Privacy Policy

This Privacy Policy describes how ClassPilot ("we," "our," or "us") collects, uses, and shares information when you use the ClassPilot mobile application and related services (collectively, the "Service"). ClassPilot is operated by the makers of StudioPilot, the app the studios themselves use.

ClassPilot connects you to independent fitness studios. Those studios are separate businesses, and this policy explains both what we hold and what a studio holds about you — because they are not the same thing.

1. Information We Collect

Information you provide

• Account information. Your name and email address. You may optionally add a phone number. If you sign in with Apple or Google, we receive a stable identifier from that provider along with an email address they have verified.
• Sign-in credentials. You can sign in with your email address and a password, with Apple, or with Google. We store only a cryptographic hash of your password — we never store the password itself and cannot recover it.
• A previous email address, if you ask us to bring credits over. If you already went to a studio before using ClassPilot, you can give us the email address that studio has for you, so your remaining credits and class history can move across. We send a confirmation link to that address to check it is yours. It may be a different address from the one you signed up with, and we use it for nothing else.
• Support communications. If you email us, we keep a record of that correspondence to resolve your enquiry.
• Health and safety questions. If your studio asks them, you answer a short health screening before your first class: injuries or movement limits, whether you are pregnant, medical conditions, medications, an emergency contact, and your date of birth. Answering is your choice. These answers are encrypted — we cannot search, sort, or report on them, and that is deliberate rather than a limitation. There is a separate Consumer Health Data Privacy Policy that covers them in full.
• Your waiver. If your studio asks you to sign one, we store the exact wording you were shown, the name you typed, and the date and time. We also record the IP address and device you signed from, because an electronic signature is only worth what its record can show. A copy is emailed to you when you sign.
• Messages. Messages you exchange with a studio, and any photos you attach, are stored so both of you can see the conversation. Studio staff can read them.

Location

If you allow it, ClassPilot uses your device's location to show you studios near you. We keep a record of the searches you make, including the position each search was made from. We use it to understand which areas people are looking in, so we know where studios are wanted and where nobody has listed one yet.

We never share your location with studios. A studio can see how many people found it, never where any of them were. Your search history is not attached to any studio, and no studio can request it.

We record a position only when you actually run a location search — not in the background, and not while the app is closed. When you delete your account, the position each search was made from is erased. We keep the fact that a search happened, and how wide an area it covered, because that is how we know where studios are wanted — but it is no longer tied to a name, an email, or a place.

Location is optional. If you decline the permission, you can still find any studio by name, and you can still join a studio with a code they give you.

Information created by using the Service

• Bookings and attendance. Classes you book, cancel, attend, or miss, and the class packs or credits used to pay for them. These records are kept rather than deleted because they are the evidence behind questions like whether a cancellation was made in time.
• Studio relationships. Which studios you have booked with, and any class packs or credits you hold with them.
• Operational records. We record the outcome of important actions — a verification email that was sent, a booking that failed, a cancellation that was refused — so we can answer a support question without asking you to reproduce the problem. These records identify you by an internal account identifier and a one-way fingerprint of your email address, never by your email address in readable form.
• Security records. Sign-in attempts, including failed ones, so we can lock an account that is being attacked and investigate unauthorised access.
• A notification address. If you turn notifications on, your device gives us an address we can send a notification to. It identifies the device rather than you, and it is deleted when you delete your account.

What we do not collect

• No third-party analytics or advertising. The ClassPilot app contains no advertising SDK, no third-party analytics SDK, and no crash-reporting SDK. We do not sell your data, we do not share it with data brokers, and we do not use it for advertising.
• No payment card details. When you buy a class pack in the app, the payment is processed by Stripe and the money goes to the studio's own Stripe account — the studio is the merchant, not us. We never see, process, or store your card details.
• No background or continuous location. We record a position only when you run a location search yourself — never in the background, never while the app is closed, and never to follow you between searches. See the Location section above for what we do keep.

2. How We Use Information

• To create and secure your account, and to sign you in.
• To show you studios and their schedules, take your booking, and apply the class pack or credit that pays for it.
• To send you transactional email — verifying your email address, resetting your password, and confirmations relating to your bookings.
• To answer support requests and to investigate errors, fraud, and abuse.
• To meet our legal obligations.

3. What Studios Can See

This is the part worth reading closely, because it is the one people assume wrongly.

• Browsing does not identify you. Looking at a studio's page or schedule does not tell that studio who you are. Studios see aggregate interest only — how many people viewed, not which people.
• Booking does. When you book with a studio, you become a client of that studio, and they receive your name and contact details so they can run their business — a class register, a cancellation, a question about your booking.
• Studios cannot see each other's clients. A studio sees only its own relationship with you. It cannot see the other studios you use, your bookings elsewhere, or your credits elsewhere.
• Studios keep their own records. A studio's record of you — your name, contact details, and any private notes they write about your classes — belongs to that studio and is governed by their own privacy practices. It persists even if you delete your ClassPilot account (see section 6).
• Your health answers are split in two, and the split is the point. The instructor teaching your class sees a short safety line built from your injuries and pregnancy answers — that is what those questions are for, and withholding them from the person cueing the class would be a safety problem dressed up as privacy. Your medical conditions, medications, emergency contact and date of birth are owner-and-admin only and are never shown to an instructor. An instructor sees the safety line only for a class they are actually teaching, and whoever opens your full answers leaves a record that they did.

4. Service Providers

We share information with a small number of providers that operate parts of the Service on our behalf, under contract and only for that purpose:

• Hosting and database — our servers and database, which store the information described above.
• Email delivery — to send your verification, password-reset and booking emails. The provider receives your email address and the message.
• Geocoding — studio addresses are converted to map coordinates once, when the studio saves its address. This is the studio's address, not yours; your location is not sent to this provider.
• Apple and Google — if you choose to sign in with them, they confirm your identity to us. We do not send them your booking activity.
• Push notifications — Apple delivers notifications to iPhones and Google delivers them to Android devices. They receive the notification itself and your device's address, not your account details. A message notification includes up to the first 140 characters of the message, so that much of it passes through Apple or Google on the way to the phone.

5. Security

• Your contact details are stored only where the Service needs them to work, and are never written into logs or analytics — operational records carry a one-way fingerprint of your address, not the address itself.
• A studio's private notes about its clients are encrypted at rest.
• Passwords, where set, are stored as a one-way hash and are never recoverable.
• Sessions can be revoked, and repeated failed sign-ins temporarily lock an account.
• All traffic between the app and our servers is encrypted in transit.

No system is perfectly secure, and we do not claim otherwise. If a breach affects your information we will notify you as required by law.

6. Deleting Your Account

You can delete your ClassPilot account at any time in the app, or by emailing us. Deleting your account revokes every sign-in, removes your contact details from your ClassPilot account record, and disconnects you from every studio.

What it does not do is erase a studio's own records. A studio's client list is that business's record — much of it typed in by them — and their bookkeeping and class history depend on it. To have a particular studio erase its record of you, contact that studio directly. Full detail is on our account deletion page.

7. Data Retention

• Account information is kept while your account is open, and removed on deletion as described above.
• Booking and attendance records are retained as the studio's business records.
• Security and sign-in records are retained for a limited period — up to 12 months — and then deleted automatically.
• Operational diagnostic records are pruned on a rolling schedule and are not kept indefinitely.
• Health answers do not last forever. A screening is good for a year, and your studio will ask you to answer again after that. Two years after your last class at a studio, we delete the answers and keep only the fact that the studio screened you on a date — so it can show it asked, without anyone holding stale medical information about you.
• A signed waiver is kept. It is a contract record between you and the studio, and deleting a login cannot un-sign an agreement. Your health answers are erased when you delete your account; the waiver is not.

8. Children

ClassPilot accounts are for adults — you must be 18 or older to hold one, and our Terms of Service make that a condition of the account. The app is not directed to children, and we do not knowingly keep an account for anyone under 18: if we learn of one, we will close it and delete its information.

If a studio's class involves someone under 18, the booking is made by a parent or guardian, on the guardian's own account. If you believe a child has given us information, email us and we will delete it.

9. Your Rights

Depending on where you live, you may have the right to access, correct, export, or delete your personal information, and to object to certain processing. Email us at support@classpilotapp.com and we will respond within the period required by applicable law. We will not discriminate against you for exercising these rights.

For information a studio holds about you in its own records, the studio is the responsible party and the request goes to them.

10. Changes to This Policy

If we change this policy we will update the effective date above, and for material changes we will notify you in the app or by email before the change takes effect.

11. Contact

Questions about this policy or your data: support@classpilotapp.com