Privacy Policy

We collect the following categories of information:

• Account information: your name, email address, phone number, and password (stored only as a secure hash), plus optional profile details such as country, ZIP/postal code, and skill level.
• Booking & session information: the sessions or programs you book, scheduling preferences, session notes, attendance, and acceptance of our Terms and Liability Waiver.
• Payment information: payments are processed by our third-party processor, Stripe. We receive transaction records (amount, status, package) but do not store your full card number.
• Workout & app activity: Ronin Box workout history (mode, rounds, punches, active time, estimated calories, dates) used to power your stats, streaks, and personal bests.
• Communications & marketing: newsletter subscription status and marketing consent, plus messages you send us via forms, email, or WhatsApp.
• Content you submit: stories, photos, and images you choose to upload.
• Device & usage data: IP address, browser/device type, and basic usage information collected automatically to operate and secure the Services. For account acceptance events we may record the IP address and user-agent as a record of consent.
• Push notification tokens (app): if you enable push notifications, we store a device push token so we can deliver notifications you have opted into.

• Create and manage your account and authenticate you.
• Schedule, deliver, and support your coaching sessions and programs.
• Process payments, apply referral credits and coupons, and prevent fraud.
• Provide app features such as workout tracking, stats, and history.
• Send transactional messages (booking confirmations, scheduling, reminders) and — where you have opted in — newsletters and promotional notifications.
• Improve, secure, and troubleshoot the Services.
• Comply with legal obligations and enforce our Terms.

We do not sell your personal information. We share it only with:

• Service providers who help us operate the Services, including: Stripe (payments), Resend (transactional and marketing email), ElevenLabs (voice cue generation), Google/Firebase (push notification delivery for the app), and our cloud hosting and database providers.
• Legal and safety recipients when required by law, subpoena, or to protect the rights, property, or safety of our users, the Company, or others.
• Business transfers in connection with a merger, acquisition, or sale of assets, subject to this Policy.

These providers may process data in the United States and are bound to use it only to perform services for us.

We use industry-standard safeguards to protect your information:

• Encryption in transit: all traffic between your browser or the mobile app and our servers is encrypted using HTTPS (TLS 1.2 or higher). Data is not transmitted in plain text.
• Payments: card details are entered and processed directly by Stripe over their PCI-DSS-compliant, encrypted connection. We never receive or store your full card number.
• Credentials: passwords are stored only as salted hashes, never in plain text. On the web, your session token is stored in a secure, httpOnly cookie (not readable by scripts); in the mobile app it is stored in the device's secure keychain/keystore (Expo SecureStore).
• Access controls: administrative access to your data is restricted and authenticated.

No method of transmission or storage is 100% secure, so we cannot guarantee absolute security, but we work to protect your data and to promptly address any incident.

• Access, correction, and deletion: you may request a copy of, correction to, or deletion of your personal information by contacting us, or use our dedicated Account & Data Deletion page.
• Marketing opt-out: you can unsubscribe from marketing emails at any time using the link in any email or via your account.
• Push notifications: you can disable push notifications in your device settings at any time.
• Account closure: you may close your account by contacting us.

Depending on your location, you may have additional rights under laws such as the GDPR or CCPA/CPRA, including the right to object to or restrict processing and the right to lodge a complaint with a supervisory authority.