Privacy policy · NinjaFit

NinjaFit (4075 Charles Hardy Pkwy, Suite 140, Dallas, GA 30157) runs this website and decides what personal information is collected on it and why (the “controller” under privacy laws). This policy says what we collect, why, who helps us, how long we keep it, and what you can do about it. To ask anything about it, email ninjafitatl@gmail.com, call (470) 516-4652, or use the contact form (choose “Privacy request”).

What we collect and why

Contact form: your name, email, phone (optional), topic and message, so we can answer you. It is emailed to us and is not stored on the website. Basis: answering your request.
Competition registration: the athlete's name, their World Ninja League athlete ID, the division they enter and how they compete, your confirmation that the league's waiver is signed, a parent or guardian's name for athletes under 18, and the registering adult's email and phone, plus anything you write in the notes. We use it to run the competition, publish the run order (athlete name and division only), send the confirmation and day-of updates, and share the registration list with the league that sanctions the event (for example World Ninja League) for standings and the run order. Basis: the registration contract.
Waivers: when you sign our waiver online (at /waiver, from a party or group link, or on the tablet at the front desk) we keep the signed agreement: the signer's name, email, phone, relationship to any children and confirmation that they are 18 or older; the name and age in years of everyone taking part (to check the age limits; we don't ask for dates of birth); the emergency contact; your answers to the waiver's questions, which can include health information you choose to share so coaches can keep everyone safe; your initials and your signature (your typed name adopted as your signature, or one you draw); whether you agreed to optional marketing emails; and the signing record (the exact text you saw, the time, your IP address and device, and fingerprints that show the record has not changed). If the gym uses the front-desk tablet's photo option, a photo of the signer is kept with the waiver, and the tablet tells you before you sign. We email you a copy with a private link. Staff use it to check people in and to see answers they need for safety. Basis: the agreement itself, our legitimate interest in keeping a record of it, and, for health information, your explicit choice to give it.
Memberships: when you join a membership we keep the name, email and phone of the adult who pays, the names of the people the membership covers, the plan and price, the statement you agreed to about automatic payments (with the time and your IP address, as proof of your consent), and the history of the membership: payments and failed payments (amounts and dates, never card numbers), holds, changes and cancellation, and notes staff add about the membership. Your card is stored by Stripe, not by us; you update it on Stripe's billing page from My account. Basis: the membership contract, and tax rules for payment records.
News emails: our forms (camp sign-ups, competition registrations, memberships, class bookings, party bookings and the shop) have an "Email me news" box. For visitors in the United States it may already be ticked; untick it if you don't want our news. Visitors from other countries always see it unticked, and you're only added when the box is ticked as you send the form. We keep your email address, when and on which form you said yes, and whether the box came ticked. Every news email has a one-click unsubscribe link, and you can also ask us to stop. Basis: your consent.
Phone calls and texts: our phone line ((470) 516-4652) is provided by Twilio. When you call, we see your number; calls are not recorded. If you leave a voicemail, it is emailed to our staff with a written transcript and then deleted from Twilio. When you text us, we keep the texts and our replies for up to 24 months to answer you. We only text you first if you agreed to texts (a separate, unticked box on our forms); reply STOP at any time to stop and START to resume. Message frequency varies; message and data rates may apply. Your mobile number and text opt-in are never shared with or sold to anyone for their marketing.
Party photos: if we take photos at a party, they go on a private page that only people with its link can see (it isn't on search engines), we email the link to the parent who booked so they can share it with their guests, and we delete the photos and the page 90 days after the party. We never post party photos publicly without asking. Basis: our legitimate interest in sharing the party with you, and your choice to share it.
Reviews: after a party we may ask the parent who booked, once, for a Google review; whether you write one is up to you and changes nothing. Our website shows the newest reviews people posted publicly on Google (their first name and last initial, the stars, the words and the date), whatever their stars; we don't load Google's profile pictures. Reviews you post on Google are covered by Google's privacy policy.
Payments: handled by Stripe on Stripe's own pages. We never see or store card numbers; we receive confirmation of payment, the amount, and the last four digits. Stripe receives the athlete's name and division with the payment so the charge can be matched to the registration on both sides. We also keep a copy of the payments you made to us through our Stripe account, including ones before this website (date, amount, refunds, what it was for, and the name and email on the payment), so our records are complete; this copy is kept for 7 years. Basis: the contract, and tax rules for keeping payment records.
My account: signing in with the email used for a registration or purchase links that email, the name from the registration and your sign-in times to the registrations, purchases, refund requests (with the reason you give) and privacy requests made with that email. Basis: the contract and your request.
Back-office log: changes made by staff, and cancellations, refund requests and privacy requests made by families, are logged with the email address that made them, the action and the time, so questions about a registration can be answered. Basis: our legitimate interest in running the gym accountably.
Website use: the hosting servers keep short-lived technical logs (IP address, browser, pages, errors) for security and to keep the site working, and the site counts sign-in and form attempts per address and network to stop abuse. Basis: our legitimate interest in a secure website.
Visit statistics: so we can see which pages are useful, the website itself counts visits: the page, the site that linked here, campaign tags in the link, the kind of device and browser, screen size, language, the approximate city (worked out by the host from the network address), how long a page was open and how far it was scrolled, and actions such as tapping the phone number, following a link to book a class or sending a form. It does this without cookies and without storing anything on your device. Your IP address is not kept: for one day it is turned into a scrambled code using a random key that is deleted two days later, so the statistics cannot be traced back to you or connected from one day to the next, and they are never combined with your registration, waiver or account. Visits are not counted at all when your browser sends Do Not Track or Global Privacy Control, or after you press the button below. There are no advertising trackers and no third-party analytics such as Google Analytics. Basis: our legitimate interest in a useful website.

No one else is watching

No advertising pixels, outside analytics, session recording, chat widgets or other companies' code run on this website, so no one outside NinjaFit and NinjaHQ sees what you type, click or read here. Our emails contain no tracking pictures. Videos come from YouTube's privacy-enhanced player and only load when you press play.

Cookies

The only cookies keep you signed in: gym_sess for staff in the back office, gym_acct for families in My account, a small gym_acct_on marker so the header can say “My account”, and on staff devices a gym_staff_on marker so the gym's own visits are left out of the visit statistics. They last up to 30 days, hold no personal information, and are strictly necessary, so there is no cookie banner. Nothing else is stored in your browser, with two exceptions. If you press “Don't count my visits”, your browser remembers that choice. And on the gym's own front-desk tablet: if the internet is down while someone signs a waiver there, the tablet keeps it until it can upload it, then deletes it.

Children

Athletes are registered by a parent or guardian, and the confirmation email, the account and every message go to that adult. Accounts belong to the adult who registered, never to the athlete: signing in asks you to confirm that you are 18 or older or the parent or guardian who registered. We do not knowingly collect information directly from children under 13 (COPPA). If we learn that a child under 13 has signed in on their own, we close that access and tell the parent. A child's waiver is always signed by a parent or legal guardian, who confirms it on the form. Parents can see, correct or delete their child's information at any time using the choices below. The run order and results name the athlete and their division, and athletes may appear in the live stream and in photos taken at competitions; ask us if you need a name left off the public run order.

Who helps us

This website runs on the NinjaHQ platform (ninjahq.ai), operated by Peak Beyond, LLC, which builds and hosts it and processes information only on our behalf and on our instructions, as our service provider. Peak Beyond does not sell your information or use it for its own purposes. NinjaHQ uses these providers, all in the United States: Stripe (payments; Stripe also uses payment data under its own privacy policy for fraud prevention and regulation), Resend (email delivery), Vercel (hosting) and Neon (database). They may not use your information for their own purposes. The league that sanctions a competition receives the registration list for that competition and handles it under its own policy; the World Ninja League's season waiver is signed on the league's own waiver service (Smartwaiver), under the league's terms, and this site only records that you confirmed it. Live streams are hosted on YouTube: nothing is loaded from YouTube until you press play; from then on the YouTube player (youtube-nocookie.com) and Google's privacy policy apply.

We do not sell personal information and we do not share it for targeted advertising, for anyone of any age, so there is nothing to opt out of; no sale or sharing happens whether or not your browser sends a signal such as Global Privacy Control. When it does send one, we also leave your visits out of our visit statistics.

How long we keep it

Sign-in codes: 10 minutes. Sessions: 30 days. Abuse counters: at most one day.
Registrations that were started but never paid: deleted after 30 days.
Signed waivers: seven years after signing, or until the youngest child on the waiver turns 22 if that is later (a child can bring a claim for a few years after turning 18), then deleted automatically. Because a waiver is a legal record, we keep it until then even if you ask us to delete your other information; it is used for nothing else.
Memberships: while the membership runs, and afterwards as a payment record for as long as tax rules require (typically seven years). A sign-up that was never paid is removed after 14 days. If you ask us to delete your information, an ended membership is kept only as an anonymous payment record; a membership that is still running has to be canceled first.
Paid registrations, purchases and refund records: for as long as we need them to answer questions about results and refunds, and payment records for as long as tax rules require (typically seven years).
Visit statistics: 14 months. They hold no names, email addresses, IP addresses or cookie ids; the random key behind each day's visitor codes is deleted after two days.
Account details: until you delete your account. Back-office logs and closed refund or privacy requests: 24 months.
Contact messages: until answered, then in our email records.
Backups: a copy of our records is made every night and kept for 14 days, so information that has been deleted leaves the backups within 14 days. The history of changes our staff make to the website is kept for 24 months.

These deletions run automatically every day. Ask us and we delete your information sooner, except records that tax rules require us to keep.

Your rights and choices

Wherever you live, you can ask us to tell you what information we hold about you or your athlete, correct it, delete it, or give you a copy, and you can object to how we use it. We never treat anyone differently for using these rights.

From My account (sign in with the email you registered with): download everything linked to your email as a file, correct your name, cancel a registration, or ask us to delete your account and data. Signing in with the emailed code is how we verify that the request comes from you.
Without an account, or for someone else's information: email ninjafitatl@gmail.com, call (470) 516-4652, or use the contact form (choose “Privacy request”). Tell us the athlete's name and the competition so we can find the record; we may ask for a detail from the registration to check that it is you. An authorized agent may ask on your behalf with your written permission.
We answer within 30 days (within 45 days where a law allows it, and we will tell you if we need the extra time). If we say no, we explain why and you can ask us to look again.

California residents (CCPA/CPRA): the rights to know, delete, correct and port your information, to opt out of sale or sharing (we do none), to limit the use of sensitive information (waivers ask for dates of birth to check ages, and may hold health information you choose to share for safety; we use these only for that, never to infer anything about you), and to non-discrimination all apply and are exercised as above. The categories we collect are listed under “What we collect”, and we have not sold or shared personal information in the preceding 12 months.

EU, UK, Switzerland and other places with similar laws: the rights of access, rectification, erasure, restriction, portability and objection apply, as does the right to withdraw consent where we relied on it, and the right to complain to your supervisory authority. Our legal bases are listed next to each use above. The information is stored and processed in the United States; our providers rely on the EU-US Data Privacy Framework or standard contractual clauses for transfers.

Security

The site is served only over HTTPS. Sign-in uses one-time codes by email or text (no passwords to leak). If you choose “Continue with Google”, Google tells our platform (NinjaHQ) your verified email address, and we use it only to sign you in: nothing else is shared with Google or read from your Google account, session tokens are stored hashed, staff access is limited by role and logged, and card details never touch our systems. Our records are kept apart from those of every other gym on the platform we use, and signed waivers (signature, answers, emergency contact and document) and our backups are stored encrypted with a key that is unique to us.

Changes

When this policy changes, the version above changes with it; important changes are also mentioned in the confirmation emails that follow.

Contact

NinjaFit (4075 Charles Hardy Pkwy, Suite 140, Dallas, GA 30157): email ninjafitatl@gmail.com, call (470) 516-4652, or use the contact form (choose “Privacy request”). NinjaHQ's own privacy policy (Peak Beyond, LLC), which covers ninjahq.ai, is at ninjahq.ai/privacy (opens in a new tab).