Spotter ("the app", "we", "us") is a fitness-tracking app with an AI pose-analysis coach, workout planner, nutrition logger, and AI health coach. This policy explains what personal data we collect, why we collect it, how it is used and shared, and your rights under the Hong Kong Personal Data (Privacy) Ordinance (Cap. 486) ("PDPO").
The data controller is the operator of Spotter, contactable at support@spotterhk.com. All requests relating to personal data should be directed to this address.
| Category | What we collect | How |
|---|---|---|
| Account | Email address; encrypted password (stored and managed by Supabase Auth) | You provide on sign-up |
| Profile & body data | Name, display nickname, age, gender, height, weight, body-fat %, skeletal muscle mass, target weight, fitness goal, experience level, weekly training frequency, activity level, preferred training time, focus body parts | You provide during onboarding and in Profile settings |
| Workout & training data | Exercises performed, sets, reps, weights, training session timestamps, rest intervals, superset / drop-set tags, training plans, cardio activity type / duration / heart rate / calories | You log during or after training sessions |
| Nutrition & hydration data | Meal entries (food name, portion, kcal, carbohydrates, protein, fat, fibre), daily calorie & macro targets, daily water intake (ml), water reminder settings | You log manually or via AI photo/text analysis |
| Weight history | Body-weight readings with timestamps | You log periodically |
| Camera & workout video data | When you use the AI Form Coach, you record or select a short training video (up to 60 seconds). A small number of still frames are extracted from that video and sent to our secure backend, then forwarded to our AI provider to generate form-analysis feedback. The original video file itself is not uploaded โ it stays on your device unless you choose to share it. Extracted frames are used only to generate that single analysis response and are not stored by us afterwards. | Camera/photo-library accessed only when you use the AI Form Coach |
| AI coaching & chat content | Your chat messages to the AI coach; still frames extracted from workout videos (see above) sent for form analysis; meal photos or text descriptions sent for food recognition; InBody report photos sent for body-composition parsing | Transmitted to our secure backend when you use AI features |
| Apple Health data | Today's step count and the latest heart-rate reading (read-only, from Apple HealthKit). We do not write any data to Apple Health. | Only if you grant HealthKit permission |
| InBody scan data | Photo of your InBody body-composition report. AI extracts weight, body-fat %, muscle mass, and test date. The photo is sent to our AI backend for processing and is not stored beyond the API call. | Only when you use the InBody Scan feature |
| Usage analytics | Screen views, feature interactions, sign-up and login events, session duration, collected via PostHog | Automatically while you use the app |
| Crash & error reports | Device model, OS version, error stack traces, collected via Sentry when the app encounters an error | Automatically on app crash or error |
| Diagnostic & telemetry data | App version, build number, platform, OS version, device model, locale, last-seen timestamp, AI-request latency and feature type (but not content), whether AI or offline fallback answered | Automatically at launch and during AI feature use |
| Feedback | Messages you voluntarily submit via the in-app feedback form | You provide when submitting feedback |
| Peer-sharing data | If you generate a share code, your workout history and progress may be visible to anyone who enters that code. You control this at all times. | Only if you generate and distribute a share code |
| Subscription & purchase data | Subscription status (active / expired / trial), purchase history, and entitlement records. Used to unlock Spotter Pro features and restore your subscription on reinstall. Managed via Apple App Store and RevenueCat; we do not store payment card details. | Only if you start a free trial or purchase a Spotter Pro subscription |
We do not sell, rent, or trade your personal data. We share data only with the following service providers, each of whom processes data solely to provide their service:
| Provider | Purpose | Data shared |
|---|---|---|
| Supabase | Authentication, database, cloud storage | Account data, profile, all fitness/nutrition/coaching records |
| AI Provider (via our secure proxy) | Generate coaching responses, food recognition, InBody parsing | Chat messages, exercise summaries, meal photos/text, InBody photos |
| Apple Inc. | Payment processing for Spotter Pro subscriptions (App Store) | Purchase transaction data, subscription status โ managed entirely by Apple; we do not receive raw payment card details |
| RevenueCat | Subscription management and receipt verification | Anonymous user ID (your Supabase account ID), purchase records, subscription status, device platform data. RevenueCat does not receive your name, email, or workout data. |
| PostHog | Usage analytics | Anonymised event data (no raw personal data fields) |
| Sentry | Crash reporting | Device info, OS version, error stack traces |
Our AI proxy server strips identifying information before forwarding requests to the AI provider. AI provider keys are stored server-side and are never shipped in the app binary.
Under the Personal Data (Privacy) Ordinance (Cap. 486), you have the right to:
To exercise these rights, use the in-app features (Profile โ Edit Profile; ๆ็ โ ๅช้คๅธณๆถ) or contact us at support@spotterhk.com. We will respond within 40 days as required by the PDPO.
If you grant permission, Spotter reads step count and heart-rate data from Apple HealthKit. This data is displayed on your home screen only. It is not uploaded to our servers, shared with third parties, or used for advertising. We do not write any data back to HealthKit. You can revoke this permission at any time in iPhone Settings โ Privacy & Security โ Health โ Spotter.
Spotter is not directed to children under 13 (or the minimum age in your jurisdiction). We do not knowingly collect personal data from children under 13. If you believe a child has provided us with personal data, please contact us and we will delete it promptly.
We may update this policy from time to time. We will revise the "Last updated" date above. Continued use of the app after changes are posted constitutes acceptance of the updated policy.
For privacy enquiries, data access or correction requests, or account deletion assistance:
Email: support@spotterhk.com
Website: spotterhk.com