GOAT Fitness Privacy

Your data.

What we collect, why we hold it, and the control you keep over it.

Last updated November 2026

1. Introduction

GOAT Fitness LLC ("GOAT Fitness," "we," "us," or "our") operates a fitness facility at 3730 N Zaragoza Rd, El Paso, Texas, along with the website at goatfitness.com, the member web application, and the GOAT ID mobile app for iOS and Android (together, the "Platform"). This Privacy Policy explains what information we collect, how we use it, who we share it with, and the choices you have.

This Policy covers the Platform and your interactions with us online. Your gym membership itself is governed by the documents you sign when you join (your "Membership Documents"): the Membership Agreement, which includes your recurring-payment authorization and the facility rules, and either the Waiver of Liability (members 18 and older) or the Parent/Guardian Release and Waiver (signed by a parent or guardian for a member under 18).

If you have questions, contact us at support@goatfitness.com, by phone at (915) 209-1040, or at the mailing address in Section 16.

2. Information We Collect

Information you give us directly

  • Account information: your name, email address, date of birth, and, if you provide it, your phone number. If you sign in with email and password, Firebase Authentication handles the password and we never see or store it. If you sign in with Google or Apple, we receive your name, email address, and an account identifier from that provider, nothing else.
  • Guardian information: if a member is under 18, the name, phone number, email address, and relationship of the parent or legal guardian who signs for them.
  • Family and sub-member information: if you add a family member to your account, their name, email, date of birth, and relationship to you.
  • Guest pass information: the name and email of guests you invite, so they can sign the waiver and receive their pass.
  • Shop orders: your name, email, and order details when you buy from our online shop. Orders are picked up at the front desk, so we do not collect shipping addresses.
  • Restock notifications: your email address if you ask to be notified when a sold-out product is back in stock. We delete it once the notification is sent.
  • Signed documents: the agreements and waivers you sign electronically, including your signature image and the values you enter in the document's fields.
  • Recovery bookings: the recovery machines you book, session times, and the credits you spend or purchase.
  • Fitness planner data: workout programs, exercises, weights, reps, personal records, and notes you choose to enter. This is entirely voluntary.
  • Profile photo and community content: a profile photo if you upload one, and posts, photos, reactions, event proposals, and event registrations you create on the member community features.
  • Referrals: your referral code and the referrals credited to your account.
  • Support communications and requests: emails and messages you send us, and account deletion requests you file.

We do not ask for health or medical information through the Platform. Anything you choose to tell our staff about a medical condition so they can keep you safe is handled under the confidentiality terms of your Waiver.

Information generated through your use of the gym and Platform

  • Gym access records: when you enter the facility, we log your member ID, the date and time, the door, and whether entry was granted or denied. There are no exit events; we estimate departures after a period of inactivity to show gym busyness.
  • Occupancy and utilization data: gym busyness, per-zone head counts, peak-time patterns, and utilization statistics derived from entry logs and our onsite vision system. Section 5 explains how camera imagery is processed but not retained.
  • Access credentials: your digital gym credential (a QR code and, in the GOAT ID app, a per-phone door login issued through our access-control provider, Kisi) and its status.
  • GOAT ID app devices: a random installation identifier the app creates on your phone, the operating system, and the phone's brand and model. We use these to issue and revoke each phone's door login and to let you choose a primary device.
  • Rewards and activity: visit counts, streaks, badges, points, and personal records earned through check-ins and the planner.
  • Billing records: your membership plan, subscription status, pauses and cancellations you schedule, payment amounts and dates, and invoice history. Section 4 describes what we do not receive.
  • Signing evidence: when you sign a document electronically, we record your IP address and browser or device information (user agent) at the moment of signing, along with cryptographic hashes of the signed document. This is standard evidence that an electronic signature is yours.
  • Incident records: if your access is suspended or your membership is restricted for a rule violation, staff record the reason and related notes.
  • Staff activity logs: every action a staff member takes on your account in our admin tools is written to an audit log that records who did what and when.

Technical information collected automatically

  • Session and security data: we use one strictly necessary, secure session cookie per app to keep you signed in. We also process IP addresses for security monitoring and rate limiting, for example to block repeated failed login attempts.
  • Request verification: to confirm that requests come from our genuine website or app rather than a bot, we use Firebase App Check. In the browser this relies on Google reCAPTCHA Enterprise; in the GOAT ID app it relies on Google Play Integrity on Android and Apple App Attest or DeviceCheck on iOS. These services evaluate signals from your browser or device and return a pass or fail to us.
  • Logs: our hosting infrastructure (Google Cloud and Firebase) keeps standard server and error logs, which may include IP addresses, timestamps, and browser information.
  • Local browser storage: the member web app stores a few items in your own browser: a guest shopping cart, the reward badges and tier you have already seen, announcements you dismissed for the session, your sign-in state, and an offline copy of your workout planner data so it works without a connection. These stay on your device.
  • Website analytics: we use Umami, a privacy-focused analytics service, to count visits to the public website and member web app. It sets no cookies, stores no identifiers, and receives only a fixed page name from a short list (for example "Shop" or "Planner") plus a handful of coarse events such as "signup started". Your account, member ID, searches, and form contents are never sent. We honor the Do Not Track and Global Privacy Control browser signals: when either is on, nothing is sent at all. The GOAT ID app contains no analytics.

Information the GOAT ID app uses on your phone

The GOAT ID app is your key to the gym, so it asks for device permissions you can grant or decline in your phone's settings:

  • Bluetooth: to detect nearby door readers and unlock by tap or hand wave. Detection runs on your phone through the Kisi software built into the app.
  • Location: the operating system requires location permission for Bluetooth reader scanning, and on Android "always" permission for hand-wave unlock to work when the app is in the background. When you tap unlock in the app, your phone's last known position and the on/off state of its Bluetooth, location, and NFC radios are sent with the unlock request so the access-control provider can confirm you are at the door. We do not store your coordinates, and we do not keep a history of where you have been.
  • NFC (Android): to unlock by tapping the reader.
  • Camera: to scan recovery-machine and guest-pass QR codes. Scanning happens on your phone; no images are stored or uploaded.
  • Secure storage on the device: the app keeps its installation identifier and your door login in the phone's secure storage so you do not have to sign in at every door.

Information we do not collect

  • We do not collect or store your full payment card number (see Section 4).
  • We do not track your location or keep location history. Location is used only as described above to open doors.
  • We do not collect biometric identifiers such as fingerprints, facial recognition data, or voiceprints.
  • We do not buy data about you from data brokers or public databases.
  • We do not include advertising or social-media tracking kits in the website or the app. Signing in with Google or Apple is a sign-in only; we never post to your accounts or read your contacts.

3. How We Use Information

We use the information above to:

  • Create and manage your account and membership, including family members, guardians, and guests you add
  • Authenticate you and keep your account secure, including screening new passwords against known data breaches using a privacy-preserving partial-hash check and verifying that requests come from our genuine app or website
  • Process payments, subscriptions, pauses, cancellations, and shop orders
  • Provide your digital gym credential, issue and revoke door logins for your phones, and operate door access
  • Show gym occupancy and peak-time information
  • Operate rewards, referrals, guest passes, recovery bookings, and recovery credits
  • Provide the workout planner, equipment status, and community features
  • Send service communications: receipts, order updates, document-signing links, access-ready notices, renewal, pause and payment reminders, password resets, verification emails, and important facility or policy notices
  • Send announcements and offers you have consented to under your Membership Agreement; you can opt out of these at any time as described in Section 9. We communicate by email only. Your Membership Agreement also covers text messages, but we do not send any today; if that changes, we will tell you first and you can opt out
  • Enforce gym rules, investigate misuse or security incidents, prevent fraud and unauthorized access, and protect our members, staff, and property
  • Meet legal, tax, and accounting obligations
  • Understand how the Platform is used, in aggregate, so we can improve and troubleshoot it

We do not use your information for targeted advertising, and we do not sell your personal information.

4. Payments

Payments are processed by Stripe. When you pay, your card details are entered directly into Stripe's secure payment fields embedded in our checkout, or into Stripe's customer portal when you manage your plan and payment method. The card number never touches our servers, and we never see or store it.

What we receive and store from Stripe:

  • Your Stripe customer ID and subscription ID
  • A payment-method reference ID (not the card number)
  • Payment status, amounts, currency, tax, and dates
  • Invoice IDs and history (paid, failed, refunded)

Stripe also notifies us of payment events such as successful payments, failures, and cancellations through a secure webhook, so we can keep your membership status up to date. Stripe's own privacy policy, at stripe.com/privacy, governs its handling of your payment data.

5. Gym Access, Cameras, and Facility Security

Three separate systems handle facility access and security, and they handle different information.

Access control (credentials and door events)

Physical access control is operated through a third-party access-control provider (currently Kisi; the provider may vary by GOAT Fitness location). The provider maintains the access-control and security information associated with its system, including your digital credential, your phone's door login, access authorization, granted and denied entry events, door or access location, timestamps, credential state, and related security events. Each entry into the gym also creates an access log in our systems containing your member ID, timestamp, door, and the grant or deny result. We use these logs to operate access, display gym busyness, award check-in rewards, investigate incidents, and enforce facility rules.

Front-desk staff can scan your member card or a guest pass in the GOAT ID app to confirm who the holder is and whether their membership or pass is active.

Security cameras (recorded footage)

The facility uses security cameras for the safety of members and staff, theft prevention, investigation of incidents and unauthorized entry, enforcement of gym rules, and protection of GOAT Fitness property. Camera recordings are retained onsite by the facility's security-camera system according to that system's configured retention practices and may be routinely overwritten as storage is recycled. GOAT Fitness may access retained footage for the legitimate security purposes described above. Cameras are not located in areas where individuals have a reasonable expectation of privacy, such as restrooms, showers, or changing areas. Your Waiver includes your consent to this video surveillance.

Onsite vision server (occupancy analytics)

A GOAT Fitness vision server located onsite receives camera video streams or image data and processes them with computer vision for zone tracking and occupancy analysis. That includes detecting occupancy within defined gym zones, generating zone head counts, calculating facility occupancy, and producing utilization, peak-time, and operational statistics.

What that means in practice:

  • The vision server processes camera imagery and video as needed to perform these functions, but it does not archive or retain the underlying video footage, and it is not the storage system for security-camera recordings. Temporary processing of imagery is different from persistent storage of footage. Camera recordings are retained only by the onsite security-camera system described above.
  • What GOAT Fitness retains is the derived output of that processing: occupancy counts, per-zone counts, utilization information, peak-time history, and operational analytics, kept according to the data-retention practices in Section 8. These derived outputs are counts and statistics; they do not identify individuals.
  • The vision system does not perform facial recognition, biometric identification, biometric-template creation, identity tracking through facial geometry, fingerprint recognition, or voice recognition. Camera imagery is used to count people in zones, not to identify who they are.

We do not sell access logs, occupancy data, camera footage, or security data, and we do not use any of it for advertising.

Photos and video used in marketing

Your Waiver includes a Publicity Release under which photos and video taken at the facility that show you may be used in GOAT Fitness marketing, including with editing or AI-assisted tools, without compensation. That release, not this Policy, governs those uses. If you have a concern about a specific image, contact us and we will work with you.

6. Technical Information and Cookies

We use only strictly necessary cookies: one secure, httpOnly session cookie on the member site and one on the staff admin site, each of which keeps you signed in for up to five days. We do not use advertising cookies, tracking pixels, or cross-site trackers.

Our website analytics (Section 2) are cookieless and honor the Do Not Track and Global Privacy Control signals, so there is no consent banner to click through: if your browser sends either signal, analytics is simply off.

A small number of preferences are stored in your browser's local storage (guest cart, seen reward badges and tier, dismissed announcements), your sign-in state and an offline copy of your planner live in your browser's IndexedDB, and the GOAT ID app keeps its door login in your phone's secure storage. You can clear these through your browser or phone settings. Clearing the session cookie or signing out will sign you out, and signing out of the GOAT ID app removes that phone's door login.

7. How We Share Information

We do not sell your personal information for money, and we do not share it with advertisers or data brokers.

We share information only with the service providers that help us run the gym and Platform, and only as needed for them to provide their services:

  • Google, Firebase, and Google Cloud: hosting, authentication (including Google sign-in), database, file storage, server logs, and request verification (reCAPTCHA Enterprise and Play Integrity)
  • Apple: Apple sign-in, App Store distribution of the GOAT ID app, and App Attest and DeviceCheck request verification
  • Stripe: payment processing, subscription billing, and the customer portal
  • Kisi: physical access control, door credentials, and per-phone door logins
  • Resend: delivery of our emails
  • Umami: pseudonymous, aggregate website analytics as described in Section 2
  • Have I Been Pwned: receives only a 5-character partial hash of a proposed password, never the password itself, to check against known breaches

Our staff can see the member records they need to run the gym, such as your membership status, entries, bookings, and documents, and every staff action on your account is logged (Section 2).

We may also disclose information:

  • To comply with the law, court orders, subpoenas, or lawful government requests
  • To investigate fraud, security incidents, or violations of our agreements and gym rules
  • To protect the rights, safety, and property of GOAT Fitness, our members, and our staff
  • To professional advisers such as attorneys and accountants, where appropriate
  • In connection with a merger, sale, or transfer of our business, subject to this Policy

Where your Membership Agreement refers to sharing information with third parties, the service providers listed above act on our behalf under contract and are not third parties in that sense.

8. Data Retention

We keep information only as long as reasonably needed for the purposes in this Policy. Different records are kept for different periods:

  • Signed waivers and agreements are retained for 7 years in a retention-locked archive, as legal evidence.
  • Account and membership records are kept while your account is active and afterward as needed for accounting, tax, dispute resolution, and enforcement of agreements.
  • Billing and transaction records are kept as required for accounting and tax purposes.
  • Entry logs (the record of your gym entries) are kept in identifiable form for 12 months for facility security and incident investigation. After that we keep only a monthly count of your visits, plus a de-identified copy of the entry record in which your name, email, and account identifier are replaced by a pseudonymous code that cannot be linked back to you.
  • Failed access attempts and access troubleshooting records are kept for 6 months; door-provisioning job records for 30 days.
  • Staff audit logs are searchable in our admin tools for 90 days, then moved to a long-term archive so we can respond to billing disputes and legal claims.
  • Recovery booking history is kept for 2 years, then archived.
  • Occupancy and analytics data (derived counts, zone statistics, and peak-time history) is kept to operate and improve facility analytics. Zone occupancy samples expire after 90 days.
  • Security-camera footage is retained onsite by the facility's security-camera system according to that system's configured retention practices and may be routinely overwritten as storage is recycled. It is not archived or retained by the GOAT vision server.
  • Incomplete signups are deleted automatically after a short period.
  • Restock notification emails are deleted once the notification is sent.
  • Reward activity history is kept for 2 years; your points balance and earned badges are not affected when older activity rows expire.
  • Abandoned shop checkouts are deleted within 24 hours; renewal-reminder markers after 60 days; rate-limit counters as soon as their window passes.
  • Door logins for a phone are deleted when you sign out of the GOAT ID app, when you remove the device, or when your access is revoked.
  • Deleted data may persist in encrypted backups for a limited time before being overwritten.

9. Your Choices and Privacy Rights

You can:

  • Review and update your account information in your profile settings.
  • Opt out of announcements and promotional email at any time by using the unsubscribe link in the email or by contacting us. We do not send text messages today; if we ever do under the consent in your Membership Agreement, you can stop them by replying STOP. You will still receive essential service messages about your membership, billing, access, documents, and security.
  • Decline optional features: the planner, community, rewards, and restock notifications only collect what you choose to enter. Device permissions for the GOAT ID app can be changed in your phone's settings at any time; the app's QR credential keeps working without Bluetooth or location.
  • Request access to, correction of, or deletion of your personal information by emailing support@goatfitness.com, or request account deletion at goatfitness.com/account/delete. We will verify your identity before acting.
  • Clear browser and app storage through your browser or phone settings.

Texas's comprehensive privacy law (the Texas Data Privacy and Security Act) directs its consumer-rights requirements at larger businesses. As a small local business, most of those statutory requirements do not apply to us. Regardless, we voluntarily honor reasonable access, correction, and deletion requests as described above, and we do not sell personal information, including sensitive personal information, to anyone.

10. Account Deletion

You may request deletion of your online account at any time at goatfitness.com/account/delete (also linked from Settings in the GOAT ID app) or by contacting support@goatfitness.com. Cancelling your gym membership (governed by your Membership Agreement) is separate from deleting your account data, and any balance owed remains due.

When we process a deletion request, we delete your sign-in (email and password, Google or Apple), your profile and online membership record, your door credentials and the phones registered to open the door, family members and guests you added, your shopping cart, your workout programs, logged sessions and personal records, and your rewards points, badges and activity. We may keep certain records where we have a legal or operational need, for the periods in Section 8:

  • Signed waivers and agreements, retained for 7 years as legal evidence
  • Billing, transaction, and tax records, retained as required for accounting and tax purposes and for the 4-year contract limitations period
  • Gym entry history, identifiable for 12 months for facility security, then only a monthly visit count and a de-identified copy
  • Security, fraud, and incident records, retained to establish or defend legal claims and to enforce gym rules

When we fulfill your request, we will tell you what was deleted and what must be kept.

11. Minor Members

The minimum age for a GOAT Fitness membership is 14. If a member or covered family member is under 18:

  • A parent or legal guardian must sign the Membership Agreement on the minor's behalf and must sign the Parent/Guardian Release and Waiver.
  • We record the guardian's name, phone number, email address, and relationship so we can reach them.
  • Members 16 and younger may use the training areas only in a designated youth program or under the direct supervision of a parent or legal guardian, as the Membership Agreement provides.

We do not knowingly collect information from children under 14. If you believe a child under 14 has given us information, contact us and we will delete it.

12. Data Security

We use reasonable technical and organizational safeguards, including encrypted connections, secure session cookies, access controls and audit logs for staff, rate limiting, password breach screening, request verification, and retention-locked storage for signed documents. No system can be guaranteed 100% secure, though, and we cannot promise absolute security. Please keep your password and your gym credential private, and tell us promptly if you suspect unauthorized use of your account.

If we learn of a data breach that affects your personal information, we will notify you promptly, as your Membership Agreement provides and as the law requires.

13. Third-Party Services

The Platform links to or relies on third-party services (listed in Section 7). Those providers have their own privacy policies, which we encourage you to review. We are not responsible for the privacy practices of third parties, and this Policy does not apply to them.

14. Changes to This Policy

We may update this Policy from time to time. The "Last updated" date at the top shows the current version. If we make material changes, we will post a notice on the Platform or notify you by email before the change takes effect.

15. Electronic Notices

Your Membership Agreement authorizes us to send notices, invoices, and account communications electronically, by email or by posting them in the Platform. Notices we send electronically are considered delivered on the date sent unless they are returned as undeliverable, so please keep your email address current.

16. Contact Us

GOAT Fitness LLC 3730 N Zaragoza Rd El Paso, TX 79938 United States

Phone: (915) 209-1040 Email: support@goatfitness.com

Request deletion of your account →