Privacy Policy

The Fitness Syndicate (“we,” “us,” or “our”) operates the The Fitness Syndicate website and mobile application (collectively, the “Platform”). This Privacy Policy explains what information we collect, how we use it, and your choices regarding your data.

1. Information We Collect

Information you provide

• Account information: Name, email address, phone number, and password when you create an account.
• Emergency contact: Name and phone number of your designated emergency contact.
• Payment information: Processed securely by Stripe, Inc. We do not store your full credit card number, bank account number, or other payment credentials on our servers.
• Waiver signatures: Digital signatures on liability waivers and gym policy acknowledgments, stored with timestamps for legal compliance.
• Fitness data: Workout logs, program progress, and training preferences you enter in the app. This data is stored locally on your device and optionally synced to your account.
• Communications: Messages exchanged with trainers through the Platform.

Information collected automatically

• Device information: Device type, operating system, and app version for compatibility and troubleshooting.
• Usage data: Pages visited, features used, and interaction patterns to improve the Platform.
• IP address: For security, fraud prevention, and waiver record integrity.

Information we do NOT collect

• Social Security numbers
• Driver’s license or government ID numbers
• Exact birth dates (we store only an age range bracket for demographic reporting)
• Biometric data (fingerprints, face scans)
• Location data (GPS tracking)

2. How We Use Your Information

• Provide the service: Manage your membership, process payments, deliver workout programs, and facilitate communication with trainers.
• Authentication: Verify your identity through password login or one-time verification codes (OTP) sent via SMS.
• Transactional communications: Send receipts, payment confirmations, membership status updates, and verification codes.
• Service communications: Send schedule reminders, class updates, and account notifications via email or SMS.
• Improve the Platform: Analyze usage patterns to improve features and user experience.
• Safety and security: Detect and prevent fraud, unauthorized access, and other harmful activities.

3. SMS Messaging

By providing your phone number during account creation, you consent to receive the following types of SMS messages from The Fitness Syndicate:

• One-time verification codes (OTP) for account login and authentication
• Account notifications (membership status changes, payment confirmations)
• Schedule reminders and class updates

Message frequency varies. Message and data rates may apply. You can opt out of non-essential SMS messages at any time by replying STOP. Verification codes required for login cannot be opted out of while using SMS-based authentication.

4. Data Sharing

We do not sell, rent, or trade your personal information to third parties. We share data only with:

• Stripe, Inc.: Payment processing. Subject to Stripe’s Privacy Policy.
• Twilio, Inc.: SMS delivery for verification codes and notifications. Subject to Twilio’s Privacy Policy.
• Resend: Email delivery for transactional emails. Subject to Resend’s Privacy Policy.
• Vercel, Inc.: Platform hosting. Subject to Vercel’s Privacy Policy.

If The Fitness Syndicate is integrated with a third-party gym management system (e.g., MindBody), limited member data (name, email, phone) may be synced to that system as part of the gym’s operations. This sync is controlled by the gym owner and can be disabled.

5. Data Security

• Passwords are hashed with bcrypt (cost factor 12) and never stored in plain text.
• Trainer-to-client messages are encrypted with AES-256-GCM.
• All data in transit is encrypted via TLS/HTTPS.
• Payment information is handled by Stripe (PCI Level 1 compliant) and never touches our servers.
• Workout data stored locally on your device uses SQLite with application-level encryption.

6. Data Retention

• Account data: Retained while your account is active. Upon account deletion, personal data is removed within 30 days.
• Waiver records: Retained for 7 years after signing for legal compliance purposes.
• Payment records: Retained by Stripe per their data retention policies and applicable financial regulations.
• Workout data: Locally stored data is deleted when you uninstall the app or clear app data. Server-synced data is deleted with your account.
• Trainer messages: Subject to ephemeral deletion policies configured by the gym. Messages may auto-delete after a configured period.

7. Your Rights

You have the right to:

• Access your personal data by viewing your profile in the app or contacting us.
• Correct inaccurate data through your profile settings.
• Delete your account and associated data by contacting us at train@thefitnesssyndicate.com.
• Export your workout and membership data.
• Opt out of non-essential communications at any time.

California residents may have additional rights under the CCPA. Contact us at train@thefitnesssyndicate.com for CCPA-related requests.

8. Children’s Privacy

The Platform is not intended for children under 13. We do not knowingly collect personal information from children under 13. If you believe a child has provided us with personal data, please contact us and we will delete it promptly. Members aged 13–17 must have parental or guardian consent to use the Platform.

9. Cookies

We use essential cookies for authentication and session management. We do not use advertising cookies, tracking pixels, or third-party analytics cookies. No cookie consent banner is required because we only use strictly necessary cookies.

10. Changes to This Policy

We may update this Privacy Policy from time to time. Changes will be posted on this page with an updated effective date. For significant changes, we will notify you by email or through the Platform.

11. Contact

Questions about this Privacy Policy? Contact us at train@thefitnesssyndicate.com.