Shadow Peak Boxing ("Shadow Peak", "we", "us") respects your privacy. This policy explains what we collect when you use shadowpeak.app and our mobile and web applications (the "Service"), how we use it, and the choices you have.
1. Information We Collect
Account data
Email, password (hashed), full name, avatar, weight class, experience level, and workout history you provide.
Usage data
Workout completions, punch counts, streaks, device type, IP address, and approximate location derived from IP.
Payment data
Processed by Shopify and (where applicable) Stripe. We never store full card numbers on our servers.
Cookies
Strictly necessary cookies for authentication and cart. See our Cookie Policy for details.
2. How We Use Information
- Operate and personalize your training experience
- Process orders and deliver merchandise
- Send transactional emails (receipts, password resets, account notices)
- Improve the Service through aggregated analytics
- Detect fraud and abuse, enforce our Terms
- Comply with legal obligations
3. Legal Bases (EEA/UK)
We process personal data under: performance of contract (your account), legitimate interests (security, product improvement), consent (marketing emails, non-essential cookies), and legal obligation.
4. Sharing
We share data with service providers that help us run the Service: Lovable Cloud (Supabase) for database and auth, Shopify for commerce, Cloudflare for hosting, and email providers for transactional mail. We do not sell personal data.
5. Data Retention
We retain account data for as long as your account is active and for up to 24 months after deletion to comply with legal and accounting obligations.
6. Your Rights
You may request access, correction, deletion, portability, or restriction of your data, and you may object to certain processing. Email privacy@shadowpeak.app. EEA/UK users may lodge a complaint with their supervisory authority. California residents have rights under the CCPA/CPRA.
7. Security
We use industry-standard safeguards including TLS in transit, encryption at rest, role-based access control, and row-level security on user data. No system is perfectly secure.
8. Children
The Service is not directed to children under 16. We do not knowingly collect data from children. Parents who believe a child has provided data may contact us for deletion.
9. International Transfers
Your data may be processed in the United States and other jurisdictions. We rely on Standard Contractual Clauses where required.
10. Changes
We will post any updates here and update the "Last updated" date. Material changes will be communicated via email or in-app notice.