Privacy Policy

Decoded Training Lab (“Decoded”, “we”, “us”) is a gym in Haw River, North Carolina. This policy explains what information we collect through the Decoded Training Lab mobile app and this website, why we collect it, who we share it with, and the choices you have.

The app is for Decoded members: it handles sign-up and membership agreements, class reservations, attendance and streaks, membership billing status, workouts and personal records, and gym announcements and polls. The website provides gym information, contact and consultation forms, and a drop-in waiver for visitors.

Account and profile. When you create an app account we collect your email address and a password. Your login is handled by our backend provider (see “Who we share information with”); we never see or store your password in readable form. When you set up a membership you give us your legal first and last name, date of birth, phone number and home address.

Emergency contact. The name and phone number of the person we should call in an emergency.

Parent or guardian details. Members aged 13 to 17, and drop-in visitors under 18, need a parent or guardian to approve and sign. We collect the guardian’s name, email, phone number, relationship to the member and typed signature.

Membership and payment records. Your membership plan, its status (such as awaiting first payment, active or past due), due dates, and a record of each payment: the date, the amount and the form of payment you told us you would use (cash, Zelle, Venmo or Apple Pay). Payments are made to Decoded directly, outside the app. The app does not process payments and does not store card numbers, bank account details or any payment credentials.

Legal agreements and electronic signatures. When you join, you review and sign the Membership Agreement, the liability waiver and the Code of Conduct by typing your legal name. We record which exact version of each document you signed, your acknowledgements and consent to electronic records, the date and time, and a snapshot of the details the documents print (such as your name, date of birth and emergency contact at the time). We then generate an executed copy of each signed document and keep it for you and for our records. Drop-in visitors sign the waiver on this website the same way; for those signatures we also record the IP address and browser type of the device used, as evidence of the signing.

Things you do in the app. Your class reservations and waitlist places; attendance, which the app derives from the classes you reserved and attended; attendance streaks; workout results, personal records, poll answers and reactions you choose to log or post; and your notification preferences.

Website forms. If you use the contact form or request a membership consultation, personal training or nutrition information, we receive the details you enter (name, email, phone number where asked, and your message or answers). These are emailed to us so we can reply; the website itself does not keep a copy.

Account and device identifiers. To keep you signed in, the app stores a login session on your device and our backend provider records the sessions and sign-in events for your account. The app also sends its version number with certain requests so we can support older versions correctly.

Technical logs. Like most online services, our backend and hosting providers may keep standard technical logs (such as IP address, request time and error details) to operate and secure the app and the website.

What we do not collect. The current version of the app does not collect your precise device location, Apple HealthKit or other health or medical data, your phone contacts, your photos, microphone or audio, or any advertising identifier. We do not use analytics, advertising or tracking software in the app or on this website, and we do not track you across other companies’ apps or websites. The current version does not send push notifications.

We use your information to:

• create and secure your account and verify your email address
• set up and administer your membership, including your agreements, billing status, due dates and payment records
• run classes: reservations, waitlists, rosters, attendance and streaks
• provide the app’s member features, such as workouts, personal records, announcements and polls
• contact you about your account and membership (see “Communications”)
• reach your emergency contact, or a member’s parent or guardian, when we need to
• keep the records a gym needs to keep, and meet our legal, accounting and safety obligations
• respond to messages and requests you send us

We do not sell your personal information, and we do not share it with anyone for their own advertising or marketing.

We email you when it is needed to run your account or membership: to confirm your email address, to reset your password, to send your signed agreements, to send payment receipts and payment reminders, and to send required notices about contract renewals. Members aged 13 to 17 and their parent or guardian each receive their own copy of the signed agreements. These are service messages, not marketing, so you cannot opt out of them while you hold an account, but you can delete your account at any time.

Some things are visible to other Decoded members inside the app by design: your name on the roster of a class you have reserved, your attendance-streak standing on the leaderboards, and the workout results and reactions you choose to post. Your contact details, date of birth, address, emergency contact, agreements, billing and payment information are never shown to other members. If you delete your app account, your name on past rosters and results is replaced with “Former App User”.

Decoded staff and coaches see member information as needed to run classes and the gym. Beyond that, we share information only with the service providers that run the app and website for us:

• Supabase provides our backend: sign-in and account security, the database that stores the records described above, and private file storage for signed agreements.
• Resend delivers our transactional email, such as verification emails, receipts, reminders, notices and copies of signed agreements.
• Our website hosting provider serves this website.

These providers process information only to provide their service to us. We may also disclose information if the law requires it, to protect the safety of members and staff, or to protect our legal rights.

We keep your information for as long as you have an account or membership with Decoded, and afterwards for as long as we need it to keep proper business records and meet our legal, accounting and safety obligations. Signed agreements, electronic-signature records and their executed copies, membership records and payment records are kept after an account or membership ends, because they document a contract. We are still confirming specific retention periods for these records with our legal advisers; when we set them, we will update this policy.

Some information is removed sooner. Website contact and consultation requests are only emailed to us, not stored on the website. When you delete your app account (see below), your personal records, poll answers, reactions, notification preferences and any push-notification registrations are deleted right away.

In the app, Profile shows the information we hold about you. You can change your phone number, home address and emergency contact yourself under Profile. Your legal name, date of birth and login email carry legal weight (they appear on your signed agreements and decide the rules for members under 18), so to change them, contact us and we will update them for you.

You can ask us for a copy of the personal information we hold about you, ask us to correct it, or ask us to delete it, by emailing us at the address below. We will respond within a reasonable time and may ask you to confirm your identity first.

You can delete your app account yourself, at any time, in the app: open Profile and choose Delete Account. You will be asked to re-enter your password to confirm. Deleting the account removes your login and the app-only data listed under “Retention”. If you cannot use the app, email us and we will delete it for you.

Deleting your app account is not the same as cancelling your gym membership. Your membership, its agreement and its billing continue until you cancel the membership under the terms of your Membership Agreement, which you can do in person at the gym or by emailing us. If you later want to use the app again, contact us; we can allow your existing membership to be reconnected to a new login.

The minimum age for a Decoded membership is 13. Members aged 13 to 17 need a parent or guardian to approve the membership and sign the agreements with them, and we collect the guardian’s details described above. We do not knowingly collect information from anyone under 13; if you believe we have, contact us and we will delete it.

Access to member information is limited to Decoded staff who need it and to the providers named above. The app talks to our backend over encrypted connections, sign-in is handled by our backend provider, signed agreements are stored in private storage that only you and Decoded administrators can open, and the rules that decide who may see or change each record are enforced on the server, not in the app. No system is perfectly secure, so please keep your password private and contact us if you think your account has been misused.

If we change how we collect or use information, we will update this page and its effective date. Where a change is significant, we will let members know in the app or by email.