Privacy policy
Last updated: 15 October 2026
This Privacy Policy explains what personal data ATHLO+ collects, why we collect it, who we share it with, and what you can do about it. It is written to comply with the Singapore Personal Data Protection Act 2012 (PDPA).
ATHLO+ is a brand of SportPlus SG Pte. Ltd. (UEN 201716926H), 2 Kallang Ave, Singapore 339407. In this policy, “we”, “us” and “ATHLO+” mean SportPlus SG Pte. Ltd., and “the Services” means athlo.sg together with your athlete locker, the community profiles, session bookings, the points programme and our emails.
SportPlus SG Pte. Ltd. is the organisation responsible for your personal data under the PDPA. Where this policy says we share data “within our group”, that means between the ATHLO+ brand and its parent, SportPlus SG Pte. Ltd.
We have deliberately written this policy to describe the whole product — not just the shop. If you only ever browse and buy gear, most of the sections below will not apply to you.
1. A summary, in plain English
- We never see your card. Payment is handled inside Shopify’s checkout. Card numbers do not reach our servers and we cannot store them.
- We never learn your age. If you add a birthday, only the day and month leave your device. The year stays on your phone or computer.
- Your locker photo stays on your device. If you upload a profile photo it is stored locally and is never uploaded to us.
- Strava is optional and read-only. If you connect it, we use your activities to verify your personal bests and work out your weekly totals. We only show you on our leaderboards or public profiles if you switch that on. We keep nothing from Strava for more than 7 days without checking it again, and we delete all of it when you unlink or revoke our access.
- Analytics are off until you agree. No analytics or advertising cookies run until you accept them.
- We do not sell your personal data, and we do not share it with advertising networks.
2. What we collect, and when
2.1 When you browse athlo.sg
- Your IP address, device type, browser and operating system, pages viewed and actions taken, and the site that referred you.
- Cookies and similar storage strictly necessary to run the site — your cart, your login session, and your cookie choice itself.
- Analytics data (Google Analytics 4) only if you accept it on our cookie banner. If you choose “Essential only”, analytics and advertising storage stay switched off.
2.2 When you buy something
- Your name, email address, billing and delivery address, and phone number.
- Your order contents, order history, and delivery status.
- Payment confirmation details — the card brand, last four digits, and whether the charge succeeded. We never receive or store your full card number, expiry date or security code. These go directly to Shopify and its payment processors, which are certified to PCI DSS Level 1.
2.3 When you create an athlete locker
Your locker is optional and you control what goes in it. It may contain:
- Display name, avatar or custom athlete kit, and up to three saved looks.
- Gender, short bio, home base, and the year you started training.
- Your birthday — day and month only. See section 3.
- Sports and interests, personal bests, custom tracked stats, and race results you enter.
- Social links you choose to add (Instagram, Strava, a personal site).
- Your public profile handle, profile background colour, privacy settings, and which achievements you have unlocked.
2.4 When you earn or spend points
- Your points balance and lifetime tier, and a log of points earned, redeemed and expired.
- Verified spend linked to your orders, referrals you make, and the day and month of your birthday if you have added one (so we can send your birthday reward).
2.5 If you connect Strava (entirely optional)
- Access and refresh tokens, held only on our servers, never in your browser.
- Your Strava athlete ID and the permissions you granted.
- For each personal best we verify: the result (for example a 5K time), the ID of the Strava activity it came from, that activity’s visibility setting, and when we last checked it. We re-check each one against Strava at least every 7 days, and remove it if the activity has been deleted or made private, or no longer supports it.
- For your recent runs, rides and swims: the sport, start time, distance, elevation gain, moving time and visibility setting of each activity, kept for no more than 7 days. We use them to work out your weekly totals and your streak and, only if you switch on Show me publicly, to place you on the weekly leaderboard.
- The IDs of activities we processed recently, kept for no more than 7 days so we don’t process the same activity twice.
- Your choice about public display, and when you made it.
- If you tap Email me when it opens while Strava sign-ups are full: that you asked, and when. We use it only to email you when there is room, and you can take yourself off the list at any time.
- We request read-only access. We cannot post, edit or delete anything on your Strava account.
- Nothing from Strava is shown to anyone else unless you tick “Show me publicly”. It is off by default and you can change it at any time in your Locker. Even then, only activities you share with “Everyone” on Strava are ever shown publicly, and we never show the Strava data of members under 18.
- We do not store your routes, maps, photos, heart rate or activity titles, or your Strava name.
2.6 When you book a session with a partner
- Your name, email address and phone number.
- The service, the partner, your requested and confirmed times, your booking reference, and payment or refund status.
- Any waiver, health declaration or intake answers the partner requires. Where a waiver form appears on a service page it is provided by a third-party app — see section 5.
The partner you book with receives your name and booking details so they can deliver and confirm the session. Where a partner runs their own calendar system, your name, the time and the booking reference are written into it. See section 5.
2.7 When you join our mailing list, take a quiz or play a game
- Your email address, and your quiz answers or game results.
- Whether you opened or clicked our emails.
Joining our mailing list is not the same as becoming a member, and you can leave at any time using the unsubscribe link in any email.
2.8 When something breaks
To find and fix faults, we log technical details when a page errors: the error message and where it occurred, the page address, your browser’s user-agent string, and whether the visitor was logged in (a yes or no — not who you are). Your IP address is stored only as a one-way salted hash, which lets us group repeated faults without recording the address itself.
2.9 When you contact us
Your name, email address or phone number, and whatever you tell us in the message, along with our reply.
3. What we deliberately do not collect
These are design decisions, not just promises, and they are enforced in our code:
- Your full card details. Handled entirely by Shopify’s checkout.
- Your birth year, and therefore your age. When you set a birthday, your device keeps the full date and sends us only the day and month. We use it to send a birthday reward. We cannot calculate your age from what we hold.
- Your locker profile photo. It is kept in your browser’s local storage and is never uploaded.
- Your Strava activity history. We keep only the verified results and the short-lived activity summaries described in section 2.5, never the activity itself (routes, maps, photos, heart rate).
- Your password. Sign-in is handled by Shopify. We never see, receive or store it.
4. Why we use your data, and our legal basis
Under the PDPA we rely on your consent, on deemed consent where you voluntarily give us data for an obvious purpose (such as an address so we can deliver an order), and on the Act’s legitimate interests and business improvement provisions where they apply.
| Purpose | Basis |
|---|---|
| Take payment, fulfil and deliver your orders, handle returns and refunds | Performance of our contract with you; deemed consent |
| Create and run your account and athlete locker; show your public profile as you have configured it | Consent |
| Request, confirm, reschedule and cancel partner sessions | Performance of our contract; deemed consent |
| Run the points programme, verify earned points, and send your birthday reward | Consent |
| Verify personal bests from Strava, and work out your weekly totals and streak | Consent, which you withdraw by unlinking Strava in your Locker or revoking our access in your Strava settings |
| Show your name, weekly totals and verified personal bests to others, on leaderboards and your public profile | Separate, opt-in consent (“Show me publicly”). Off by default, and you can withdraw it at any time in your Locker |
| Send you service messages you would expect — order updates, booking confirmations, refund notices, security notices | Performance of our contract; legitimate interests |
| Send marketing emails | Consent, withdrawable at any time |
| Detect and prevent fraud, abuse, spam and unauthorised access; enforce our Terms | Legitimate interests |
| Measure how the site is used and improve it | Consent for analytics cookies; business improvement for aggregate analysis |
| Diagnose faults and keep the Services working | Legitimate interests |
| Meet tax, accounting and other legal obligations | Legal requirement |
We do not use your personal data to build advertising profiles, and we do not share it with advertising networks or data brokers. We do not sell personal data.
5. Who we share your data with
We share personal data only with organisations that need it to run the Services, and only as much as they need. Each is bound to protect it and to use it solely on our instructions.
| Who | What they handle |
|---|---|
| Shopify | The store, checkout, payments and customer accounts. Hosts our shop and processes your orders. |
| Supabase | The database and backend behind your locker, the points programme and bookings. |
| Cloudflare | Domain, content delivery, security filtering, and staff access control. |
| Resend | Sends our transactional email — booking confirmations, reminders, refunds, birthday rewards. |
| Google Analytics 4, only after you accept analytics cookies. Also logs quiz and mailing-list entries. | |
| Strava | Only if you connect it, and only for as long as you keep it connected. Strava may monitor and collect usage data about how its API is used, including through our connection, and may use that data for any business purpose, as set out in Strava’s own terms and privacy policy. |
| The partner you book | Your name and booking details, so they can deliver the session. Where the partner uses a calendar system such as Wix or Google Calendar, your name, the session time and the booking reference are written into it. |
| The brand that ships your order, and its courier | Our physical products are shipped to you directly by the brand whose product you bought, or by that brand’s official distributor. They receive the order details they need to ship it — your name, delivery address, contact details and the items you ordered — and pass your name, address and phone number to their courier. Your order reaches them through Shopify Collective or the Multi Store Sync app by Tipo. |
| Easify | Provides waiver and intake forms shown on some service pages. |
| SportPlus SG Pte. Ltd. | Our own group. ATHLO+ is a SportPlus SG Pte. Ltd. brand, so the same people run both and may access your data to operate the Services and support you. This is not a sale or a transfer to an outside company. |
We may also disclose personal data where we are legally required to, to comply with a valid order from a court, regulator or law-enforcement agency, to establish or defend legal claims, or to protect the safety of our members, our staff or the public. If our business is sold or reorganised, data may transfer to the acquirer, who will remain bound by this policy or a materially similar one.
6. Transfers outside Singapore
Some of the organisations above store or process data outside Singapore, including in the United States, Canada, the European Union and Hong Kong. Where we transfer personal data overseas we take reasonable steps, as required by section 26 of the PDPA, to satisfy ourselves that the recipient is bound to a standard of protection comparable to the PDPA — ordinarily through contractual commitments such as data processing agreements and standard contractual clauses.
7. Cookies, analytics and your choices
We use three kinds of browser storage:
- Strictly necessary — your cart, your login session, your cookie choice, and security protections. These cannot be switched off without breaking the site.
- Analytics — Google Analytics 4. Off by default. These run only after you press “Accept”.
- Advertising — we do not currently use advertising or personalisation storage at all, and our cookie banner does not grant it.
You can decline analytics at any time by choosing “Essential only” on the banner, and you can change your mind later by clearing this site’s data in your browser, which makes the banner appear again. You can also block or delete cookies in your browser settings, though parts of the site may then not work.
8. Members under 18
You must be at least 13 to create an ATHLO+ account. If you are under 18, the Services apply additional protections to your profile automatically, without you having to ask:
- Age-related and social-link fields are hidden from their public profile.
- These protections are enforced on our servers, not merely hidden in the page, so they cannot be bypassed by calling our systems directly.
- Once applied, the protections cannot be switched off by a device that has lost its stored birthday — they persist until the member genuinely turns 18.
We do not knowingly collect personal data from children below the age at which they can consent for themselves under Singapore law. If you are a parent or guardian and believe your child has given us personal data, contact us at the address in section 13 and we will delete it.
9. How we protect your data
No system is perfectly secure, and we will not pretend otherwise. What we can tell you is what we actually do:
- Everything travels encrypted. The whole site is served over HTTPS, and data is encrypted at rest by our hosting providers.
- Only you can write to your locker. Every write is cryptographically signed by Shopify to prove it came from your logged-in session. Our backend ignores any identity claimed in the request itself, so nobody can alter your profile by guessing an ID.
- Our database is not reachable from the internet. There is no database key in the website’s code. All access runs through our own authenticated backend.
- Privacy settings are enforced on the server. Fields you mark private are removed before a public profile is sent out, so they cannot be scraped by calling our systems directly.
- Staff access is locked down. Our admin tools sit behind single sign-on with an explicit per-person allowlist. There is no shared admin password.
- Rate limiting and abuse controls throttle attempts to hammer, spam or brigade our systems, identified per caller.
- Secrets are never in the website. API keys and tokens are held in server-side secret storage.
- We back up regularly and have tested that we can restore from those backups.
- Sensitive data is minimised or hashed rather than stored — see sections 2.8 and 3.
If a data breach occurs that results in, or is likely to result in, significant harm to affected individuals or is of a significant scale, we will notify the Personal Data Protection Commission and affected individuals as required by Part 6A of the PDPA.
Please still take your own precautions: keep your account credentials to yourself, and do not send us sensitive information over channels you do not trust.
10. How long we keep your data
We keep personal data only as long as we need it for the purposes in section 4, or as long as the law requires.
| Data | Kept for |
|---|---|
| Order, payment, refund and booking records | At least 5 years, because Singapore tax and accounting rules require us to keep them that long |
| Your account and athlete locker | While your account is open. If you ask us to delete it, or your account is deleted, we erase your locker and everything linked to it — profile, personal bests, races, avatar, saved items, points history and any Strava connection. We action deletion requests within 30 days |
| Points balances and history | While your account is open |
| Strava access tokens | Until you unlink Strava or revoke our access at Strava. We then delete your tokens and every piece of Strava data we hold about you, and confirm it on screen. When you unlink from ATHLO+, we also ask Strava to revoke our access |
| Verified personal bests from Strava | While you stay connected, re-checked against Strava at least every 7 days. Deleted when you unlink or revoke access. A PB whose value you edited yourself stays as an ordinary, unverified PB |
| Summaries of your recent Strava activities | No more than 7 days |
| IDs of Strava activities already processed | No more than 7 days |
| Leaderboard and challenge caches | No more than 7 days, refreshed daily |
| Your public-display choices | A record of each choice, kept while your account is open, so we can show you consented |
| Strava sign-up waitlist | Until you connect Strava, take yourself off the list, or your account is deleted |
| Mailing-list membership | Until you unsubscribe |
| Technical error logs | 30 days, deleted automatically every night |
| Support conversations | In our email inbox, kept while they are useful for supporting you and normally no longer than 24 months |
Where we no longer need data but cannot yet delete it, we stop using it and restrict access to it.
11. Your rights
Under the PDPA you may:
- Ask what we hold and how we have used it. We will respond, ordinarily within 30 days, and tell you if we need longer.
- Correct anything inaccurate. Most of your locker you can edit yourself at any time.
- Withdraw your consent to any use of your data, including marketing. We will tell you if withdrawing means we can no longer provide part of the Services. Some records must be kept for the periods in section 10 even after you withdraw.
- Ask us to delete your data, subject to those retention periods.
- Ask for a copy of your data in a portable form.
- Opt out of marketing at any time using the unsubscribe link in any of our emails, or by contacting us. You may also register with Singapore’s Do Not Call Registry to stop marketing calls and texts.
We will never treat you differently for exercising these rights. We may need to verify your identity before we act on a request. There is no charge for a reasonable request; if a request is unusually costly we will tell you the fee before doing the work.
12. Complaints
If you are unhappy with how we have handled your data, please contact our Data Protection Officer first — we would rather fix it. If we cannot resolve it, you may complain to the Personal Data Protection Commission of Singapore at pdpc.gov.sg.
13. Contact us
We have appointed a Data Protection Officer who is responsible for how we handle personal data and for answering your requests under this policy. You can reach the Data Protection Officer at:
Email: john@sportplus.sg
Post: The Data Protection Officer, SportPlus SG Pte. Ltd., 2 Kallang Ave, Singapore 339407
14. Changes to this policy
We may update this policy as the Services change or the law requires. We will post the revised version here and update the date at the top. If a change materially affects how we use data you have already given us, we will tell you directly and, where the law requires it, ask for your consent again.