Privacy Policy
Last updated 11 October 2026
This describes the app as it actually works, field by field, not as a template. If something here does not match what TrainFloor does, the policy is wrong and we want to hear about it.
The short version
- There is no analytics SDK, no advertising and no advertising identifier.
- Your phone's location is read only while you are using a map in the app, never in the background, and what your profile keeps is a city, not a point.
- There are two ways to sign up, Apple and Google. A third way in, an email and a password, exists only for accounts we set up ourselves, such as the one Apple's reviewers use.
- What we hold is your account, your profile, what you post, what you train, who you follow, and - if you coach - what you paid us for.
- Coaches pay by card. Stripe takes the card and we never see its number.
- A coach can verify their photo with a selfie, and that reads their face. It happens only after a written release in the app, the face template is never stored, and the selfie is deleted when the check finishes. The full terms are below.
- Workouts and comments you post are read by an automated model, run by a company in Singapore. The app asks your permission once before it sends any, and without it you cannot post or comment.
- Tapping a coach's promo is counted. That count is what the business sells a coach, and it is described in full below.
- You can delete everything from inside the app, immediately. Payment records are the one thing that outlives the account.
- Nothing is sold, and nothing goes to advertisers or data brokers.
Who we are
TrainFloor is a product of ManuSoft Inc., Chicago, Illinois, United States. ManuSoft Inc. decides why and how the data described here is handled, which under the GDPR makes it the controller and under United States state privacy laws the business. Where this policy says we, it means ManuSoft Inc.
Anything about your data goes to privacy@trainfloor.com.
What TrainFloor collects
Your account
An account is made one of two ways: Continue with Apple, or Continue with Google. There is no sign-up form and no password to set. What we receive is the email address the provider hands back, which is what your account is identified by and which Settings shows you. If you use Sign in with Apple and choose to hide your address, TrainFloor receives Apple's private relay address and never sees your real one.
If you use Sign in with Apple, our server also keeps a token from Apple, and only so it can be revoked. When you sign in, Apple gives the app a one-time code; our server exchanges it with Apple for a refresh token and stores that token against your account. It is never used to read anything about you. When you delete your account, we send it back to Apple to revoke, which ends TrainFloor's access to your Apple ID.
There is a third way in, and nobody can choose it for themselves: an email address and a password, for an account TrainFloor set up and handed to somebody, such as the account Apple's reviewers sign in with. The app has no way to create one. Its password is held by our sign-in provider, Supabase, as a one-way hash, never in a form anybody can read back.
Your profile
A handle and a display name, which are required. Everything else is optional: a biography, a location, years of training experience, gender, the sports you train and your level, an avatar, a cover image, and links to your accounts elsewhere. Your location is a city you pick on a map. Wherever you drop the pin, the profile keeps the name of the city it is in and that city's centre, from a list of cities built into the app, and never the pin itself.
Your location
The app reads your phone's location only while you are using it, and only for a map. It asks for permission while the app is open (never "Always"), and only when you open one of its maps - the map on Explore, the city picker when your profile has no city yet, or a coach's gym picker when they have none - or press a map's locate button. It never reads your location in the background, at launch, or to follow you.
What happens to the reading depends on the map. Picking a city keeps the city, not you. On the Explore map and in the gym picker, the point is sent to our server and to our database to find the gyms and coaches near it. Neither stores it with your account; our server's request log records the coordinates it was asked about and the time, but not who asked. A coach's gyms are a different thing, described below: places they chose to publish.
The maps themselves are drawn by Apple Maps on an iPhone and from OpenFreeMap on Android, and your phone fetches them directly - see what your phone sends to somebody else.
What you post
Workouts and the equipment, body parts and places tagged on them. Images, YouTube links, and voice notes, which are stored with their length and a waveform of their loudness so the app can draw the bars. Comments, replies, reactions, and direct messages. Highlights, which are the same kinds of attachment posted to expire on their own. Call-outs, which dare one person to beat your result on a workout, and the result each of you posted. The events you say you are going to.
A photograph can carry the place it was taken, and we should be exact about when ours do. A profile photo and a picture sent in a message are re-encoded on your phone before they leave it, which removes what the camera wrote into the file, location included; the only exception is a phone that cannot re-encode the picture at all. A picture attached to a workout is re-encoded too, but if the re-encoded copy would be larger than the original, the original is sent instead, and an original photograph can still hold the latitude and longitude it was taken at. Anybody who can see that workout can download the picture. Until we fix this, if that matters to you, turn off location for your camera, or attach a screenshot rather than the photograph.
What you train
Two records and no others, and they are worth naming exactly. Starting a workout writes one row holding which workout it was, that it was you, how many seconds you spent on it, and when you started. Posting a result to a leaderboard writes one row holding the time, rounds, reps, weight, the unit you chose, whether it was as prescribed, and when you recorded it.
Nothing else about your body is collected. There are no vital signs, no heart rate, no weight or body measurements of yours, no diagnoses, no symptoms and no medical history, because nothing in the app asks for them.
Who you follow
Accounts you follow, block, mute or save, and threads you have cleared from your own inbox, so the app can show them back to you the way you left them.
Your settings
Notification preferences, and the switches that control whether you appear on leaderboards, whether your reaction counts are hidden, and who may message, comment or post scores.
What you tap on a coach's storefront
A coach may put outbound links on their storefront, and a tap on one is recorded. The record holds which coach it was, that it was you, what kind of link it was, the workout you arrived from if you arrived from one, and the hour it happened. One tap an hour is kept per coach and reader, so this counts visits rather than clicks.
This is stated plainly because it is the only behaviour of yours that TrainFloor records for a commercial reason: a coach is shown how many times their links were reached, and that figure is what the business sells them. The coach is shown a number, never you. Nothing identifies you to them, no profile of you is built from it, none of it goes to an advertiser, and the same figure is counted whichever link was tapped.
Asking a coach to train you
If you ask a coach to train you live, we store what you wrote: your goal, when you would like to train, whether it is at their gym, yours or elsewhere, which of their gyms if you picked one, which coach you asked, and whether the request is new, opened or declined.
The coach is not shown who you are until they open the request, and a coach pays to open one after their first three. When they open it they see your name and can message you. Deleting your account removes the request.
If you coach: your gyms and your schedule
A coach may add the gyms they work out of - a label they type, and the coordinates of the place they picked - and dated blocks of open availability or named sessions. Those coordinates are a place a coach chose to publish, never a reading from their phone. Both are shown to anybody looking at that coach's page, which is the point of them.
Payments, if you are a coach
Reading, training and posting are free, and none of this applies to you until you buy one of the two things a coach can buy: an introduction to somebody who has asked to train with you, or a further promo on your storefront. The card is typed into Stripe and never into TrainFloor. The sheet that appears in the app and the page that opens in your browser are both Stripe's, and no card number, expiry or security code ever reaches us.
What we keep is the record of the charge: which of the two you bought, what it was against, the amount, the currency, Stripe's identifier for the payment, whether it succeeded, and when it settled, was refunded or was disputed. Your profile also carries the customer identifier Stripe issues you, which is how a second purchase can use the card you already saved with them. Stripe is sent that profile identifier and the email address on your account, so that a charge can be traced back to you when you write to us about one.
Stripe's own software is built into the app to draw that sheet. It starts only when you open it, and Stripe collects device signals of its own for fraud detection when a card is submitted. Those signals are Stripe's, not ours, and Stripe states they are used for fraud detection and security and never for advertising.
Your device, only for notifications
If you turn on push notifications, TrainFloor stores a push token and your platform, iOS or Android, so a notification can reach the right device. Turning notifications off removes it.
Safety
Reports you file about other people or their content, including what you reported, the reason, any detail you wrote, and how it was resolved. Each new report is emailed to our support team, and the time it was sent is recorded. Reports are kept after resolution so a pattern of behaviour can be recognised.
Photo verification and your face
A coach can verify that the person in their profile photo is them, which puts a badge on their profile. It is optional, it is offered only to coaches, and nothing else in the app depends on it. Because it reads a face, Illinois law treats it as biometric, and TrainFloor's company is in Illinois, so this section is written to the Illinois Biometric Information Privacy Act (740 ILCS 14) and applies to everybody who uses the check, wherever they live.
What is collected
- A selfie. The app opens the front camera and asks you to move your face in the oval, to show it is a live person and not a photograph held up to the lens. That liveness check runs entirely on your phone, using Google's ML Kit face detection and your phone's motion sensors, and none of what it measures leaves the phone. When it passes, one frame - a single photograph of you - is uploaded to a private storage area that nobody can read back from the app, you included.
- Your profile photo, which we already hold.
- A face template of each. Our own server, in Germany, turns the selfie and the profile photo into numerical face templates with an open-source face model, and measures the distance between them. The templates exist only in memory for the seconds the comparison takes and are never written down, to a database, a file or a log.
- The result: whether it passed, the reason if it did not, the distances the decision was made on, and the name of the model. The distances are numbers describing how alike two faces were; they cannot be turned back into a face, and they are kept so we can check the threshold against real attempts.
What it is for, and what it is never for
To confirm the person in your photo is you, and for nothing else. It is never used to identify you anywhere, never used to recognise you in other pictures, never sold, leased or traded, and never given to another company to use for itself. No outside face-recognition company is involved: the comparison runs on our server. The selfie is stored, until it is deleted, with Supabase, the same hosting provider that holds every other photo in the app, which acts only on our instructions. We would disclose any of it only where a valid warrant or subpoena required it.
Your written release comes first
Before the camera opens, the app shows you what is collected, why, and for how long, and asks you to agree to the Biometric Release with the words Agree and Verify. Nothing about your face is captured until you have. Pressing it records a release in our database holding the version of the wording, the purpose and the term exactly as they were shown, and the time you agreed. If the wording changes, you are asked again before your next check.
How long each part is kept
- The face templates: never stored, so there is nothing to delete.
- The selfie: deleted the moment the check finishes. The verdict and the deletion are one step, and the file itself is removed within about a minute of it. A check nothing decides fails after fifteen minutes, and a selfie that was uploaded but never checked is deleted after an hour.
- The distances: destroyed three years after the check they came from, so never later than three years after your last use of TrainFloor, and straight away if you withdraw. A daily job carries this out, and a database backup holding them is deleted within about a month, as every backup is.
- The pass or fail itself, and your release: kept with your account, so a verification and the consent behind it can be shown later. Both go when you delete your account.
Withdrawing
You can withdraw at any time, in the app: open Settings from your own profile and, under Who can see your content, tap Photo verification, then Remove. That marks your release withdrawn, takes the badge off your profile, deletes any selfie still held, and destroys the distances. You can also write to privacy@trainfloor.com. Deleting your account does all of this too.
What your phone sends to somebody else without passing through us
Some things in the app are fetched by your own device from a company that is not us, and none of them reaches our servers. They are listed here because we never see it is not the same as nobody does.
- Maps. On an iPhone, the maps are Apple Maps, so Apple receives your device's IP address and the area of the map you are looking at, under Apple's own privacy policy. On Android, the map tiles come from OpenFreeMap, run by Hyperknot Software Kft. in Hungary, which states it keeps no IP addresses in its access logs and deletes its server logs after seven days.
- Google's ML Kit, during photo verification. The face detection that runs on your phone during the check never sends Google the camera image or what it found in it. Google states that ML Kit does send it diagnostics and usage data: the device's make, model and operating system, the app's identifier and version, a per-installation identifier Google says is not meant to identify a user or a device, performance figures such as how long a detection took, the image format and size it was given, which features were started, and error codes. Google uses these to measure, debug and improve ML Kit and to detect misuse. They are not linked to your TrainFloor account.
- YouTube. A workout carrying a video draws its thumbnail from YouTube, and playing it loads YouTube's player. Google therefore receives your device's IP address and the identifier of the video, on any workout with a video attached, whether or not you press play. The player itself is loaded in YouTube's privacy-enhanced mode, which does not set its usual tracking cookies; the thumbnail is fetched from an ordinary YouTube address.
- Searching for a gym. When you type a gym's name into the search on a map - on Explore, or in a coach's gym picker - what you typed and your device's IP go to Nominatim, run by the OpenStreetMap Foundation in the United Kingdom and the Netherlands, with the area of the map it should look near. TrainFloor never receives the search. The OSM Foundation states it truncates logged addresses and keeps detailed usage for 180 days.
What TrainFloor does not collect
- No analytics or advertising SDK of any kind. Three pieces of other companies' software are built into the app: Stripe's, which draws the payment sheet a coach pays through; Google's sign-in, which runs only when you choose Continue with Google; and Google's ML Kit face detection, which runs only during photo verification and sends Google the diagnostics described above.
- No advertising identifiers, and no advertising.
- No location in the background, and none at all unless you open one of the app's maps. The permission asked for is while-using only.
- No health or fitness data from Apple Health, HealthKit, Health Connect or Google Fit. TrainFloor asks for none of them and is not built against them.
- No contacts, calendar, or photo library access. Attaching a picture opens the phone's own photo picker, which runs outside TrainFloor and hands back only the pictures you chose. The app is never given your library, and it never asks to be - on iOS it ships with no photo library permission declared at all.
- No card numbers, and no card details of any kind. Coaches do pay us, and every card is typed into Stripe. What we hold about a payment is listed above.
- No voiceprints, and no biometrics outside photo verification. A voice note is stored and played back as a recording. It is never analysed to identify, verify or distinguish the person speaking. The waveform stored beside it is loudness over time, drawn as bars, and carries nothing about the voice itself. The one place the app reads a face is the photo check described above.
The app asks for five device permissions, each at the moment it is needed and never at launch. Every one is refusable, and the app works without any of them; you lose only the thing that needed it.
- Microphone, when you first record a voice note on a workout or in a message.
- Camera, when you start photo verification, for the selfie. When card payments are on, Stripe's sheet can also use it to scan a card, if you ask it to.
- Motion, during photo verification only, so the liveness check can tell a live person from a photograph. The readings stay on your phone.
- Location, while using the app, when you open one of its maps or press a map's locate button, as described under Your location.
- Notifications, the first time you leave a workout unfinished and are offered a reminder, or the first time you follow somebody - whichever comes first. A screen says why before your phone asks.
There is no photo library permission: attaching a picture uses the phone's own picker, as above.
Why we hold each of these
| What | Why | Legal basis under GDPR |
|---|---|---|
| The email address Apple or Google returns, or the one an account we set up was given | To create your account and let you sign back in | Performance of a contract |
| The Apple refresh token, if you use Sign in with Apple | To revoke TrainFloor's access to your Apple ID when you delete your account, which Apple asks of every app that offers it | Legitimate interests, and our obligations to Apple |
| Your profile's city, and your phone's location while you use a map | To show where you are based, and to find the gyms and coaches near the point on the map | Performance of a contract, and consent to the location permission, withdrawn in your phone's settings |
| Your selfie, the face templates, and the result of the check | To confirm the person in your photo is you | Your written release, which under the GDPR is explicit consent to processing biometric data (Article 9(2)(a)), withdrawn in Settings |
| Profile and posts | To show them to other people, which is what the app is for | Performance of a contract |
| Training records and results | To draw your history and leaderboards | Performance of a contract |
| A tap on a coach's link | To tell a coach how often their links were reached, which is what they are paying us for | Legitimate interests, being the operation of the marketplace itself |
| A request to train with a coach | To carry your request to them and let them answer it | Performance of a contract |
| Push token | To deliver a notification you asked for | Consent, withdrawn by turning notifications off |
| Automated review of the workouts and comments you post, and of your profile's name and bio | To keep the app free of abuse and illegal content | Your explicit permission, given in the app before your first post or comment, for sending the text to Moonshot AI |
| Automated check of the pictures you show others, on our own server | To keep sexual content out of the app | Legitimate interests, and our obligations to app stores |
| Automated review of a direct message somebody reported | To act on the report | Legitimate interests, and our obligations to app stores |
| Reports | To act on abuse and recognise repeat behaviour | Legitimate interests |
| Payment records, and your Stripe customer identifier | To charge you for what you bought, to prove afterwards what you were charged, to answer a dispute, and to keep our books | Performance of a contract, and a legal obligation to keep records of what we are paid |
Where we rely on legitimate interests you may object, and how to do that is under Your rights.
Automated review of what you post
When you post a workout, its text is sent to a language model operated by Moonshot AI PTE. LTD. so it can be classified and checked for spam, abuse and unsafe content. Every comment is read the same way shortly after it appears, and so is a changed profile name or bio, once you have agreed below. A direct message is never sent to Moonshot unless somebody reports it; then its text is, so the report can be answered. This means text you post leaves our systems and is processed on servers in Singapore, which is outside the EU and the United Kingdom. Nothing that names you goes with it: no profile identifier, no handle and no workout identifier is ever in the payload, so what Moonshot receives is the words alone.
The app asks your permission before any of your text goes to Moonshot. Before the composer first opens, before your first comment is sent, and before you first save a new name or bio, a sheet titled Posts are checked by AI says that the workouts and comments you post, and the name and bio on your profile, are read by Moonshot AI's model, and that Moonshot may use what it reads to improve its own service. Its one button is Agree; closing the sheet declines. Without your agreement you cannot post a workout or a comment, or save a new name or bio, and you can still read, train, follow and message. Agreeing is asked once: we record the time you agreed on your profile. To withdraw it, write to privacy@trainfloor.com and we clear that record, so the app asks again before you next post or comment.
We ask Moonshot to use that text for the decision and nothing else, and we should be straight about the limit of that. Moonshot's published terms reserve the right to use content submitted to their API to provide, maintain, develop, support and improve their services, and they offer a restriction on that only by separate written agreement. We have asked for one and do not have it yet. Until we do, our instruction is what governs between us and them, and their terms are what they have reserved for themselves. If that is not acceptable to you, do not post text you would not want read by a third party, and see Who else processes your data for what we are doing about it.
Pictures are checked too, on our own server and by nobody else. Every picture you show other people - your profile photo and cover, and the pictures on your workouts and coach profile - is read shortly after it is posted by an open-source image model running on our server in Germany, which scores how likely it is to be sexual content. A picture scored very likely is taken down: it stops showing and its file is deleted. A picture in a direct message is checked only if somebody reports it. No picture goes to Moonshot or any other company for this, so this check does not wait on the permission above. We keep the score and the outcome, which only we can read, so a decision can be explained and disputed.
This is an automated decision that can cause a post or a picture to be held, rejected or taken down. It does not have a legal or similarly significant effect on you, and a person reviews anything you dispute. Write to us and we will look at it.
Who else processes your data
| Who | What they handle | Where | Their role |
|---|---|---|---|
| Supabase | Sign-in, the database, stored images and voice notes, and a verification selfie until its check finishes | United States | Our processor |
| Hetzner | The server that receives a posted workout and runs the review, runs the photo-verification comparison, and answers the map's gym search | Germany | Our processor |
| Moonshot AI | Automated review of posted text | Singapore | Our processor by our instruction; see above |
| Stripe | Card payments from coaches, and the card details we never see | United States | Our processor, and a controller in its own right |
| Apple | Sign in with Apple and the revocation of its token, the device token and text of every push to an iPhone, and Apple Maps fetched by your iPhone | United States | A controller in its own right |
| Sign in with Google, Play distribution, YouTube thumbnails and embeds fetched by your device, and ML Kit's diagnostics from your device during photo verification | United States | A controller in its own right | |
| Cloudflare | This website, the domain, and email to our published addresses | United States | Our processor |
| Resend (Plus Five Five, Inc.) | The alert sent to our support team about each new report: the report's reason, the profile ids involved, the reporter's handle and note, and up to 280 characters of the public content reported. A private message is named by id and never quoted. | Ireland (sending) and the United States | Our processor |
| OpenStreetMap Foundation | A gym search typed into a map, sent by your own device | United Kingdom and Netherlands | A third party your device contacts |
| OpenFreeMap (Hyperknot Software Kft.) | Map tiles on Android, fetched by your own device | Hungary | A third party your device contacts |
Three of these do not act only on our instructions, and saying otherwise would be untrue. Stripe is our processor for taking the payment and a controller in its own right for fraud prevention and financial regulation, because the card networks oblige it to decide those for itself. Apple and Google are controllers in their own right for sign-in and for store distribution: neither offers us a processing agreement for those services, and what they do with an Apple ID or a Google account is governed by their own policies rather than by this one. The OpenStreetMap Foundation and OpenFreeMap have no relationship with us at all; a gym search or a map tile reaches them the same way tapping a coach's Instagram link reaches Instagram.
Your data is not sold, not rented, and not shared with advertisers or data brokers. We disclose data to law enforcement only where we are legally required to, or where somebody is in immediate danger.
Where your data goes
TrainFloor is operated from the United States and its database is hosted there, so if you use the app from the European Economic Area or the United Kingdom your data is transferred out of them. What covers each transfer differs, and the honest answer is not the same sentence for every party.
- Supabase, Stripe, Cloudflare and Resend. Covered. Each of their data processing agreements incorporates the EU Standard Contractual Clauses and the UK International Data Transfer Addendum, and takes effect with their terms rather than needing a separate signature. Stripe additionally receives EEA, UK and Swiss data under the EU-US Data Privacy Framework.
- Hetzner. No transfer arises. The server is in Nuremberg, Germany.
- Apple and Google. Not covered by anything we hold, because neither offers a transfer agreement for sign-in. Both operate under their own published terms and their own transfer mechanisms, as controllers, and we are not a party to that.
- Moonshot AI. Not covered. Singapore has no European Commission adequacy decision, Moonshot publishes no data processing agreement, and no Standard Contractual Clauses are offered to us. We have asked. What a transfer of your posted text to Singapore rests on is the explicit permission you give in the app before your first post or comment, after being told here that no safeguard covers it, which is the ground Article 49(1)(a) of the GDPR provides where there is neither an adequacy decision nor the clauses. We would rather say so plainly than imply a paperwork trail that does not exist. The routes open to us are a provider that offers the clauses, or running the review on our own German server, and one of them will be taken. A reported direct message has no such permission behind it, which is one more reason that route has to close.
- OpenStreetMap Foundation and OpenFreeMap. No transfer arises. The United Kingdom holds an adequacy decision, and the Netherlands and Hungary are in the European Union.
- Photo verification. The selfie is held in the United States by Supabase, covered as above, and compared in Germany.
What other people can see
Your handle, name, biography, location, experience, gender if you set it, avatar, cover image, links, and a coach's photo-verified badge are visible to anybody signed in to TrainFloor, and so is a posted workout unless you set that workout to followers only. Comments and reactions are public on the thing they belong to. Leaderboard placements are public unless you turn them off. A coach's gyms and schedule are public on their page. Direct messages are visible only to you and the person you sent them to.
There is no private-account switch. The audience is set per workout rather than per person: each one you post is either visible to everybody signed in or to your followers only, and that is enforced by the database rather than by the app. Blocking somebody stops them contacting you and hides their content from you.
How long it is kept
| What | How long |
|---|---|
| Your account and everything attached to it | Until you delete it |
| Direct messages | Until either side's account is deleted |
| Taps on a coach's links | Deleted with either account, yours or the coach's |
| Payment records, if you are a coach | Seven years from the charge, even if you delete your account |
| Reports you filed | Kept after resolution, so repeat behaviour is visible |
| A photo-verification selfie | Deleted when its check finishes, and within an hour if it is never checked |
| Face templates | Never stored |
| The distances a photo check was decided on | Three years from the check, or until you withdraw your release, whichever is sooner |
| Your biometric release, and the pass or fail of each check | Until you delete your account |
| When you agreed to AI review | Until you withdraw it or delete your account |
| The Apple refresh token | Replaced at each Apple sign-in, revoked with Apple and deleted when you delete your account |
| Coordinates in our server's request log, from a map | Not linked to your account; kept only as long as the server's ordinary logs |
| Database backups | A copy is taken daily. The two most recent stay on our own server and older copies are held off-site for about a month, then deleted |
Payment records are the one thing that outlives your account. We have to keep them: tax law requires it, and a card payment can be disputed months after it was made. Deleting your account unlinks your name from the charge rather than deleting the charge, so what is left is the amount, the date, what it bought and Stripe's own reference for it. Stripe keeps its copy either way. This is the exception in Article 17(3) of the GDPR for data we are required by law to keep, or need in order to defend a legal claim.
Deleting your account
You can delete your account from inside the app, in Settings. It removes your sign-in record, your profile and the content attached to it, including any verification selfie and your biometric release. If you signed in with Apple, our server first asks Apple to revoke TrainFloor's token, which ends the app's access to your Apple ID. Your payment records stay, with your name unlinked from them, for the reason given above. Deletion is immediate and cannot be undone. Copies already written to a backup disappear when that backup is overwritten.
If you would rather we did it, or you want a copy of your data first, write to privacy@trainfloor.com.
Your rights
You can see and change your profile in the app at any time, and delete your account. Depending on where you live you also have the right to:
- ask for a copy of the data we hold about you, and to know what we collect and who we disclose it to;
- have inaccurate data corrected;
- have your data deleted;
- restrict or object to how it is used, including where we rely on legitimate interests;
- receive your data in a portable form;
- withdraw consent you have given, without affecting what was done before you withdrew it;
- complain to a data protection authority, or in the United Kingdom the Information Commissioner's Office.
To exercise any of these, write to privacy@trainfloor.com. We answer within 30 days, or 45 days where a United States state law allows it, and we will tell you if we need longer. We will not treat you differently for asking - no feature is withdrawn, no price changes, and nothing about your account is degraded.
If we refuse a request, you may appeal it by replying to our answer and saying so. An appeal is looked at by somebody who did not decide it the first time, and we answer within 45 days with our reasons. If we refuse again, the laws of Virginia, Colorado, Connecticut, Texas, Oregon, Montana and several other states let you complain to your state Attorney General, and we will give you the link.
If you are in California: we do not sell or share personal information as the CCPA defines those terms, and we have not done so in the preceding twelve months, so there is no Do Not Sell or Share link to offer you. We do not knowingly sell the personal information of anybody under 16. The categories we collect, why, and who receives them are set out in full above rather than summarised, which is the same disclosure the CCPA asks for.
If you are in any other United States state with a privacy law - Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana, Delaware and the rest as they take effect - the rights above are yours on the same terms, and you may use an authorised agent. We do not sell personal data, we do not use it for targeted advertising, and we do not profile anybody in a way that produces legal or similarly significant effects, so there is nothing for an opt-out to switch off. We honour Global Privacy Control and any other universal opt-out signal your browser sends, and there is nothing on this website for it to stop.
Cookies
The app uses no cookies. This website sets none, and carries no analytics and no trackers.
Children
TrainFloor is not for children under 13, and we do not knowingly collect anything from them. Where local law sets a higher age for consent to data processing, that age applies instead. If you believe a child has an account, write to us and it will be removed.
Security
Data is encrypted in transit. Access to the database is restricted per account by row-level security, so one account cannot read another's private data. The credential that can bypass those rules is held only on our server and never ships inside the app. No system is perfectly secure; if a breach occurs that puts your data at risk we will tell you and the relevant authority.
Changes
If this policy changes materially, the date at the top changes and the app will point you here. Continuing to use TrainFloor after a change means the new version applies.
Contact
ManuSoft Inc.
Chicago, Illinois, United States
Privacy: privacy@trainfloor.com
Everything else: support@trainfloor.com