Security
This website collects nothing: it sets no cookies, runs no analytics and has no forms or accounts. It is a set of static pages served over HTTPS. In the product, card payments go straight to the gym through the gym's own Stripe account, and nobody signs in with a password. The rest says how a gym's data is kept.
What does this website collect?
This website sets no cookies, runs no analytics and has no forms. There is nothing to sign in to and no JavaScript runs in your browser. Our build checks fail if a script, a form or a tracker is added to a page.
Where is the website hosted?
This website is hosted on Cloudflare Pages and is served only over HTTPS. Like any web host, Cloudflare sees the address a request comes from in order to answer it. The privacy notice covers that.
Who handles card payments?
Card payments go through the gym's own Stripe account, so the gym is the merchant and we never hold its money.
How do staff and members sign in?
A gym's staff sign in to its private screens with a single-use link sent to their email address, and there are no passwords. The set-up docs say how long a link and a session last.
Members sign in to their accounts with no password either: by a one-time code sent by email, or with an Apple, Google or Microsoft account, and every session can be ended from the account.
Where is a gym's data kept?
In European data centres. A gym's member records are held under a processor agreement, with the gym as controller and Mediant Partners Ltd as its processor, and a data protection impact assessment is completed before a gym's member data is brought in.
How do you report a security problem?
Use the route on the contact page and say it is a security report. Please give us the chance to fix a problem before you publish it.