Privacy Policy

Katado (“Katado”, “we”, “us”) is a free, local-first workout logging web app at katado.app. This policy explains what personal data we process, why, who processes it for us, and the rights you have under Singapore’s Personal Data Protection Act (PDPA), the EU/UK General Data Protection Regulation (GDPR) where it applies to you, and similar laws.

Who we are (data controller)

Katado is operated by Daniel Cheng. For any privacy question, or to exercise your rights, contact us at privacy@katado.app.

Privacy by design

Katado is local-first: your workouts are saved on your device first and are sent to our cloud only if you choose to sign in to sync across devices. You can use the app fully without creating an account.

What we collect

• Identity. When you first open the app we create an anonymous identifier so your data can be saved. If you choose Google sign-in, we receive your name and email address from Google to identify and sync your account.
• Workout data you enter. Exercises, sets (weight, repetitions, and effort/RPE), session dates and times, and — only if you add them — a workout location, notes, bodyweight, and bodyweight-relative load, plus your preferences (units, theme). Some of this may be health or fitness data — see the note below.
• Reach analytics. To understand how many people use Katado and roughly where, we record a minimal once-a-day “app opened” measure containing: a random device identifier we generate (not linked to your name or email), whether the device is signed in, whether it has ever logged a set, a coarse location (country and, where available, region/city derived from your IP), and a truncated IP address (the last part is removed so it can’t identify you). We do not track you across other sites and never use this for advertising. In the EU/EEA and UK this runs only with your consent; elsewhere it runs by default and you can turn it off at any time (see below).
• Technical data. Standard server logs (such as IP address and browser type) processed by our hosting provider for security and reliability.

Health & fitness data

The workout information you log — and any bodyweight you enter — may be considered health-related data. We process it solely to provide the app to you (store, display, and sync your workouts and estimate calories and progression), on the basis of your use of the service and, where required, your explicit consent. We do not share it, sell it, or use it for any purpose other than running Katado for you. You can delete it at any time.

Why we use it, and our legal bases

• To provide the service (GDPR Art. 6(1)(b), contract): to store, display, and sync your workouts and generate progression suggestions from the numbers you enter.
• To sign you in (Art. 6(1)(b)/(a)): only when you choose Google sign-in.
• Reach analytics (Art. 6(1)(a), consent, in the EU/EEA and UK; Art. 6(1)(f), legitimate interests, elsewhere): to measure how many people use the app and roughly where. You can withdraw consent or opt out at any time in the app.
• To keep the service secure (Art. 6(1)(f), legitimate interests): monitoring and error/abuse prevention, kept minimal and balanced against your rights.

We do not use your data for advertising, and we do not sell it.

Cookies, local storage & consent

We set no advertising or cross-site tracking cookies. We use:

• Strictly necessary storage to run the app — the on-device database (IndexedDB) that holds your workouts, the session storage that keeps you signed in, and a short-lived cookie that records your approximate country so we can show the right consent choices.
• Analytics storage — the random device identifier and a “last pinged” marker used for the reach measure described above, kept on your device.

If you are in the EU/EEA or UK, we show a consent banner on first use and do not run analytics until you choose “Allow analytics”. You can change your choice at any time from the account sheet in the app (“Anonymous analytics”). Outside those regions analytics is on by default and the same control lets you opt out.

Who processes data for us

We rely on a small set of vetted providers who process data on our behalf:

• Supabase — database and authentication (your synced workouts and account, and the reach-analytics records).
• Vercel — website/app hosting, server logs, and the edge network that provides the coarse country/region used for the reach measure.
• Google — only if you choose Google sign-in.

Each provider processes data under its own data-processing terms. We do not sell or rent personal data.

International transfers

Our providers may process data in the United States or other countries. Our database is hosted in Singapore. Where data leaves your region (for example the EEA or UK), transfers rely on appropriate safeguards such as the European Commission’s Standard Contractual Clauses.

How long we keep it

We keep your account and workout data for as long as your account exists. If you use Katado anonymously, your data lives on your device (and in our cloud only if that device has synced). Deletions propagate across your devices. You can ask us to delete your data at any time.

Your rights

Under the GDPR and similar laws you have the right to access your data, correct it, delete it (the “right to be forgotten”), restrict or object to processing, receive your data in a portable format, and — where we rely on consent — to withdraw it. To exercise any of these, email privacy@katado.app. We are building self-serve export and deletion into the app; until then we handle requests manually and promptly. You also have the right to lodge a complaint with your local data-protection authority.

Security

Access to synced data is protected by row-level security, so each account can reach only its own records, and data is encrypted in transit. No system is perfectly secure, but we design to keep your data isolated and minimal.

Children

Katado is not directed to children. You must be at least 16 (or the age of digital consent in your country), or have the consent of a parent or guardian, to use it.

Changes to this policy

We may update this policy. We will revise the date above and, for material changes, provide a clearer notice.

Contact

Daniel Cheng — privacy@katado.app.