Privacy Policy

Who we are

GoBeast is a pelvic-floor and confidence training app for men. It comes as an iPhone app, an Android app and an installable web app, and this website is gobeast.com. GoBeast is made by Obscura Vertex Pte. Ltd., a company registered in Singapore ("we", "us"). We decide how your personal data is used, so we are its controller.

Questions about privacy go to support@gobeast.com.

This policy covers the apps and this website. Our Consumer Health Data Privacy Policy explains how we handle health-related data under US state laws such as Washington's My Health My Data Act. It applies alongside this policy.

The short version

This website and the waitlist

This website has no cookies, no analytics and no advertising tags.

When you visit

Our host, Vercel, processes your IP address, browser type, the page you asked for and the time, so it can deliver the page and protect the service. These server logs are kept for a short time under Vercel's log settings.

The pages load their fonts from Google Fonts. To do that, your browser connects to Google's servers, which receive your IP address and browser details. Google Fonts does not set cookies. Google's Privacy Policy applies to that connection.

The waitlist

If you join the waitlist, we store your email address, your country, where you signed up (this website) and the date. We use them only to tell you when GoBeast opens in your country, to send your founding-member code and to invite you to vote on the first new program. We don't send other marketing.

We rely on your consent, which you give by ticking the box on the form. You can withdraw it at any time by emailing us or using the link in any waitlist email, and we then delete your entry.

The form sends your entry straight from your browser to our database at Supabase, in the EU (Ireland). Supabase records the request, including your IP address, in short-lived service logs.

Joining a waitlist for a men's health app can itself say something about you, so we treat the list as sensitive. It is never shared, sold or used for ads. We delete it within 6 months after GoBeast launches, or sooner if you ask.

What stays on your phone

Most of what GoBeast knows about you never leaves your device. It is kept in encrypted storage on your phone, or in the web app, in your browser's storage on that device:

• Your onboarding answers, such as your goals, answers about your sexual health, any medication (optional) and your relationship status
• Quiz answers, the private self-check every two weeks, and anything you write in practices
• Your safety-check answers, whether you're on the relax-first path, and when you used the Pain button
• Second-by-second session detail
• Your settings

We can't see this data, and backup never includes it. If you delete the app or use Delete everything, it's gone. If you lose your phone, we can't restore it.

What the app sends to our servers

Your account

The first time you open GoBeast, the app signs in anonymously. That creates a random account ID. It is not linked to your name, and you don't need an email or password. With it we store a few account settings: your time zone, language, app version, the program you're following, and your choices about backup, reminder emails and monthly reminders.

Backup

Backup ("Back up progress" in You › Data) is on by default, so your progress survives a lost or replaced phone. When it is on, the app sends:

• which programs you've started and the lessons, sessions and steps you've completed, with dates
• one summary per session: which workout, how long it ran, how much you completed, your "too easy / right / too hard" tap, and whether the screen was locked
• your Kegel level and training counters
• your streak and your daily reminder time

Turning backup off deletes this copy from our servers and stops further uploads. Your progress stays on your phone.

Notifications

If you allow notifications, we store a push token for your device, with its platform, app version and time zone, so we can send billing reminders.

Optional email and sign-in

If you sign in with Apple, Google or email to sync between devices, we store the email address that service gives us and link it to your account. With Sign in with Apple this can be a private relay address. If you tick "Email me before I'm charged", we store your email address and send a confirmation link first. Reminders only go to confirmed addresses.

The server never receives your answers. A completed lesson can hint at topics you're interested in, so we treat all of the above as health-related data and protect it that way.

Subscriptions and payments

Subscriptions are sold through the App Store and Google Play. Apple and Google handle your payment details; we never see your card. They process your data under their own privacy policies.

We use RevenueCat to manage subscriptions. RevenueCat receives your random account ID and the purchase details Apple or Google provide: product, price, currency, store, purchase and renewal dates, trial status and transaction IDs. We keep a copy of your subscription status (plan, store, status, next renewal date, price and currency) so we can remind you before charges, handle refunds and show your next charge in the app.

When you ask for a forgot-to-cancel refund on Android, we check your session dates to see whether the renewal qualifies, then ask Google to refund it through RevenueCat. On iPhone the request goes to Apple, and Apple decides.

Raw billing events from RevenueCat are kept for 30 days for troubleshooting. A log of the billing reminders we sent (which reminder, for which billing date, by push or email) is kept for up to 400 days, so we can show that a reminder went out before a charge.

Notifications and email

Training reminders (at most one a day) are scheduled on your phone; we don't send them. Billing reminders, 3 days before a trial ends or a subscription renews, are sent by our server through Expo's push service, which passes them to Apple or Google for delivery. Notification text is discreet and never names a body part or condition.

Billing reminder emails, and other service emails you ask for, are sent through Resend, our email delivery provider. We don't send marketing email unless you opt in.

Analytics, only if you allow it

With your permission, the app sends usage events to PostHog (EU cloud) so we can see which screens confuse people and where the app breaks. You choose during onboarding and can change your mind at any time in You › Privacy › Share anonymous usage.

Events are neutral action names from a fixed list, such as "session_completed" or "paywall_viewed", with a few technical details such as how long a session lasted, the app version and the screen name. They never include your answers, safety-check results, Pain-button stops or lesson titles, and programs appear only as codes. Events are linked to your random account ID, never to your name or email. PostHog also receives basic device information. We set it to discard IP addresses.

On Android, if you allow analytics, the first-open event can include the campaign label from the store link you installed from, if there was one.

Crash reports

When the app crashes or hits an error, it sends a crash report to Sentry (EU data region): the error, where in the code it happened, device model, operating system, app version and the last few technical steps. Sending personal data is switched off, IP storage is disabled, and fields that could hold answers or an email are removed before a report leaves your device. Crash reports are deleted within 90 days.

Support messages

If you email support@gobeast.com, we receive your email address and whatever you write. Cloudflare routes mail sent to that address to our team's inbox. You never need to tell us anything about your health to get help. We keep support conversations for up to 2 years after your last message, then delete them, unless we need one longer to deal with a legal claim.

What we never do

• Sell personal data, or share it for targeted or cross-context advertising.
• Send your answers or any health-related data to advertising networks, data brokers or attribution tools.
• Use health-related data for advertising, marketing or profiling.
• Ask for App Tracking Transparency permission or read your device's advertising ID.
• Use your precise location, contacts, photos, camera or microphone.

There are no advertising or attribution SDKs in the app. On iPhone, Apple's own privacy-preserving ad measurement (SKAdNetwork and AdAttributionKit) can tell an ad network, without identifying you, that an install came from its ad. We don't share data with advertisers today. If we ever measure ads in another way, we will update this policy first and ask for your consent where the law requires it.

Why we use your data

If you are in the EEA, the UK or Switzerland, the law asks us to name a legal basis for each use.

Who processes your data

These providers process data for us under data-processing agreements and only on our instructions. Apple and Google act as independent controllers for what they do as app stores.

Where your data is stored

Our database is hosted by Supabase in the EU (Ireland). Some providers above are in the United States or work globally, so your data may be transferred outside your country, including from the EEA, UK or Switzerland to countries without an adequacy decision. Where the law requires it, we rely on the European Commission's Standard Contractual Clauses (with the UK Addendum) or on the provider's certification under the EU–US Data Privacy Framework.

How long we keep it

Your choices in the app

• You › Data › Back up progress: on or off. Off deletes the copy on our servers.
• You › Data › Export my data: a file with the data on your phone and your data on our servers.
• You › Data › Delete everything: deletes your account, your data on our servers and the data on your phone. See Delete your account.
• You › Privacy › Share anonymous usage: analytics on or off.
• You › Subscription: switch monthly renewal reminders off. Reminders before a trial ends or a yearly renewal always appear in the app.
• Notifications: your phone's settings. Emails: the link at the bottom of each email.

Your rights

Depending on where you live, you can ask to access, correct, delete or export your personal data, to restrict or object to how we use it, and to withdraw consent at any time (this doesn't affect what we did before). We will never treat you differently for using these rights.

Export and deletion are self-serve in the app. For anything else, email support@gobeast.com, ideally from the address linked to your account. Most accounts are anonymous, so we may ask for something only you would have, such as the order number on your Apple or Google receipt, to find yours. We reply within 30 days, and tell you if the law allows us more time and we need it.

EEA, UK and Switzerland

You have the rights above under the GDPR and UK GDPR, including data portability. You can complain to your local data protection authority, such as the Data Protection Commission in Ireland or the Information Commissioner's Office in the UK.

United States

Residents of California and other states with privacy laws can ask to know, access, correct and delete their personal information. We do not sell or share personal information for cross-context behavioural advertising, and have not done so in the past 12 months. We use sensitive personal information only to provide the service you asked for. You can use an authorised agent. If we refuse a request, you can appeal by replying with "Appeal" in the subject line; we answer within 45 days, and if you disagree you can contact your state attorney general. Health-related rights are covered in our Consumer Health Data Privacy Policy.

Canada, Australia, New Zealand and Singapore

You can ask to access and correct your personal information. You can complain to the Office of the Privacy Commissioner of Canada, the Office of the Australian Information Commissioner, the Office of the Privacy Commissioner in New Zealand or Singapore's Personal Data Protection Commission.

Security

• Data is encrypted in transit (TLS) and at rest on our database provider (AES-256).
• On your phone, GoBeast's data is encrypted with a key kept in the iOS Keychain or the Android Keystore, and it is excluded from Android's automatic backup.
• Row-level security means each account can read only its own records.
• Only the people who need access to run GoBeast have it.
• App lock and discreet mode protect GoBeast on your phone.

No system is perfect. If a breach affects your data, we will tell you and the authorities as the law requires.

Age limit

GoBeast is for adults 18 and over. We don't knowingly collect data from anyone under 18. If you think a minor has used GoBeast, tell us and we will delete their data.

Changes to this policy

When we change this policy, we update the date at the top. For important changes, we tell you in the app, and by email if we have your address, before they take effect, and we ask for consent again where the law requires it.

Contact us

Obscura Vertex Pte. Ltd., Singapore
Email: support@gobeast.com (subject "Privacy")