Privacy policy

Who we are

Occult is a training app for gyms, their coaches and their members. It’s run by Lucas Standen, of Brisbane, Queensland, Australia.

Questions or requests about your information: support@occult.fitness.

Occult is for gyms in Australia that train in kilograms. Members must be 16 or older.

Your gym and Occult

Your gym decides who to invite and runs its own coaching, classes and community. Occult provides the app to your gym and handles members’ information on the gym’s behalf, to run that service.

Occult also handles some information for its own reasons: your account and sign-in, security, support, safety reports, and deleting your account when you ask.

Questions about classes or your membership go to your gym. Your membership is between you and your gym, not Occult.

What we collect

Your account

Your name and email. Sign-in runs on Google Firebase Authentication, which holds your password. Occult never sees it.

Your photo

A profile photo, if you add one.

Your membership

Your role (member, coach or owner), your plan, whether your access is active or paused, and when you joined.

Bookings

The classes you book, cancel and attend. If you add your classes to your calendar, a private link to them, which our database holds only in a scrambled (hashed) form.

Training

Workouts, results, lifts and rep maxes, notes, and the workouts you add yourself. Training records can say something about your health, so we treat them as health information: we collect them only with your consent, which you give when you agree to the terms, and take extra care with them.

Community

Posts, comments, reactions and photos you share, who you’ve blocked, and reports you make.

Private coaching

Messages with your coach, planned sessions and session packs.

Notifications

Your phone’s push token, an ID for this install of the app, and your notification choices.

Feedback

What you send us: your message, an optional screenshot, the screen you were on, the app version and build, and your phone’s operating system, with your name and email so we can reply.

Crash reports

When the app hits an error: the error message and technical trace, the screen, the app build and version, your phone’s operating system, and your last 15 taps or screens. The first report of a new error goes on our Trello board with your name, never your workout text.

Usage counts

How many times a day each feature gets used, per account, with the app build. No content and no timings.

Guest bookings

If you book a class as a guest: your name, your email, and whether you’d like to hear from the gym.

Gym requests

If you sign a gym up or ask to bring one to Occult: what you put in the form, plus a scrambled (hashed) form of your internet address that we use only to stop abuse. If Occult isn’t open in your country yet and you leave your email, we keep it with the country, only to send you one email when it opens there.

A gym’s account

For a gym that signed up: the gym’s business name, country and ABN if the owner gave them, the owner’s email, the state and dates of the gym’s account with Occult as Stripe reports them, and, from Stripe, the brand and last four digits of what the owner entered on Stripe’s own page. Stripe holds the owner’s details for that account (see Stripe, below).

Your choices

Whether your coaches may use Claude with your training, whether your scores show on the Board, and your notification choices.

Safety

Reports you make and reports about you, who you’ve blocked, and, if Occult suspends an account, why and when.

Terms

Which versions of the terms and this policy you agreed to, when, and whether you were joining or setting up a gym. If you signed a gym up, which version of Occult’s terms for gyms you agreed to, and when.

How we use it

• To run your gym’s service: classes and bookings, programming, results, community and coaching.
• To look after accounts and gyms: sign-in, limits that stop abuse, checking posts, comments, messages and names for objectionable words, reports, and suspending an account or pausing a gym when we have to.
• To fix and improve Occult: crash reports, feedback and usage counts.
• To email you about your account: invitations, verification, password resets, and confirming a deletion. If you signed a gym up, we also email you about the gym’s account with Occult. Occult doesn’t send you marketing.

We don’t sell your information, we don’t show ads, and we don’t track you across other apps or websites.

Who helps us run Occult

Google Firebase

Our database, in Sydney (australia-southeast1), and sign-in, which runs on Google’s servers worldwide. Encrypted backups are kept in Google Cloud.

Vercel

Runs the Occult website and the servers the app talks to, in Sydney (syd1).

Resend

Sends Occult’s emails, like invitations and account notices. Based in the United States.

Expo and Apple

Deliver push notifications to your phone if you turn them on, through Expo’s push service and the Apple Push Notification service.

Trello (Atlassian)

Our board for feedback and crash reports.

YouTube (Google)

Plays the movement demo videos your gym links, in YouTube’s privacy-enhanced mode (youtube-nocookie.com). When you play one, YouTube receives information from your device under Google’s own privacy policy, and may show its own ads. Occult shows no ads of its own.

Anthropic (Claude reads)

At gyms that switch on Claude reads, the timetables, programming, screenshots and PDFs an owner or coach adds while setting up their gym or writing its programming are sent to Anthropic in the United States to turn them into drafts. Emails and phone numbers are taken out of a paste first, and Occult doesn’t keep the files. Member lists are never sent. It’s off by default.

Anthropic (Occult for Claude)

Only at gyms that switch on Occult for Claude, and only for people who say yes. If you turn on “Let my coaches use Claude with my training” in Account, a coach there can let Claude read your name, training history and attendance to help them coach you. It’s processed under that coach’s own Claude account, in the United States. It’s off for everyone until they say yes, and you can turn it off at any time. A private client who isn’t on Occult yet has no account to say yes with, so Claude can’t see them until they join and say yes.

Stripe

Only for gyms that sign up. Stripe holds the owner’s details for the gym’s account with Occult: their name and email, the gym’s business name and ABN if they give them, and what they type on Stripe’s own page, which Occult never sees in full. Stripe handles information in Australia, the United States and other countries. Members’ information never goes to Stripe.

Cloudflare Turnstile

If the page for signing a gym up checks that you’re a person, Cloudflare Turnstile does the check. It looks at your browser and device, not what you type in the form. Based in the United States.

Anthropic (how we run Occult)

Occult is built and run with Claude, Anthropic’s AI, working with us on our own computers. Claude reads feedback, crash reports and usage counts, which carry names, to help us fix and improve Occult. It doesn’t open members’ training, bookings, posts or messages, except for a support job someone has asked us for, and then only what that job needs.

Occult’s database is in Sydney. Some of these services handle parts of your information overseas, mostly in the United States, such as sign-in, emails and push notifications.

Each service that handles your information for Occult is bound to protect it at least as well as this policy does, and to use it only to run Occult. YouTube, and Claude when a coach uses it with your permission, handle information under their own privacy policies.

Who sees what

• Your gym’s coaches see your training, results, bookings and attendance.
• Everyone at your gym sees what you share in the community: posts, comments, your name and your photo.
• The Board. Scores you log on parts your gym puts on the Board are shown to everyone at your gym, unless you keep your scores off the Board in Account, in the app or on the web.
• Claude. Only if you say yes: your gym’s coaches can then use Claude with your training (see Anthropic, above).
• Private coaching is just you and your coach.
• Your calendar link. If you add your classes to your calendar, you get a private link with no sign-in, so anyone who has it can read your booked classes from two weeks back to eight weeks ahead: their times, coach and venue, and your gym’s name. Your calendar service (Apple’s or Google’s, say) fetches the link and keeps its own copy, possibly overseas, under its own privacy policy. Keep the link to yourself. Stop it any time in My bookings in the app, or ask us at support@occult.fitness.
• The Occult team looks at your information only to give support, keep people safe (we act on every report within 24 hours), or finish a deletion that didn’t go through by itself.

We share information with authorities only when the law requires it.

How long we keep it

Your account and training

While you have an account. If your gym pauses your access, your training is kept for when you’re back, until you delete your account.

Crash diagnostics

30 days. The first report of a new error, and feedback you send, stay on our Trello board with your name until we’ve dealt with them.

Usage counts

While you have an account.

Calendar links

Until you stop the link or delete your account. Once you stop it, or your access at your gym ends, it shows an empty calendar within about 15 minutes, so your calendar clears the next time it looks instead of showing an error. A stopped link’s record holds your account, gym and dates, not your classes. We delete it the next time you add a link, once it’s been stopped for over 30 days, or when you delete your account.

Email and notification delivery records

30 days.

Encrypted backups

35 days, plus the database’s own backups (up to 14 days) and its 7-day recovery window.

Reports that reach Occult

90 days after they’re settled, and never more than a year.

Content Occult hides after a report

A private copy for 90 days, in case it’s needed to keep people safe, even if the account that posted it is deleted.

A suspension

While the account exists, so it can be reviewed or undone. If a suspended account is deleted, we keep a one-way code made from its email (not the email itself) and the suspension date, so it can’t come back under the same email.

Gym requests we decline

180 days after we decide.

A sign-up that isn’t finished

If the owner doesn’t finish Stripe’s page, 7 days after it was last opened. Then we delete the sign-up and ask Stripe to delete what it holds for it.

A sign-up on the waiting list

30 days after we email to say there’s room, or 90 days after it began waiting if we never do.

An email waiting for its country to open

Until we send the one email we said we would, when Occult opens there, or 365 days after it was left if it doesn’t open by then.

A gym’s account with Occult

While the gym is on Occult, and until its records are deleted. Stripe keeps its own records of the account, as the law requires of it.

Stripe’s messages about a gym’s account

400 days.

A gym that stops or closes

Its records are kept until the date its owner is shown, 30 to 90 days on, so the gym can be restarted or reopened. Then we delete them. Its members keep their own accounts.

Deleting your account

We delete your account and data after 7 days and email you when it’s done; you can cancel until then. It happens by itself, and always within 30 days unless it waits on you: if you own a gym that’s open, or you’re the only coach at a gym with full access, we tell you what to do first and delete it once that’s done. If you never confirmed your email address, we delete your account and everything in it, but not things kept only under that address (such as an invitation a gym sent to it), since nothing shows the address is yours, and we don’t email it. We never restore a deleted account from a backup: a short record of the deletion stays while any backup could still hold your information, so a restore can’t bring it back.

Your choices

• Get a copy. Export your training from Account in the app, or ask us for everything we hold about you.
• Fix it. Ask your gym or us to correct anything that’s wrong.
• Delete it. Delete your account in the app or on the web, under Account. We delete your account and data after 7 days and email you when it’s done. You can cancel until then. Deleting your account doesn’t cancel your membership with your gym.
• Notifications. Turn push notifications off any time, in the app or in your phone’s settings.
• Withdraw consent. Turn off “Let my coaches use Claude with my training” in Account, in the app or on the web, at any time. Deleting your account withdraws your consent to everything else, including usage counts and error reports.
• Complain. Tell us first at support@occult.fitness and we’ll reply within 30 days. If you’re not happy with our answer, you can complain to the Office of the Australian Information Commissioner at oaic.gov.au.

More help is on the support page.

Age

Occult is for people 16 and older. Gyms agree to invite only members who are. If you think someone younger is using Occult, tell us at support@occult.fitness and we’ll close their account.

Keeping it safe

Your information is encrypted in transit and at rest by the services above, and our backups are encrypted too. Behind the scenes, only the people who run Occult can reach its systems, and they sign in to do it.

If a data breach is likely to cause you serious harm, we’ll tell you and the Office of the Australian Information Commissioner, as the Notifiable Data Breaches scheme requires.

Changes

When we change how we handle information, we’ll update this page and its version. If a change matters to you, we’ll tell you in the app or by email before it applies. The terms cover the rest of how Occult works.

Version 2026-11-gyms · 6 November 2026