Privacy policy

Your gym and us

Gyms use Motisfit to run their business: classes, memberships, payments and member records. When you join a gym that uses Motisfit, the gym decides what it records about you and how it uses it, and we hold and process that information for the gym. Questions about how your gym uses your information are best asked of the gym, and we'll help it answer. Your Motisfit account, which you use to sign in at any gym, is ours to look after, as is information about gym owners and visitors to this website.

What we collect

• Your account. Your name and email address, and your phone number and an emergency contact if you add them. If you sign in with a passkey, we keep only its public half, which can't be used to sign in as you.
• Family members. A parent or guardian can add their children. We keep the child's name, and their date of birth if it's given.
• What you do at your gym. Memberships, class packs and credits, bookings and waitlists, appointments, check-ins, challenges and referrals. When you sign a gym's waiver, we keep the version you signed, the name you signed with, the time, and your IP address and browser, as the gym's record that you agreed.
• What staff record. Gym staff can add notes and labels to a member's record, such as an injury to work around.
• Gyms. For gym owners and staff: the gym's name, location, schedule, plans and prices, who works there in which role, and a log of the changes made to the gym and its members.
• Payments. Card payments are handled by Stripe. You enter your card on Stripe's own pages and Stripe keeps it, so we never see or store your full card number. We keep Stripe's reference numbers and what was paid or refunded, and when.
• Devices and connected apps. If you turn on notifications on a phone, we keep the address used to deliver them and the device's name. If you connect an AI assistant or another app, we keep which app it is and when you connected it.
• Messages to us. Email you send to hello@motisfit.com.
• Technical information. Our servers keep logs of requests and errors, for security and to fix problems.

How we use it

• To run Motisfit: signing you in, booking classes, taking payments, sending receipts and reminders, and showing your gym what it needs to run its classes.
• To send messages for your gym, such as class changes, waitlist spots, news and the welcome and come-back messages a gym sets up. They come from Motisfit on the gym's behalf, by email or as a notification in the app.
• To bill gyms for Motisfit.
• To keep Motisfit secure, prevent abuse and fix problems.
• To see whether our own advertising works (see Cookies and advertising).

We don't sell personal information. We don't use members' information to advertise to them, and we don't use it to train AI models.

AI assistants

Motisfit works with AI assistants such as Claude and ChatGPT. Nothing is shared with an assistant until you connect it and approve what it can do. Once it's connected, it can see and do what your account allows when you ask it to, such as finding a class or booking one. For gym staff, that includes the member information their role can see. What the assistant receives is handled by its provider under that provider's privacy policy. You can disconnect an assistant at any time under Account in the app.

Who we share it with

• Your gym. Gyms you belong to see your account details (name, email, phone and emergency contact), what you do there and the waivers you sign. They don't see what you do at other gyms.
• Service providers that run parts of Motisfit for us, only for that purpose:
  • Amazon Web Services, for hosting, storage and sending email
  • Stripe, for card payments on each gym's own Stripe account, and for gyms' Motisfit subscriptions
  • Expo, for delivering notifications to phones through Apple and Google
  • Google, for measuring our ads on motisfit.com
• Your calendar app, if you add your classes to your calendar. It reads them from a private link made for you, so keep that link to yourself.
• When the law requires it, such as a valid court order, or when it's needed to protect someone's safety.
• If the business changes hands, to the new owner, who must keep this policy's promises for information collected under it.

Cookies and advertising

motisfit.com uses Google's advertising tag, which sets cookies so we can tell whether a visit came from one of our Google ads. If you set up a gym in the app on the web after clicking one of our ads, the app tells Google that a sign-up happened, with a random number for the gym. It doesn't send your name or email address.

You can limit how Google uses information for ads in My Ad Center, or block cookies in your browser: motisfit.com works the same without them. The app keeps you signed in using your browser's or phone's storage, and doesn't use cookies for advertising beyond that one sign-up message.

Where it's stored

Motisfit's data is stored with Amazon Web Services in the United States, in Ohio. If you live outside the US, your information is stored and processed there and is subject to US law, including lawful requests from US authorities. It's encrypted on its way to and from Motisfit and while it's stored. Stripe, Expo and Google may process information in other countries under their own safeguards.

How long we keep it

• Your account and gym records: while your account is open and your gym uses Motisfit.
• Sign-in codes: they expire after 10 minutes.
• Server logs: two weeks.
• Email to hello@motisfit.com: 30 days in our mail system, and in our own mailboxes for as long as we need it to deal with your message.
• Backups: 35 days, after which deleted information is gone from them too.

When you delete your account, we delete your profile, email address, passkeys, connected apps, devices, notifications and calendar link, cancel your upcoming bookings, and remove your contact details and staff notes from each gym's records. Gyms keep what they need for their accounts and legal records, without your contact details: payments and class credits, attendance, plans and signed waivers.

When a gym stops using Motisfit, its owner can ask us to delete the gym's information, and we'll do so within 30 days.

Your choices and rights

• Get a copy. In the app, go to Account and choose Download my data for everything your account holds.
• Correct it. Change your name, phone and emergency contact in the app, or ask your gym to correct its records.
• Delete your account. In the app, go to Account and choose Delete account.
• Ask us. Write to hello@motisfit.com to ask what we hold about you, to have it corrected, or to withdraw your consent to something. We'll answer within 30 days. Withdrawing consent may mean we can't provide part of Motisfit to you.
• Complain. If you're not satisfied with our answer, you can contact the Office of the Privacy Commissioner of Canada.

Children

Motisfit is meant for adults. A parent or guardian can add their children as family members, so they can book classes and sign waivers for them. Children don't sign in themselves, and their notifications go to the parent. If you think a child is using Motisfit without a parent's involvement, write to us and we'll delete the account.

Security

You sign in with a one-time code sent to your email or with a passkey, so there's no password to steal. Information is encrypted in transit and at rest, and only the people who run Motisfit can reach it. No system is perfectly secure: if a breach creates a real risk of significant harm, we'll tell the people affected, the gyms involved and the Privacy Commissioner of Canada.

Changes to this policy

When we change this policy, we update the date at the top. For significant changes, we also email gym owners before they take effect.

Contact

Credit River Software, Ontario, Canada. Write to hello@motisfit.com with any question or request about privacy, and the person accountable for privacy at Credit River Software will answer.