Privacy policy

Who we are

TakeSlot is a marketplace for last-minute spots at fitness studios and spas, starting in Warsaw. We run the website takeslot.app and the TakeSlot iOS and Android apps. The controller of your personal data is TakeSlot. Use the contact form on this website.

What we collect

When you create an account we may collect:

• Phone number and SMS one-time codes
• Name, email address and a hashed password
• Interests, preferred areas and times
• Language and notification preferences
• Booking history (class, studio, time, price, status)
• Push token, IP address and basic device or app info
• An optional profile photo

If you list a studio we also collect business name, address, contact details, class inventory, calendar connection data (for example Fitssey) and payout details handled by Stripe Connect.

Polish telecom rules require us to store when you agreed to SMS (time, IP and consent version).

Sign in with Google and Apple

You can sign in with a phone number, with email and password, with Sign in with Apple, or with Google. Apple and Google are optional: you can use every part of TakeSlot without them.

When you choose Continue with Google, we ask Google only for the basic sign-in scopes (openid, email and profile). From your Google Account we receive:

• Your Google account ID, so we can recognise you next time
• Your name, to fill in your TakeSlot profile
• Your email address and whether Google has verified it, to create your account or link it to an existing TakeSlot account with the same email, and to send booking confirmations
• Your profile photo, to show as your TakeSlot avatar (you can replace it at any time)
• Sign-in tokens issued by Google, used only to complete sign-in. We never use them to read your Gmail, contacts, calendar, Drive or any other Google data

We use this Google user data only to sign you in and to run your TakeSlot account. We do not sell it, use it for advertising, or use it to build user profiles for anyone else. We do not use it to develop, improve or train generalised AI or machine-learning models. We share it only with the service providers in the section "Who we share it with" that host or deliver TakeSlot for us, and with a studio only when you book with it (your name and contact, so they can check you in).

TakeSlot's use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

We keep this data while your account is open. When you delete your account, we revoke TakeSlot's access with Google and delete the stored Google sign-in tokens. You can also remove TakeSlot's access at any time at myaccount.google.com/connections; you can then keep using TakeSlot with a phone number or email.

With Sign in with Apple we receive a unique account identifier and, if you share them, your name and email. If you use Apple's Hide My Email, we receive a private relay address, not your personal inbox. We never receive your Apple or Google password.

Payments and device permissions

Card payments are processed by Stripe. We never store your full card number. Stripe may collect card details, Apple Pay or Google Pay data and billing information needed to charge you and pay the studio.

On the mobile app some features need permission, and only if you grant it:

• Location while the app is in use, to sort nearby last-minute spots. We do not track you in the background.
• Camera only if you choose to scan a payment card through Stripe. We do not keep camera images.
• Push notifications for booking updates and, if you opt in, last-minute deals. You can turn these off in the app or in system settings.

Why we use your data

We use your data to create your account, show relevant classes, process bookings and payments, message you about bookings, send SMS codes, improve the product, prevent fraud and comply with the law. The legal bases are performing our contract with you, our legitimate interest in running a safe marketplace, and your consent where we ask for it (marketing, location, optional deal alerts).

Who we share it with

We share data only as needed to run the service:

• Stripe, for payments and studio payouts
• Resend, for email
• SMS Fly, for SMS in Poland
• Railway, for hosting
• Object storage, for photos you or a studio upload
• Apple and Google, if you sign in with them
• Expo, to deliver push notifications
• Google Analytics and Umami on the website, for usage stats
• PostHog (EU servers), for product analytics and session recordings on the website and in the apps, linked to your account when you are signed in
• Meta (Facebook), for the Meta Pixel on the website if you accept marketing cookies
• The studio you book with, so they can check you in: your name and contact for studios we manage inside TakeSlot
• Fitssey, the booking system some studios use, when you book such a studio: we send only your first name and your TakeSlot confirmation code into Fitssey — never your surname, email or phone — so the studio can match you at the desk without being able to contact or market to you directly

We do not sell your data. We do not share it with a studio until you book.

How long we keep it

We keep your account until you delete it. Booking and payment records may be kept longer where tax, accounting or dispute rules require it. If you close your account we deactivate it, drop your push token and sessions, and stop using your profile for marketing.

How we protect your data

All traffic between you, our apps and our servers is encrypted with HTTPS (TLS). Passwords are stored only as salted hashes. Sign-in sessions use secure, HTTP-only cookies or the device's secure storage. Access to production data is limited to the people who need it to run TakeSlot, and our providers (listed above) are bound by data processing terms. Card details go straight to Stripe and never touch our servers.

Deleting your account

You can delete your account at any time, no reason needed:

• In the iOS or Android app: Profile → Sign out or delete account → Delete account
• On the website: Settings → Account → Delete my account
• Or use the contact form on this website and we will do it within 30 days

Deleting the account removes your profile, preferences and saved devices. Upcoming paid bookings stay booked with the studio and are not refunded. If you signed in with Apple or Google, we also revoke our access with them and delete the stored sign-in tokens.

Your rights

Under GDPR you can access, correct, delete, restrict or export your data, and object to some processing. Use the contact form on this website; we act within 30 days. You can complain to the Polish data protection authority (UODO).

Children

TakeSlot is for people 18 and over. We do not knowingly collect data from children. If you think we have, use the contact form on this website and we will delete it.

Cookies and analytics

The website uses essential cookies to keep you signed in and remember language. On takeslot.app we also use Google Analytics, Umami and PostHog to understand how the site is used; PostHog stores an anonymous ID in a cookie and, when you are signed in, links your activity to your account. If you accept marketing cookies in the cookie banner, we also load the Meta Pixel to measure our ads on Facebook and Instagram. You can change your choice at any time on the Cookie policy page (takeslot.app/cookies). The mobile apps use PostHog in the same way to understand how the app is used, and do not use advertising trackers. PostHog may also record how you move through the site or app (taps, clicks, scrolls and screens) so we can find and fix problems; text you type is masked in these recordings, and in the apps on-screen text and images are masked too.

Changes

If this policy changes in a way that matters, we will post the update here and, where required, tell you in the app or by email. The date at the top of this page is the latest version.