gistfile1.txt

# LiftOff — Privacy Policy

_Last updated: 29 May 2026_

This Privacy Policy explains how **LiftOff** ("LiftOff", "we", "us"), collects, uses, and protects your information when you use the LiftOff mobile and web app (the "App") to book classes, manage your membership, and make payments at participating gyms.

> **Beta notice:** LiftOff is currently in pre-release testing. In this test version, payments are processed in **sandbox mode** — no real money is transferred.

## 1. Information we collect

**Information you provide**
- Account details: your name, email address, phone number, and (optionally) a profile photo.
- Authentication: your password (stored only as a secure cryptographic hash) or, where offered, sign‑in via Apple or Google.
- Content you submit: messages you post in your gym's team chat.

**Information created as you use the App**
- Class bookings and attendance.
- Membership status, plans/packs, and remaining credits.
- Payment and purchase history (amount, date, status, and a payment‑provider reference).
- Membership suspension history, if applicable.

**Payment information**
- Payments are handled by our third‑party payment providers — **BlinkPay** (open‑banking bank transfer) and **Stripe** (card payments). Your full bank‑account or card details are entered with, and processed by, those providers. **We do not store your full bank‑account or card numbers** — only the transaction records and provider references needed to manage your membership.

**Device & technical information**
- A push‑notification token (via Expo) so we can send service‑related notifications.
- Standard technical data (e.g. app version and basic logs) needed to operate and secure the service.

**Camera**
- The App requests camera access **only if you choose to scan a payment card**. Card images are handled by the payment provider and are not stored by us. You can decline camera access and enter details manually.

## 2. How we use your information
- To provide the service: your account, class bookings, memberships, and payments.
- To communicate with you (booking confirmations, membership reminders, team announcements).
- To provide customer support.
- To secure the service and prevent fraud or abuse.
- To comply with our legal obligations.

## 3. How we share your information
We share information only as needed to run the service:
- **Payment providers** — BlinkPay and Stripe — to process payments.
- **Infrastructure providers** — Supabase (database, authentication, storage), Railway (web hosting), and Expo (push notifications).
- **Your gym** — administrators of the gym you belong to can see your bookings, membership, and payment status to manage your membership.
- **Legal** — where required by law.

We do **not** sell your personal information.

## 4. Where your data is stored
Your data is stored in our database hosted by **Supabase in Sydney, Australia (ap‑southeast‑2)**. Payment providers and other processors may process data in their own locations.

## 5. Security
We protect your data with encryption in transit (HTTPS/TLS), database row‑level security (so members can only access their own data), and restricted server‑side access for any operation involving money or permissions.

## 6. Data retention
We keep your information for as long as your account is active or as needed to provide the service and meet legal obligations. You may request deletion of your account and associated data (see Contact).

## 7. Your rights
Depending on where you live, you may have rights to access, correct, export, or delete your personal information, and to withdraw consent. To exercise these, contact us at the email below. New Zealand users may also contact the Office of the Privacy Commissioner (privacy.org.nz).

## 8. Children
LiftOff is not intended for children under 16, and we do not knowingly collect personal information from children under 16.

## 9. Changes to this policy
We may update this policy from time to time. Material changes will be reflected by updating the "Last updated" date and, where appropriate, notifying you in the App.

## 10. Contact
Questions or requests about your privacy: **YASH@DUCK.COM**.