Privacy Policy

The Fitness Syndicate (“we,” “us,” or “our”) operates the The Fitness Syndicate website and mobile application (collectively, the “Platform”). This Privacy Policy explains what information we collect, how we use it, and your choices regarding your data.

We’re built to collect as little personal information as possible: essentially what’s needed to run your membership, and nothing more.

1. Information We Collect

Information you provide

• Account information: Name, email address, phone number, and password when you create an account.
• Emergency contact: Name and phone number of your designated emergency contact.
• Payment information: Processed securely by Stripe, Inc. We do not store your full credit card number, bank account number, or other payment credentials on our servers.
• Waiver signatures: Digital signatures on liability waivers and gym policy acknowledgments, stored with timestamps for legal compliance.
• Fitness data: Workout logs, program progress, and training preferences you enter in the app. This data is stored locally on your device.
• Profile photo (optional): A photo you add from your phone, or one added by gym staff, used so our team can recognize you at the gym.
• Date of birth (month and year only, optional): Used to confirm eligibility for 18+ amenities (such as the sauna) and senior pricing. We do not collect the day of your birth date.

Information collected automatically

• Device information: Device type, operating system, and app version for compatibility and troubleshooting.
• Usage data: Pages visited, features used, and interaction patterns to improve the Platform.
• IP address: For security, fraud prevention, and waiver record integrity.

Information we do NOT collect

• Social Security numbers
• Driver’s license or government ID numbers
• The day of your birth date (we use month and year only)
• Biometric data (fingerprints, face scans)
• Location data (the app confirms you’re at the gym on your device only; your location never leaves your phone or reaches our servers)

2. How We Use Your Information

• Provide the service: Manage your membership, process payments, deliver workout programs, and facilitate communication with trainers.
• Authentication: Verify your identity through password login or one-time verification codes (OTP) sent via SMS.
• Transactional communications: Send receipts, payment confirmations, membership status updates, and verification codes.
• Service communications: Send schedule reminders, class updates, and account notifications via email or SMS.
• Improve the Platform: Analyze usage patterns to improve features and user experience.
• Safety and security: Detect and prevent fraud, unauthorized access, and other harmful activities.

3. SMS Messaging

By providing your phone number during account creation, you consent to receive the following types of SMS messages from The Fitness Syndicate:

• One-time verification codes (OTP) for account login and authentication
• Account notifications (membership status changes, payment confirmations)
• Schedule reminders and class updates

Message frequency varies. Message and data rates may apply. You can opt out of non-essential SMS messages at any time by replying STOP. Verification codes required for login cannot be opted out of while using SMS-based authentication.

4. Data Sharing

We do not sell, rent, or trade your personal information to third parties. We share data only with:

• Stripe, Inc.: Payment processing. Subject to Stripe’s Privacy Policy.
• Twilio, Inc.: SMS delivery for verification codes and notifications. Subject to Twilio’s Privacy Policy.
• Resend: Email delivery for transactional emails. Subject to Resend’s Privacy Policy.
• Vercel, Inc.: Platform hosting. Subject to Vercel’s Privacy Policy.

If The Fitness Syndicate is integrated with a third-party gym management system (e.g., MindBody), limited member data (name, email, phone) may be synced to that system as part of the gym’s operations. This sync is controlled by the gym owner and can be disabled.

5. Data Security

• Passwords are hashed with bcrypt (cost factor 12) and never stored in plain text.
• All data in transit is encrypted via TLS/HTTPS.
• Payment information is handled by Stripe (PCI Level 1 compliant) and never touches our servers.
• Workout data is stored locally on your device, isolated per account, and protected by your device’s built-in security.

6. Data Retention

• Account data: Retained while your account is active. You can delete your account at any time, directly in the app or under My Account on the web. When you do, your access is removed immediately and you have 7 days to cancel and restore your account. After that window, your personal data is permanently deleted once any active billing has ended and any required financial-retention period has passed.
• Waiver records: Retained for 7 years after signing for legal compliance purposes, even after account deletion.
• Payment records: Retained by Stripe per their data retention policies and applicable financial regulations.
• Workout data: Locally stored data is deleted when you uninstall the app or clear app data.

7. Your Rights

You have the right to:

• Access your personal data by viewing your profile in the app or contacting us.
• Correct inaccurate data through your profile settings.
• Delete your account and associated data directly in the app or under My Account on the web. Deleting your account is not the same as canceling your membership: deletion removes your access and personal data, but it does not stop billing. To cancel your membership, contact the gym by phone or in person and we’ll help you sort out whatever you need — pausing, changing your billing date, or canceling outright. If you delete your account but don’t cancel your membership, billing continues, and that ongoing billing can delay the deletion of your personal data. You can also contact us at train@thefitnesssyndicate.com for any data request.
• Export your workout and membership data.
• Opt out of non-essential communications at any time.

California residents may have additional rights under the CCPA. Contact us at train@thefitnesssyndicate.com for CCPA-related requests.

8. Children’s Privacy

The Platform is not intended for children under 13. We do not knowingly collect personal information from children under 13. If you believe a child has provided us with personal data, please contact us and we will delete it promptly. Members aged 13–17 must have parental or guardian consent to use the Platform.

9. Cookies

We use essential cookies for authentication and session management. We do not use advertising cookies, tracking pixels, or third-party analytics cookies. No cookie consent banner is required because we only use strictly necessary cookies.

10. Changes to This Policy

We may update this Privacy Policy from time to time. Changes will be posted on this page with an updated effective date. For significant changes, we will notify you by email or through the Platform.

11. Contact

Questions about this Privacy Policy? Contact us at train@thefitnesssyndicate.com.