Third Eye Muay Thai app privacy

Effective 1 November 2026

L.A Bindig and S.J Dekel, a partnership trading as Third Eye Muay Thai, operates this app. For privacy questions, app help or gym and class enquiries, contact hello@thirdeyemuaythai.com.

Public member screens

You do not need a member account to view the timetable, gym announcements, class cancellations, opening hours and gym information. The member app does not ask you for your name, email address, date of birth, payment details or health information.

When the app connects to our services, our service providers process technical connection information, which may include IP addresses, request times, device or software details and service logs, to operate, protect and troubleshoot the service.

Optional class alerts

If you enable class alerts, we collect a randomly generated installation identifier, an Expo push token, your platform, alert-topic preference and registration timestamps. A secret stored securely on your device proves control of the registration; our registration database stores a hash of that secret. These identify an app installation rather than a member account.

We use this information to register your device, deliver the alerts you choose, prevent misuse and duplicate sends, and investigate delivery problems. A registration may refresh when you open or return to the app. Delivery depends on internet connectivity, device settings and notification providers and is not guaranteed.

Turning alerts off and deleting registration

Open Gym → Class alerts → Turn off alerts and delete registration. This requests removal of your active registration and removes or scrubs associated installation/token identifiers and delivery ticket details. If you are offline, the request remains pending and automatic re-registration is blocked until it succeeds. Messages already in transit may still arrive.

A one-way deletion safeguard remains temporarily to reject delayed registration requests. Some minimal delivery history remains to prevent duplicate sending. Deletion does not immediately erase every provider log or backup. Turning off notification display in iPhone Settings or uninstalling alone is not a guaranteed deletion request to our backend.

How long we keep information

Our daily cleanup removes registrations after 180 days without a registration refresh. Verified in-app deletion requests are processed without waiting for that period.

We retain the one-way deleted-installation safeguard for 30 days. Finished per-recipient delivery details are removed after 30 days; unresolved sends or receipts are retained while resolution is needed. For completed or aborted notification jobs, message content and staff attribution are scrubbed after 90 days. Minimal duplicate-send prevention records remain. Unused invalid-token suppression records are removed after seven days and rate-limit records after two days.

Routine app-support correspondence is deleted 90 days after the matter closes. Unresolved complaints and records required for legal or business obligations are retained separately while needed and then reviewed for deletion.

Database backups and service-provider records have their own retention cycles. Our production Supabase Pro service includes daily database backups with access to the previous seven days and standard seven-day API/database log availability. These access windows do not mean every provider security, billing or audit record is erased after seven days. If recovery from a backup is needed, notification processing must remain stopped until deletion and consent records have been reconciled; where evidence is incomplete, restored registrations must not be used without fresh opt-in.

Authorised staff

Staff use a separate authorised account with email/password and an authenticator. Supabase processes authentication and MFA information, and staff membership controls access. Staff sessions are held in app memory and end on sign-out, leaving the staff area, app termination or expiry. Staff authentication and administration records may be retained for access control, security and accountability while needed. This does not create a member-account requirement.

Service providers and overseas processing

Supabase provides the backend; the production database project is hosted in Sydney, Australia. Expo and Apple's notification service support iPhone notification delivery. Expo describes processing in the United States. Our email is routed through Google, and the support/privacy webpages are hosted by Squarespace. These providers may process information outside Australia for delivery, hosting, security and support. The Sydney database region is not a promise that all processing occurs in Australia.

For their own processing and retention practices, see Supabase privacy, Expo privacy, Apple privacy, Google privacy, and Squarespace privacy.

This policy concerns the app and app-support/privacy correspondence. Visiting our website can also involve website connection information, cookies and optional contact, chat or booking tools. Information you choose to submit through those tools is separate from the app's account-free member screens. Contact us about the handling of a specific website enquiry.

Access, correction and complaints

Email hello@thirdeyemuaythai.com to ask about your information, request access or correction, or make a privacy complaint. Shae handles these requests, verifies identity or installation ownership where appropriate, investigates and responds through that mailbox.

An email address alone does not identify an account-free member installation. Use the in-app deletion action to prove control of that registration. Do not email passwords, authenticator codes, installation secrets, full push tokens, payment information or health information.

Changes

We will update this page when our app's data practices change and show the effective date of the revised policy.