RollTrackApp collects only what it needs to run gym software, and gyms control their members' data. Last updated October 12, 2026.
1. Who We Are and What This Covers
RollTrackApp, Inc. ("RollTrackApp," "we," "us") provides gym management software. This Privacy Policy explains how we collect, use, and share personal information when you visit our website or use our web application (the "Service"). It works together with our Terms and Conditions.
Two kinds of people use RollTrackApp, and our role differs for each:
- Gym Owners (and their staff) are our customers. For their account and billing information, RollTrackApp decides how the data is used and acts as the "business" or controller.
- Members are students and athletes whose information a gym stores in RollTrackApp. Members do not have RollTrackApp accounts or passwords; the gym creates their profile, or they complete it through an invitation link the gym sends. For Member data, the gym decides why and how it is used, and RollTrackApp acts as the gym's "service provider" or processor, following the gym's instructions and the Data Processing Addendum in the Appendix.
If you are a Member, the gym you train at is your first contact for questions about your data. We will also help you directly where we can.
2. Information We Collect
| Category | Examples | Who provides it |
|---|---|---|
| Account and profile | Name, email, password, gym name, gym address | Gym Owners |
| Member profile | Name, email, date of birth, gender, home address, phone number | Gym Owners, Members, or imported by the Gym Owner from a previous system |
| Photos | Profile photos of Members, Gym Owners and staff (including photos taken with a device camera), gym logos | Gym Owners, Members |
| Emergency contacts | Name, phone number, email, and relationship of a person the Member names | Members, Gym Owners |
| Family links | Which Member profiles belong to the same household | Gym Owners |
| Membership and attendance | Plan type, start and billing dates, pause and cancellation dates, class check-ins | Gym Owners, Members |
| Payment | Billing name, payment status, subscription details, Stripe customer ID | Gym Owners, Members via Stripe |
| Signed documents | Waivers and policies, signatures, signing date and time | Members, Gym Owners |
| Communications | Support requests, emails Gym Owners send through the Service, delivery and unsubscribe status | Gym Owners, Members |
| Device, usage, and error data | IP address, browser, device type, pages viewed, sign-in sessions, log data, error reports | Collected automatically |
RollTrackApp does not store credit or debit card numbers. Card details are entered with and held by Stripe. We do not knowingly collect Social Security numbers, health records, or biometric data. Gym Owners should not enter such information into free-text fields.
When a Member names an emergency contact, the gym is responsible for telling that person their details have been stored.
3. How We Use Information
- Provide, operate, and support the Service, including billing, check-in, and document signing.
- Send verification codes, receipts, billing notices, and security alerts.
- Deliver emails that Gym Owners send to their own Members. Members can stop receiving a gym's marketing emails at any time using the unsubscribe link in each email; the gym can still send account and billing notices.
- Detect fraud, abuse, and security problems, and find and fix errors in the Service.
- Improve and develop the Service, using de-identified or aggregated data where possible.
- Send Gym Owners product updates and service notices. Gym Owners can opt out of non-essential messages using the link in each message.
- Comply with legal obligations and enforce our Terms.
We do not sell personal information, and we do not use Member data for advertising. We do not send text messages. If we add text messaging, we will ask for consent first and update this Policy.
4. How We Share Information
We share personal information only in these cases:
- With the gym. Member information is visible to the Gym Owner and Authorized Users of the gym the Member joined, not to other gyms. Profiles linked as a family are visible together within that gym.
- With Stripe. Gyms collect membership payments through their own Stripe account. Stripe handles that payment data under its own privacy policy, in addition to acting as our sub-processor.
- With sub-processors that help us run the Service, under contracts that limit their use of the data. The current list is on our Sub-processors page.
- For legal reasons, such as responding to valid legal process or protecting safety, rights, and property.
- In a business transfer, such as a merger, financing, or sale. We will notify Gym Owners before data becomes subject to a different privacy policy.
- With your direction or consent.
The current list of sub-processors, with what each one does and the data it handles, is published on our Sub-processors page. We update that page when our providers change, and Gym Owners can ask us for a copy at the address in Section 12.
5. Retention
We keep personal information while an account is active and as long as needed to provide the Service. Sign-in session records (device, browser, IP address) are kept for security and can be reviewed and revoked by the Gym Owner in the Privacy & Security settings.
After a Gym Owner closes an account, we do not send Gym Data automatically. A Gym Owner may request an export of Gym Data at any time while the account is active, and within 30 days after it ends; we provide the export within 30 days of the request. After that period, Gym Data is deleted within a reasonable period, except records we must keep for legal, tax, fraud-prevention, or dispute reasons. Backups are overwritten on a normal rotation.
6. Security and Staff Access
We use encryption in transit, access controls, and other reasonable safeguards. Each gym's data is logically separated from other gyms' data within our systems. No system is completely secure. If we learn of a breach affecting personal information, we will notify affected Gym Owners and regulators as the law requires.
Authorized RollTrackApp staff may access a gym's account to provide support and fix problems. That access is limited to what the task needs, is logged, and triggers a notice to the Gym Owner. Everyone with that access is bound by confidentiality duties.
7. Children's Privacy
RollTrackApp does not offer accounts to children under 13, and we do not knowingly collect information from a child without a parent or guardian's consent. Many gyms teach kids' classes, so a gym may keep a profile for a child Member.
- When a date of birth shows that a Member is a minor, the Service asks the parent or legal guardian to confirm consent to our Terms and Conditions before the profile is completed, and records who gave that consent and when.
- Gym Owners are responsible for obtaining and keeping parental consent before entering a child's information, including when they enter it on the child's behalf or import it from another system.
- We use a child's information only to provide the Service to the gym, never for advertising or profiling.
- Parents and guardians may ask the gym, or us, to review, correct, or delete their child's information.
- If we learn that a child's information was entered without consent, we will delete it or ask the gym to obtain consent.
8. Your Privacy Rights
Depending on where you live, you may have the right to:
- Know what personal information we hold about you and get a copy.
- Correct inaccurate information.
- Delete your information.
- Opt out of the sale or sharing of personal information. We do not sell or share it for advertising.
- Not be treated differently for using these rights.
California residents have these rights under the CCPA/CPRA. To use them, email us at the address in Section 12. We may need to verify your identity, and we aim to respond within 45 days. Members should usually start with their gym, because the gym controls their data. If you ask us directly, we may pass your request to the gym or help the gym respond. You may use an authorized agent, and you may appeal a decision by replying to our response.
9. Cookies and Similar Technologies
We use cookies and browser storage only where they are necessary to sign you in, keep your session secure, and remember settings such as a check-in kiosk's device key or which guided tours you have completed. On pages where a card is entered, Stripe sets its own cookies to detect fraud. We do not use advertising or analytics cookies. You can block cookies in your browser, but parts of the Service may stop working.
Because we do not sell or share personal information, there is nothing for a "Do Not Track" or Global Privacy Control signal to switch off; we treat every visitor the same way.
10. International Users
RollTrackApp is operated from the United States, and data is processed and stored there. If you use the Service from another country, you understand your information will be transferred to the United States. If you are in Canada, we handle your information in line with PIPEDA and applicable provincial law, and you can contact us at the address in Section 12 with any question.
11. Changes to This Policy
We may update this Policy. For material changes we will notify Gym Owners by email or in the Service before they take effect, and we will update the date at the top.
12. Contact
RollTrackApp, Inc., privacy@rolltrackapp.com.
Appendix: Data Processing Addendum
This Addendum applies to Member personal information that a Gym Owner ("Customer") enters into RollTrackApp ("Processor"). It is part of the Terms.
- Roles and instructions. Customer controls the purpose and means of processing. RollTrackApp processes Member data only to provide the Service and on Customer's documented instructions, which are the Terms and Customer's use of the Service's features.
- Confidentiality. Everyone at RollTrackApp with access to Member data is bound by confidentiality duties.
- Security. RollTrackApp keeps reasonable technical and organizational safeguards, including encryption in transit, access controls, and logical separation of each gym's data.
- Support access. RollTrackApp staff may access Customer's account to provide support as described in Section 6 of the Privacy Policy. Such access is logged and limited to the task.
- Sub-processors. Customer authorizes the sub-processors named in Section 4 of the Privacy Policy and on the Sub-processors page. RollTrackApp will bind them to equivalent data protection terms, give notice of material changes, and let Customer object on reasonable grounds.
- Data subject requests. RollTrackApp will give Customer reasonable help, through the Service or on request, to respond to access, correction, and deletion requests from Members.
- Incident notice. RollTrackApp will notify Customer without undue delay, and in any event within 72 hours, after confirming a breach of Member personal information.
- Return and deletion. On termination, RollTrackApp will provide an export of Member data if Customer requests it within 30 days, delivered within 30 days of the request, and then delete it, except where the law requires retention.
- California. RollTrackApp is a "service provider" under the CCPA/CPRA. It will not sell or share Member data, will not use it outside the direct business relationship with Customer, and will not combine it with other data except as the law allows.
- Audits. On reasonable written request, RollTrackApp will give Customer information needed to show compliance with this Addendum, no more than once a year.
- Customer duties. Customer will have a lawful basis and any required consent, including parental consent for minors, for the data it enters, and will inform emergency contacts that their details are stored.