This Privacy Policy describes how OSSHub (“we”, “us”, “our”) processes personal data when you use osshub.co, the OSSHub student mobile app, and the OSSHub Manager mobile app for gym owners, as well as related websites and APIs.
We respect your privacy and design the platform so each gym can operate its academy while we host and secure the software. This policy explains what we collect, why we use it, who we share it with, and the rights you may have under applicable data-protection law.
Your gym (the academy or martial-arts school that invited you or that you joined) is typically the controller of student and membership data: it decides why you are enrolled, which plans and classes apply, and how front-desk operations run.
OSSHub provides the software platform (website, APIs, and native apps) and processes that data on the gym’s instructions as a processor.
Where we process data for our own platform administration — for example OSSHub billing for a gym, security logs, product analytics that do not profile individual students for advertising, or support requests you send us directly — OSSHub is the controller.
Depending on your role and the features you use, we may process:
Identity and profile data: name, nickname, email, phone, address, emergency contact, profile photo, status message, belt/rank, language preference, and gym membership status.
Academy operations data: class schedule and attendance/check-ins, class packs or credits, sparring logs you create, peer check-in requests, registration or trial requests, and Updates your gym sends.
Communications: Oss! messages between students at the same gym, message reports, and block lists.
Membership and payment records: plan, amounts, payment status, method labels (for example cash, card, bank transfer), and dates. We do not store full payment-card numbers in OSSHub when card payments are taken online (see Payments).
Device and app data: gym address (subdomain) you enter to sign in, app version and build, operating-system version, push-notification tokens when you enable notifications, and diagnostic crash or error reports.
Usage and technical data: IP address, approximate location derived from IP where needed for security, browser or app type, and logs needed to operate and secure the service.
We do not sell your personal data.
We use personal data to:
• Provide the OSSHub service to your gym and to you (accounts, schedule, check-in, membership records, owner tools).
• Send transactional messages you or your gym request (for example welcome email, payment receipts, academy Updates, Oss! or check-in-request notifications when enabled).
• Secure the platform (authentication, abuse prevention, fraud and integrity checks).
• Diagnose and fix errors (including crash reporting).
• Comply with legal obligations and respond to lawful requests.
• Improve the product in aggregate (for example reliability), without selling data to advertisers.
Where EU/UK GDPR or similar laws apply, we rely on one or more of: performance of a contract (providing the service), legitimate interests (security, product improvement, supporting gyms), consent (for example optional push notifications or certain cookies on the marketing site), and legal obligation.
We share personal data only as needed to run OSSHub:
• Your gym’s authorised owners and staff, for academy operations.
• Other students at the same gym, limited to what the product shows (for example first name and rank on a class list, or content you choose to send in Oss!).
• Service providers (processors) that help us deliver the product, including: hosting and infrastructure providers for osshub.co; Stripe, for online card payments and related billing where a gym enables them; email delivery providers, for transactional email; Sentry, for application error monitoring (configured to scrub tokens and sensitive fields where practicable); Expo, Apple Push Notification service (APNs), and Google Firebase Cloud Messaging (FCM), to deliver push notifications you enable.
• Professional advisers or authorities when required by law or to protect rights and safety.
Some technique demo links chosen by a gym may open third-party sites such as YouTube or Vimeo; those services have their own privacy policies.
Connection diagnostics (OSSHub student app, devices set to the Spain region only): when the app cannot reach OSSHub, it checks whether your internet provider is blocking our servers, as some Spanish providers do during LaLiga matches. For this check the app contacts RIPEstat (operated by RIPE NCC), which receives your device’s public IP address and returns your provider’s network number; Google Public DNS, which receives your gym’s OSSHub address; and hayahora.futbol, which provides the list of addresses your provider blocks. No account details, tokens or identifiers are sent, and the results are kept only in the app’s memory for a few minutes. The OSSHub website runs a lighter version of this check on its offline page, only when your browser is set to a Spanish time zone and reports a working connection: it contacts RIPEstat alone, to learn which provider you are on. No account details, tokens or identifiers are sent, and nothing is stored.
We do not share data with advertisers for cross-app tracking.
OSSHub (student app): sign-in tokens and related session data are stored in the device secure store. Pending offline check-ins may be kept in an encrypted local database on the phone until they sync. Signing out revokes the session on the server (best effort) and deletes local app data for that account on the device.
OSSHub Manager (owner app): sign-in tokens are stored in the device secure store. Academy data is kept in memory while you use the app and is not stored in a local database. Signing out revokes the session and clears local session data.
Language preference may be stored on the device. Public gym logos may be cached as images.
If you turn on notifications, we store a push token for your device and session so we can send operational messages (for example academy Updates, Oss!, check-in requests for students, or registration alerts for owners).
Notification text may include class names or classmate names depending on the feature. Delivery uses Expo together with Apple APNs and/or Google FCM. You can turn notifications off in the app or in system settings; signing out disables the device registration for that session.
Features such as Oss!, profile photos, status messages, sparring logs, and similar content are visible to the people the product is designed for (typically you, your gym, and classmates at the same gym as applicable).
In the student app, Oss! supports reporting inappropriate messages and blocking another student. Blocking stops Oss! messages, sparring logs, and check-in requests between you; the other person is not notified. Reported content may be reviewed by your gym and/or OSSHub to keep the community safe.
Membership fees are charged by your gym, not by Apple or Google as an in-app digital purchase in the OSSHub or OSSHub Manager apps. Those apps do not use Apple In-App Purchase to sell digital content or subscriptions.
Online card payments, where enabled by a gym, are processed by Stripe. OSSHub stores payment records needed for membership (amounts, status, method, dates) but does not store full card numbers.
Owners may also record manual payments (for example cash) in OSSHub Manager or on the web for front-desk bookkeeping.
We keep personal data for as long as needed to provide the service to your gym, to meet legal, accounting, or security requirements, and to resolve disputes. When a gym closes an account or you successfully request deletion, we delete or anonymise personal data we hold, except limited records we must retain by law or for legitimate security and accounting purposes.
Push tokens and device sessions are removed or disabled when you sign out, turn notifications off, or the session expires.
OSSHub and some of our processors (for example Stripe, Sentry, Expo, Apple, or Google) may process data in countries other than where you live, including the United States. Where required, we use appropriate safeguards such as standard contractual clauses or the processor’s approved transfer mechanisms.
Depending on where you live, you may have rights to access, correct, delete, restrict, or port your personal data, and to object to certain processing or withdraw consent.
To update profile information, use the app or website where those controls exist, or ask your gym.
To request deletion of your OSSHub account and associated personal data, contact your gym and/or use our contact form and clearly ask for account deletion. We will work with your gym to delete or anonymise data we hold. Signing out of a mobile app ends the session on that device and deletes local app data; it does not by itself delete your gym membership account.
You may also lodge a complaint with your local data-protection authority.
The OSSHub student mobile app is intended for adult student accounts. Guardian-only and child accounts are not signed into that app. Gyms may still manage child members on the website under the gym’s own rules and parental involvement. If you believe we have collected a child’s data inappropriately, contact us through the contact form.
We use technical and organisational measures appropriate to the risk, including encrypted transport (HTTPS), secure storage of mobile session tokens, access controls, and session re-validation on the server. No method of transmission or storage is completely secure; please protect your login credentials and device lock screen.
We may update this Privacy Policy from time to time. The “Last Updated” date at the top will change when we do. Continued use of the services after an update means you acknowledge the revised policy where permitted by law. Material changes may also be communicated through the product or by email where appropriate.
If you have questions about this Privacy Policy, our privacy practices, or wish to exercise your rights (including account deletion), please use our contact form. You may also raise requests with your gym, which remains responsible for many membership decisions.