Privacy Policy

Summary

• Kobu does not sell your personal information.
• Kobu does not use third-party advertising or cross-app tracking.
• Your workout history, routines, profile details, nutrition entries, preferences, and app settings are stored locally on your device. In the current version of Kobu, this data is not synced to iCloud.
• Leaderboards and challenge boards are built into the app but are switched off in this version. Nothing is published, and no name or training stat leaves your device for them. If a board is switched on in a later version, your display name and the single stat used for ranking are published to a shared CloudKit database.
• HealthKit access is optional and controlled by Apple Health permissions on your device.
• Apple Watch workout delivery and completion sync happen between your paired Apple devices.
• If you use AI food photo scanning, your photo is sent over HTTPS to Kobu's server and forwarded to Anthropic to estimate the meal's nutrition; the photo itself is not stored by Kobu's server.
• Coaching is optional and works by invitation. If you accept a coach's invite, the training you choose to share goes to that one coach through Kobu's server, and their plan and messages come back the same way. If you choose, your daily nutrition totals are shared too. Progress photos, GPS routes, Apple Health data and the foods you log are never shared. See Coaching below.

Legal Entity, Data Controller, and DPO Contact

Kobu is developed and operated by Handyy Pte. Ltd., a company registered in Singapore, of 13 Lorong 8 Toa Payoh, #06-04 Braddell Tech, Singapore 319261, which acts as the data controller (or equivalent role under your local law) for the personal information described in this policy.

Kobu does not currently have a dedicated Data Protection Officer. For any data-protection question, access/deletion request, or complaint — including requests you would otherwise direct to a DPO under GDPR, UK GDPR, or a similar law — contact: support@joinkobu.app. If a DPO is appointed in the future, their contact details will be published here.

Data We Handle

Kobu may handle the following information when you choose to enter it or grant access:

• Workout and routine data: exercises, sets, reps, weights, rest timers, workout notes, personal records, goals, badges, Hyrox-style sessions, and training history.
• Profile and preference data: display name, age, body weight, unit preferences, selected gym, saved settings, and app customization choices.
• Nutrition and food data: food search terms, scanned barcodes, meal entries, calories, macros, and related nutrition values you log in the app.
• Photos and camera input: images you choose for profile, workout, or barcode scanning features.
• Location-related data: approximate or precise location only if you allow Kobu to help search for nearby gyms or places.
• Account or purchase data: if sign-in or subscriptions are enabled, Kobu may process Apple account identifiers, email or display name provided by Apple, and purchase entitlement status.

How We Use Data

Kobu uses data to provide core app features: building routines, running live workouts, calculating progress, syncing selected workout state to Apple Watch, showing nutrition totals, supporting app preferences, and responding to support requests.

We do not use your personal data for third-party advertising, and we do not sell or rent your personal data.

Apple Health and HealthKit

Apple Health integration is optional. If you grant permission, Kobu may read or write workout-related HealthKit data such as workouts, heart rate, active energy, body mass, and activity information needed for training features.

HealthKit data is used only for health and fitness functionality inside Kobu. Kobu does not use HealthKit data for advertising, does not sell HealthKit data, and does not share HealthKit data with data brokers.

You can change Health permissions at any time in the Apple Health app or iOS Settings.

Apple Watch Sync

Kobu uses Apple Watch connectivity to send routines, live workout state, timers, and workout completion details between your paired iPhone and Apple Watch. This device-to-device sync is used to run workouts across the phone and watch surfaces.

Local Storage (No iCloud Sync)

Your workout history, routines, profile, nutrition entries, and preferences are stored locally on your device. In the current version of Kobu, this data is not synced to iCloud — it stays on the device you're using and is not automatically available on your other Apple devices.

Because this data is not synced anywhere, uninstalling Kobu or erasing your device removes it permanently unless you've exported it yourself (for example, via the app's CSV export feature, where available). A future version of Kobu may add optional iCloud sync; if we do, this policy will be updated first and the feature will be clearly presented in the app.

Food Photo Analysis

Kobu's optional AI food photo feature lets you take or choose a photo of a meal and get an estimated nutrition breakdown. When you use this feature, the photo is sent over HTTPS to Kobu's server (hosted on Cloudflare), which forwards it to Anthropic so its Claude model can analyze the photo and produce the estimate. Anthropic processes the photo in the United States — see International Transfers below. The photo is processed by Anthropic solely to produce the nutrition estimate.

Kobu's server does not store the photo — it is held only for the moment needed to relay it to Anthropic and return the result, then discarded. Because the photo is not retained, there is no server-side copy for us to delete on request. The nutrition estimate produced from the photo (dish name, ingredients, calories, and macros) is saved only on your device, the same way as any other food entry you log.

This feature requires your in-app consent the first time you use it, and device-level requests are subject to daily quota limits to prevent abuse. You can decline consent and continue using every other part of Kobu, including manual and barcode food logging.

Coaching

Coaching lets one coach work with one athlete inside Kobu. It is optional and works by invitation: nothing below applies unless you open a coach's invite and accept it, or apply to coach.

Your account. Coaching needs an account, created with Sign in with Apple or with your email address and a one-time code. Kobu's server keeps the display name you choose, a sign-in session for each phone or browser, and either an identifier from Apple or your email address. If you sign in with Apple, Kobu does not keep the email address Apple has, unless you add a sign-in email yourself.

Your sign-in email. Kobu uses it only to send your sign-in codes, through our email provider, Resend. Your coach or athlete never sees it, and Kobu never sends you marketing. A code works once, for 10 minutes, and the server keeps only a scrambled form of it (a hash). You can change the address, and remove it from an Apple account, in the app.

What an athlete shares. Before you accept an invite, Kobu shows exactly what your coach will see, and you choose. Your coach can see:

• each session you finish: exercises, sets, reps, weights, effort (RPE), time and your session notes;
• distance, time and pace of cardio;
• the routine you train now; and
• if you choose, the weigh-ins you enter in Kobu and your goal weight; and
• if you choose, each day's total calories, protein, carbs and fat from your food log, and how many foods you logged that day.

Your coach never sees your progress photos, GPS routes, heart rate, sleep, readiness or anything else read from Apple Health, or the foods in your food log. Progress photos never leave your device.

What a coach writes. The plan a coach writes for you, and the messages and comments the two of you send, are stored on Kobu's server so both phones can read them. In the app, only the two of you can see them. We look at a message only if one of you reports it: a copy is then kept with the report so we can review it. A coach can also keep private notes about an athlete, such as an injury or a goal. Only that coach sees them, never the athlete.

Check-ins and forms. A coach can send you questions to answer, such as a weekly check-in or an intake questionnaire, which may ask about your health, injuries, sleep or eating. Answering is up to you. Your answers go to your coach through Kobu's server and are stored there with the rest of your coaching, so both of you can read them. Your iPhone also uses your local date to know when a weekly check-in is due.

Nutrition targets and habits. A coach can set daily calorie and macro targets, which become your food goals in the app, and habits such as a daily step count. The days you tick a habit go to your coach through Kobu's server and are stored there with the rest of your coaching.

Booking sessions. A coach can publish the hours they train clients in person, with a location. When you or your coach book a session, its time, length, location and any note are stored on Kobu's server so both of you can see it, and the other side gets a notification. Your iPhone schedules a reminder before each session on the device.

The coach dashboard. A coach can also work from Kobu's coach dashboard in a web browser, signed in with Apple. It shows the coach the same things as the app. The browser keeps a sign-in cookie for up to 90 days; signing out or deleting the account ends it. A coach's plan templates are stored on the server for that coach only.

Coach accounts. To coach, you sign up with a display name and, if you like, a short bio and a link to your work. You can invite clients straight away. Kobu can suspend a coach account.

Notifications. To tell you about a new message or a plan update, Kobu's server sends a notification through Apple Push Notification service, using a token your phone provides.

Your control. You can turn sharing of sessions, weigh-ins or nutrition off at any time, and what was shared under it is deleted from the server at once. Either side can end the coaching at any time: the shared training and nutrition, the plan, the messages, check-in answers, habits, booked sessions and the coach's notes are then deleted from the server at once. Deleting your account in Settings deletes all of your coaching data, as coach and as athlete.

Coaching data is stored by Kobu's server on Cloudflare. It is used only to run coaching. It is not used for advertising, not sold, and not shared with anyone other than your coach or your athlete.

Finding a Coach

If you ask us to find you a coach, or ask a coach directly from their profile, on our website or in the app, we store what you enter in the form: your email address, your goal, whether you want online or in-person coaching, and, if you give them, your name, your city or gym and your note. We use it only to reply to you and to put you in touch with a coach.

The request is stored by Kobu's server on Cloudflare and emailed through Resend. A request you send to a coach goes to that coach, by email and on their dashboard, and a copy comes to us. A request you send to us is shared with a coach only when we introduce you, and only the coach we introduce. It is not used for advertising and not sold. The request is deleted 180 days after you send it, or sooner if you ask us at support@joinkobu.app. To limit abuse, the server counts requests per network address for one day.

Coach profiles. A coach can publish a profile: their name, photo, what they write about themselves, where they coach and what they offer. Kobu reviews a profile before it is listed. A listed profile is public on our website and in the app, so anyone can read it. The coach can unpublish it or remove the photo at any time, and deleting their account deletes the profile.

International Transfers

Kobu's core workout, routine, profile, and nutrition data stays on your device and is not transferred anywhere by us. The one feature that does transfer personal data internationally is the AI food photo feature: when you use it, your photo is transmitted from your device, through Kobu's Cloudflare-hosted server, to Anthropic, which processes it in the United States. If you are located outside the United States (for example, in the EEA, UK, or Singapore), this means your photo is processed in a country whose data-protection laws may differ from your own.

We rely on Anthropic's own safeguards for cross-border processing (including its standard contractual commitments to customers) and on the facts that: the photo is not linked to an account or persistent identifier, is not stored by Kobu's server, and is used by Anthropic solely to generate the nutrition estimate returned to the app. If you do not want your photo processed in the United States, do not use the AI food-scan feature — manual and barcode food logging do not transmit a photo anywhere.

If you use coaching, your account and the coaching data described above are stored by Kobu's server on Cloudflare, which may store and process it outside your country. If you do not want that, do not use coaching; the rest of Kobu keeps your training on your device.

Leaderboards & Challenges

Both boards are switched off in this version of Kobu. The screens exist, and they show only the numbers your own device calculated. Nothing is published, and no name or training stat leaves your device for them. The rest of this section describes what happens if a board is switched on in a later version.

Kobu has two kinds of board. A gym leaderboard ranks people who train at the same gym. A challenge board ranks the people who opened the same challenge invite link, which is a closed group.

A challenge invite carries the whole workout inside the link itself, after the # character. A web browser never sends that part of a link to a server, so the workout in an invite reaches nobody but the person who opens it. Kobu keeps no copy of it.

When a board is switched on and you post a result, three things are published to the CloudKit public database: your display name, the single number the board ranks, and which board it belongs to. Nothing else. It does not include your workout history, health data, nutrition entries, location, body measurements, or contact details.

A record in the CloudKit public database is readable by anyone who queries it, not only by the people you sent the link to. A challenge is identified by a random value that nobody can guess, but the record is not private. Do not use a display name you do not want others to see. You can change your display name in the app at any time.

Deleting your account deletes these records. Kobu reports deletion as complete only after every published record is confirmed deleted. If the device is offline or signed out of iCloud at that moment, the app records the wipe as unconfirmed rather than claiming your data is gone.

Device Permissions

Kobu may request access to Apple Health, notifications, camera, photos, and location. Each permission is optional unless a feature depends on it, such as scanning a barcode with the camera or saving workout data to Apple Health.

You can disable permissions at any time in iOS Settings. Some features may stop working when their required permission is disabled.

Third-Party Services

Kobu does not include third-party advertising or analytics. Some features may interact with service providers or public databases when you choose to use them:

• Apple services: App Store, StoreKit, Sign in with Apple, HealthKit, MapKit, notifications, and device frameworks used to operate iOS and Apple Watch features. Kobu does not currently sync app data through iCloud/CloudKit (see Local Storage above).
• Food lookup services: barcode or food search features may query nutrition databases such as Open Food Facts or Singapore Health Promotion Board data sources using the barcode or search term you provide.
• AI food photo analysis: if you use the AI photo feature, your photo is relayed through Kobu's server (Cloudflare) to Anthropic for analysis. See Food Photo Analysis above.
• Coaching: if you use coaching, your account and coaching data are stored by Kobu's server on Cloudflare, and notifications are delivered through Apple Push Notification service. If you sign in with email, your sign-in codes are sent to your address through Resend. See Coaching above.
• Finding a coach: a request from the website's find-a-coach form is stored by Kobu's server on Cloudflare and emailed to us through Resend. See Finding a Coach above.
• Purchases: if subscriptions or premium features are enabled, Apple and RevenueCat may process purchase status and entitlement data. Kobu's current free launch does not require a purchase.

Third-party services process information under their own privacy policies and only to the extent needed for the feature you use.

Retention Schedule

The table below states, for each category of data Kobu touches, where it lives and how long it is kept.

Health data written to Apple Health can be managed through the Apple Health app. If you contact support, we may retain your message and email address long enough to respond and maintain support records. You may request deletion of support correspondence by emailing us (see Your Rights below).

Security

Kobu relies on Apple platform protections, local device storage, and permission prompts to limit access to your data. No method of storage or transmission is perfectly secure, so you should keep your device, Apple ID, and passcode protected.

Children's Privacy

Kobu is not directed to children under 13, and we do not knowingly collect personal information from children under 13. If you believe a child has provided personal information, contact us so we can help remove it where possible.

Your Rights and Choices

Depending on where you live, you may have rights to access, correct, delete, or receive a copy of personal information, and to object to or limit certain processing. Because Kobu is local-first, most app data can be viewed, changed, exported, or deleted directly on your device:

• Access/export: use the app's CSV export feature (where available) or view your data directly in the relevant tab (Workouts, Food, Profile).
• Correction: edit or delete individual entries directly in the app at any time.
• Deletion: use in-app Account Deletion (Profile → Settings → Delete Account) to permanently erase all local app data and sign out of Apple in a single step. Deleting the app does the same.

Data-subject request workflow. For anything the in-app tools above can't do yourself — for example, requesting deletion of support correspondence, asking what data we hold about a specific interaction, or exercising a right under GDPR/UK GDPR/CCPA or a similar law — email support@joinkobu.app with a description of your request and enough detail for us to identify the relevant records (e.g. approximate date and nature of a support conversation). We will acknowledge your request within 5 business days and aim to resolve it within 30 days (or notify you if a request is complex enough to need more time, consistent with applicable law). We may ask you to verify your request before acting on it.

For privacy requests related to support emails, account identifiers, or purchase support, contact us at the same address above.

Security Incident Contact

If you believe you have discovered a security vulnerability in Kobu (the app or its backend at joinkobu.app, which older versions of the app reach at joinliftr.app), or you suspect a security incident affecting your data, contact us immediately at support@joinkobu.app with as much detail as you can provide (steps to reproduce, affected endpoint, and any relevant logs or screenshots). We will acknowledge reports within 3 business days. If a confirmed incident affects your personal information, we will notify affected users and any relevant regulator without undue delay and consistent with applicable law.

Changes to This Policy

We may update this Privacy Policy when Kobu changes, when legal requirements change, or when new services are added. The effective date above will be updated when the policy changes.

Contact

Questions, privacy requests, and support messages can be sent to support@joinkobu.app.