Privacy Policy

Information we collect

• Account and profile information. If you sign in, we receive information such as your email address and, when you choose to provide it or use a supported sign-in provider, a display name and profile image.
• Passport and preference information. This may include gyms you save or visit, visit dates, ratings, reviews, workout preferences, home city or gym, and photos or share links you choose to create.
• Gym business and owner information. We may collect public business contact details from gym websites, social profiles, and business directories to verify listings and contact the gym about its Iron Passport listing. When you submit or claim a listing, we may also collect your name, work email, role, verification evidence, listing edits, uploaded photos, correspondence, and subscription or payment-connection status.
• Guest-pass information. For a pass sold through Iron Passport, we collect the buyer name and email, requested visit date, quantity, accepted offer terms, and order, fulfillment, dispute, and refund status. Stripe handles payment card details; Iron Passport does not store full card numbers.
• Usage and device information. We may record page paths, searches, interactions, outbound clicks, referring site, browser or device details, screen size, and a session identifier. Our analytics code removes URL query strings and fragments before recording page locations and suppresses analytics on sensitive token-bearing routes.
• Advertising measurement information. When our Meta Conversions API integration is enabled, outbound-click and guest-pass interactions may be sent to Meta with the source page, gym, IP address, and browser user agent. A submitted guest-pass lead may also include a SHA-256 hash of the normalized email address; we do not send the plain-text email in that event.
• Location. If you ask the map or finder to locate you, your browser may provide location data so we can show nearby gyms. You control this through your browser permissions.
• Communications. We receive information you send in feedback, support messages, listing corrections, and other correspondence.

Cookies and browser storage

Iron Passport and its service providers use cookies and first-party browser storage for authentication, security, search and order sessions, saved interface preferences, attribution, and analytics. Some storage lasts only for the current tab or session; some remains until it expires or you clear it. Blocking essential storage may prevent sign-in, checkout, or account features from working.

How we use information

• Provide search, maps, comparison, Passport, and account features.
• Personalize results and remember requested preferences.
• Verify listings and ownership claims and moderate public content.
• Process and fulfill guest passes and gym-side subscriptions.
• Send service, receipt, security, and support messages, requested marketing, and limited business-listing outreach to public gym contacts.
• Measure demand, diagnose errors, prevent abuse, and improve the service.
• Measure advertising conversions and help configured advertising campaigns optimize toward relevant interactions.
• Comply with law and protect users, gyms, Iron Passport, and the public.

What can become public

Gym listings are public. If an approved review is marked public, its display name, rating, review text, and visit date may appear on the gym page. Approved gym photos may appear with their caption or requested credit. A Passport share link you create can be viewed by anyone who has the link until it is revoked. Gym owners should not submit private contact details in fields intended for a public listing.

Gym-page reviews and listing photos are moderated before they appear on those surfaces. A Passport share link is created at your direction and may immediately display the visit photo you selected without prior review. Listing-photo uploads identify whether a photo is licensed only for the site or also for credited social and promotional use; we use it according to the scope selected at upload.

When we share information

• Service providers. We use vendors for database hosting and authentication, infrastructure and analytics, email, maps, payment processing, security, and AI-assisted search or data enrichment. They receive information needed to perform those services for us.
• Advertising measurement. When enabled, we share the interaction and device information described above with Meta through its server-side Conversions API so Meta can measure and optimize advertising under its own terms. Clearing browser storage alone may not prevent a server-side conversion event. We do not sell personal information for money; some privacy laws may treat targeted-advertising or measurement disclosures as a sale or sharing. Contact us to request an applicable opt-out.
• Gyms and payment partners. A connected gym receives the buyer and visit details needed to fulfill its pass. Stripe receives payment and transaction information. The gym is the seller for a connected-gym pass.
• Public sharing. We publish content and listing details as described above when you choose a public feature or submit material for a public listing.
• Legal, safety, and business events. We may disclose information when reasonably necessary to comply with law, enforce our terms, protect people or the service, investigate fraud, or as part of a merger, financing, acquisition, or sale of assets.

External websites

Gym websites, social networks, mapping services, and other sites linked from Iron Passport have their own privacy practices. When you follow an external link, that service may receive information such as your IP address and referring page under its own policy. Iron Passport does not control those third-party sites.

Retention

We keep information for as long as reasonably needed to provide the service, maintain security and business records, resolve disputes, and meet legal obligations. The period depends on the type of data. For example, account content may remain while your account is open, while order, payment, moderation, fraud-prevention, and backup records may need to remain longer. We delete or de-identify data when it is no longer reasonably needed. Publicly sourced business contacts and outreach records may be retained to maintain listing history, honor opt-outs, prevent repeat contact, and keep required business records.

Your choices

• Use public gym search without creating an account.
• Remove saved gyms and Passport visits from the available account controls.
• Delete public review text without deleting the underlying private stamp.
• Revoke a Passport share link or remove its saved visit photo.
• Disable browser location access or clear cookies and browser storage.
• Use the unsubscribe link in marketing emails.
• Ask us to stop business-listing outreach; we may keep a minimal suppression record so we can honor that request.

To ask to access, correct, or delete other personal information, contact us at the address below. We may need to verify your identity before completing a request, and some records may be retained where required or permitted by law.

Security and international use

We use administrative, technical, and organizational safeguards designed to protect information, but no online service can guarantee absolute security. Iron Passport is available internationally, so information may be processed in countries other than your own, with different data-protection laws.

Children

Iron Passport is not directed to children under 13, and we do not knowingly collect personal information from them. If you believe a child has provided personal information, please contact us.

Changes to this policy

We may update this policy as the service changes. We will post the revised policy here and update its effective date. If a change is material, we may provide an additional notice through the service or by email when appropriate.

Contact

Questions or privacy requests can be sent to tyler@iron-passport.com. You can also review the other support paths on our Contact page.