Your Data

Straight answers about what we know about you, what we don’t, and why you can trust us with it.

Signing up to anything online means handing over something. You should know exactly what. So here is the honest version — no legal fog. If you want the full detail, the Privacy Policy has it.

The five things people actually worry about

“Will you have my card details?”

No. We never see them. When you pay, you are inside Shopify’s checkout — the same system used by millions of stores worldwide, certified to the payment industry’s highest security standard. Your card number goes to the bank, not to us. We are told whether the payment worked and the last four digits. That is all we could tell you about your own card, because it is all we have.

“Can someone else get into my locker?”

Not by guessing. Every change to your athlete locker has to arrive with a cryptographic signature from Shopify proving it came from your logged-in session. Our backend throws away any claim about who you are that comes from the request itself — it trusts only that signature. So knowing your profile URL, your name or your member number gets an attacker nowhere.

And there is no database key hidden in this website for anyone to find. Our database refuses connections from the open internet entirely.

“If I mark something private, is it really private?”

Yes — it is removed before it leaves our server. This matters more than it sounds. A lot of sites just hide private fields in the page, which means the data is still sent to your browser and anyone technical can read it. We strip it out on the server first. If you have hidden your stats, there is nothing to find.

“What do you know about my body and my age?”

Less than you would expect, on purpose.

• We do not know your age. If you add your birthday, your device keeps the year and sends us only the day and month — enough to send you a birthday reward, not enough to work out how old you are.
• Your locker photo never leaves your device. It is stored in your own browser. We could not look at it if we wanted to.
• Your personal bests and stats are yours to show or hide, field by field, and hidden means hidden. See above.

“Are you going to sell my data or spam me?”

No, and no. We do not sell personal data. We do not hand it to advertising networks or data brokers. We do not build ad profiles on you — the site does not even switch on advertising cookies.

Analytics stay off until you tap Accept on the cookie banner. Choose “Essential only” and they never run. Marketing emails are opt-in, and every one has a one-click unsubscribe that actually works.

If you connect Strava

Connecting Strava is optional, and it is how we verify a personal best is real rather than typed in.

• We ask for read-only access. We cannot post, edit or delete anything on your Strava. The permission to do so was never requested.
• We do not keep your training history. We read an activity, check whether it beats one of your personal bests, keep the result, and move on.
• Disconnect whenever you like. We delete our stored access to your account and tell Strava to revoke us, so ATHLO+ drops off your Strava apps list too.

If you book a session

A booking involves a third party — the coach, gym or studio actually delivering it — so here is exactly what happens.

• The partner gets your name and your booking details so they know who is turning up and when. Where they run their own calendar, your name, the time and your booking reference go into it.
• Some partners require a waiver or health declaration. That is theirs, and it is between you and them.
• If a session cannot be confirmed, you get your money back automatically. No emailing us, no chasing. That is written into our refund policy and it runs on its own.

Under 18?

You need to be at least 13 to join ATHLO+. Younger athletes are then protected automatically: age-related details and social links are hidden from public profiles, and those protections are enforced on our servers rather than in the page — so they hold even against someone technical. They also cannot be accidentally switched off; they stay on until you genuinely turn 18.

How to check we are real

Fair question to ask of anyone. Here is how to verify us rather than take our word for it:

• ATHLO+ is a brand of SportPlus SG Pte. Ltd., a registered Singapore company at 2 Kallang Ave, Singapore 339407. Our company registration number is UEN 201716926H — look it up on ACRA’s public register and you will find us. A scam cannot give you a number that checks out.
• We publish a full Privacy Policy, Terms of Service, Refund Policy and Shipping Policy. Read them — vagueness in these is the warning sign.
• Your browser shows a padlock on every page of athlo.sg. Checkout happens on Shopify’s infrastructure.
• A real human answers hello@athlo.sg. Test us before you spend anything.

And here is what we will never do, so you can spot anyone pretending to be us: we will never ask for your password, your full card number, or a one-time code — not by email, not by text, not on the phone. If a message claiming to be ATHLO+ asks for any of those, it is not us. Forward it to hello@athlo.sg.

What we will not claim

We are not going to tell you our systems are unbreakable, because nobody honest says that about any system. What we will tell you is that we have deliberately arranged things so that a bad day costs you as little as possible: we do not hold your card, we do not hold your age, we do not hold your photo, and we do not hold your training history. The safest data is the data we never collected.

Your call, any time

You can ask us what we hold on you, correct it, get a copy of it, withdraw your consent, or tell us to delete it. Most of your locker you can edit or clear yourself in seconds. For anything else, email hello@athlo.sg and we will come back to you within 30 days — usually far sooner.

If you think we have got something wrong and we cannot sort it out between us, you can raise it with Singapore’s Personal Data Protection Commission at pdpc.gov.sg. We would much rather you gave us the chance to fix it first.