FightPeak Privacy Policy
Effective date: October 27, 2026 · Version: 1.0 Controller: TK Collective LLC, 26787 Agoura Rd, Ste E8 PMB 1025, Calabasas, CA 91302, United States Contact: support@fightpeak.com
This policy explains what we collect when you use FightPeak, why, who receives it, and your choices.
The short version
| What we collect | Why | Who receives it |
|---|---|---|
| Account details (name, email, password hash, role) | Run your account; service email when enabled | Supabase (database/auth); our email provider when enabled |
| Payment and subscription information | Charge your subscription; show your billing status | Stripe processes your card. We receive and store payment status, transaction and customer identifiers, plan, and limited billing details. We never receive your full card number. |
| Athlete profile (name, date of birth, sex, discipline, level, weights, fight dates, round format, fighting style) | Build camps and sessions | Supabase; the coach or gym that manages your profile |
| Readiness entries (resting heart rate, HRV, sleep, soreness, mood, concussion-symptom answers), sparring logs, weight entries | Readiness scores, sparring budgets, weight targets, training suspension when symptoms are reported | Supabase; your coach or gym |
| Health-screen answers and consent records (with version and timestamp) | Decide whether weight-management features can be shown to you; keep a record of what you agreed to | Supabase |
| Usage and technical data (pages used, device and browser type, IP address, approximate region, error logs) | Keep the service working; understand what's used | Lovable (hosting and error reporting), Supabase |
| Early-access waitlist (email address; optionally your audience—what brings you here—main sport and planning challenge; referral source/campaign from link tags, e.g. utm_source/utm_campaign) | Send early-access invitations and launch updates when enabled; understand who’s joining and where signups come from | Supabase; our email provider when enabled |
| First-party, non-identifying funnel analytics events (page view, form start, submit success/error, with source/campaign) | Understand the signup funnel and where signups come from | Supabase |
| Abuse-prevention data (a hashed IP address and email, kept for the rate-limit window) | Protect the waitlist form | Supabase |
We don't sell personal information and we don't share it with data brokers.
1. What we collect and where it comes from
From you: when you sign up, join the early-access waitlist, build a fighter profile, log readiness, sparring or weight, answer the health screen, or write to support. The waitlist collects your email address and, optionally, your audience (what brings you here), main sport and planning challenge.
From your coach or gym: if they create or manage your athlete profile on a Coach or Team plan. They are responsible for having your permission.
Automatically: IP address, browser and device type, pages and features used, timestamps, error reports. For waitlist signups we collect referral source/campaign from link tags (e.g. utm_source/utm_campaign) to understand where signups come from. We record first-party, non-identifying funnel analytics events (page view, form start, submit success/error, with source/campaign) and abuse-prevention data (a hashed IP address and email, kept for the rate-limit window) to protect the form. There is no advertising pixel and no third-party analytics.
Not collected: precise location; data from your phone's health apps (a future version may offer a connection, and we'll ask first).
2. Health-related information
Readiness entries, weight, sleep, soreness, concussion-symptom answers and health-screen answers are health-related. We use them only to run the features you're using: adjusting your training and weight plan and showing them to the coach or gym that manages your profile. We don't use them for advertising, don't sell them, and don't send them to ad platforms.
The services that host and run FightPeak (Lovable, Supabase, and our email provider when enabled) may process this information as part of storing it, backing it up, delivering email when enabled, or reporting errors. We select providers that commit to using data only to provide their service to us.
FightPeak handles health-related information as described in this policy. HIPAA does not apply to every fitness or health application. Other federal and state privacy, security and breach-notification laws may apply to this information, and we maintain an incident-response process so that, if a breach affects you, you're notified as those laws require.
3. How we use information
- Provide the service: camps, sessions, readiness, sparring and weight tracking, billing status.
- Run the business: payments, fraud prevention, support, enforcing our Terms.
- Communicate: service email (receipts, trial and renewal reminders, payment failures, security notices). Marketing email only if you opted in; unsubscribe any time.
- Improve FightPeak: aggregated statistics with identifiers removed (for example, average readiness by camp phase). We don't attempt to re-identify anyone from these.
- Understand waitlist signups: first-party, non-identifying funnel events and referral source/campaign, as described above.
4. Who we share with
Service providers that process data to provide their service to us: Lovable (hosting, error reporting), Supabase (database, authentication, backups), Stripe (payments), and an email delivery provider when enabled. We may add or replace providers; the categories stay the same.
We use no third-party analytics or advertising pixel.
Your coach or gym, if you're on their plan: profile, readiness, sparring, weight and sessions. You can remove a coach's access from your fighter page, or ask us to.
Legal: if the law requires it, to protect someone's safety, or to enforce our Terms. If TK Collective LLC is acquired, your data transfers with the business under this policy.
5. Retention
| Data | Kept for |
|---|---|
| Account, profile, training and readiness data | While your account is active, then deleted or de-identified within 90 days of closure |
| Consent and health-screen records | Life of the account plus 3 years |
| Subscription consent evidence | At least 3 years, or 1 year after the subscription ends, whichever is longer |
| Billing records | As required by tax law (generally 7 years) |
| Support correspondence | 2 years |
| Waitlist records | Waitlist details are kept until you unsubscribe or until 24 months after you joined, whichever comes first; if we have emailed you, 24 months after our last email to you if later. After you unsubscribe we keep only a minimal suppression record (your email address and unsubscribed status) to honour the opt-out. Ask support@fightpeak.com for full deletion at any time. |
| Backups | Rolling backups are overwritten within 35 days of deletion from the live database |
You can ask for earlier deletion (§7); we'll keep only what the law requires.
6. Security
Data is encrypted in transit and at rest. Access inside FightPeak is controlled so that users can read only their own records and those of athletes they manage; our staff access production data only for support and operations. Card numbers are handled by Stripe, not by us. No system is perfectly secure.
7. Your choices and rights
Everyone can: see, correct, download and delete the personal information we hold; remove a coach's access; opt out of marketing email. Email support@fightpeak.com. If you don't have an account (for example, a coach entered your profile), tell us the coach or gym and the name on the profile; we'll verify you before acting, usually by confirming details only you would know. An authorized agent may submit a request with your written permission. We respond to access and deletion requests within 45 days and to simpler requests sooner; we'll tell you if we need more time.
Do Not Track and Global Privacy Control: we don't track you across other sites. We treat a GPC signal as a request not to share your data for advertising.
California residents: you have the right to know, delete and correct personal information and to limit the use of sensitive personal information. We do not sell personal information. If we ever share it for cross-context behavioral advertising we'll say so here and offer an opt-out. We won't discriminate against you for exercising your rights.
Washington and other state residents: where state consumer-health privacy laws apply, we collect and share health-related information only with your consent, as described in this policy and in the health screen you complete.
EU/UK residents: FightPeak is offered from the United States. If you use it from the EU or UK, our legal bases are contract (running your subscription), consent (health-related data, marketing email) and legitimate interests (security, product improvement). You may complain to your local data-protection authority.
8. Children
FightPeak is for adults 18 and older. We don't knowingly collect information about anyone under 18, including through coach-created profiles. If you believe a minor's information was entered, contact us and we'll delete it.
9. Cookies
We use strictly necessary cookies/storage only (authentication session for signed-in users). There are no advertising or third-party analytics cookies. Blocking necessary cookies/storage may prevent sign-in or other essential functions.
10. Changes
We'll post updates here with a new effective date and version number and email you about material changes at least 14 days before they take effect. New uses of health-related information will ask for your consent.
Questions or requests: support@fightpeak.com · TK Collective LLC, 26787 Agoura Rd, Ste E8 PMB 1025, Calabasas, CA 91302.