Privacy Policy
Effective March 17, 2026 · Updated August 15, 2026
Looking for the short version? Read our plain-English privacy summary.
Effective Date: March 17, 2026
Last Updated: August 15, 2026
1. Introduction
KeyChannel LLC ("KeyChannel," "we," "us," or "our") operates FixTag, a software-as-a-service platform for equipment maintenance tracking, accessible at https://gym.fixtag.app (the "Service"), and the FixTag marketing website at https://getfixtag.com (the "Website").
This Privacy Policy explains what information we collect, how we use it, who we share it with, and your rights regarding your information.
FixTag is operated in the United States and is intended for customers in the United States. All data is stored and processed in the United States.
FixTag serves two distinct categories of users, and the information we collect differs significantly between them. We encourage you to read the section that applies to you. Section 5 covers information collected on the Website.
2. Information We Collect
A. Facility Members (Public Reporters)
Facility Members are individuals who scan QR codes on equipment to report maintenance issues. No account, login, or personal information is required to use the reporting interface.
| Information | Purpose |
|---|---|
| Issue description | The text you type describing the equipment problem. Your description is displayed on the scan page to anyone who scans the same tag, and to your facility's staff. |
| Issue severity | Your selection of the issue severity (Safety Risk, Unusable, Minor, or Cosmetic). |
| Photograph | Optional. Only collected if you choose to attach a photo of the issue. Photos are delivered to the facility's dashboard and are not displayed on the scan page. |
| Device fingerprint | Collected automatically. A non-reversible hashed identifier generated from your device's browser properties (e.g., screen size, timezone, language). Used solely to enforce rate limits, prevent duplicate votes, and prevent spam. It is not linked to any account and cannot on its own be used to determine your identity. Fingerprints recorded from scan visits are automatically deleted after 90 days; a fingerprint is also stored with each issue report and upvote you submit and is retained with that report (see Section 7). |
| IP address | Collected automatically and used for rate limiting. Not retained as part of your report; short-lived abuse-prevention log entries that include IP addresses are automatically purged (see Section 7). |
| Email address | Optional. Only collected if you choose to subscribe to a notification when the issue you reported is resolved, and only where the facility has that feature enabled. Used solely for that one-time notification and associated with the specific issue you reported. |
| Upvote identifier | Collected automatically when you vote on an existing issue, and used to prevent duplicate votes. Not linked to any account. |
What we do NOT collect from Facility Members:
- We do not require your name, email address, phone number, or any account credentials.
- We do not set any tracking or advertising cookies when you use the reporting interface. A single short-lived technical cookie is used to load the page you scanned; see Section 10.
- We do not track your browsing activity across websites.
- We do not build a profile of your activity.
- We do not use your information for advertising.
B. Business Administrators (Account Holders)
Business Administrators are business owners, managers, and staff who create accounts to manage their facilities. We collect:
- Account information. Your name, email address, password, and role. Your email address is your login identifier and is used for transactional email (issue alerts, resolution notifications, password reset, order confirmations). Passwords are hashed by our authentication provider; we never store or have access to your plaintext password. Your role (owner, manager, or staff) determines your access level.
- Business information. Your business name, industry type, and the names of your locations.
- Equipment and facility data. Equipment names and types, and optionally manufacturer, make and model, serial number, placement details, and equipment photographs. Equipment photographs may be processed by third-party AI services to suggest equipment details or generate catalog images. See Section 3.
- Order information. For tag store purchases, your shipping address and payment details are collected at checkout by our payment processor and stored with them. We never see or store card numbers. Your shipping address also appears in your order confirmation email.
- Information collected automatically. Login timestamps and administrative action timestamps, kept as a security and audit record. Essential session cookies set by our authentication provider to keep you logged in. Interface preferences (theme, dismissed banners, cart contents) stored locally in your browser and not transmitted to us except when you place an order. Aggregate, cookie-free page-view analytics on the admin dashboard, described in Section 4.
3. How We Use Your Information
| Purpose | Description |
|---|---|
| Providing the Service | Processing issue reports, displaying equipment data, enabling team collaboration, and maintaining your account. |
| Transactional Communications | Sending issue alert emails to Business Administrators when new reports are submitted, and order confirmations for tag purchases. |
| Order Fulfillment | Processing payment and shipping physical tag orders to the address you provide at checkout. |
| Resolution Notifications | Sending a one-time email to Facility Members who opted in when their reported issue is resolved. You can unsubscribe via the link in any notification email, which deletes your address immediately. |
| AI Content Moderation | Reviewing issue report description text through a third-party AI service to detect spam, threats, and off-topic content. Only the description text is sent; no names, emails, or account data. See Section 4. |
| AI Equipment Recognition | When a Business Administrator uses the equipment analysis feature, we transmit the uploaded equipment photograph to a third-party AI service to suggest equipment details. Suggestions require explicit acceptance before anything is saved. Only the photograph and related equipment details are transmitted; no names, emails, or account data accompany the request. |
| AI Product Image Generation | When a Business Administrator uses the image generation feature, we transmit the uploaded equipment photograph to third-party AI services to generate a studio-style product image. Only the photograph and related equipment details are transmitted. |
| Error Tracking | Identifying and resolving technical issues with the Service. Error-triggered session replays may be captured with all text masked and media blocked. |
| Abuse Prevention | Enforcing rate limits through device fingerprinting and IP-based throttling to prevent spam and misuse of the reporting interface. |
| Service Analytics | Understanding aggregate usage of the admin dashboard and Website through self-hosted, cookie-free analytics. |
| Responding to Inquiries | Responding to contact, demo, sample kit, and referral submissions made on the Website, including shipping sample kits and sales follow-up on requests you initiate. See Section 5. |
We do NOT:
- Sell, rent, or trade your personal information to third parties.
- Use data in your FixTag account, or member issue reports, for advertising or marketing.
- Build behavioral profiles for targeted advertising.
- Share your information with data brokers.
4. Information Sharing with Third Parties
We share information with the service providers below solely as necessary to operate the Service and the Website. We do not share information for advertising purposes. A small number of authorized KeyChannel personnel may access customer data as needed for support, troubleshooting, and operations; administrative access is logged.
| Provider | Purpose | Privacy policy |
|---|---|---|
| Supabase | Database hosting, user authentication, and file storage. Receives application data, including account information, business data, equipment records, issue reports, and Website form submissions. | supabase.com/privacy |
| Postmark | Transactional email delivery: issue alerts, resolution notifications, order confirmations, and responses to Website inquiries. Receives recipient addresses and the contents of those messages. | postmarkapp.com/privacy-policy |
| Google Gemini API | AI content moderation of issue description text, and equipment photo analysis and image generation. No names, email addresses, or account data are sent. | policies.google.com/privacy |
| Google Maps Platform | Address autocomplete on Website forms. Receives what you type into the gym-search fields. | policies.google.com/privacy |
| Replicate | Generating studio-style product images from equipment photographs. No names, email addresses, or account data are sent. | replicate.com/privacy |
| Sentry | Error tracking. Receives stack traces and error context, which may include user and business identifiers as UUIDs rather than names or emails, and error-triggered session replays with text masked and media blocked. | sentry.io/privacy |
| Railway | Application and Website hosting. Receives standard web server request logs. | railway.app/legal/privacy |
| Stripe | Subscription billing and tag order payment. Receives and stores payment details, billing address, and, for physical orders, your shipping address and order email. FixTag does not store card numbers. | stripe.com/privacy |
| Twilio | Text message (SMS) delivery for staff who opt in to text alerts: equipment safety alerts, one-time verification codes, and opt-in confirmations. Receives the recipient mobile number and the contents of those messages, solely to transmit them on our behalf. | twilio.com/legal/privacy |
All of these providers are located in the United States. A current list of sub-processors is available on request at support@getfixtag.com.
Analytics. We measure page views on the Website and the admin dashboard using Umami, an open-source, cookie-free analytics tool that we host on our own infrastructure. Analytics data stays on infrastructure we control and is not shared with any analytics company. The public scan and reporting pages are not included in analytics.
AI services and photographs. Equipment photographs processed by AI services may incidentally capture facility surroundings or portions of individuals who are present during capture. No facial recognition or biometric analysis is performed on any photograph. AI services are not used to identify, analyze, or profile individuals who may appear incidentally in equipment photographs.
International data transfers. All data is stored and processed in the United States. FixTag does not transfer personal data outside the US.
5. Information Collected on This Website (getfixtag.com)
If you submit a form on the Website, we collect what you provide and store it in our customer-relationship system so we can respond. The newsletter and demo forms collect an email address and optionally your name and company. The contact form collects your name, email, message, and optionally your gym name. The sample kit and gym referral forms additionally collect a shipping address, the gym's name and address, and approximate equipment and location counts, so we can ship the kit and follow up.
We use Website form submissions to respond to the request you made, to fulfill sample kits, and for related sales follow-up. We do not sell this information or share it with advertisers, and we do not add you to a mailing list you did not request. You may ask us to delete your submission at any time (Section 8).
The Website uses the same self-hosted, cookie-free analytics described in Section 4 and sets no tracking cookies.
6. Data Storage and Security
- Encryption in transit. All data transmitted between your device and our servers is encrypted using HTTPS/TLS.
- Password security. Passwords are hashed using industry-standard algorithms by our authentication provider. We never store or have access to plaintext passwords.
- Data isolation. Each business's data is logically separated from every other business's and enforced at the database layer. Business Administrators can only access data belonging to their own business.
- Access controls. Team member access is governed by role-based permissions (owner, manager, staff). KeyChannel administrative access to customer data is limited to authorized personnel and logged.
- Photo storage. Photographs are stored in secure cloud storage with access controls.
- Data location. All data is stored in the United States.
7. Data Retention
| Data Type | Retention Period |
|---|---|
| Active account data | Retained for the duration of your active account. |
| Data after account deletion | Permanently removed from our active systems within thirty (30) days of a deletion request. Backup copies may persist in encrypted backups for a limited additional period, after which they are purged in the ordinary course. |
| Anonymous issue reports | Retained (including the device fingerprint recorded with the report or upvote) for as long as the associated business account exists. When a business account is deleted, all associated issue reports are permanently deleted. |
| Device fingerprints (scan visits) | Automatically deleted after ninety (90) days via a scheduled cleanup process. Also deleted when the associated business account is deleted. |
| Rate-limit and abuse logs (IP addresses) | Automatically purged after two (2) days. |
| Resolution notification emails | Automatically deleted thirty (30) days after the notification is sent. If the related issue is closed and the notification was never sent, the email is deleted after ninety (90) days. You can also unsubscribe at any time using the link in the notification email, which immediately deletes your email address. |
| Error tracking data | Retained for ninety (90) days, then automatically purged. |
| AI processing logs | Records of AI-assisted operations are retained for the lifetime of the associated business account, then permanently deleted with it. |
| Website form submissions | Retained while we are responding to or following up on your request, and deleted on request (Section 8). |
| Order records | Payment and shipping records are retained by our payment processor for accounting and tax purposes. Order records held in the Service are deleted with your business account. |
| Demo environment data | Data submitted through the public demo environment is automatically reset on a periodic basis and should not be considered persistent. |
8. Your Rights
All Users
You have the right to:
- Access. Request information about what data we hold about you.
- Deletion. Request that we delete your personal information. Business Administrators can request account deletion by contacting support@getfixtag.com. Facility Members who provided an email address for resolution notifications can unsubscribe via the link in the notification email, which deletes it immediately, or contact support@getfixtag.com.
- Correction. Request correction of inaccurate personal information.
- Data portability. Request a copy of your data in a structured, machine-readable format. Business Administrators can request a data export by contacting support@getfixtag.com.
- Withdraw consent. Where you opted in to something, such as resolution notification emails, you may opt back out at any time.
California Residents (CCPA)
If you are a California resident, you have additional rights under the California Consumer Privacy Act (CCPA):
- Right to Know: You have the right to request disclosure of the categories and specific pieces of personal information we have collected about you.
- Right to Delete: You have the right to request deletion of personal information we have collected from you, subject to certain exceptions.
- Right to Opt-Out of Sale: We do not sell your personal information.
- Right to Non-Discrimination: We will not discriminate against you for exercising any of your CCPA rights.
To exercise any of these rights, please contact us at support@getfixtag.com. We will respond to verifiable requests within thirty (30) days.
9. Children's Privacy
The FixTag administrative platform is not directed at children under the age of thirteen (13).
The public reporting interface may be used by individuals of any age in public facilities such as gyms. This interface does not require or collect names, email addresses, or account information. If an individual under the age of 13 voluntarily provides an email address for resolution notifications, and we become aware of this, we will promptly delete that information.
If you believe that a child under 13 has provided personal information through the Service, please contact us at support@getfixtag.com.
10. Cookies and Tracking Technologies
We use only essential cookies:
- Session cookies set by our authentication provider to keep Business Administrators logged in. These persist until the session expires or you log out.
- A short-lived technical cookie on the scan page that carries the scanned tag identifier while the reporting page loads. It contains no personal information and expires within minutes.
- A demo session cookie that identifies demo environment sessions, for demo users only.
We also store interface preferences (theme, dismissed banners, cart contents) locally in your browser. That data is not transmitted to us except when you place an order.
Analytics. We use Umami, a self-hosted, open-source analytics tool, on the Website and the admin dashboard. It sets no cookies, uses no advertising identifiers, and its data never leaves infrastructure we control. The public scan and reporting pages are not included in analytics.
What we do NOT use:
- We do not use third-party analytics services.
- We do not use advertising cookies.
- We do not use third-party tracking pixels.
- We do not use social media tracking widgets.
- We do not engage in cross-site tracking.
11. Changes to This Privacy Policy
We may update this Privacy Policy from time to time to reflect changes in our practices or applicable law. For material changes, we will provide at least thirty (30) days' notice via email to Business Administrators at the email address associated with their accounts.
The "Last Updated" date at the top of this policy indicates when the most recent changes were made. Your continued use of the Service after an updated Privacy Policy takes effect constitutes acceptance of the updated policy.
12. SMS and Text Message Alerts
FixTag offers optional text message (SMS) alerts to staff members of businesses that subscribe to the Service. Participation is voluntary and requires opt-in. A staff member enters their own mobile number in their FixTag account under Settings > Text alerts and ticks a consent checkbox that is not pre-selected. FixTag then sends a one-time passcode by text, which they enter to complete verification. No alert message is sent to a number until that verification succeeds.
Mobile information sharing
No mobile information will be shared with third parties or affiliates for marketing or promotional purposes. All of the above categories exclude text messaging originator opt-in data and consent; this information will not be shared with any third parties. Mobile phone numbers are used only to deliver the messages you opted in to receive, and are disclosed to our messaging provider (Twilio, listed in Section 4) solely to transmit those messages on our behalf.
Message frequency
Message frequency varies. Alert messages are sent only when a safety issue is reported on equipment at your location, so volume depends on activity at your site. You may also receive a one-time verification code when you enroll and a single confirmation message.
Message and data rates
Message and data rates may apply.
Opting out
Reply STOP to any message to stop receiving texts, or turn alerts off under Settings > Text alerts in your FixTag account. Reply HELP for help, or contact support@getfixtag.com. Opting out of text alerts does not affect email notifications or your use of the Service.
13. Contact Information
If you have questions about this Privacy Policy, wish to exercise your privacy rights, or have concerns about our data practices, please contact us:
KeyChannel LLC
Email: support@getfixtag.com