Controller and scope
Commpair (Pty) Ltd, registration number 2023/208601/07, operates ASTA and is responsible for its processing of personal information. Business address: 3 Gwarrie Street, Oudtshoorn 6625, South Africa. Contact help@astafitness.com for support or privacy requests during weekdays 09:00–17:00 SAST, excluding South African public holidays.
These policies describe ASTA’s private South African beta for invited adults aged 18 or older, using free test credits with no cash value. Read Health Data and Connected Services for the Apple Health data flow. A device permission, a Health sharing choice and a beta-scope acknowledgement are different choices.
This policy also covers personal information processed through the ASTA website, including website enquiries.
Information you provide
ASTA processes the information you supply to create and use your account and participate in the service. Optional information is used when you choose the associated feature.
- Account information: email, username/display name, sign-in provider identifiers, authentication and security records, time zone, beta invitation and versioned age/residency/scope declarations, notification choices and an optional phone number for supported SMS verification.
- Profile and social information: profile/cover photos, biography, posts, comments, likes, follows, messages, event invitations and scores.
- Participation information: entries, team membership, event goals, activity evidence, rankings, results and fair-play flags.
- Test-credit information: grants, entries, holds, returns, awards and ledger records. The free beta does not require bank or card details for test credits. Genuine historical payment or transfer records, if any exist, require separate handling; they are not converted into test credits by this policy.
- Support and safety information: reports, reported content, account identifiers, descriptions and evidence you choose to submit.
Health, location and device information
With your permission and an enabled health connection, ASTA can read steps, saved workouts, relevant walking/running, cycling and swimming distance, and sleep. For scoring it sends eligible totals and workout evidence to ASTA’s server, including dates, timestamps, distance, activity type and source information. Pools can also receive sleep start/end and sleep totals.
When you request nearby games, ASTA sends your current coordinates to its server to find nearby events. A venue you choose when creating a game is stored and shown with that event. Apple Maps provides native map and venue-search features. Optional Strava or workout-file imports, when enabled, can contain GPS routes and elevation; Strava records can indicate the presence of heart-rate data. These import paths differ from the iPhone Health connection.
Device and service records can include push tokens, platform, security/attestation records, IP/network request information and operational error logs. Permission access does not mean your complete photo library or every Health record is uploaded.
Why information is used
ASTA uses information to authenticate accounts, provide profiles and social features, organise events, sync and verify eligible activity, calculate results, maintain test-credit and any existing financial records, deliver selected service notifications, investigate abuse, answer requests and protect the service.
Health data is used for the fitness and event features you enable. It must not be used for advertising, marketing, data brokerage or unrelated profiling. Participation incentives and disclosure of health-derived results remain subject to Apple’s platform restrictions as well as applicable law; consent cannot waive those restrictions.
Other people and event visibility
Information you post or send is visible according to the feature’s audience. Public discovery, shared profiles, posts and event listings can expose information beyond your friends. Private messages are delivered to their conversation participants. Player profiles and race history can be opened by other signed-in users; there is no general private-profile setting in the reviewed app. Photos are held for moderation before public display. Approved photos use public URLs, so anyone with the URL may be able to access them or keep an external copy. ASTA serves these images without persistent browser caching and removes unreferenced owned images when the related content is deleted.
Competitions and Pools display participants, progress and results. Health-derived totals may therefore be visible in event views. Do not treat participation as private medical storage. Blocks restrict profile, social-content and contact access in both directions. Shared event and financial records are handled separately; blocking does not cancel participation or erase another participant’s lawful result.
Recipients may retain screenshots or copies they made. Removing content from ASTA cannot erase copies held outside ASTA. Blocking does not by itself remove a shared event record or settle a financial entry.
Service providers and transfers
ASTA uses Hostinger for application hosting and support email, and Supabase PostgreSQL for its database, currently located in Ireland. Hosting and provider operations can involve processing outside South Africa. Hostinger's available account and product documentation does not identify the countries where our email is stored or processed. The database region does not mean that all provider processing occurs in Ireland.
Depending on the feature and configuration, Apple or Google handles provider sign-in; Apple push services or Expo deliver notifications; and a configured SMS provider such as Twilio handles verification messages. Optional Strava connections process information needed to authorise and import activity. Some built-in imagery loads from Unsplash, which receives ordinary image-request network information. Apple Maps provides venue search and map displays on iPhone using search text and the map area or coordinates supplied for the request.
The free test-credit beta does not offer cash checkout or withdrawals. Paystack checkout and PayPal payouts are unavailable for beta test credits. Any genuine historical payment records and provider obligations must be handled separately. Providers should receive only information needed for their function under appropriate protections. Information may also be disclosed where legally required or necessary to investigate fraud or protect rights.
Hostinger also hosts this website and its support email. This website serves its images and fonts from its own hosting.
Storage, security and retention
Account and feature records are stored to operate the account and its associated activities. Security controls include authenticated requests and access checks; no system can guarantee absolute security.
The approved ASTA-controlled retention targets are: routine support email and attached evidence, 90 days after the issue closes; ordinary diagnostic copies, no more than 30 days from creation; and future encrypted cloud database recovery copies, a rolling maximum of 30 days. These are operator handling rules, not claims that automatic purge jobs or a database-backup schedule already exist. Unresolved complaints, genuine obligations and documented preservation exceptions need a specific purpose, minimal records, responsible owner and dated review. A last verified recovery copy may be retained temporarily until its replacement is verified, with the exception recorded and reviewed.
The in-app deletion request removes posts, comments, messages and owned photos, and records a target completion date and private receipt. Cancellable entries use the ordinary return process. Positive test credits alone do not delay deletion: they are erased when account deletion completes, without a cash withdrawal or bank details. Unsettled entries, pending payments or credits, negative adjustments and unresolved financial concerns can still require review.
Final deletion removes the account, associated Health snapshots and paired-device records. For free, nonredeemable beta-credit transaction history, the approved rule is no additional financial archive after completed deletion. The operator must configure and verify that rule before relying on it; genuine payment obligations or legally required records need separate handling. Provider credentials requiring revocation are encrypted for retries and cleared after successful revocation. Missing operator retention configuration or unresolved obligations can delay completion. Deleting the app is not an account-deletion request.
Hostinger makes the latest deployment's runtime log available and starts a fresh runtime log on redeployment. This does not prove older copies were erased. No fixed deletion period is confirmed for all stderr, access/proxy, cron and historical deployment/build logs. ASTA's 30-day diagnostic-copy target does not apply as a guarantee to these provider-managed records.
Hostinger Email keeps deleted messages in Trash for up to 30 days. A message manually removed from Trash is described as non-restorable; a separate expiry for residual provider recovery copies is not published. The provider describes deletion of an entire mailbox's data after 30 days, which is not a retention limit for individual support messages or proof of their residual-copy expiry.
For our Business Web Hosting plan, the supplied Hostinger response states that automatic daily website backups are retained for 7 days and weekly backups for 6 weeks. Manual backups have no published fixed expiry. Website backups do not establish coverage of the separate Supabase database. No blanket deletion deadline is promised for all provider-managed copies.
Minimal deletion receipts and revocation/suppression metadata must be retained through the life of relevant recoverable pre-deletion snapshots, then removed within 30 days after the last such copy expires. Restoration must reapply later deletion and withdrawal decisions before service resumes. The expiry procedure and scoped implementation need verification; these policies do not claim a general automatic purge is already running.
Website contact delivery uses an encrypted mail connection. Support correspondence remains subject to the retention and rights provisions in this policy.
Your rights and controls
Subject to applicable law, you may request access, correction or deletion of personal information and raise an objection or complaint about its use. Use Help and privacy requests in Settings, or Account privacy and deletion on the sign-in page if normal account access is restricted. ASTA may need proportionate identity checks before releasing or changing account data.
Turn off Apple Health syncing in Settings to stop that connection’s future syncs. Revoke individual Health permissions in Apple’s Health controls. Previously uploaded data is a separate deletion matter. Manage camera, photos, location and notification permissions in the device settings.
Use Delete my account in ASTA Settings to initiate the current deletion flow. Read Account Deletion and Data Rights for current restrictions and the distinction between removing the app, disconnecting a service and deleting account data.
For South African privacy complaints, the Information Regulator provides information about POPIA rights and complaint procedures at inforegulator.org.za. This does not replace your right to contact the applicable regulator.
Policy updates
This is beta policy version 0.6, effective 23 October 2026. Material changes will be identified when a new version is published. Website: https://astafitness.com. Reading these pages or acknowledging the beta scope does not by itself record acceptance of these policies.