Privacy notice
This notice explains what personal data Thryform collects, why, who can see it and how long we keep it, in line with Malaysia's Personal Data Protection Act 2010 (PDPA).
Who we are
Thryform runs the Thryform app, which connects personal trainers with clients and helps trainers coach them. For any privacy question or request, email fitnessaspire888@gmail.com.
What we collect
- Everyone: your name, email, password (stored encrypted, we can't see it) and profile photo if you add one.
- Trainers: your public profile (headline, bio, city, specialties, packages, coaching hours), WhatsApp number and Instagram handle if you add them, and your IC or passport and any certificates you upload for verification.
- Clients: the training, nutrition, bodyweight, body-assessment, habit and check-in information you or your trainer record, messages with your trainer, and reviews you post.
Body measurements and check-ins can describe your physical health. We only use them to help you and your trainer track progress.
Why we use it
- To run your account and the coaching features you use.
- To show trainers in the marketplace and let clients contact them.
- Trainer ID documents are used only to confirm the trainer is a real person before they appear in the marketplace, and kept so we can confirm who an account belongs to if a safety concern, complaint or legal request ever comes up.
- To keep the platform safe, for example blocking accounts that break our rules.
We don't sell your data. We show some product picks (affiliate or sponsored links) based on the page you're on. We only use your own progress data to choose products if you turn on Suggestions based on my progress in the Shop, and you can turn it off any time. When you tap a product, we record which product, where in the app and when, so we can count clicks. Brands only ever see totals, never who you are or your data.
Who can see it
- The public: a trainer's public profile, packages, contact buttons, coaching hours and reviews (shown with the reviewer's first name and initial only).
- Your trainer: the coaching data of clients they coach. A trainer who used to coach you keeps a view of what was recorded while they coached you, but not anything you log after coaching ends. A new trainer you join can see your full training history.
- The Thryform team: account details, and trainer ID documents and certificates, for verification and safety only.
- Nobody else. ID documents are never shown to clients or the public. They're stored privately and opened only through links that expire after 10 minutes.
Where it’s stored
Your data is stored with our hosting providers, Supabase (database and files, in Singapore) and Vercel (the website). Data is encrypted in transit and access is restricted by account permissions.
How long we keep it
| Data | Kept until |
|---|---|
| Trainer ID and certificates | Deleted automatically 12 months after the trainer’s last log-in, or 90 days after a rejected verification that isn’t re-sent, or straight away when the trainer removes them |
| ID of a blocked account | 24 months after blocking, in case it’s needed for an investigation |
| Account and coaching data | While your account is open. Ask us to delete your account and we’ll remove it within 30 days |
Your choices and rights
You can ask to see, correct or delete your personal data, or withdraw consent, by emailing fitnessaspire888@gmail.com. You can edit most details yourself in the app, and trainers can remove their documents at any time from the Verification page. Removing your ID means you won't be listed in the marketplace.
Language
This notice is available in English and Bahasa Malaysia. If the two versions differ, the English version applies.
Changes
If we change this notice we'll update the date above and, for important changes, tell you in the app.
Client Terms of Use · Trainer Agreement
© 2026 Thryform