Privacy policy

FiveStripe (fivestripe.app) is run by On the Button Limited, a company registered in the Isle of Man (company number 135320C). We decide how the personal data described here is used, so we are its controller under Isle of Man data protection law, which applies the GDPR.

Questions, or a request about your data: oss@fivestripe.app.

Browsing without an account

You can read the catalogue, watch lessons and vote without an account.

• Votes are anonymous. Your browser makes a random voter id and keeps it, with your votes, in its own storage. We store the id with each vote, never linked to an account.
• To stop abuse, we keep a one-way hash of your IP address, mixed with the date, next to votes, lesson suggestions, sign-ups and sign-in attempts, and use it to limit how many each address can make. We never store the IP address itself.
• We read the country your connection comes from to decide whether to ask before using analytics. We do not store it.

Your account

• Your email address, and your name if you give one.
• Your password, stored only as a salted PBKDF2 hash that cannot be turned back into the password. Accounts that sign in by email link, Google or Apple may have none.
• Your belt, whether you have confirmed your email, when you last signed in, and your account role and status.
• If you turn on two-step sign-in: the authenticator secret, and your recovery codes as hashes.
• Sign-in sessions, which last 30 days unless you log out.

Signing in with Google or Apple

If you continue with Google or Apple, the provider tells us an id for your account with them, your email address and whether they have verified it, and your name (Apple shares the name only the first time). With Apple’s Hide My Email, the address is a private relay address that forwards to you.

We keep the id and email to recognise you next time, and use the name only when we make a new account. You can disconnect Google or Apple on your account page.

What you add

• Lessons you save, your own video links and notes, and the topics you tag them with.
• Gameplans, including their notes, playlists and any background images you upload.
• Gym and franchise branding, curricula and shared videos, if you run a gym.
• Lessons you suggest to the catalogue. Suggestions are kept without a link to your account.

What you share with a gym or franchise is visible to its members. People who run a franchise can see the name, email, gym and last sign-in of members of its gyms.

Training log

Your birthday, weight and gender are optional. We use them only to estimate the energy you burn. Each session you log keeps its date, length, intensity, the positions and techniques you trained, and the estimate.

Weight and training details can say something about your health, so we use them only for the estimates and insights you ask for, and only because you chose to enter them. You can clear the profile fields or delete any session at any time.

Paying for Pro

PayPal takes the payment on its own pages, with a PayPal account or a card. We send PayPal the amount, what you are buying and our order number, not your name or email. We never see your card or PayPal details.

We keep a record of each order: the product, amount, currency, any discount code, PayPal’s order id, its status and the dates.

Emails

We email you only about your account: confirming your address, sign-in links, and reminders before and after a Pro year ends. We do not send marketing.

Analytics

We use Google Analytics to see which pages help. It receives the page address (with sign-in tokens, codes and email addresses removed), the page title, and what Google Analytics collects about your browser and device. We do not send it your account.

In the UK, the EU, Iceland, Liechtenstein and Norway we ask first, and analytics loads only if you allow it. Elsewhere it loads unless your browser sends a Global Privacy Control signal. If you have said no, or your browser sends that signal, it never loads.

Why we use your data

• To run your account and the features you use, and to deliver what you buy: this is needed for our contract with you.
• To keep FiveStripe secure, limit abuse and keep votes fair: our legitimate interest in running a safe service.
• Analytics, and your training profile and log: your consent, which you can withdraw at any time.
• Order records: our legal duty to keep accounts.

Who else handles it

We do not sell your data. These companies handle it for us, or when you choose to use them:

• Cloudflare hosts the site and its database, and keeps short-lived logs of how it runs.
• Resend delivers our emails.
• PayPal takes payments.
• Google and Apple, when you sign in with them; Google also runs Google Analytics.
• YouTube, Instagram and TikTok: a lesson’s player loads from them only when you press play. YouTube thumbnails and instructor pictures load from Google’s image servers as you browse.

Some of them may process data outside the Isle of Man, the UK and the EU. Where they do, they rely on safeguards such as the European Commission’s standard contractual clauses.

Cookies and browser storage

Our own cookies are needed for the site to work, so they do not need consent:

• fs_sid keeps you signed in (30 days).
• fs_mfa holds a two-step sign-in while you type the code (10 minutes).
• fs_next remembers the page to return to after signing in (30 minutes).
• fs_oauth ties a Google or Apple sign-in to the browser that started it (10 minutes).

Your browser’s own storage keeps your anonymous voter id and votes, list filters, lessons saved while signed out, beginner path progress, your analytics choice and an unsaved gameplan. It stays on your device until you clear it.

Google Analytics, when allowed, sets its own cookies (named _ga and _ga_ followed by an id).

How long we keep it

• Your account and what you add: until you delete the account, which removes it at once. You can also delete gameplans, videos, saved lessons and training sessions one by one.
• Sign-in links: 20 minutes. Email confirmation links: 24 hours. A Google or Apple sign-in in progress: 10 minutes.
• Order records: with the account.
• Anonymous votes, suggestions and hashed IP addresses are not linked to an account and are kept to protect the service.

Your rights

You can ask for a copy of your data, ask us to correct or delete it, object to how we use it, or withdraw consent. You can change your name, email, password, belt and training profile on your account page.

Under Your data on your account page you can download a copy of everything your account holds, or delete the account and everything in it.

For anything else, email oss@fivestripe.app from the address on the account. We will reply within a month.

If you are unhappy with how we handle your data, you can complain to the Isle of Man Information Commissioner, or to the data protection authority where you live.

Security

Passwords and recovery codes are stored as hashes, sign-in cookies cannot be read by page scripts, every connection uses HTTPS, and you can turn on two-step sign-in with an authenticator app.

Children

Accounts are for people aged 13 or over. If you are younger, ask a parent or guardian to set one up for you.

Changes

If we change how we use your data, we will update this page and its date, and tell account holders by email about any important change.