Privacy Policy
Last Updated: June 1, 2026
Effective Date: June 1, 2026
1. Introduction
BoxBestie operates the gym management platform at boxbestie.com. This Privacy Policy explains how we collect, use, store, and share information when you use our Service. Contact us at privacy@boxbestie.com.
2. Information We Collect
From Gym Administrators: name, email, password, gym information, payment info (via Stripe), workout programming, athlete membership data.
From Coaches: name, email, password, profile photo, class schedules.
From Athletes: name, email, password, profile photo, birthday (optional), emergency contact (optional), physical metrics (optional), workout results, performance history, lifting maxes, attendance records.
Generated Through Use: PR history, leaderboard positions, reactions, AI interaction history, device information, IP address, usage patterns.
3. How We Use Your Information
To provide the Service, process payments, deliver programming, track performance, send notifications, and generate reports.
AI Features: gym data is sent to xAI Grok to generate insights and WOD suggestions. Data is used only for your requested output — not to train AI models.
Community Features: name and profile photo displayed on leaderboards and activity feed. Automated celebrations for birthdays, PRs, and milestones.
4. How We Share Your Information
We do not sell your personal information. We share only with: service providers (Stripe, Supabase, Resend, xAI, Cloudflare), within your gym community (performance data visible to coaches and gym members), and as required by law.
5. Data Storage and Security
Data stored on Supabase servers in the United States. Security measures include row-level security, encrypted connections, encrypted credentials, automated backups, and strict access controls.
6. Data Retention
Active accounts: data retained while account is active. After cancellation: data retained 90 days, then may be permanently deleted. AI interaction logs: retained 12 months for usage monitoring.
7. Your Rights
Access and correction: update your information at boxbestie.com/profile. Data export: request at privacy@boxbestie.com — fulfilled within 30 days. Deletion: request at privacy@boxbestie.com. Opt-out of community feed: available in notification preferences. Birthday visibility: optional, removable at any time.
8. Children's Privacy
BoxBestie is not directed to children under 13. Athletes between 13 and 18 require parent or guardian consent.
9. California Privacy Rights (CCPA)
California residents have the right to know, delete, opt-out of sale (we do not sell data), and non-discrimination. Contact privacy@boxbestie.com to exercise these rights.
10. GDPR Rights
EEA users have rights of access, rectification, erasure, restriction, portability, and objection. Legal basis for processing: contract performance, legitimate interests, and consent. Contact privacy@boxbestie.com or your local supervisory authority.
11. Cookies
BoxBestie uses essential cookies for login sessions, preferences, and onboarding state. No advertising cookies. No third-party tracking pixels.
12. Changes
Material changes notified by email and in-app notice.