Privacy Policy

At Bastion Fitness ("Bastion," "we," "us"), we treat your fitness data with the same respect we treat our own training. This Privacy Policy outlines exactly what we collect, why we collect it, and—most importantly—what we won't do with it.

1. Information We Collect

1.1. Personal Identification Information

• Account Details: Name, email address, password (hashed), and profile photo.
• Gym Affiliation: The gym or organization you are a member of.
• Date of Birth: When you join a gym as an athlete, coach, or head coach, Bastion asks for your date of birth. We use it to work out your age band (under 13, 13 to 17, or 18 and over). The age band is calculated and is not stored. If you are under 13, we do not keep the date. Your gym owner can see your date of birth in the app. It is included in your own data export, is not included in your gym's export or in analytics, and is deleted with your account.
• Parent or Guardian Information (members aged 13 to 17): The parent or legal guardian's name, relationship to the member, email address, and electronic signature, with the date and time consent was recorded. This is stored with the member's record.

1.2. Health and Fitness Data ("Protected Fitness Data")

We collect specific metrics to provide our core service—tracking your fitness progress. This includes:

• Gender: Optional, used for leaderboard categorization.
• Performance Data: Workout results (times, rounds, reps), weight lifted, 1-Rep Maxes (1RM), and benchmark scores.
• Notes: Personal journal entries and notes attached to workouts.

1.3. Technical Data

Device information (mobile vs. desktop), IP address, and browser type, used solely for security logging and improving user experience. When something breaks, technical error details (such as the error, the device and the app version) are sent to our error-monitoring provider, Sentry. Sentry also receives your IP address and performance timings, including page addresses, for a sample of page loads.

1.4. Photos and Signatures

• Photos: Workout photos and profile pictures you upload.
• Signatures: If you sign a waiver electronically, we store your signature image and the date and time you signed. If a parent or guardian signs for a member aged 13 to 17, see Section 6.

2. How We Use Your Data

We use your data strictly to provide and improve the Bastion Fitness platform:

• Programming Logic: To calculate personalized lifting weights based on your 1RM percentages.
• Progress Tracking: To generate history charts and identify Personal Records (PRs).
• Leaderboards: To display your scores on your gym's leaderboard (if your privacy settings allow).
• Gym Management: To allow your coaches to view your attendance and performance to help them coach you better.

2.1. AI Features

Bastion uses Google's Vertex AI (Gemini models) in two places. Bastion does not train AI models on your data.

• Workout parsing: When a coach pastes or uploads a workout to turn it into a structured workout, the text is sent to Vertex AI. Athlete results and member names are not sent by design, but a coach could paste anything into that box.
• Message screening: Where a gym uses Bastion messaging, the text of each message is checked by Vertex AI for harassment, threats, sexual content, self-harm and similar content. Only the message text is sent, not names or gym details. A flagged message from a member or coach is queued for your gym owner to review; if it contains a threat or sexual content, it is also reported to Bastion. Flagged messages from gym owners, and flagged announcements, go to Bastion for review.

3. Data Ownership and Sharing

3.2. Sharing with Your Gym

By joining a Gym on Bastion, you authorize that Gym's staff (Owners and Coaches) to view your:

• Name and Profile Photo.
• Workout Logs and Results.
• Attendance history.
• Personal Records.

This sharing is essential for your coaches to provide programming and feedback. You can leave a Gym at any time to revoke this access.

3.3. Public Visibility

By default, your workout results are visible to other members of your Gym (the "Community Board"). You can adjust your privacy settings to make your logs "Private" (visible only to you and your coaches).

3.4. Service Providers

We use trusted third-party sub-processors to run our infrastructure. They process data only according to our instructions:

• Google Cloud Platform / Firebase: Hosting, database, authentication and push notifications.
• Google Vertex AI (Gemini): The AI features described in Section 2.1.
• Stripe: Payment processing, including your gym's billing (we do not store full credit card numbers).
• SendGrid (Twilio): Sending password resets, invitations and notifications by email.
• Sentry: Error and crash reporting.
• Google and Apple sign-in: If you choose to sign in with your Google or Apple account.
• Google Fonts: Our public website pages load fonts from Google, which receives your IP address when the page loads.

4. Data Storage and Security

4.1. Security Measures

• Encryption: Data is encrypted in transit (using TLS 1.2+) and at rest (AES-256) on our servers.
• Access Control: Role-based access controls limit who can read and change data. Access to our production systems is limited to authorized Bastion personnel. For support and security, an authorized Bastion administrator may enter a gym's account or sign in as a specific user; those sessions are logged.
• Passwords: Passwords are managed by Google Firebase Authentication and stored hashed and salted.

4.2. Data Retention and Deletion

We retain your data for as long as you maintain an account.

• Deletion: When you ask to delete your account, deletion is scheduled for 30 days later and you can cancel until then. On the deletion date we delete your profile and sign-in, personal records, notifications, profile photo and result photos. Your workout results and class bookings stay in your gym's records, but your name and photo are removed and they show as "Deleted member". If you still have an active paid membership on that date, deletion waits until it ends.
• What we keep: Signed waiver images (including a guardian's signature, where a guardian signed) stay with your gym as its record that you signed. Payment records and your customer record in Stripe are kept for financial and tax purposes. Messages you sent stay with your gym as "Former member" for up to three years, and longer while a legal hold applies.
• Backups: Backup copies, if any, are overwritten on a rolling schedule.

5. Your Rights

• Access: You can view all your logged data within the app.
• Portability: You can request an export of your workout history in a machine-readable format.
• Correction: You can edit your past workout results and your profile details.
• Erasure: You can request deletion of your account and data in the app under Settings, Account, Delete account, or by emailing privacy@bastionfit.com. Section 4.2 explains what is deleted and what we keep.

6. Children's Privacy

Bastion is not intended for use by children under the age of 13. We do not knowingly collect data from children under 13. When someone joins a gym, Bastion asks for a date of birth; if it shows the person is under 13, we do not keep the date, the account is marked, and the person is not let in.

Users Ages 13-17: Minors between 13 and 17 may use the Service only with the consent and supervision of a parent or legal guardian. A parent or legal guardian gives consent (name, relationship, email address, and a signature) when the member joins, or the gym records it in person. Until consent is on file, the member cannot book classes or use the app apart from a short list of screens. If you are a parent or guardian and believe your minor child has provided us with personal information without your consent, please contact us at privacy@bastionfit.com.

Notices and copies to parents and guardians: We send the parent or guardian a notice when consent is recorded. Until the member turns 18, we also send the parent or guardian a separate copy of the emails sent to the member (for example, billing and class notices). These copies contain no payment links or card details. At 18 the member is asked to sign the waiver themselves and the copies stop.

Corrections: A gym owner can correct a member's date of birth. Corrections are logged.

7. Cookies and Local Storage

The Bastion app and website do not use advertising or analytics cookies or trackers. They store a small amount of data on your device to work: your sign-in session (kept by Google Firebase Authentication in your browser's storage) and your preferences, such as theme. Our website pages load fonts from Google (Section 3.4), and Stripe's payment pages set their own cookies. You can clear this data in your browser settings; if you clear your sign-in session you will need to sign in again.

8. Contact Us

For any privacy-related questions or to exercise your rights, please contact our Data Protection Officer at:

Email: privacy@bastionfit.com
Address: 1600 Maximilian Dr, Wesley Chapel, FL 33543