Privacy Policy

Who we are

Rotation Master is scheduling software for gymnastics gyms. In this policy, “we” and “us” mean Rotation Master, based in Seattle, Washington, USA. You can reach us at info@rotation-master.com.

What this policy covers

Rotation Master handles two kinds of personal information.

Information your gym puts in

Your gym’s schedule, the names of its coaches and its staff accounts are your gym’s information. Your gym decides what goes in and why, so for this information it is the “controller” and we are its “processor”: we handle it on the gym’s behalf, under our Data Processing Addendum. If you work at a gym and have a question about this information, you can ask your gym or us. We’ll help your gym answer.

Information we collect for ourselves

For everything else, we decide what is collected and are responsible for it: messages from our website and email, sign-in and security records, counts of how the app is used, and the business contact details of gyms we talk to.

What we collect

• Contact details. Your name, email address and gym, and, if you choose to add them, your city and how many classes your gym runs, when you use our contact form, open our demo or email us.
• Account details. Your name and email address, your role at your gym and which gyms you belong to. Your password is never stored as you typed it, only as a scrambled one-way code that can check it but can’t be turned back into it.
• Your gym’s schedule. Classes, times, categories, equipment and rotations, and the names of the coaches on them.
• Activity records. Who changed what in your gym’s schedule and when, and each time someone opens or leaves the app.
• Security and device information. Your IP address, your browser type and version, and the time of each request, used by Cloudflare’s browser check and by our sign-in system.
• Usage counts. How often each main page is opened and how many requests the app makes, without what was on the page.
• Demo visits. If you open our demo: which of its pages you open, how many times you come back and how long it is on your screen, never what you type or change in it.
• Messages. Ideas, bug reports and emails you send us.
• Business contact details. Names, work email addresses and phone numbers of gym owners and managers, from public sources such as a gym’s own website, when we contact gyms about Rotation Master.

The complete list, with where each item is kept and for how long, is on Data we collect.

We don’t collect payment details (there are no payments yet), athletes’ information, your precise location, or anything from your device beyond what is listed here.

How we use it

We use personal information only for the purposes below. If you are in the UK or the European Union, the law asks us to name the “legal basis” for each, so we have.

We don’t use personal information for advertising, we don’t sell it, and we don’t make automated decisions about people that have legal or similarly significant effects on them.

Cookies and storage on your device

The website sets no cookies of its own and has no analytics, advertising or tracking of any kind.

The app stores a few small things in your browser, all of them needed for it to work or to remember choices you made:

• one cookie, __Host-rm_pass, that remembers for 30 days that this browser passed Cloudflare’s browser check. It holds an expiry time and a signature, nothing about you;
• your sign-in, so you stay signed in until you sign out;
• your choices: light or dark, the gym and schedule you last opened, and similar settings;
• a message or request you are in the middle of sending, so a dropped connection doesn’t lose it or send it twice. It is removed when you close the tab.

On both sites, Cloudflare may also use short-lived security cookies or storage of its own to tell people from bots. Because none of this is used for tracking or advertising, we don’t ask for consent with a banner. You can clear it in your browser’s settings at any time; you’ll be signed out and see the browser check again. Each item is listed on Data we collect.

Who we share it with

• Companies that help us run Rotation Master. Supabase (our database and sign-in system), Cloudflare (hosting, security, the browser check and email delivery) and Google (our email inbox). They handle it to provide their services to us. Data we collect says what each one does.
• Your gym. Your gym’s admins and managers can see your name and email address. Everyone in your gym sees the coaches’ names on the schedule, and the name of whoever last changed a class. Your gym’s admins manage your account.
• Rotation Master support, when helping your gym or fixing a problem.
• Google, if you choose to sign in with Google where the sign-in page offers it. Google confirms who you are and tells us your name, email address and profile picture. Google’s own privacy policy covers your Google account.
• When the law requires it, or when it is needed to protect someone’s safety or our legal rights.
• If Rotation Master changes hands. The information would go to the new owner, still under this policy, and we would tell you first.

We never sell or rent personal information, or share it for advertising.

Where it is stored

Our database is in the United States, in Oregon, on Amazon Web Services through Supabase. Cloudflare’s network is worldwide, so your visit may pass through a data center near you.

If you are in the UK, the European Union or Switzerland, this means your information is transferred to the United States. Our providers protect these transfers with the standard contractual clauses approved for this, including the UK addendum. If your gym is in one of those places, tell us before you start and we will sign transfer clauses with your gym too.

How long we keep it

• Your gym’s workspace (its schedule, coaches’ names, activity records, page counts and messages from the app): while your gym uses Rotation Master. When your gym leaves, we keep it for 30 days so you can ask for a copy, then delete it within the next 30 days.
• Your account: while you belong to a gym. If you are removed from every gym, we delete it within 90 days, or sooner if you ask. If your whole gym leaves, it goes with the workspace.
• Sign-in sessions: until you sign out or the session expires.
• Request counts: about 90 days.
• Enquiries and emails: for as long as we are talking, and then deleted, normally within two years of the last message.
• Demo sign-ups: until you unsubscribe or ask us to delete them, and otherwise within two years of our last email with you.
• Backups: deleted information can remain in our providers’ backups for a limited time before it is overwritten: normally up to 30 days, and up to about two months for email.

How we protect it

• Everything travels over encrypted connections (HTTPS), and our database provider encrypts stored data.
• Each gym’s information is kept separate. The database checks every request against the person’s gym and role.
• Passwords are stored only as one-way codes.
• A browser check stops bots before the app even loads.
• Behind the scenes, only Rotation Master support can reach gyms’ information, and only to run, support and secure the service.

No system is perfectly secure. If a breach affects your information, we’ll tell your gym, and you where the law requires, without undue delay.

Your choices and rights

Anyone can ask us to:

• tell them what personal information we hold about them, and give them a copy;
• correct it, or delete it;
• stop using it for a particular purpose, such as contacting them about Rotation Master or sending them news.

Email info@rotation-master.com, from the address you sign in with if you have an account, so we know the request is yours. It’s free, and we’ll reply within 30 days. If the information is part of your gym’s workspace, we may involve your gym, since it decides what is in there; we’ll tell you if we do.

In the app, you can change your own name and password in Settings, and your gym’s admins can remove you from the gym.

In the UK and the EU you also have the right to object to how we use your information, to restrict it, and to take it elsewhere, and you can complain to your data protection authority: in the UK, the Information Commissioner’s Office (ico.org.uk). We’d appreciate the chance to put things right first.

In the United States, if a privacy law where you live gives you rights, email us and we’ll honor them. We don’t sell personal information, share it for targeted advertising, or use it to profile people.

Do Not Track

We don’t track you across other websites, and we don’t let anyone else track you on ours. So both sites behave the same whether or not your browser sends a Do Not Track or Global Privacy Control signal: there is no tracking to switch off.

Children

Rotation Master is a tool for gym staff and isn’t directed at children. We don’t knowingly collect personal information from children under 13. Gyms agree not to put athletes’ personal information in it (see the Terms). If you think a child’s information has been entered, tell us and we’ll delete it.

Changes to this policy

When this policy changes, we’ll post the new version here with a new date. If a change is significant, we’ll email gym admins at least 30 days before it takes effect.