1. Introduction

TrainOS ("we", "our", or "us") provides gym management software for martial arts academies. This Privacy Policy explains how we collect, use, and protect your personal information when you use our web application and mobile app (collectively, the "Service").

2. Information We Collect

We collect the following types of information:

Account information: Name, email address, and password when you create an account.
Profile information: Phone number, date of birth, bio, profile photo, belt rank, and stripe count.
Academy membership data: Your membership status, attendance records, class check-ins, and subscription details at academies you join.
Payment information: Payment transactions are processed by third-party providers (Stripe and Square). We do not store your credit card numbers. We retain transaction history (amounts, dates, plan details) for your records.
Device information: Push notification tokens for delivering notifications to your mobile device, as well as device type, operating system version, and app version for analytics purposes.
Usage data: We collect anonymous analytics data such as screen views, feature usage, and app interactions to improve the Service. This data is processed by PostHog and does not include advertising identifiers or cross-app tracking.
Content you create: Posts, comments, and other content you share within your academy's community feed.

3. How We Use Your Information

To provide and operate the Service, including class scheduling, attendance tracking, and membership management.
To process payments through our payment providers (Stripe and Square).
To send push notifications you have opted into, such as class reminders, announcements, and membership updates.
To display your profile to other members of your academy (subject to your privacy settings).
To enable academy administrators and instructors to manage their academy, including tracking attendance and promotions.
To analyze usage patterns and improve the Service through anonymous analytics.

4. Third-Party Services

We do not sell your personal information. We use the following third-party services to operate the Service:

Supabase: Database hosting, user authentication, and file storage. Your account data, membership records, and uploaded files (such as profile photos and post images) are stored on Supabase infrastructure.
Stripe: Payment processing for academy membership subscriptions and store purchases. Stripe handles all credit card and payment credentials directly.
Square: Payment processing for academies that use Square as their payment provider. Square handles all credit card and payment credentials directly.
PostHog: Anonymous product analytics to understand how the Service is used and to improve features. PostHog collects device type, OS version, and in-app interactions. We do not collect advertising identifiers (IDFA) or perform cross-app tracking.
Expo: Push notification delivery service. Expo receives your device push token to deliver notifications. Tokens are automatically cleaned up when they become invalid (e.g., after app uninstall).

5. Information Sharing

We share data only in these circumstances:

With your academy: Your profile, attendance, and membership information is visible to the administrators and instructors of academies you join.
With other members: Your name, belt rank, and profile photo may be visible to other members of your academy, subject to your profile visibility settings.
With third-party services: As described in Section 4, we share necessary data with our service providers to operate the Service. These providers process data on our behalf and are bound by their own privacy policies.
Legal requirements: We may disclose information if required by law or to protect rights and safety.

6. Data Storage and Security

Your data is stored securely using Supabase infrastructure with row-level security policies. We use encryption in transit (HTTPS/TLS) and implement access controls to protect your information. Payment credentials are handled entirely by Stripe or Square and never touch our servers.

7. Your Rights and Choices

Profile visibility: You can set your profile to "Private" so only you and staff can view your details.
Push notifications: You can manage notification preferences in the app settings, or disable notifications through your device settings.
Account deletion: You can delete your account directly in the mobile app under Settings > Account > Delete Account. This will permanently remove your account, cancel any active subscriptions, and delete all associated personal data.
Data access: You may request a copy of the personal data we hold about you by contacting us at train.os.app@gmail.com.

8. Push Notifications

We use Expo Push Notification service to deliver notifications to your device. Push tokens are stored associated with your user account and are automatically removed when they become invalid (e.g., after app uninstall). You can opt out of specific notification categories in the app's notification preferences.

9. Data Retention

We retain your account data for as long as your account is active. If you leave an academy, member-specific data (such as likes and conversations) is removed. Content you authored (posts, comments) may be retained with your identity anonymized. If you delete your account, all associated data is permanently removed, including your profile, memberships, push tokens, and uploaded files.

10. Children's Privacy

The Service is not directed to children under 13. We do not knowingly collect personal information from children under 13. If you believe we have collected such information, please contact us so we can delete it. Users under the age of 18 are automatically assigned a private profile visibility setting to protect their information from other members.

11. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by posting the updated policy with a new "Last updated" date. Your continued use of the Service after changes constitutes acceptance of the updated policy.

12. Contact Us

If you have questions about this Privacy Policy or wish to exercise your data rights, please contact us at train.os.app@gmail.com.