Privacy Policy

1. Introduction

Welcome to PT Locked (available at https://ptlocked.com). We are committed to protecting your privacy and your right to the security of your personal information. This policy explains how we collect, use, store and protect information when you access the platform and use the service connecting personal trainers (PTs) and clients.

PT Locked decides the purposes and means of processing the personal data described in this policy. This policy is also our notice of personal data processing under the Law on Personal Data Protection No. 91/2025/QH15 and Decree 356/2025/ND-CP.

2. Information We Collect

Depending on how you interact with PT Locked, we may collect the following types of data:

• Account information: Display name, email address, profile picture, the language you use, and a one-way encrypted password (only for accounts registered with email). We do not collect your phone number, date of birth or gender.
• Information from third-party sign-in (Google, Apple): When you use the “Sign in with Google” feature, we receive your Google identifier (Google ID), full name, verified email address and the link to your public profile picture (avatar) provided by Google. When you use “Sign in with Apple”, we receive your Apple identifier, email address (which may be a hidden email address relayed by Apple) and your full name if you choose to share it.
• Trainer (PT) profile information: Introduction, years of experience, area of operation, expertise, a cover photo and a profile gallery (for example training certificates or training photos) with photo captions, the regular weekly schedule and the service price list.
• Training area and locations: The training area (province/city, ward/commune) you choose to find PTs near you, the address and directions you enter for a training session, and the locations you save. We do not use your phone’s GPS location. When you tap to open a map, the session address is passed to the map app on your device.
• Information in requests to a PT: The message, training goals, budget, desired frequency and desired location you fill in when asking about a package or booking a session.
• Transaction and schedule data: Session booking history, packages purchased, timetables, session notes the PT writes when ending a session, and payment status logs, including transfer confirmation information received from the bank (amount, sending account number, transfer reference, time).
• PT payout information: The bank name, account number and account holder name that PTs save to receive their weekly payouts, together with the PT’s earnings and balance on the platform.
• Content you create: Photos, videos and notes in Moments, the meal journal and comments, reviews, consultation messages between Clients and PTs, and photos and captions on PT profiles.
• Community safety: Violation reports you send or that are made about you, the people you block, account suspension decisions, appeals and dispute records.
• Feedback: When you send feedback in the app or on the web (Tôi (Me) → Gửi góp ý (Send feedback)), we keep its type, the text, the screenshots you attach, whether you allow us to contact you, and the app version, device model, operating system and language you use.
• Push notifications: The device token (push token) issued by Apple and Firebase to send notifications to your phone, with the platform and app version. You can turn them off in the app under Tôi (Me) → Cho phép thông báo (Allow notifications).
• Technical data: The IP address and browser or device type tied to each sign-in session, and system security logs for the purpose of detecting fraud and protecting the security of the application.

4. Purposes and Legal Bases

We use the information we collect only for the purposes below, each based on a legal ground:

• To provide the service you signed up for (contract): creating and managing your account; verifying you at sign-in; connecting Clients and PTs and scheduling sessions; reconciling payments, refunds and paying PTs their earnings; sending notifications about session status, schedule changes and your account (in the app and by push notification); answering support requests and feedback.
• With your consent: processing the sensitive data you enter in section 3; showing Moments and meal journal entries you make public; the public PT profile while its switch is on; publishing testimonials on the home page; contacting you by email when you allow it while sending feedback. You can withdraw your consent at any time; withdrawing it does not affect processing carried out before.
• For safety and to comply with the law: content moderation (filtering offensive language before it is posted, handling violation reports and appeals); preventing fraud and protecting the system; keeping transaction records under accounting and tax law; resolving disputes; providing information when a competent state authority requests it as the law provides.

We do not use your data for purposes other than those above without first telling you and, where needed, obtaining your consent.

5. Publicly Displayed Information

Public profiles of Trainers (PTs). Each PT has a profile page at an address in the form ptlocked.com/pt/your-name. This page is public on the internet and may be collected, stored as copies and shown again in search results or answers by search engines (such as Google, Bing, Cốc Cốc) and artificial intelligence (AI) services. The public profile includes:

• Display name, profile picture, cover photo, photo gallery with captions, introduction and years of experience.
• Service area (ward/commune, province/city) and regular weekly schedule by time slot, without a specific address.
• Packages currently on sale and their prices.
• Rating, number of completed sessions and the reviews currently displayed.

The public profile does not show the PT’s email, phone number, address or payment information. PTs can turn off their public profile at any time in the Hồ sơ (Profile) section. Once it is turned off, the page stops being displayed within a few minutes, but search engines may take a few days to remove their stored copies. Information that has been public may be viewed, captured or copied by others, so do not put on your profile anything you do not want to make public.

PT profile photos. The cover photo and gallery a PT posts appear at once on their profile in the app and on their public profile page. PTs can edit a caption or delete any photo at any time; the public page updates within about 10 minutes. When posting a certificate, PTs should cover any personal details they do not want to make public (such as ID numbers). Photos reported for a violation may be hidden by PT Locked. Certificate photos are posted by the PT; PT Locked does not verify what they certify.

Featured trainers on the home page. PT Locked may feature some public profiles on the home page, with the display name, profile picture, area, starting price and rating already on the profile, together with a short line describing the PT’s expertise. A profile is automatically removed from the home page when the PT turns off their public profile or deletes their account.

Testimonials on the home page. We only publish a person’s testimonial (a client, a PT or a trial user) when that person agrees to the exact wording to be published, together with the display name, role or area and photo (if any) that they choose. We keep a record of the date the person gave consent. The person may request that the testimonial be edited or removed at any time via the contact details in section 14; after we remove it, the home page is updated within 10 minutes.

Client reviews. Reviews you write after a training session are displayed publicly on the PT’s profile with a shortened name (for example, “Minh N.”), without your full name or profile picture.

Client profiles are not public. Clients do not have a public profile page and are not included in search engines. Your meal journal and moments in private mode are visible only to you and the PT you are training with. Moments or meal journal entries that you yourself switch to public mode can be seen by anyone through PT Locked, including people who are not signed in.

7. Data Storage, Security and Sharing

The database and the photo and video files are stored on a server that PT Locked rents and manages itself in Vietnam, with firewalls and strict access control. All information transmitted between your browser or app and our system is encrypted using the HTTPS / TLS standard. User passwords are hashed with a strong one-way cryptographic algorithm and are never stored in plain text.

Internal access. Only authorized administrators can use the admin tools, to support users, moderate content, and handle reports, disputes and payments. The moderation tool shows the captions of Moments and meal journal entries, including private ones, so that violations can be handled. The admin tools do not show consultation messages between Clients and PTs.

Service providers. We share with the providers below only the data they need to perform their services, and we only choose providers that commit to protecting data at a level equivalent to this policy:

• Google: signing in with Google, and Firebase Cloud Messaging to send push notifications (receives device tokens and notification content, which may include the name of a person involved in a session).
• Apple: signing in with Apple and sending push notifications to iPhone. When you delete an account that signs in with Apple, we ask Apple to revoke PT Locked’s sign-in access.
• SePay and banks: reconciling payment bank transfers.
• VietQR: generating payment QR code images from the amount and transfer reference. Your browser or app loads the image directly from VietQR, so VietQR receives your IP address.
• Telegram: feedback you send in the app or on the web goes to the PT Locked team’s internal channel on Telegram to be handled: the text, attached screenshots, your name, role, email (only if you allow us to contact you), user ID, app version and device.
• jsDelivr: on the web only, when you upload a HEIC photo, your browser loads an image converter from jsDelivr, which receives your IP address. Your photo is not sent to jsDelivr.

Transfers outside Vietnam. Google, Apple and Telegram process data on servers outside Vietnam. When you sign in with Google or Apple, receive push notifications or send feedback, the necessary data described above is transferred to them. Apart from these cases, your data is stored in Vietnam. If we move the system to another provider or storage location, we update this policy and give notice in advance as described in section 13.

We do not sell personal data, do not use data for advertising and do not share it with data brokers. We only provide data to state authorities when they make a lawful request as the law provides.

8. How Long We Keep Data

• Account, profile, sign-in sessions and push notifications: while your account is active; deleted or anonymized when you delete your account. A push token is also deleted when Apple or Firebase reports that it no longer works.
• Content you create: until you delete that content or your account. Files you upload but do not post are deleted automatically after 1 day (Moment drafts after 7 days).
• Requests, consultation messages and session notes: while your account is active; when you delete your account, see section 9.
• Transactions, payments, reconciliation, payouts to PTs and booked sessions: up to 10 years under accounting and tax law; after you delete your account, these records are no longer linked to your name or email.
• PT payout accounts: kept to pay any remaining earnings, even if the PT deletes their account, and then stored with the payout records for the period above.
• Violation reports, blocks, suspensions, appeals and disputes: as long as needed to keep the community safe and resolve disputes.
• Feedback: until you delete your account; copies already passed to Telegram are deleted when you ask.

9. Your Rights and Data Deletion

Under the Law on Personal Data Protection, you have the right to:

• Be informed about the processing of your personal data.
• Consent or refuse consent, and ask to withdraw your consent to processing.
• View, edit or ask us to edit your data.
• Ask for a copy of your data, its deletion or the restriction of its processing; object to its processing.
• Complain, denounce, sue and claim compensation for damage as the law provides.

How to exercise them. You can edit your information in the Hồ sơ (Profile) section, and delete Moments, meal journal entries, profile photos and your account yourself in the app. For other requests (such as a copy of your data, or restricting or objecting to processing), email [email protected] from your sign-in address. We confirm receipt within 2 working days and carry out the request within 15 days. If a complex request needs more time, we tell you why and the new deadline, within the limits the law allows. If you are not satisfied with how we handle it, you can complain to the personal data protection authority of the Ministry of Public Security.

• Account deletion: You have the right to permanently delete your account and personal data directly in the PT Locked app (Tôi (Me) → Hồ sơ cá nhân (Personal profile) → Xóa tài khoản (Delete account)), without having to send an email and wait for support. Accounts that sign in with a password can also be deleted on the web on the Delete your PT Locked account page. If you cannot use the app, please send a request from your sign-in email address to [email protected]. See more on the Support page. An account cannot be deleted while a session is in progress or a dispute is still open.
• Data deleted: Your full name, email, profile picture, Google/Apple sign-in links, push tokens, the IP addresses and devices of your sign-in sessions, Moments photos and videos, meal journal, comments, review content, the message, training goals, budget and desired frequency in your requests, PT profile cover and gallery photos with their captions, the PT’s introduction, feedback text with its screenshots and device details, and saved locations are permanently deleted or anonymized from the operational database.
• Data retained: Transaction and payment records, booked sessions with their training locations, and security logs, violation reports, blocks and disputes are retained in a form not linked to your name or email for the period in section 8. Consultation messages you have sent remain in the recipient’s conversation; for Clients, session notes written by the PT remain in the PT’s history. This content serves dispute resolution and is no longer linked to your name. If the account is temporarily locked when it is deleted, we keep a hash (which cannot be reversed) of the Google/Apple identifier until the lock period ends, so that the account cannot be created again to evade the lock. Copies of feedback already passed to the team’s internal Telegram channel are not removed with the account; you can ask for them to be deleted at [email protected].

10. People Under 16

PT Locked is intended for people aged 16 and over. People under 16 may only use PT Locked with the consent of a parent or legal guardian, who exercises the rights in section 9 on the child’s behalf. We do not collect dates of birth. If we learn that an account belongs to someone under 16 without that consent, we will lock the account and delete its data.

11. If a Data Incident Occurs

If we find that personal data has been exposed, lost or accessed without authorization, we act at once to contain the incident, notify the personal data protection authority as the law requires (for sensitive data: within 72 hours of discovering it), and notify you when the incident may affect you, with the steps you should take.

12. Cookies and Data Stored on Your Device

• Sign-in cookies on the web: pt_access (expires after 15 minutes) and pt_refresh (30 days) keep you signed in. They are HttpOnly cookies, sent only over secure connections, and scripts on the page cannot read them.
• Language: the pt_locale cookie (1 year) remembers the language you choose, and your browser remembers that you closed the language suggestion.
• The Google and Apple sign-in buttons on the web are provided by Google and Apple and may set their own cookies under their own policies.
• Home screen widgets on iPhone store your next session, meals and earnings on your device to display them.

We do not use third-party tracking cookies to target advertising. The PT Locked website and app for iPhone do not use third-party advertising or analytics tools and do not track you across other parties’ apps or websites.

13. Changes to This Policy

When we change this policy, we update the date at the top of the page. For important changes, such as collecting a new type of data, using data for a new purpose or sharing it with a new provider, we give notice in the app or on the website before applying them, and ask for your consent where the law requires it.

14. Contact Us

If you have any questions, comments or requests regarding this Privacy Policy, please contact the administration team: