Privacy Policy & Data Protection Charter

01. About Us & Data Controller

Welcome to Fitness God Quest (also known and distributed as the Transcendent Fitness Management App, collectively referred to as the "Application", "Platform", or "Services").

This application was conceived, engineered, and developed by Edward Say (Lead Developer), and is officially owned, operated, and maintained by Nakama Spirits Pte. Ltd. (UEN: 202348117G), a private limited company incorporated under the laws of the Republic of Singapore. This privacy charter applies directly to this specific application and our verified operational domains:

For the purposes of the Singapore Personal Data Protection Act 2012 (PDPA), the General Data Protection Regulation (GDPR) (Regulation (EU) 2016/679), and the UK GDPR, Nakama Spirits Pte. Ltd. is the Data Controller responsible for your personal data. This privacy policy is tailored specifically to the operational architecture of Fitness God Quest and is not a sample or generic template.

02. Categories of Personal Data We Collect

In order to deliver advanced biomechanical progression analysis, bilateral coach-athlete management, gamified RPG leveling, and secure subscription billing, we collect and process the following categories of data:

03. Health, Biometric & Special Category Data (PAR-Q+)

Fitness coaching inherently involves the processing of Special Category Health Data under GDPR Art. 9 and sensitive personal data under the Singapore PDPA. We treat this data with the highest standards of confidentiality:

• Physical Activity Readiness Questionnaire (PAR-Q+): When participating in coach-guided or intense exercise, users complete the standard PAR-Q+ screening questionnaire. This assesses cardiovascular indicators (heart condition, chest discomfort during exertion or rest), balance/dizziness, bone or joint vulnerabilities, high blood pressure medication, and physician clearance status.
• Assumption of Risk & Liability Waiver (Form 3A): Legal documentation confirming voluntary participation in progressive physical overload and acknowledgement of inherent athletic risks.
• Biometric Handwritten Signature Canvas: To execute valid digital contracts, our application utilizes an interactive HTML5 canvas allowing clients and coaches to furnish handwritten digital signatures. These signatures are paired with timestamped audit trails and compiled into locked, tamper-evident PDF documents.
• Explicit Consent Requirement: Processing of health and biometric signature data is conducted strictly under your Explicit Consent provided during client onboarding, digital intake execution, or when connecting with a personal trainer.

04. Photo Privacy & Automatic Client-Side EXIF GPS Stripping

Physique progress photos can inadvertently contain sensitive location information embedded inside the image file's Exchangeable Image File Format (EXIF) metadata tags, including precise GPS latitude, longitude, altitude, and device hardware serial numbers.

05. Bilateral Coach-Client Data Access & Disconnection Archival

The application allows independent athletic training (Personal Mode) as well as paired coaching relationships (Coach-Client Mode):

• Authorized Coach Access: When a trainee accepts a coach's invitation code or establishes a coaching link, the coach is granted real-time access to the trainee's workout execution logs, weight logs, biofeedback readiness, habit checklist compliance, and assigned routine templates. Coaches may prescribe custom workout schedules and dietary guidance notes.
• Coach Invoicing & Session Tracking: Coaches can track active session packages, issue custom digital invoices via Stripe, and monitor training compliance.
• Bilateral Disconnection & Archival Rule: If either party initiates a relationship termination through the Bilateral Disconnection protocol:
  • The coach's active real-time viewing and editing privileges over the trainee's day-to-day workout logs are immediately revoked.
  • Signed Legal Document Preservation: Any previously executed legal intake contracts (PAR-Q+, Liability Waiver Form 3A, Coach-Client Agreement, PDPA Consent Form) remain securely archived and accessible to both parties in read-only PDF format. This retention is strictly necessary for statutory legal compliance, mutual protection, and defense against potential liability claims under applicable statutes of limitation.

06. Virtual Executive Assistant (VEA) & Audio / Voice Logging

The application includes the Virtual Executive Assistant (VEA), an intelligent assistant designed to automate workout debriefs, compute progressive overload milestones, and facilitate hands-free dictation:

• On-Demand Voice Dictation: When using the VEA Voice Logger or client voice notes, audio is processed using your browser's native SpeechRecognition / webkitSpeechRecognition Web Speech API. Audio is only accessed while the user explicitly presses and holds or activates the microphone button.
• No Ambient Background Recording: We do not conduct continuous ambient listening or passive acoustic monitoring. When you leave the modal or release the recording toggle, microphone access terminates immediately.
• Speech Data Retention: Transcribed speech is converted to plain text (e.g., "Bench press 100kg for 8 reps RPE 9") and saved directly into your workout notes or coach briefing. Raw audio streams are not permanently archived on our database servers.

07. Gamification, RPG Cosmos & Virtual Items

Under the Fitness God Quest gamification system, physical training metrics are correlated with in-game progression:

• Progression Classes & Attributes: Users select a progression path (Player, Adventurer, or Cultivator). Workout tonnage, workout streaks, and exercise volume yield experience points (EXP) and Starlight Crystals.
• Virtual Familiars & Avatars: Virtual pet companions and customizable 2D avatars reflect user consistency and milestones.
• Training-Only Mode Isolation: Users who opt for "Training App Only" during onboarding have all RPG elements, cosmic storylines, daily streak rewards, and familiar prompts completely disabled and hidden. In this mode, only standard athletic data is logged.

08. Payments, Billing & Stripe Integration

All commercial transactions—including Starlight Crystal bundles, personal training packages, monthly subscriptions, and custom coach invoices—are processed securely via our integration with Stripe, Inc.

• PCI-DSS Compliance: Stripe is certified as a PCI-DSS Level 1 Service Provider, the highest security certification in the payments industry.
• Zero Raw Card Retention: Your full credit card number, CVV/CVC security code, and expiration date are transmitted directly from your browser to Stripe's secure vault via Stripe.js. Nakama Spirits Pte. Ltd. servers never receive, process, or store raw card data.
• Retained Financial Records: To manage subscriptions and provide receipts, we retain non-sensitive transaction tokens, including your Stripe Customer ID, Stripe Subscription ID, invoice status, currency, purchase amount, and transaction dates.

09. Google API Services, OAuth & Google User Data Disclosures

Fitness God Quest integrates with Google Identity Services (GIS) and Google Workspace APIs to provide seamless user authentication and bidirectional workout calendar synchronization. This section provides complete, transparent disclosures in strict accordance with the Google API Services User Data Policy, including the Limited Use requirements and Google OAuth verification criteria.

9.1 Categories of Google User Data Accessed

Our application will access the data you have provided to us via Google APIs solely when you explicitly authenticate with Google Sign-In or connect the Google Calendar feature. Specifically, we access:

Negative Scope Covenant: We do not read, scrape, harvest, inspect, or process any personal emails, unrelated Google Drive files, address book contacts, photos, or unrelated calendar entries from your Google account. Access is strictly scoped to workout scheduling events and user-initiated spreadsheet exports created or managed directly by our application.

9.2 How Your Application Uses Google User Data

We will use your data to provide you with the services you requested. Specifically:

• Identity & Profile Setup: Authenticating your identity and establishing your personalized athlete or coach profile without requiring separate password management.
• Calendar Workout Synchronization: Synchronizing your scheduled workout routines, training blocks, rest days, and personal training appointments directly to your primary Google Calendar, enabling visual schedule management and timely workout reminders.
• Google Sheets Training Exports: Generating structured spreadsheets in your personal Google Drive containing your historical workout logs, total volume load, sets, reps, estimated 1RM calculations, and client training rosters when you explicitly trigger "Export to Google Sheets".
• Account Link Management: Displaying your connected Google account email and status inside in-app settings so you can monitor, configure, or disconnect your integration at will.

9.3 With Whom We Share, Transfer, or Disclose Google User Data

We do not transfer or disclose your information to third parties for purposes other than the ones provided. Specifically:

• Google user data is utilized exclusively to fulfill the core user-requested features: account sign-in and Google Calendar workout scheduling.
• We never sell, rent, lease, monetize, or broker Google user data to any external commercial entity.
• Google user data is never shared with third-party advertisers, data brokers, information resellers, or marketing analytics networks.
• The sole subprocessor handling Google user data is Google Cloud Platform & Firebase, which provides the underlying database and hosting infrastructure subject to strict SOC 1/2/3, ISO 27001, and GDPR Article 28 data processing commitments.

9.4 Data Protection Mechanisms for Sensitive Data

Security procedures are in place to protect the confidentiality of your data. We use encryption to protect your information through comprehensive technical and organizational safeguards:

• Encryption in Transit: All data transmissions between your browser, our application, and Google API servers are encrypted using modern Transport Layer Security protocols (HTTPS / TLS 1.2 and TLS 1.3), preventing eavesdropping and man-in-the-middle attacks.
• Sandboxed Client Storage: Temporary Google OAuth access tokens are stored in origin-isolated client-side browser localStorage (keys: fgq_gcal_access_token, fgq_gcal_user_email, fgq_gsheets_access_token, fgq_gsheets_user_email). Tokens are never written to public source code, backend logs, or third-party monitoring platforms.
• Encryption at Rest: Profile data synchronized through Firebase is safeguarded using enterprise AES-256 encryption at rest across Google Cloud data centers.
• Instant Token Revocation: You can terminate token access at any moment via the in-app Google Calendar Disconnect toggle or through your Google Account security center.

9.5 Data Retention and Deletion Policy

We adhere to strict data minimization principles regarding Google user data:

• Retention Period: We store your personal information for a period of time that is consistent with our business purposes. We will retain your personal information for the length of time needed to fulfill the purposes outlined in this privacy policy unless a longer retention period is required or permitted by law.
• End-of-Life Destruction: When the data retention period expires for a given type of data, we will delete or destroy it. Google Calendar OAuth access tokens are temporary (valid for 1 hour) and are wiped automatically or upon disconnection.
• User-Initiated Deletion: You may request for your data to be deleted by:
  1. Utilizing the self-serve "Delete Profile" modal inside in-app User Settings, which permanently purges your account document and authentication bindings from our operational Firestore database; or
  2. Submitting a direct written request to our Data Protection Officer at edwardjdsay@gmail.com. We will confirm and execute complete data deletion within thirty (30) calendar days.
• Revoking Google Permissions: You can revoke the application's access to your Google Account at any time directly through the Google Account permissions dashboard at: https://myaccount.google.com/permissions.

9.6 Limited Use Disclosure & AI / ML Model Training Prohibition

Our use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Our application limits the use of Google user data strictly to providing and improving user-facing athletic tracking and scheduling features. All other uses of Google user data are strictly prohibited. We explicitly affirm that we do not use or transfer Google user data for any of the following reasons:

10. Push Notifications, Local Storage & Cookies

The application uses modern Progressive Web App (PWA) client technologies to provide fast, responsive, and offline-capable functionality:

• Web Push Notifications (VAPID / FCM): If you grant notification permissions, we use Web Push and Firebase Cloud Messaging to send rest-timer completion chimes, coach feedback notifications, and session reminders. You may revoke notification permissions at any time via your browser settings or the in-app notification toggle.
• Local Storage & IndexedDB: We utilize browser localStorage (keys prefixed with af_) and IndexedDB to cache your active routine builder state, offline workout logs, user interface preferences (theme, dark/light mode, character aesthetics), and automated disaster recovery database snapshots.
• No Third-Party Tracking Cookies: We do not deploy third-party advertising cookies, cross-site tracker pixels, or behavioral retargeting beacons.

11. Legal Bases & Purposes for Data Processing

Under the Singapore PDPA and GDPR Article 6, we process personal data under the following recognized legal grounds:

• Contractual Necessity (Art. 6(1)(b) GDPR): Providing core workout logging, routine calculations, bilateral coach communication, and fulfilling package purchases.
• Explicit Consent (Art. 6(1)(a) & Art. 9(2)(a) GDPR, PDPA s 13): Processing health data, PAR-Q+ declarations, biometric digital signatures, progress photos, and voice notes.
• Legal Obligation (Art. 6(1)(c) GDPR, PDPA s 17): Retaining tax and financial invoice records in accordance with IRAS/Singapore Companies Act and preserving signed liability waivers under applicable statutory limitation periods.
• Legitimate Interests (Art. 6(1)(f) GDPR): Defending against security attacks, preventing fraud, detecting bugs, and maintaining high availability across our cloud infrastructure.

12. Subprocessors & Third-Party Disclosures

We partner with leading, enterprise-grade cloud service providers to power our platform. All subprocessors are bound by data processing agreements (DPAs) enforcing strict confidentiality and data protection standards:

International Transfers: Where data is transferred outside of Singapore or the European Economic Area, transfers are safeguarded using European Commission Standard Contractual Clauses (SCCs), adequacy decisions, or legally recognized transfer mechanisms ensuring equivalent levels of protection.

13. Data Retention, Portability & Account Deletion

• Active Account Retention: Your workout history, routine library, and progression stats are retained for as long as your account remains active.
• Data Portability: You have the right to download a machine-readable copy of your personal data at any time. Coaches and athletes can export comprehensive workout logs and routine datasets in JSON or CSV format directly from the in-app settings and admin dashboards.
• Self-Serve Account Deletion: You can permanently delete your profile and associated training data at any time using the in-app "Delete Profile" modal (located in User Settings). Once initiated, your personal user document, authentication credentials, routine libraries, and active logs are permanently expunged from our operational database.
• Statutory Retention Exception: In accordance with legal obligations, signed legal waivers (Form 3A) and tax billing records cannot be destroyed immediately upon account closure and are retained in an isolated, encrypted archive for the duration of the applicable legal limitation period (typically 5 to 7 years) to protect both parties in the event of legal disputes.

14. Your Legal Privacy Rights

Depending on your location and citizenship, you enjoy specific legal rights regarding your personal information:

• Rights under Singapore PDPA: The right to request access to your personal data, the right to request correction of inaccurate data, and the right to withdraw consent for processing (with reasonable advance notice).
• Rights under GDPR / UK GDPR: The right to access (Art. 15), right to rectification (Art. 16), right to erasure / "Right to be Forgotten" (Art. 17), right to restriction of processing (Art. 18), right to data portability (Art. 20), and right to object to processing (Art. 21).
• Rights under California CCPA / CPRA: The right to know what personal information is collected, the right to delete personal information, the right to correct inaccurate information, and the right to non-discrimination for exercising your rights. We do not sell or share personal information as defined by California law.

To exercise any of your rights, contact our Data Protection Officer at edwardjdsay@gmail.com. We will respond within 30 calendar days (or the statutory period prescribed by your jurisdiction).

15. Children's Privacy & Minors

Our application is intended for individuals who are at least 13 years of age (or 16 years of age in the European Economic Area).

We do not knowingly collect or solicit personal data from children under 13. If you are under the legal age of majority in your jurisdiction (typically under 18 or 21), you may only use our services and participate in training under the supervision of a parent or legal guardian who must co-sign the digital Liability Waiver and PAR-Q intake forms.

If we discover that personal data of a child under 13 has been collected without verified parental consent, we will promptly delete that data.

16. Contact Our Data Protection Officer (DPO)

If you have questions, feedback, or concerns regarding this Privacy Policy, our data handling practices, or wish to submit a formal data subject access request (DSAR), please reach out directly to our Data Protection Officer:

You also have the right to lodge a complaint with your relevant supervisory authority, such as the Personal Data Protection Commission (PDPC) in Singapore (www.pdpc.gov.sg) or your local European Data Protection Authority.

17. Policy Updates & Notification Procedures

We may periodically update this Privacy Policy to reflect advancements in our training technologies, regulatory evolutions, or modifications to third-party integrations (including Google Identity Services and Google Calendar APIs).

Notice of Material Changes: If we modify this privacy policy in a way that materially changes how we access, collect, use, store, or share Google user data or sensitive biometric records, we will notify users through the following channels prior to the changes taking effect:

• In-App Notice Banner: A prominent modal notification or banner will be displayed in the application interface upon your next login or session launch.
• Email Notification: Registered account holders with an active email address on file will receive a direct notification outlining the key updates and effective dates.
• Version History & Effective Date: The "Effective Date" and "Version" displayed at the top of this document will be updated synchronously with any amendments.

Your continued use of Fitness God Quest following the effective date of an updated Privacy Policy constitutes your acknowledgement of the revised terms. If you do not agree with any revised data handling practices, you may disconnect third-party integrations or close your account at any time.