Theo Privacy Policy
This policy explains what the Theo iOS app (the “app”) and this website collect, how it is used, and the choices you have. Theo is made by Hoon Oh (the “developer”). The Korean version of this policy, which includes the disclosures required by the Personal Information Protection Act of Korea, is on the Korean page of this website (개인정보 처리방침). If the two versions read differently, the version in your language applies to the extent the law of your country of residence applies.
Effective date: October 21, 2026
At a glance
- The app has no account and no sign-in. It never asks for your name, email address, or phone number.
- Your workout plans and workout records are stored only on your device. They are never sent to the developer’s servers or anywhere else.
- To keep the app stable, the app automatically sends anonymous usage statistics and crash reports. They contain nothing that identifies you and nothing you typed into the app, such as exercise names or the weights and reps you entered.
- The data that is sent is stored on servers in the United States operated by two service providers, PostHog and Sentry.
- You can turn this off at any time in the app’s settings under “Send usage statistics and crash reports”. The app works exactly the same with it off.
- This website sets no cookies. It sends page views, referrers, and App Store link clicks to PostHog, counts visitors only by a hash that changes every day, and stores neither IP addresses nor locations.
1. What the app collects
1.1 Stored only on your device, never sent
| Data | What it contains | Where it is stored |
|---|---|---|
| Workout plans | Exercises by date, set structure, targets, rest times, equipment settings | The app’s data on your device |
| Workout records | Start and end times, values performed per set, pauses, and the history of corrections to finished records | The app’s data on your device |
| Install identifier | A random UUID created on first launch. It is unrelated to your name or to any hardware identifier | The app’s data on your device |
| Scheduled notifications | Local notifications for the end of a rest period and for reaching a timed set target | Your device (iOS Notification Center) |
This data is deleted together with the app when you delete it. The developer cannot access it. Depending on your iOS backup settings it may be included in your device backup, and Apple’s policies govern that backup.
1.2 Collected automatically and sent
The app sends the following data automatically, without any action on your part. Nothing you type, such as exercise names, search terms, weights, or reps, is ever sent.
(1) Usage statistics — service provider: PostHog, Inc.
| Item | Examples |
|---|---|
| Install identifier | The UUID from 1.1 above. Used only to group every event from the same installation |
| App usage events and their properties | App launch; viewing, creating, and editing a plan; opening and closing the exercise picker; starting a workout, completing a set, adjusting rest, pausing, finishing; viewing past workouts; reopening a summary; correcting results; a failed save and the retry. Properties are counts and category values only, such as the number of exercises, the number of sets, workout duration in seconds, the number of completed sets, the measurement type (for example weight and reps), how the plan was started, and the notification permission state |
| App and device information | App version and build number, whether installed through TestFlight, iOS version, device model, device language and time zone, screen size, network type (Wi-Fi or cellular), and the exercise catalog version |
| Approximate location | The country and city estimated from your IP address at the time of sending. The IP address itself is discarded by the service provider after the estimate is made and is not stored |
(2) Crash reports — service provider: Functional Software, Inc. (Sentry)
| Item | Examples |
|---|---|
| Install identifier | The UUID from 1.1 above |
| Error details | The call stack when the app crashes or hangs, the type and description of an error when saving or loading fails, and the app’s actions just before the error (screen changes, save results, and similar breadcrumbs) |
| App state | The screen shown, the workout’s progress state, the launch stage, the storage schema version, and the exercise catalog version at the time of the error |
| App and device information | App version and build number, distribution channel (TestFlight or App Store), iOS version, device model, and memory and storage status |
| Approximate location | The country and city estimated from your IP address at the time of sending. The IP address itself is discarded by the service provider after the estimate is made and is not stored |
Crash reports never include screenshots, the layout of the screen, or anything you typed.
1.3 What the app does not collect
Your name, email address, phone number, date of birth, precise location, contacts, photos, Health app (HealthKit) data, the advertising identifier (IDFA), or your activity in other apps or on other websites. The app does not track you across other companies’ apps or websites, and it does not allow third parties to collect your activity across sites through the app or this website.
1.4 This website
This website is served as static files and sets no cookies. To learn how many people visit, where they come from, and which pages they read, it automatically sends the following to the service provider PostHog, Inc.
| Item | Examples |
|---|---|
| Visit events | Page views and taps on the App Store link (with the link’s placement and the page language) |
| Page and referral information | The address of the page viewed, the previous page (referrer), and campaign parameters (UTM) in the address |
| Browser and device information | Browser and operating system type and version, device type, screen size, browser language, and time zone |
| Visitor hash | A hash computed on the service provider’s servers from the IP address, browser information, the site address, and a random value for that day. It is used only to group views from the same day into one visitor, and it changes every day |
The IP address is discarded after the hash is computed and is not stored, and no location is estimated from it. Because the website uses no cookies, local storage, or session storage, the same visitor cannot be recognized again on another day. The company that hosts the website may keep access logs to operate its service; the developer does not access those logs. If you email the developer, the information in your email is used only to handle your request.
2. How the data is used
| Data | Purpose |
|---|---|
| Workout plans and records on your device | Providing the app’s core features: planning, performing, and reviewing workouts |
| Usage statistics | Understanding which features are used and where people stop, in order to improve the app |
| Crash reports | Finding and fixing the causes of crashes, hangs, and failed saves, and judging the stability of a new version |
| Install identifier | Grouping usage statistics and crash reports from the same installation, and locating that installation’s data when you ask for it to be deleted |
| Website visits | Understanding how many people visit, where they come from, which pages they read, and how many tap the App Store link, in order to improve the website |
| Emails you send | Replying to your question or request |
The developer does not use the collected data for advertising or marketing, and does not sell it or share it with other businesses. Workout-related data is never used for advertising or data mining and is never given to data brokers.
3. Who receives the data
The developer does not share personal data with third parties, except where disclosure is required by law.
The developer uses two service providers to receive, store, and analyze the data described in 1.2. Both process the data only on the developer’s instructions under a data processing agreement, and both store it in the United States.
| PostHog | Sentry | |
|---|---|---|
| Company | PostHog, Inc. | Functional Software, Inc. (Sentry) |
| Privacy contact | [email protected] | [email protected] |
| Country of storage | United States | United States |
| When data is sent | Continuously while you use the app, and when you open a page of this website | Immediately after an error, or on the next launch |
| Data received | Usage statistics (1.2 (1)) and website visits (1.4) | Crash reports (1.2 (2)) |
| Purpose | Storing usage statistics and providing analysis tools | Storing crash reports and providing analysis tools |
| Retention | See section 5 | See section 5 |
4. Your rights and choices
- Turning collection off. In the app’s settings, turn off “Send usage statistics and crash reports”. From then on nothing is sent. Data sent before you turned it off can be deleted on request as described below.
- Data on your device. You can view and change it in the app, and deleting the app deletes all of it.
- Data that was sent. It is identified only by the install identifier, so the developer cannot tell whose data it is. To have it shown to you or deleted, send the install identifier displayed in the app’s settings to the contact address in section 10. A request without the identifier cannot be matched to any data and therefore cannot be fulfilled.
- Website visits. They carry no identifier that could single you out, so the developer cannot find, show, or delete the visits of a particular person. To stop them being sent, block requests to
posthog.comwith a content blocker or turn off JavaScript; the website still works in full. - Requests are handled, and you are told the result, within 10 days of receipt. For California residents, see section 7.
- A parent or legal guardian may exercise these rights on behalf of a child.
5. How long data is kept
| Data | Retention |
|---|---|
| Workout plans, records, and the install identifier on your device | Until you delete the app or clear its data on your device |
| Usage statistics (PostHog) | 7 years from the date sent |
| Website visits (PostHog) | 7 years from the date sent |
| Crash reports (Sentry) | Up to 90 days from the date sent |
| Emails you send | 1 year after your request is handled |
Data past its retention period is deleted automatically by the service provider’s systems. When you request deletion, the developer deletes the data for your install identifier in the service provider’s tools; there is no separate copy to erase.
6. Children
The app is not directed to children under 13, and the developer does not knowingly collect personal data from children under 13. The app does not ask for your age, so the developer cannot know how old you are. If the developer learns that data was sent from a device used by a child under 13, that data is deleted promptly. You can request this as described in section 4.
7. Additional information for California residents
The developer does not sell personal information and does not share it for cross-context behavioral advertising. The app and this website do not track your activity across other websites or apps and therefore do not respond to browser “Do Not Track” signals, and the developer does not allow third parties to collect your activity across sites through the app or this website.
California residents have the right to know what categories of personal information the developer collects and why, the right to request deletion, and the right not to be discriminated against for exercising these rights. The categories the developer collects are listed in section 1 and the purposes in section 2. To make a request, follow section 4 and write to the address in section 10. Requests are handled within 45 days.
8. International transfer
The app is offered on the App Store in the Republic of Korea and the United States. Wherever you use it, the data described in 1.2 is sent to and processed in the United States by the service providers listed in section 3.
9. Security
- Identifying values and anything you typed are excluded from the data before it is sent (data minimization).
- Data is sent only over TLS-encrypted connections.
- Only the developer can access the service providers’ tools, and that access uses two-factor authentication.
- Both service providers hold SOC 2 Type II attestations.
- Data on your device is protected by the iOS app sandbox and device encryption.
10. Contact
| Responsible person | Hoon Oh (the developer) |
| [email protected] |
Send questions, complaints, and requests about your personal data to this address.
11. Changes to this policy
This policy is updated when the law or what the app collects changes. Changes are posted on this page 7 days before they take effect, and changes that add collected data or new purposes are also announced inside the app.
| Version | Effective | Change |
|---|---|---|
| 1.0 | 2026-10-21 | First version |