Surpast Privacy Policy
This is the reference version of this policy.
Last updated: September 19, 2026
1. Scope
This policy explains how Surpast handles data when you use the app, and how this website (surpast.com) handles data when you visit it.
2. Data controller
Surpast is published by:
John Kalkhof Sole proprietor (auto-entrepreneur) SIREN: 108741562 Address: 151 Chemin Magnique, 06600 Antibes, France Phone: +33 7 54 00 71 95 Email: privacy@surpast.com
You may use this address for any question about Surpast or this policy.
3. Data we process
Surpast is an offline-first workout log. It does not require an account, and the publisher currently uses no advertising, audience analytics or user-tracking service.
Training data (in the app, on your device only)
- workouts, exercises, sets, weights, repetitions, durations and timestamps;
- plans, templates, records, statistics and notes;
- body-weight entries;
- exercise, timer and display settings;
- your Surpast Pro access status.
This information provides logging, history, statistics, backups and progress tracking. It remains in the application’s private storage on your device. The publisher does not receive it and cannot view it remotely. Website and support data
- technical data: your IP address and technical information about your browser/device, logged automatically by GitHub Pages (our host) when you visit surpast.com;
- support correspondence: the information you choose to send us (email address, message, attachments) when you contact us.
The website sets no cookies and stores nothing in your browser.
Social media
- If you follow or interact with Surpast’s pages on Instagram or Reddit, those platforms process your data under their own privacy policies. For Instagram, this includes aggregate visitor statistics (“Insights”) that Meta provides to page administrators — see Meta’s privacy policy: https://privacycenter.instagram.com/policy/.
4. Purpose and legal basis
| Data | Purpose | Legal basis |
|---|---|---|
| Training data | Provide the app’s logging, history, statistics and backup functionality | This data stays on your device and is never sent to us — we do not process it as a data controller |
| Website technical data | Operate and secure the website | Legitimate interest in running a functional, secure website (GDPR Art. 6(1)(f)) |
| Support correspondence | Respond to your request | Legitimate interest in providing support (GDPR Art. 6(1)(f)) |
| Social media (Instagram Insights) | Understand our page audience | Legitimate interest in understanding our page audience (GDPR Art. 6(1)(f)) |
5. Backups, exports and sharing
Depending on your device and account settings, its operating system may back up or transfer application data, for example through Android backup services or iCloud. These operations are managed by the platform provider and do not give the publisher access to their contents.
You may choose to export a backup or share an image. You then select the receiving application or destination yourself. The publisher does not receive the file.
Exported .surpast backups contain readable workout and body-weight information. Surpast does not apply additional encryption to them. Store them somewhere safe. Files sent to another application or third-party service are subsequently handled under that recipient’s rules.
6. Device features and permissions
Surpast may use the following only when you request the corresponding feature:
- notifications, to display timers;
- the camera, to create an achievement image;
- the file picker, to import or export a backup;
- the system share interface, to share an image or backup.
These features are optional and may be refused through your device settings without preventing ordinary workout logging.
7. Purchases
Surpast Pro purchases are processed by the store used for the purchase, such as Google Play or the App Store. The publisher does not receive your complete banking details. The store may provide Surpast with a transaction status and technical purchase identifier needed to activate or restore Pro. The store handles purchase information under its own policy:
8. Retention
- Training data: stays on your device for as long as you want it to. We never receive this data, so we don’t set a retention period for it ourselves.
- Website technical data: retained by GitHub under its own retention practice — see the GitHub privacy statement linked in section 9 below.
- Support correspondence: retained for 24 months after your request is resolved, then deleted — unless a longer period is required by law, or to establish, exercise or defend a legal claim.
9. International transfers
- Email: handled by STRATO GmbH (Germany, EU) — no transfer outside the EU/EEA.
- Website hosting: GitHub Pages is provided by GitHub, Inc. (United States). Technical data (such as your IP address) may therefore be transferred to the US. GitHub relies on the European Commission’s Standard Contractual Clauses and is certified under the EU-U.S. Data Privacy Framework. See GitHub’s privacy statement: https://docs.github.com/en/site-policy/privacy-policies/github-general-privacy-statement.
- Purchases: handled by Google Play or the App Store, each under its own policy (see section 7).
10. Deletion and security
Surpast data remain on your device until you delete an entry, use Options → Delete all data, clear the application’s storage or uninstall it.
Deletion inside Surpast cannot remove exported files, shared copies or system backups stored outside the application. You must delete these from their destination or service.
Primary data are stored in the application’s private storage and protected by the device’s security mechanisms. No system can guarantee absolute security; protect access to your device and keep exported backups somewhere safe.
11. Your rights
Under the GDPR you have rights of access, correction, deletion, restriction, portability and objection regarding the personal data we hold about you.
You directly control data stored only on your device by viewing, editing, exporting or deleting it. For information sent to support, you may exercise your rights using the address in section 2.
You may also submit a complaint to the French data-protection authority, the CNIL: https://www.cnil.fr/fr/plaintes.
12. Changes
This policy may change if Surpast adds features such as accounts, synchronization, online services, analytics or new service providers. The date at the top identifies the latest version.