HossTrainPrivacy Policy
Draft. This policy covers the HossTrain beta and is being reviewed by a lawyer. Sections still being finalised say so. If it changes, the date above will change and, where the change matters, we will tell you in the app.
Who we are
HossTrain is software for running a martial arts or fitness school: a management app for the school, and a member app for its students and instructors.
The service is provided by HossTrain LLC, PO Box 1063, Oak Creek, CO 80467, United States. Contact us at support@hosstrain.com.
Who controls your data depends on who you are. If you are a member of a school, that school decides what records it keeps about you, and we hold them on the school’s behalf. If you run a school, we hold your account and billing records on our own behalf. Where the two differ, this policy says so.
What we collect, and why
Your account
| What | Why | Where it goes |
|---|---|---|
| Email address | So you can sign in and so we can reach you | Firebase Authentication |
| Name or display name | So your instructor knows who you are | Firestore |
| School membership and role | To decide what you may see | Firestore |
Joining the beta
When a school signs up for the beta we record the school’s details, the owner’s name, email and phone number if given, and when the owner agreed to the Beta Participation Agreement and which version. When a member signs up for the member app during the beta we record their name, email, date of birth, which school’s code they used, and when they agreed. The date of birth is how we check they are 18 or older, and it is what their school needs on their record. We keep these so we can contact beta participants and show who agreed to what.
What your school records about you
Rank, gradings, attendance, and progress through the syllabus. This is the school’s record of your training. It exists because a school needs it, and it is visible to the instructors of the schools you belong to.
What you record about yourself
This is health and fitness information, and both app stores treat it as a sensitive category. It covers:
- how you felt on a given day, and any symptoms you ticked;
- what you ate and drank, if you use the food diary;
- body measurements, if you record them;
- your workout log;
- marks you place on a body diagram to show where something hurt, and any note you attach to one.
It is yours and it is private to you. It is stored in your own record, separate from anything the school holds, and no instructor screen reads it. We do not use it for anything except showing it back to you.
The body diagram is a drawing, not you. It is one anatomical model, the same for everybody. A mark on it means “about here”, the way pointing at a chart in a treatment room does. It is not a measurement of your body, it is not a diagnosis, and it is not medical advice.
Photos, video and audio
Photographs and video you upload, and camera and microphone during a live class. Class recordings, where your school has them switched on, belong to the school. Assessment video is stored for your school’s instructors to review.
Camera and microphone are used only while you are in a class or recording a technique. Movement analysis for scoring a self-assessment happens on your device; the video frames are not sent anywhere for it.
Practitioner notes
If your school’s instructor or practitioner writes nutrition guidance for you, that note is stored inside the school’s records, because the school wrote it.
Technical and diagnostic
Error reports and diagnostic signals, so we can find out why something broke.
What we do not collect
- No advertising identifiers, no ad networks, no third-party analytics.
- No location.
- No contacts, calendar or text messages.
- No card numbers. Payment pages are hosted by Stripe and card details are entered there, never in our app and never on our servers.
Who else handles it
We use these companies to run the service. They process data on our instructions and for no purpose of their own.
| Who | What for |
|---|---|
| Google (Firebase, Cloud Run) | Sign-in, database, hosting, push notifications |
| Cloudflare (R2) | Storing photos, video and documents |
| Agora | Live classes, and captions or translation during them |
| Stripe | Payments and subscriptions |
| Anthropic | Reading an uploaded syllabus, and translating a school’s own text |
Anthropic sees curriculum text a school uploads or asks to translate. It does not see your health records, your training history or your name.
We do not sell your data. We do not share it with anybody for advertising.
Where it lives
Data is stored in the United States, with Google Cloud and Cloudflare.
How long we keep it
- Your account: until you delete it.
- Your health and fitness records: until you delete your account, at which point they are deleted with it.
- Your school’s training records about you: kept by the school, with your personal details removed, when you delete your account (see below).
- A school’s data after it stops paying: thirty days, then deleted. The school is warned twice before that happens and can export everything.
- Beta sign-up records: for as long as the beta runs and for as long afterwards as we need to show who agreed to what.
Deleting your account
You can delete your account in the app, under Account → Delete account. It deletes rather than requests.
What is deleted outright
- Your sign-in and password.
- Your name, email and profile details.
- Your membership of every school.
- Everything you recorded about yourself: workout log, food diary, daily check-ins, and every mark on the body map.
What your school keeps, with you removed from it
- Grading and attendance history, with your name and contact details cleared.
- Class recordings you appeared in, which belong to the school.
Schools need their own training history to stay intact; a grading record with a hole in it is not a record. Those rows remain, and they no longer identify you.
If you cannot reach the app, write to support@hosstrain.com and we will delete the account for you.
Your rights
You can ask us for a copy of what we hold about you, ask us to correct it, or ask us to delete it. Write to support@hosstrain.com.
If your school holds the record, we may need to refer you to the school, since it is their record and we hold it for them. We will tell you if that is the case rather than leaving you to guess.
Children
Martial arts schools teach children, so we plan for young people using HossTrain. The app treats anybody under 18, or anybody whose date of birth their school has not recorded, as a minor.
- A child’s account belongs to a school. It is created by the school, or by joining with a code the school gave them. The beta is open to people 18 and older, so nobody under 18 signs up for it.
- A child’s own health records are private to them. No instructor screen reads them.
- Assessment video of a child is stored in their school’s account and is visible to that school’s instructors.
- A school can record a parent or guardian’s name and contact details.
- A guardian is linked to a child by the school, from people who joined the school as a guardian. A child cannot choose a guardian, and a guardian cannot link themselves to a child.
- A linked guardian can read their child’s private messages and competition results, and the child is shown, in each conversation, that a guardian can see it. Nobody is given hidden access to a child’s messages.
- A guardian cannot see their child’s own health records: the check-ins, food diary and body map are the child’s.
- A guardian’s access ends on the child’s 18th birthday. From then on their messages and results are their own.
Security
- Encrypted in transit everywhere, and encrypted at rest by Google and Cloudflare.
- Access to a school’s data is limited to that school’s members, enforced by server-side rules rather than by what the app chooses to show.
- Payment card details never reach us.
Changes
If we change this policy we will change the date at the top and, where the change matters, tell you in the app.
Contact
HossTrain LLC, PO Box 1063, Oak Creek, CO 80467, United States. support@hosstrain.com