Privacy Policy

Effective: June 9, 2026 · Last updated: July 29, 2026

This Privacy Policy explains how Show Up Show Out LLC ("Show Up Show Out," "we," "us," or "our") collects, uses, and shares information when you visit iVenza.app (the "Site") or use the iVenza mobile app (the "App," and together with the Site, the "Services"). iVenza is a training companion and athlete/coach platform for all sports. By using the Services, you agree to this Policy.

"iVenza" is a brand and trademark (registration pending) of Show Up Show Out LLC, so references to "iVenza," "Show Up Show Out," "we," "us," or "our" in this Policy mean the same company.

iVenza is offline-first: most of your training data is stored locally on your device and works without an account. If you create an account, your data syncs to our cloud so you can back it up and use it across devices.

1. Information We Collect

Information you provide

• Account & profile: your name and email address, a password or a token from a social sign-in, and profile details you add such as your discipline/sport, units, goals, and gym or team.
• Launch waitlist (closed): if you joined the pre-launch waitlist on iVenza.app, the email address and, optionally, the name and phone number you submitted (collected through Microsoft Forms). The waitlist is closed now that the iOS and Android beta is open. We keep those details only to send you the launch and beta announcements you signed up for, and you can ask us to delete them at any time by emailing help@susos.co.
• Training & health content you log: techniques and notes, training sessions, strength workouts, runs, body weight and measurements, nutrition and meals, fasting, hydration, supplements, sleep, competitions and camps, goals, and photos or videos you attach.
• Coaching & gym data: if you join a gym or team or act as a coach, information such as roster membership, lesson plans, messages and broadcasts, bookings, schedules, and the training data you choose to share. If you share a film-review video with a gym, that clip and its comment thread are visible to that gym's coaches.
• Waivers, contracts & e-signatures: if you sign a gym waiver, membership agreement, or fight contract electronically through the Services, we store the signed record for you and for the gym, promotion, or organizer it is with. The signature record includes your typed or drawn signature, the document you signed, and metadata stamped at signing - the date and time, your network (IP) address, and your device or browser information - which together form the audit record of the signature.
• Fight promotion & event compliance: if you compete on a promotion's fight card, the promotion may require compliance items you submit through the Services, such as medical documents (for example bloodwork, physicals, or eye exams), promotional photos, and a completed IRS Form W-9. These are stored for that promotion and are visible to its staff and to you. Your Social Security or tax ID number is never stored as app data and never logged - it exists only inside the completed W-9 PDF held privately for the promotion that requested it (the app keeps only the last four digits and the ID type as a reference), and the promotion is responsible for using it solely for tax reporting. Photos you upload as event compliance items may be used by the promotion to promote that event, as disclosed at upload.
• Marketplace & recruiting profiles (opt-in): if you choose to publish a fighter-marketplace resume (limited to athletes 18 and older) or a recruiting profile, the details you include - and, for recruiting profiles, training and competition statistics computed from data you logged - become visible to the matchmakers, scouts, and recruiters those features serve. Nothing is published without your explicit action, and you can unlist at any time.
• Payments: if you book a coach or buy a ticket, your payment is processed by Stripe. We receive limited transaction details (such as amount, status, and the last four digits of a card) but not full card numbers.
• Communications & support: messages you send us (for example, to help@susos.co), feedback, and in-app support requests.
• Security reports: if you submit a vulnerability report through ivenza.app/security/ or help@susos.co, the report details you provide, an optional contact email, a hashed network (IP) identifier we record for abuse prevention, and any files you attach (screenshots, PDFs, logs, archives, or documents). Attachments are stored privately, are readable only by our security triage team, and are never published or served publicly - so please don't include anyone's personal data beyond what is needed to demonstrate the issue.
• Text messages (SMS): if you provide a phone number and opt in, we - and the gyms, coaches, or organizers you interact with - may send you service texts and, where you have separately opted in, marketing texts through our SMS provider (Twilio). Your number reaches us only because you gave it: to gym staff in person, on a gym's own online form hosted by us, or when you turn on two-step verification and confirm the number by entering a code we text you. We do not buy, rent, or scrape phone numbers, we do not sell your number, and we do not share it with third parties for their own marketing. Each message names both the gym and iVenza, so you can tell who is contacting you. We keep a record of the messages sent and your opt-out state. Message frequency varies; message and data rates may apply; consent is not a condition of any purchase. Reply STOP at any time to stop texts, or HELP for help - you can also manage them under More › Reminders in the app or at Your Privacy Choices. Full messaging terms are in our Terms.

Health & fitness data

• The App records training and health information you enter and, if you grant permission, imports data from Apple Health (HealthKit) on iOS or Health Connect on Android, such as workouts, runs, body weight, and sleep.
• We use health and fitness data only to provide the Services to you. We do not use HealthKit or Health Connect data for advertising or marketing, and we never sell it.

Location data

• If you use GPS run tracking, the App collects precise location while you record a route, in order to map your run.
• Location- and map-based features (such as finding gyms or venues) use Google Maps / Google Places and may use approximate location.

AI-powered features

• Some optional features use a third-party artificial-intelligence provider (Anthropic, the maker of Claude) to help you log and manage your training - for example, filling in a workout, session, or meal from text or a photo you provide, drafting coach messages and lesson plans, and generating suggestions. When you choose to use one of these features, the specific content you submit for it (such as the text you type or the image you upload) is sent to the provider to generate the result.
• This content is used only to provide the feature you requested. The provider acts as our processor, does not use your content to train its models, and we never use it for advertising. You control when AI features run - they only send content when you explicitly use them.

Information from third parties

• If you sign in with Apple, Google, Facebook, Discord, or Microsoft, we receive basic profile information from that provider (such as your name, email address, and profile picture). If you sign in with Facebook and grant the optional permissions, we also receive your date of birth (to fill in your profile and calculate your nutrition and macro targets by age) and your current city (to help you find nearby gyms, events, and training partners). We never request your Facebook photos, videos, or posts.

Information collected automatically

• Usage analytics: to understand how the App and website are used and decide what to improve, we record limited product-usage events, such as which screens or pages you open, in-app actions and counts, the order and timing of those actions within a usage session (so we can reconstruct a session's event timeline for debugging and product analysis), how far you get through key flows such as sign-up, onboarding, and subscription (conversion and drop-off, or "funnel", analysis), your platform (iOS, Android, or web), app version, and device model. These events do not include your name, email address, health or training values, message contents, or other free-form text you enter.
• Email engagement: emails sent through the Services (for example a gym's announcements or marketing campaigns) may record whether the email was delivered or opened and whether a link in it was clicked. For messages a gym or team sends its members, those delivery and engagement signals are visible to that sender. Every marketing email includes an unsubscribe link.
• Crash & error diagnostics: when the App hits an error or crash, it sends a diagnostic report containing the error message and technical stack trace, the screen you were on, and the same platform, app-version, and device-model details, so we can find and fix the problem.
• Web performance: when you use iVenza in a web browser, we collect anonymous performance measurements - such as Core Web Vitals (loading, interactivity, and visual-stability timings) and how long pages or components take to load - tied to the page or route and your browser platform, so we can find and fix slow or unstable pages. These measurements contain no personal content.
• This usage, diagnostic, and web-performance data is associated with your account when you have one (so we can group repeated events, measure conversion, and prevent abuse), but it is never used to build an advertising profile, is not sold, and is not used for cross-app or cross-site advertising or tracking.
• You can turn it off. This collection is on by default, but you can disable it at any time with the "Share usage & diagnostics" switch under More → Data & Sharing in the App (this also turns off in-app funnel and event-timeline analytics tied to your account). Anonymous website analytics collected before you sign in can be limited through your browser's cookie and storage controls. We can also disable this collection globally for everyone.
• The Site uses only the minimal cookies and local storage needed to function and for the analytics described above.

Acquisition and referral data

• To understand how people discover iVenza, we record where a visit or sign-up came from: the referring website or link, and any campaign parameters in the URL (for example utm_source, utm_medium, and utm_campaign).
• Before you create an account, when you browse our website we collect this acquisition information on an anonymous basis, together with basic page-view analytics. To measure this without identifying you, we store a random identifier (an "anonymous ID") in your browser's local storage. This anonymous ID is not your name or email; it is used only to count visits and attribute a later sign-up to its original source. If you then create an account, we may associate that anonymous activity with your account so we can measure conversion.
• If you tell us which kind of visitor you are (for example "athlete" or "coach") using the selector on our homepage, we remember that choice in your browser's local storage so we can show you the most relevant part of the site and skip asking again if you sign up. It is a preference, not an identifier, and it is stored even if you have opted out of analytics.
• You can clear this identifier at any time through your browser settings, and the Site uses only the cookies and local storage needed for these purposes.

2. How We Use Information

• Provide, sync, and back up the Services and your data across devices.
• Enable coaching and gym features and share the categories of data you have chosen to share with the coaches or gyms you authorize.
• Process payments and bookings (through Stripe).
• Power optional AI-assisted features (such as filling in a workout or meal from text or a photo, and drafting coach content) using a third-party AI provider, as described in "AI-powered features" above.
• Send communications: launch updates if you joined the waitlist, transactional messages, reminders and push notifications you enable, and responses to your support requests.
• Maintain security, prevent fraud and abuse, and debug and improve the Services.
• Measure how features and key flows perform (including conversion and drop-off), reconstruct usage sessions for debugging, monitor web performance, and understand how users discover iVenza.
• Comply with legal obligations.

3. How We Share Information

We do not sell your personal information. We share information only as described here:

• Service providers (processors): companies that help us run the Services, including Supabase (cloud database, authentication, sync, and backups), Cloudflare (domain routing, security filtering, and email routing), Vercel and Microsoft Azure (website and web app hosting), Better Stack (availability monitoring), Stripe (payments), Anthropic (AI-assisted features, as described in "AI-powered features" above), Apple and Google (health data you import, maps and places, sign-in, and push notifications), Resend (email delivery and engagement measurement), Twilio (text messages), Lob (printed mail some gyms choose to send), RevenueCat (app-store subscription management), Google/YouTube (embedded video playback and video search, when you use those features), Microsoft (sign-in and the closed pre-launch waitlist form), Meta (Facebook) and Discord (sign-in, if you choose them), and USDA FoodData Central (nutrition lookups). These providers may process your data only to provide services to us. A complete, current list with the purpose and data category for each is published in our sub-processor register.
• Coaches and gyms: if you join a gym or team or share data with a coach, they can see the categories of data you choose to share. You control these per-category permissions and can change or revoke them at any time. Waivers and agreements you sign with a gym or team, and compliance items you submit to a promotion (including any medical documents, photos, and tax forms described above), are visible to that organization's staff as part of running the gym, team, or event.
• Sellers you buy from: when you buy merchandise or other physical goods through the Services, the shipping address and contact details you enter at checkout are shared with the seller so they can fulfill your order.
• Other users: content you choose to publish (for example, a technique you share to the community feed) is visible to other users.
• Legal and safety: to comply with law, enforce our terms, or protect the rights, safety, and security of our users and the public.
• Business transfers: in connection with a merger, acquisition, financing, or sale of assets, subject to this Policy.

4. Your Choices and Rights

Your Privacy Choices is the single page for exercising everything below: see and download your data, correct it, delete your account, and choose how your information is used and shared. It also carries a request form for anyone who cannot sign in - a lost account, a profile a gym created for you, or a parent acting for an athlete under 18.

• Access & export: you can view your data in the App and export a full backup of your data.
• Delete: you can delete your account and associated data from within the App, or on the web at my.ivenza.app/data without installing anything. Deleted gyms or teams may be recoverable for a limited window (about 30 days) before permanent deletion.
• Permissions: you can grant or revoke Health, Location, Camera, and Notification permissions in your device settings, and manage data-sharing with coaches and gyms in the App.
• Usage analytics & diagnostics: you can turn off product-usage analytics and crash diagnostics (including funnel, session-timeline, and web-performance analytics) at any time with the "Share usage & diagnostics" switch under More → Data & Sharing in the App. The anonymous website analytics collected before sign-in can be turned off on Your Privacy Choices, and we honor your browser's Do Not Track setting.
• Communications: you can set email and text-message preferences by category under More → Reminders in the App or at my.ivenza.app/data, use the unsubscribe link in any marketing email, reply STOP to any text, and disable push notifications in your device settings.
• Cookies: you can manage cookies through your browser settings.

California residents (CCPA/CPRA): you have the right to know what personal information we collect, to obtain a copy of it, to correct it, to request deletion, to limit our use of sensitive personal information, and to opt out of the "sale" or "sharing" of personal information. We do not sell your personal information and we do not share it for cross-context behavioral advertising, and we have not done so in the preceding 12 months. We will not discriminate against you for exercising any of these rights. You may also use an authorized agent. To exercise these rights, use Your Privacy Choices or contact help@susos.co.

EU and UK residents (GDPR): you have the right to access, correct, erase, restrict, and object to our processing of your personal data, and to receive it in a portable format. Where we rely on your consent you may withdraw it at any time without affecting processing carried out beforehand, and you may lodge a complaint with your national data protection authority. Use Your Privacy Choices or contact help@susos.co.

We acknowledge privacy requests within 10 business days and complete them within 30 days, or tell you why we need longer, up to the extension the applicable law allows. Because anyone can type an email address into a form, we verify that you control an account before we delete or release anything.

5. Data Retention

We retain personal information only for as long as necessary to provide the Services and for the purposes described in this Policy, or as required by law. When you delete your account, we delete or de-identify your personal data, except where we must retain it to comply with legal obligations, resolve disputes, or enforce our agreements. In particular, signed waivers, membership agreements, fight contracts, tax forms (such as Form W-9), and event compliance records are held for the gym, promotion, or organizer you provided them to, and may be retained after you delete your account where the law requires it - for example tax reporting and liability records.

Our full data retention schedule sets out the retention period for each category of data and names every carve-out that survives account deletion.

6. Data Security

We protect information using measures such as encryption in transit, access controls, and secure infrastructure provided by our cloud vendors. However, no method of transmission over the Internet or method of electronic storage is completely secure, and we cannot guarantee absolute security.

7. Children's Privacy

The Services are not intended for children under the age of 13 to use on their own. We do not permit anyone under 13 to create their own account: we ask for a date of birth at sign-up and refuse the account if the answer is under 13.

A child under 13 may appear in iVenza only through a profile created and owned by an adult - a parent or guardian who adds them to a family account, or a gym, team or club that adds them to its roster. That profile has no login of its own.

If an account is nevertheless established as belonging to someone under 13, we narrow it to internal use only. That account is not listed on any leaderboard, is not returned by contact matching or friend finding, cannot generate or redeem referral codes, receives no marketing email or text messages, and sends nothing to our AI provider. Messaging is limited to the coaches and staff of a gym or team the child has actually joined; other athletes cannot message them and they cannot message other athletes. Practice reminders, schedule changes and other service messages still work, as does their own training history. These limits are enforced on our servers, and once an account is known to be under 13 that fact cannot be changed from the app.

We are building a verifiable parental consent flow for adult-created child profiles. In a school deployment, consent runs through the school under our agreement with it. If you believe a child has provided us information, or you are a parent or guardian who wants to review, correct or delete a child's information, contact help@susos.co or use Privacy Choices.

Athletes aged 13-17 may use the Services only with the involvement of a parent or guardian (for example through a family or guardian account). Publication features are age-gated: publishing a recruiting profile at 13-17 requires a parent or guardian to review and approve it in the app, that approval can be revoked at any time (which unlists the profile), and a minor's recruiting profile never shows health statistics or an exact city. The fighter marketplace, the affiliate and partner programs, and promotional sweepstakes are limited to users 18 and older.

8. International Data Transfers

We are based in the United States and may process and store information in the United States and other countries. Where required, we use appropriate safeguards, such as standard contractual clauses, for international transfers.

9. Changes to This Policy

We may update this Policy from time to time. We will post the updated version here and revise the "Last updated" date above. Material changes may also be communicated through the Services.

10. Contact Us