Privacy Policy

1. Who This Policy Applies To

This Policy applies to:

• Individual athletes and competitors
• Parents and legal guardians who create or manage accounts for children
• Gym owners, administrators, staff, coaches, and trainers
• League organizers
• Spectators and other users of the Service

The Service is multi-tenant. When you join or register with a specific gym, league, or organization on the platform, that organization may process certain information about you in connection with its own membership, events, classes, and operations. We act as a service provider / processor for those organizations with respect to the data they manage through the Service.

2. Information We Collect

A. Information you provide to us

• Account and profile information: email address, password (stored only as a secure hash), first and last name, phone number, date of birth, gender, mailing address (street, city, region/state, postal code, country), username/handle, Warrior ID, profile photo, bio, goals, preferences, and public-profile settings.
• Family / guardian connections: information needed to link parent/guardian accounts to managed child or spouse profiles.
• Competition and performance data: event registrations, bib numbers, run times, obstacle results, scores, rankings, personal records (including optional links to videos you provide), milestones, attendance, skill-level progress, and related notes.
• Medical and emergency information (optional and sensitive): medical notes and emergency-contact details. These are encrypted at the application level.
• Communications: messages you send or receive through the in-app messaging system, and any content you submit to support.
• Waiver signatures: name, email, electronic signature, IP address, user-agent, and a snapshot of the waiver text at the time of signing.
• Payment-related information: billing details are processed by Stripe. We do not store full payment-card numbers.

B. Information collected automatically

• Device and usage data (browser type, device type, operating system, app version, pages viewed, actions taken).
• Log data and session information, including IP address and user-agent string.
• Approximate location derived from gym/organization addresses or profile address (city/region level). We do not continuously track GPS location of athletes during runs or training.
• Cookies and similar technologies strictly necessary for authentication, security, session management, and core functionality. We do not use advertising or cross-site tracking cookies.

C. Information from third parties

• Payment and subscription status from Stripe.
• Error and performance data from Sentry (error monitoring).
• Map and geocoding data from Mapbox (used for the “Find a Gym” feature and organization address geocoding).
• Email delivery status from our email provider (Resend).

3. How We Use Information

We use the information we collect to:

• Provide, operate, maintain, and improve the Service
• Create and manage accounts, profiles, and multi-gym memberships
• Process event registrations, class bookings, memberships, and payments
• Power timing, scoring, leaderboards, personal records, and results
• Enable gym and league administration (rosters, check-in, messaging, waivers, staff tools)
• Send transactional communications (account verification, receipts, event reminders, waiver requests, system notices, and in-app message notifications)
• Provide customer support
• Detect, prevent, and address fraud, abuse, and security issues
• Comply with legal obligations and enforce our Terms
• (In the future, and only with your opt-in consent) send marketing or promotional communications

We do not sell personal information.

4. How We Share Information

We share information only as described below:

• With gyms, leagues, and organizations you join or register with — so they can manage memberships, events, classes, check-in, messaging, waivers, and related operations.
• With service providers that help us operate the Service (currently including Stripe for payments, Pusher for real-time leaderboards, Resend for email, Vercel Blob for file storage, Mapbox for maps/geocoding, Sentry for error monitoring, and our database and hosting providers). These providers are contractually obligated to use the information only to provide services to us.
• With your consent or at your direction (for example, when you make a profile public or share a registration QR code).
• For legal and safety reasons — if we believe disclosure is necessary to comply with law, respond to lawful requests, protect rights and safety, or investigate fraud or security issues.
• Business transfers — in connection with a merger, acquisition, or sale of assets, subject to continued protection of personal information.

Public results, leaderboards, and optional public athlete profiles may display limited information (name, results, rankings, etc.) as configured by the organizing gym or by you.

5. Cookies and Similar Technologies

We use only essential cookies and similar technologies required for the Service to function (authentication, security, session management, load balancing, and basic preferences). We do not use advertising, analytics, or cross-site tracking cookies.

You can control cookies through your browser settings. Disabling essential cookies may prevent you from using parts of the Service.

6. Data Retention

We retain personal information only as long as necessary to provide the Service, fulfill the purposes described in this Policy, meet legal and accounting obligations, and resolve disputes.

• Account and profile data are retained while your account remains active.
• After account deletion, we anonymize or delete personal identifiers; historical competition records may be retained by the relevant gym or league in anonymized form for their records and reporting.
• Waiver signatures and related audit records are retained as required for legal and safety purposes.
• Message content is subject to automatic retention limits and cleanup.

7. Security

We implement technical and organizational measures designed to protect personal information, including:

• Encryption of sensitive fields (including medical notes) at the application level
• Secure password hashing
• Access controls and multi-tenant isolation
• HTTPS / TLS in transit
• Regular security practices and monitoring

No method of transmission or storage is 100% secure. We cannot guarantee absolute security.

8. Children’s Privacy

You must be at least 13 years old to create your own account.

Parents or legal guardians may create and manage accounts for children under 13 (or under the applicable age of digital consent). In those cases, the parent/guardian is responsible for the child’s information and for providing any required consent.

We do not knowingly collect personal information directly from children under 13 without parental involvement. If you believe we have collected such information improperly, contact us at legal@warriorcomps.com and we will take appropriate steps to delete it.

9. Your Rights and Choices

Depending on your location, you may have rights regarding your personal information, including:

• Access and portability (you can export a copy of your data from your account settings)
• Correction of inaccurate information
• Deletion of your account and personal information (subject to limited exceptions for legal, safety, and anonymized historical records)
• Opt-out of future marketing communications (when offered)
• Restriction or objection to certain processing (where applicable under local law)

To exercise these rights, use the tools in your account (Privacy & data settings) or email legal@warriorcomps.com. We will respond in accordance with applicable law.

California residents (CCPA/CPRA): You have the right to know, delete, and correct personal information, and to opt out of the “sale” or “sharing” of personal information. We do not sell personal information. You will not be discriminated against for exercising your rights.

European Economic Area, United Kingdom, and similar jurisdictions: Where the GDPR or equivalent laws apply, we process personal data on the bases of contract performance, legitimate interests, consent (where required), and legal obligation. You may have rights of access, rectification, erasure, restriction, portability, and objection, and the right to lodge a complaint with a supervisory authority.

10. International Users

The Service is operated from the United States. If you access the Service from outside the United States, your information will be transferred to and processed in the United States and other countries that may have different data-protection laws than your country of residence. By using the Service, you acknowledge this transfer.

Where required, we implement appropriate safeguards for international transfers.

11. Third-Party Links and Services

The Service may contain links to third-party websites or services (including gym websites, Stripe Checkout, Mapbox maps, etc.). This Privacy Policy does not apply to those third parties. We encourage you to read their privacy policies.

12. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will post the updated version and revise the “Last Updated” date. Material changes will be communicated through the Service or by email when appropriate. Continued use of the Service after the effective date of changes constitutes acceptance of the revised Policy.

13. Contact Us

For privacy questions, requests, or complaints, contact:

We will review and respond to your inquiry as promptly as reasonably possible.