Privacy Policy

1. What this covers

This policy explains what personal data firstpower-crossfit.com and FirstPower collect, why, and what you can do about it. It applies to the website, member accounts, class bookings, membership payments, and the competition/leaderboard features (e.g. Fittest in Nairobi).

2. What we collect, and what we deliberately don't

• Email, name, a one-way password hash: your account.
• Date of birth: collected at registration to confirm you're 18+, or that a parent/guardian is registering on behalf of someone under 18.
• Phone number, home address: not collected anywhere on the site.
• Card number, CVV, mobile money (M-Pesa) details: never. Entered directly on Paystack's own payment page; our servers never see or store it.
• Payment amount, currency, a reference number, and status: so we know your membership is paid for.
• Class bookings: which sessions you've booked or are waitlisted for.
• Competition athlete name, division, gender, home gym: shown publicly on the leaderboard and results, for anyone who registers to compete.
• Competition athlete email, phone, M-Pesa transaction code: never copied into this website; those exist only on the separate, off-platform event sign-up sheet.
• A contact-form message you send us: emailed straight to our inbox, not stored in any database.
• Sign-in attempts (date, IP address, browser, success/failure): kept for security.

3. How we use it

• To create and run your account, bookings, and membership.
• To process payment through Paystack and activate your membership once payment is confirmed.
• To send account-related email: a welcome email, membership start/cancellation confirmation, and password reset links.
• To respond if you contact us through the contact form.
• To keep the site and accounts secure: detecting repeated failed logins, enforcing rate limits, investigating a report of a compromised account.
• To display competition results publicly, the normal, expected format of a CrossFit competition.

We don't use your data for advertising, and we don't sell it to anyone.

4. Payments: Paystack

Paystack processes every payment. When you pay, you're giving your card or mobile money details to Paystack, governed by Paystack's own privacy policy, not this one. FirstPower only ever receives back an amount, a currency, a reference, and whether the payment succeeded.

5. Cookies

The website sets two cookies, both strictly functional, to keep you logged in, not to track you. They're set to HttpOnly, meaning no script running on the page can read them; only our own server can. FirstPower doesn't run any analytics, advertising, or tracking cookies of its own. Our hosting/security provider, Cloudflare, operates infrastructure-level traffic monitoring as part of running its network. That's part of how any site behind Cloudflare works, not something FirstPower separately configures.

6. Public competition data

If you register to compete in a FirstPower event, your name, division, gender, home gym, and your scores for each event are visible to anyone: on the live leaderboard during the event, on a results screen at the venue, and afterward as the event's published final results. By entering, you're agreeing that this information will be public in that way, the same as how a race's results are normally published.

7. Who else sees your data

• Paystack: payment processing.
• Our hosting providers (Google Cloud, Neon, Cloudflare): running the infrastructure the site runs on.
• Our email provider, once configured, for sending account emails.

We don't share your data with anyone else, and we don't sell it.

8. Where your data is processed

FirstPower serves members locally in Nairobi as well as visitors from elsewhere. In practice, your data is processed on servers located outside Kenya: the database is hosted in the EU, and the application servers in South Africa. This is part of how the site's infrastructure is built, not a choice about any individual's data specifically.

9. How long we keep it

Your account and its related data are kept while your account is active. If you ask us to delete your account, it's removed along with everything tied to it: your bookings, memberships, payment history, and sign-in records all go with it. Sign-in history is automatically pruned after 365 days regardless.

10. Your rights

Under Kenya's Data Protection Act, you can ask us to:

• Tell you what personal data we hold about you.
• Correct anything that's wrong.
• Delete your account and its data.
• Object to or ask us to restrict a particular use of your data.

There's no self-service "export my data" or "delete my account" button in the app yet. Send a request to the contact below and an admin will handle it directly. You can also lodge a complaint with the Office of the Data Protection Commissioner if you believe we've mishandled your data.

11. Children's data

The CrossFit Teens program serves members under 18. Registration asks for a date of birth; when it indicates the person is under 18, a parent or legal guardian must confirm they are the one creating and controlling the account, see the Terms of Service, Section 2. This confirmation is a checkbox at registration, not independent identity verification.

12. Security

We use industry-standard measures to protect your data: passwords are never stored in plain text, login sessions use secure, browser-inaccessible cookies, repeated failed login attempts automatically lock an account temporarily, and access to your data within our own systems is limited to what each part of the site actually needs.

13. Changes to this policy

We may update this policy as the site changes. The "Last reviewed" date at the top will change when we do.

14. Contact

Questions about this policy, or to make a data request: +254 116 121263 or [email protected].