What we store

You can read the home page, gym directory, gym profiles, and pricing page without an account. Our hosting and authentication services may process technical request information needed to deliver and protect the site.

Ronin does not load advertising pixels, session recorders, or browser analytics scripts. Fonts and gym images are served by Ronin. Google Maps loads only for a map, as described below.

We count how many visits reach each step of joining, such as viewing a gym or starting checkout. These are daily totals only. They are not linked to you, your device or your account, and no cookie is used.

Ronin doesn’t track you across other sites, and doesn’t sell or share personal information for advertising. Browser “Do Not Track” and Global Privacy Control signals therefore don’t change anything we do.

• Vercel hosts the site and keeps its request logs.
• Supabase runs our database, sign-in, and file storage, including photos and signed waivers. Passwords are stored there as one-way hashes, never as typed.
• Stripe takes payments and pays gyms.
• Resend sends our emails, such as pass notices and a gym’s daily list of waiver signers.
• Google provides the maps. If you choose Continue with Google, Google also tells us your name and email address. We don’t get your Google password.
• Sentry receives error codes from our server, with no personal information.

The gym directory has a ZIP search. We find the nearest gyms on our own server, against a bundled US Census table, and don’t save your ZIP to your account. The ZIP is part of the page address (/gyms?zip=…), so it appears in our hosting provider’s request logs.

To show prices for your area, the pricing page asks for your ZIP code, or lets you search by city. Both are looked up on our own server, against US Census and GeoNames place data (geonames.org, CC BY 4.0). The map of where your pass works is drawn by Ronin from US Census boundaries; it loads nothing from Google or anyone else.

The maps are Google Maps embeds. On the directory, a map loads only after you search a ZIP or open “Show map”. On a gym’s own page, its map loads only when you open “Show map”. If JavaScript is turned off in your browser, the browser can’t wait, so a gym page’s map loads with the page. Once a map loads, Google receives your IP address and the gym’s address, and Google’s own privacy policy applies. After a ZIP search, the map shows directions from your ZIP, so Google also receives your ZIP. If no map loads, nothing is sent to Google. The “Open on Google Maps” and “Directions” buttons take you to Google’s site, with the gym’s address and, after a ZIP search, your ZIP.

A gym’s “Download class schedule” file comes from our server. It holds the gym’s public timetable and nothing about you.

A referral cookie. Scanning a gym’s printed Ronin card records which gym sent you, in a cookie called ronin_ref, for 30 days. It holds one thing: that gym’s slug. The first referring gym keeps that attribution; a later scan does not overwrite it. Referral bonuses depend on the program’s eligibility rules. Ronin’s server uses this cookie to record the referring gym.

A sign-in cookie. If you make an account, our authentication provider sets a session cookie to keep you signed in. Account setup also uses temporary cookies to verify email links and return you to the right page.

An application cookie, for gym owners only. If you start an application to list your gym, a cookie called ronin_gym_apply keeps your place for 14 days so you can finish later. It holds a random code, not your answers, and only the application pages can read it. It is deleted when you send the application.

A ZIP code cookie. If you enter your ZIP code to see prices, a cookie called ronin_zip remembers it for one year so every page shows the prices and map for your area. It holds only the five digits. Enter a different ZIP to change it, or clear your cookies to remove it.

These cookies support referral attribution, sign-in, account setup, saving an application, and showing prices for your area. Ronin does not use them for advertising or profiling.

When server error monitoring is enabled, Ronin sends Sentry fixed error identifiers to help diagnose failures. This integration excludes personal fields, request bodies, cookies, and browsing analytics.

A member inquiry stores your email, the gyms you picked, the page you sent it from, and the time. A gym inquiry stores the gym name, contact email, the time, and any unlimited membership price or note you add.

Authorized Ronin operators can review these details and export a batch to follow up with you. The inquiry list isn’t public. An inquiry doesn’t create a subscription, reserve a founding membership, or confirm that a gym has joined Ronin.

A gym application stores what the owner enters: the gym’s details, schedule, prices, an optional logo, and the owner’s name, role, email and phone. A logo is redrawn on our server before it’s stored, and served from Ronin like the rest of the page. Unfinished answers are kept for 14 days. Only Ronin operators see an application. If we accept it, the gym’s name, address, disciplines, description, schedule, website, Instagram and logo go on its public page; the owner’s contact details and the gym’s own prices stay private.

We store your email, name, selected gyms, check-ins, free-week use, drop-in purchases, and the billing records needed to run your pass and pay gyms. Stripe handles card payment details; Ronin does not receive full card or bank account details.

When you agree to the Membership Terms, we record which version you agreed to, when, and the IP address and browser you agreed from. Gyms don’t get that record.

Your gyms see what they need to let you train: that your pass is valid and how many classes you have left. At check-in, a gym sees your first name, last initial and when you checked in there. A gym whose waiver you sign also sees the full name you sign with, as described under Online waivers. Gyms don’t get your email, your card, or where else you train.

If you add a photo of yourself, the front desk of a gym can see it when you’ve checked in there before, or when you might train there today: the gym is on your pass, you’ve booked a class there, you have a drop-in there, or you’re on a free week. That way the desk knows it’s you. A gym may also keep its own photo of you, taken at its desk; only that gym and Ronin see it. We keep photos privately, remove everything but the picture itself (including where it was taken), and delete yours when you remove it.

If you sign a gym waiver through Ronin, we store the document version, the name you sign with, your signature image, the time you signed, and the IP address and browser you signed from.

The gym whose waiver you sign gets a signed copy: the waiver text and version, the full name you signed with, your signature, and when you signed. It sees this from the moment you sign, even before your first visit. It also gets a daily email listing who signed, and its check-in history shows whether you’ve signed its current waiver. The gym doesn’t get your IP address or browser. Authorized Ronin operators can access waiver records to manage them.

A gym’s public page shows its name, address, disciplines, description, schedule, website, Instagram, logo, and premium status. Private owner contact details and commercial terms with Ronin are not published.

Ask for a copy of what we hold about you, or ask us to delete it, and we will. Some billing records must be kept for tax and for the statements gyms are paid from. Where that applies, we’ll name the specific records.

Email support@roninpass.com from the address on your account, so we know the request is yours. We reply within 30 days.

What we charge is on the pricing page. What a pass commits you to is on the terms page.