Privacy

Your name, your email, and a password, which our sign-in provider stores hashed so nobody here can read it.

The group’s name, activity, place, nights, cap and cut-off, what a session costs and how you are paid if you tell us, and every session it has had.

Each person is a name and a random key stored on their own device so they need not type the name again.

We never ask them for a phone number, an email address or a password, and there is nowhere for them to give one.

A child appears only as a name a parent answers for.

People in a group can see the count, never anyone else’s name or answer.

If an organiser shares a spare-place link when they are short, the person who opens it sees the organiser’s first name, so they know who is asking, and nothing else about them.

What a session costs, as a price per person or as a total split between whoever comes, the one line saying how you are paid if you write one, and a note of who you have ticked off as having paid you. That is all.

The group’s link shows that line to the people who are in, and a spare-place link shows it to whoever takes the place.

We never take, hold, move or process a payment, we ask for no card or bank details from anyone, and nothing you are owed passes through us.

Each person sees only their own share and whether you have ticked them off, never anybody else’s.

Who said In, Out or joined the waitlist for a session and when, whether it was after the cut-off, who came, who walked in, and the one-line note the organiser leaves.

The register exists because clubs, halls and dojos have to hold attendance for safeguarding and for grading, and Plus exports it as a spreadsheet for exactly that.

Which screens are opened, when a link is shared, when a register is taken, and whether a new organiser arrived from the line at the bottom of a link.

Each one carries a random id we set ourselves in a first-party cookie, set for every visitor, including someone who opens a group’s link; when you are signed in it also carries your account id.

The outside measurement we use is the Meta pixel and the Grafana reports listed below, and nothing else.

If you allow notifications in a browser, the address it gives us for them, the two keys that let us encrypt a message to that browser, and when it was last seen. Nothing else about the device.

When no phone of yours can take a push, the same notification arrives by email at your account address instead.

When you write to us through Help or Contact: your name, your email address and your message, and from Help the page you wrote from.

We keep them so we can answer and so you can see what you sent.

Anyone can write to us; no account is needed.

We record that an address was sent a given kind of email in a given hour, so we cannot send it twice; and, per session, which count lines have gone, by push or by email, and per group that the first reply was announced, so none goes twice either.

An error report carries the page, the browser and the stack trace; your email address and any token are stripped out before it leaves us.

A report carries the page, the browser, how fast the page loaded and any error it hit, tied to a random id that lasts only as long as the tab.

It never records what you type or tap, never carries your name or email, and the key in a group’s link is swapped for a placeholder before it leaves your phone.

Stripe holds the card; we hold the customer and subscription ids, the plan and the date it runs to.

Stripe’s own privacy notice covers the card.

When an organiser types where a group meets, the words typed go from our server to Photon (run by komoot, on OpenStreetMap data) and, for a UK postcode, to postcodes.io, so real places can be suggested.

Our server adds the rough area the organiser is in, to about ten kilometres, so nearby places come first.

No name, no account and no IP address goes with it, and nothing anyone in a group does is ever sent.

We switch it on for as long as we run Meta ads and it is off the rest of the time (with no pixel id set, nothing loads).

While it is on it loads as soon as the front door or the sign-up page opens, for every visitor and not only for someone who came from an ad, and again for an organiser who has just made their first group.

It tells Meta the page was seen, and when someone signs up or makes a first group, which is how we tell whether an ad paid for itself, and Meta’s script sets Meta’s own cookies on the device (_fbp, and _fbc if the visitor came from a Meta ad).

There is no setting for it on the site; your browser’s tracking protection or an ad blocker stops it.

It never loads on a group’s link or a spare-place link, so nothing someone in a group does is ever sent to Meta.

For ten minutes at most, holds what you typed in a form we sent back (a sign-in, or a new group), so it returns as you left it. Never a password.

We keep what it held for 30 days, so a mistake can be undone by writing to us, and then delete the account and every group, person, session and register in it for good.