LEGAL

Privacy policy

Last updated 9 October 2026

The short version

We collect what Sanya needs to run your membership: your account, your classes, your trainers and your check-in photos.
We don't sell your data, and we don't show you ads.
We never take your no-show fine. You spend it on someone you love, outside the app. We only keep the note you write about it.
Payments go through Apple or Google. We never see your card.
You can delete your account and everything in it from the app or the website at any time.

This policy explains how the Sanya team ("Sanya", "we", "us") handles your information when you use the Sanya app for iOS and Android and the website at sanyagym.com (together, "Sanya").

What we collect

Things you give us

INFORMATION	WHY WE NEED IT
Account details: your name and email address from Sign in with Apple or Google	To create your account and keep you signed in on your phone and the web.
Membership card: the name on your card, card colour, monthly pass, weekly goal, sick days, no-show fine amount and membership length	To run your membership the way you set it up.
Trainers and videos: trainer names, photos, YouTube or course links and the videos you save	So you can book classes with them.
Classes: bookings, times, sessions and focus areas, cancellations, freezes	To build your schedule, your pass and your stamps.
Check-in photos and the time each one was taken	To confirm you showed up. See Your check-in photos.
Make it right: your health tasks, your kindness ideas, what you did, who it was for, the amount and an optional photo	To record that a missed class was made right.
Waitlist: your email address, if you join the waitlist on sanyagym.com	To send you a welcome email, and your early-member code when Sanya launches. Every email has an unsubscribe link.

Things collected automatically

Device and app information: device model, operating system, app version, language and time zone, so the app works correctly and your class times are right.
Notification token, if you allow notifications, so we can remind you about classes and check-in windows.

Things we get from others

Apple or Google share your name and email when you sign in. If you use Apple's "Hide my email", we only receive a relay address.
YouTube provides public channel and video details, like the title, thumbnail and length, when you paste a link. We use the YouTube API Services, so Google's Privacy Policy also applies to that data.
Apple, Google and RevenueCat tell us whether your subscription is active, on trial or cancelled.

We don't collect your location, your contacts, your health data from Apple Health or Google Fit, or your payment card details.

How we use it

To run Sanya: your card, bookings, check-ins, no-shows, sick days and freezes.
To keep your phone and the website in sync.
To send reminders and notifications you've allowed. You can turn them off in your phone's settings.
To show you your own progress, like your stamps, show-up rate and month recap.
To answer you when you contact us.
To keep Sanya secure, fix problems and improve it.

We don't sell your personal information, use it for advertising or share it with data brokers.

Where the law asks for a legal reason to use your data, such as under the EU GDPR or Thailand's Personal Data Protection Act (PDPA), we rely on: providing the service you asked for (your account and membership), your consent (photos, notifications, optional analytics), and our legitimate interest in keeping Sanya safe and working.

We only share data with companies that help us run Sanya, and only what they need:

Hosting and storage: Supabase, to store your account, classes and photos, and the waitlist.
Email: Resend, to send waitlist emails.
Subscriptions: RevenueCat, to check your subscription status with Apple and Google.
Sign-in: Apple and Google.
Notifications: Apple Push Notification service and Firebase Cloud Messaging.

We may also share information if the law requires it, to protect someone's safety, or as part of a sale or merger of Sanya (you'd be told first).

Some of these companies are outside your country, including in the United States. When data is moved across borders, we use the safeguards the law requires, such as standard contractual clauses.

Your check-in photos

A photo is only taken when you tap check in. Sanya never uses your camera in the background.
We read the time the photo was taken, so we can tell it's from your class window.
Your photos are private. They're only shown to you, on your card and in your attendance log, and are never shared or made public.
We don't use your photos for face recognition or to train any AI.
You can delete a photo at any time. If you do, the class still counts as attended.

Payments

Subscriptions are bought and managed through the Apple App Store or Google Play. They handle your payment and card details under their own privacy policies. We only receive your subscription status, plan and renewal date.

The no-show fine is never paid to us or through Sanya. You spend it yourself, on someone you love, and Sanya only stores the note and amount you choose to log.

How long we keep it

We keep your account and membership history while your account is open, so you can see your past months and rejoin later.
When you delete your account, we delete your data within 30 days. Backups are cleared within a further 90 days.
We may keep a small record of transactions longer if tax or accounting law requires it.

Your rights

Depending on where you live, you can ask us to:

See a copy of your data, or get it in a portable file.
Correct something that's wrong.
Delete your data.
Stop or limit how we use it, or withdraw consent you gave.
Complain to your local data protection authority.

Email hello@sanyagym.com and we'll reply within 30 days. We won't treat you differently for using these rights.

Deleting your account

You can delete your account in the app under Me → Settings → Delete account, or on the website under Membership → Delete account. This removes your card, classes, trainers, photos and Make it right history.

Deleting your account doesn't cancel a subscription with Apple or Google. Cancel it in your App Store or Google Play settings, or you may still be charged.

Children

Sanya is for people aged 16 and over. We don't knowingly collect data from children under that age. If you think a child has given us their data, email us and we'll delete it.

Changes to this policy

If we make important changes, we'll tell you in the app or by email before they take effect. The date at the top shows when this policy last changed.

Contact us

Sanya team
Bangkok, Thailand
Email: hello@sanyagym.com