Privacy Policy

OneMore platform · effective August 27, 2026 · applies to 1mo.re, onemoregym.app, and every gym application powered by OneMore

OneMore builds the software that member-focused gyms run on. This policy covers the OneMore platform as a whole; each gym on the platform also presents this policy inside its own app. The short version: training data belongs to the athlete, coaches see it only with the athlete's permission, and we never sell it.

1. What the platform collects

Account information — name, email, phone, and optionally birthday month/day (we deliberately do not collect birth year), physical address, and emergency contact.
Membership & attendance — plans, bookings, check-ins, purchases, waiver signatures.
Heart-rate and workout data — when an athlete chooses to broadcast a heart-rate device in class, connect one during a workout, or link a wearable account: heart-rate samples, workout timing, and computed effort metrics.
WHOOP data (optional) — only the scopes an athlete authorizes (workouts, recovery, sleep summaries, cycles, body measurements, profile). Sharing with a coach is controlled item by item; sleep stays private by default.
Messages & content — coaching messages, survey and intake responses, and anything entered in the app.
Technical data — sign-in timestamps, device/browser type, IP address; kept for security and shown to each user in their own active-session list.

2. How it's used — and how it isn't

Data is used to run gym memberships (booking, billing, check-in, waivers), to power the training experience (live class boards, effort scores and timelines, workout history, coaching features), for communications users opt into, and for security and legal compliance. We do not sell personal information, use health data for advertising, or share data with brokers. Wearable data — including all WHOOP data — is used solely to provide the features described here, consistent with WHOOP's developer terms; it is never used for advertising, model training unrelated to the user's own features, or resale.

3. Who can see workout data

The athlete — their full history, always.
Coaches the athlete approves — granted and revoked coach-by-coach in the app. Personal-training signup grants that one coach, revocably.
Class instructors, live only — during a class, the instructor sees live heart rate on the class board. The live view is not access to stored history.
Gym owners and staff — no access to workout or health data unless approved as a coach, or the gym has adopted an implied-consent policy disclosed in its signed waiver.
OneMore operations — strictly to operate, support, and secure the service. Every staff access to personal or health data is recorded in an append-only audit log.

4. Text messaging (SMS)

Gyms on the platform send SMS only to members who give express, timestamped opt-in inside the app or on gym forms. Messages may include schedule changes, class updates, account notices, and gym announcements. Message frequency varies; message and data rates may apply. Reply STOP to any message to opt out immediately, or HELP for help. Consent is never a condition of membership. Phone numbers and opt-in status are shared only with our messaging provider (Twilio) to deliver messages the member requested — no mobile information is shared with third parties or affiliates for marketing or promotional purposes.

5. WHOOP connections

Connecting WHOOP is optional and scope-by-scope. Athletes can disconnect in the app at any time — which stops all syncing — or revoke access from their WHOOP account settings. WHOOP-sourced data is deleted from the platform within 30 days of disconnection or account deletion. We request only the scopes needed for features in use.

6. Service providers & AI processing

Vetted processors, each receiving only what their function requires: cloud hosting and database (Vercel, Neon — encrypted at rest, TLS in transit), payments (Stripe; card numbers never touch the platform), email (Resend), SMS (Twilio), music (Spotify, gym-account only), and WHOOP for optional wearable connections. Backups are encrypted and access-controlled. A current list of subprocessors and their security certifications is available on request at [email protected].

AI features. Some features (coaching summaries, program tagging, business analytics for gym staff) send limited data — workout text, program content, and aggregate training metrics — to our AI provider (Anthropic) to generate a result. Under our commercial terms this data is not used to train AI models. AI outputs that affect members are reviewable by a human before they are relied on.

7. Retention, deletion & rights

Data is kept while a membership is active. Members can request deletion of their account and training data at any time through their gym or [email protected]; requests are honored within 30 days, except records required for legal, billing, or safety purposes (such as signed waivers). Depending on residence, members may have rights to access, correct, export, or delete personal information and to withdraw consent — most are self-serve in the app, and we never discriminate against anyone exercising them.

8. Security & children

Encryption in transit everywhere and at rest in the database; passwordless one-time-code sign-in; role- and consent-gated access; immutable audit logging of administrative and data access. Youth athletes participate only under a parent or guardian's membership and waiver; family-linked accounts never share workout data between family members.

9. Cookies, device storage & notifications

The platform uses only essential cookies (a session cookie to keep you signed in) and on-device storage for preferences such as home-screen layout. There are no third-party advertising cookies or cross-site trackers in the member app. Push notifications are strictly opt-in through your device prompt and can be disabled any time in the app or device settings.

10. State privacy rights

Depending on your state of residence, you may have specific statutory rights. Washington residents: heart-rate and fitness data may be "consumer health data" under the My Health My Data Act — we collect it only with your consent, do not sell it, and honor deletion requests as described above. California residents: you may request access, deletion, correction, and portability, and we do not "sell" or "share" personal information as defined by the CCPA/CPRA. Residents of other states with comparable laws hold the equivalent rights. Exercise any of these via your gym or [email protected]; we respond within the timeframe the applicable law requires and never discriminate for exercising rights.

11. If something goes wrong

If a security incident affects your personal information, we will notify affected gyms and members without undue delay, consistent with applicable breach-notification laws, and tell you plainly what happened, what data was involved, and what we are doing about it.

12. Changes & contact

Material changes are announced in-app before taking effect. Questions or requests: [email protected].