and rate-limiting counters kept for a short period.

The camera

Pose estimation runs on your device. The camera frames are analysed locally to count repetitions and are not uploaded, not stored by us, and not sent anywhere. What leaves your phone is the result — the numbers above.

A video only leaves your device when you deliberately record and upload one.

2. What we do not collect

We do not collect government ID, precise location, contacts, health records, or biometric identifiers. We do not use your workout videos to train pose models. We do not sell personal data, and we do not run advertising networks in the app.

3. Why we use it, and on what basis

Accepting the Terms of Use and this policy is required to create an account, because without them there is no service to provide. Marketing email is not: it is a separate box, unticked by default, that you can leave alone and still sign up. You can turn it on or off at any time in Settings, and turning it off takes effect immediately.

Under Thailand's PDPA the equivalent bases are contract, legitimate interest and legal obligation. Where we rely on consent — marketing email, and creator monetization — you can withdraw it, and we explain the effect at the point we ask. We record which version of this policy and of the Terms you accepted, and when, so we can answer that question accurately if you ever ask us.

4. What other people can see

• Public to signed-in users: username, display name, avatar, level, XP, total score, leaderboard position, uploaded reels, comments.
• Visible to your team: your contribution to the team score, team chat.
• Visible in a room: your handle and your live score while the room runs.
• Private: email address, password hash, body weight, coins, ban state, billing records, direct messages, reports you file, blocked accounts.

Moderators and administrators can see reported content, the account behind it, and — for a paying or earning account — the billing and payout records they need to do their job.

5. Who we share it with

• Hosting and storage: our cloud provider and object storage for uploaded media.
• Payments: our card processor, and Apple or Google for in-app purchases. They receive what they need to take the payment; we never receive your full card number.
• Infrastructure: email delivery, error and performance monitoring.
• Authorities: when we are legally required to, and no further than required.

Some of these process data outside Thailand. Where they do, transfers rely on standard contractual clauses or an equivalent safeguard.

6. How long we keep it

• Account data: until you delete your account.
• Workout results and scores: until you delete your account; leaderboard entries are removed with it.
• Content you delete: removed from the app immediately and purged from storage within 30 days.
• Moderation records for content that was reported or removed: up to 2 years, so repeat behaviour can be recognised.
• Billing, payout and tax records: as long as tax and accounting law requires (currently 10 years in Thailand), in a pseudonymised form once the account is gone.
• Security logs: up to 90 days.

Deleting your account removes your profile, your content, your comments, your scores and your messages. Records we are legally obliged to keep are stripped of identifying fields and retained under a pseudonymous key that cannot be reversed to you from within the app.

7. Your rights

You can ask us to give you a copy of your data, correct it, delete it, restrict or object to a use, or hand it to another service. Where we rely on consent you can withdraw it at any time.

Write to [PRIVACY EMAIL]. We answer within 30 days. If you are not satisfied you can complain to the Personal Data Protection Committee in Thailand, or to your local supervisory authority.

8. Children

FlexBlitz is not for anyone under 16, and we do not knowingly collect their data. 16 is above the 13 that US federal law sets and matches the highest minimum any EU member state applies, so one rule covers every market we operate in. If you believe an underage person has an account, write to [PRIVACY EMAIL] and we will remove it.

9. Security

Passwords are hashed with bcrypt. Sessions use short-lived access tokens with rotating refresh tokens, and a session can be revoked immediately. Traffic is encrypted in transit. Access to production data is limited to staff who need it. No system is perfect; if a breach affects you we will notify you and the regulator as the law requires.

10. Changes

We will bump the version at the top of this page for any change, and tell you in the app before a material change takes effect.