Privacy policy

Who we are

TakeSlot is a marketplace for last-minute spots at fitness studios and spas, starting in Warsaw. We run the website takeslot.app and the TakeSlot iOS and Android apps. The controller of your personal data is TakeSlot. Write to hello@takeslot.app.

What we collect

When you create an account we may collect:

• Phone number and SMS one-time codes
• Name, email address and a hashed password
• Interests, preferred areas and times
• Language and notification preferences
• Booking history (class, studio, time, price, status)
• Push token, IP address and basic device or app info
• An optional profile photo

If you list a studio we also collect business name, address, contact details, class inventory, calendar connection data (for example Fitssey) and payout details handled by Stripe Connect.

Polish telecom rules require us to store when you agreed to SMS (time, IP and consent version).

Sign in with Google and Apple

You can sign in with a phone number, with email and password, with Sign in with Apple, or with Google. Apple and Google are optional: you can use every part of TakeSlot without them.

When you choose Continue with Google, we ask Google only for the basic sign-in scopes (openid, email and profile). From your Google Account we receive:

• Your Google account ID, so we can recognise you next time
• Your name, to fill in your TakeSlot profile
• Your email address and whether Google has verified it, to create your account or link it to an existing TakeSlot account with the same email, and to send booking confirmations
• Your profile photo, to show as your TakeSlot avatar (you can replace it at any time)
• Sign-in tokens issued by Google, used only to complete sign-in. We never use them to read your Gmail, contacts, calendar, Drive or any other Google data

We use this Google user data only to sign you in and to run your TakeSlot account. We do not sell it, use it for advertising, or use it to build user profiles for anyone else. We do not use it to develop, improve or train generalised AI or machine-learning models. We share it only with the service providers in the section "Who we share it with" that host or deliver TakeSlot for us, and with a studio only when you book with it (your name and contact, so they can check you in).

TakeSlot's use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

We keep this data while your account is open. When you delete your account, we revoke TakeSlot's access with Google and delete the stored Google sign-in tokens. You can also remove TakeSlot's access at any time at myaccount.google.com/connections; you can then keep using TakeSlot with a phone number or email.

With Sign in with Apple we receive a unique account identifier and, if you share them, your name and email. If you use Apple's Hide My Email, we receive a private relay address, not your personal inbox. We never receive your Apple or Google password.

Payments and device permissions

Card payments are processed by Stripe. We never store your full card number. Stripe may collect card details, Apple Pay or Google Pay data and billing information needed to charge you and pay the studio.

On the mobile app some features need permission, and only if you grant it:

• Location while the app is in use, to sort nearby last-minute spots. We do not track you in the background.
• Camera only if you choose to scan a payment card through Stripe. We do not keep camera images.
• Push notifications for booking updates and, if you opt in, last-minute deals. You can turn these off in the app or in system settings.

Why we use your data

We use your data to create your account, show relevant classes, process bookings and payments, message you about bookings, send SMS codes, improve the product, prevent fraud and comply with the law. The legal bases are performing our contract with you, our legitimate interest in running a safe marketplace, and your consent where we ask for it (marketing, location, optional deal alerts).

Who we share it with

We share data only as needed to run the service:

• Stripe, for payments and studio payouts
• Resend, for email
• SMS Fly, for SMS in Poland
• Railway, for hosting
• Object storage, for photos you or a studio upload
• Apple and Google, if you sign in with them
• Expo, to deliver push notifications
• Google Analytics and Umami on the website, for usage stats
• Meta (Facebook), for the Meta Pixel on the website if you accept marketing cookies
• The studio you book with: your name and contact so they can check you in

We do not sell your data. We do not share it with a studio until you book.

How long we keep it

We keep your account until you delete it. Booking and payment records may be kept longer where tax, accounting or dispute rules require it. If you close your account we deactivate it, drop your push token and sessions, and stop using your profile for marketing.

How we protect your data

All traffic between you, our apps and our servers is encrypted with HTTPS (TLS). Passwords are stored only as salted hashes. Sign-in sessions use secure, HTTP-only cookies or the device's secure storage. Access to production data is limited to the people who need it to run TakeSlot, and our providers (listed above) are bound by data processing terms. Card details go straight to Stripe and never touch our servers.

Deleting your account

You can delete your account at any time, no reason needed:

• In the iOS or Android app: Profile → Sign out or delete account → Delete account
• On the website: Settings → Account → Delete my account
• Or write to hello@takeslot.app and we will do it within 30 days

Deleting the account removes your profile, preferences and saved devices. Upcoming paid bookings stay booked with the studio and are not refunded. If you signed in with Apple or Google, we also revoke our access with them and delete the stored sign-in tokens.

Your rights

Under GDPR you can access, correct, delete, restrict or export your data, and object to some processing. Write to hello@takeslot.app; we act within 30 days. You can complain to the Polish data protection authority (UODO).

Children

TakeSlot is for people 18 and over. We do not knowingly collect data from children. If you think we have, write to hello@takeslot.app and we will delete it.

Cookies and analytics

The website uses essential cookies to keep you signed in and remember language. On takeslot.app we also use Google Analytics and Umami to understand how the site is used. If you accept marketing cookies in the cookie banner, we also load the Meta Pixel to measure our ads on Facebook and Instagram. You can change your choice at any time from the cookie banner. The mobile apps do not use advertising trackers.

Changes

If this policy changes in a way that matters, we will post the update here and, where required, tell you in the app or by email. The date at the top of this page is the latest version.