LiLo
Live data
Legal

Privacy Policy

Last updated: 16 September 2026

Straightforward is the whole point. This policy explains what LiLo collects when you use the site to discover and book fitness classes, why, who sees it, how long we keep it, and how to exercise your rights. Every statement here describes what the site actually does.

1. Who We Are

LiLo (yourlilo.com) is operated by Alex Braid, Los Angeles, California, United States. For the purposes of the EU and UK General Data Protection Regulation, LiLo is the controller of the personal data described in this policy. We have not appointed a representative in the UK or EU; you can contact us directly at the address in section 10. This policy applies wherever you are; sections 7 and 8 set out rights that depend on where you live.

2. What We Collect, Why, and On What Basis

You can use the directory and book most classes without an account. We collect only what each feature needs:

Holding a spot or requesting a drop-in: Your name and email address, an optional phone number, the gym and class, and anything you write in the request. We use these to pass your request to the gym and confirm it back to you. Basis: performing the contract you are asking us to arrange.

Paying for a drop-in on LiLo: For gyms marked "Book & pay on LiLo", your payment is taken by Stripe on Stripe's own page; LiLo never sees your card number. We keep the booking record (name, email, class, amount, status) and, where the gym requires a waiver, your waiver signature with the date, time and the IP address it was signed from, so the gym can rely on it. Basis: contract; legal obligation for the payment records.

An account (beta): Your email address, used to send a one-time login code (we store no password). If you create a profile: a handle, display name, optional home gym and skill levels, and anything you choose to log — gym check-ins and workout results. Workout and check-in data can reveal information about your health and whereabouts, so we only record it when you enter it yourself, and you can delete it or the whole account at any time. Basis: contract for the account; your consent for logs and check-ins.

Claiming a gym listing: Your name, email address, role at the gym and your message. Basis: our legitimate interest in verifying who represents a listed business, and the steps you ask us to take.

Page-view counting: We count page views ourselves. For each view we store the page, the referring site (host only), the country, whether the device is a phone or a desktop, and a visitor key that is a one-way hash of the day, your IP address and browser type. The key changes every day, cannot be reversed, and lets us count unique visitors per day and nothing more. Your IP address and browser type are not stored. If your browser sends Global Privacy Control or Do Not Track, the view is counted with no visitor key at all. You can also switch counting off for your browser with "Don't count me" in the notice at the bottom of the page. We also use Vercel Web Analytics, which sets no cookies. Basis: our legitimate interest in knowing whether the site works and is used.

Cookies: We set one cookie, only if you choose a home city: it remembers that choice for a year and identifies nothing about you. We set no advertising or tracking cookies.

Technical logs: Our hosting provider keeps short-lived request logs (IP address, URL, time) to run the site and stop abuse. Basis: legitimate interest in security.

3. Information About Gyms

Gym listings are compiled from public sources: the gym's own website, Google Places, and the CrossFit and HYROX affiliate directories. A listing may include a business phone number, website, opening hours, class times, a photo the gym publishes, and for some gyms a contact email address that we use only to pass on drop-in requests and never publish on the site. If you run a gym and want anything corrected or removed, email us and we act within five business days (see our Terms, section 8).

4. Who We Share It With

We share personal data only to provide the service. We do not sell it, and we do not share it with advertisers or data brokers.

The gym you book: Your name and contact details, and your waiver where one is required, so they know you are coming and can confirm you.

Service providers (processors): Vercel (hosting, United States), Supabase (database and login, United States), Stripe (payments), Resend (email delivery), and Google (Places, the source of listing data). We also receive an internal alert on Telegram when a paid booking is confirmed; it carries the booking reference only, never your name or email.

When the law requires it: We disclose data if we are legally required to, or to protect our rights, our users or the public.

5. International Transfers

LiLo is operated from the United States and our providers store data there. If you are in the UK, the EU or Switzerland, your data is transferred to the United States under our providers' standard contractual clauses and, where they are certified, the EU–US and UK–US Data Privacy Frameworks. You can ask us for details of the safeguards in place.

6. How Long We Keep It

Page-view records: Raw rows are deleted after 90 days; only totals are kept after that.

Hold requests and bookings: Records of a paid booking are kept for up to seven years for tax and accounting. Unpaid hold requests are kept for 12 months.

Accounts: Until you delete the account or ask us to. Check-ins and workout logs go with it.

Gym claims: 12 months after the claim is resolved.

Emails we send: Delivery records are kept by our email provider for up to 90 days.

7. Your Rights (UK, EU, Switzerland and Elsewhere)

You can ask us to access, correct, delete or export the personal data we hold about you, to restrict or object to how we use it, and to withdraw any consent you gave (which does not affect what was done before). Email us (section 10); we answer within one month. If you are not satisfied you can complain to your data-protection authority — in the UK the Information Commissioner's Office (ico.org.uk), in the EU your national authority.

8. Your California Privacy Rights

If you are a California resident, the California Consumer Privacy Act (CCPA) and the California Online Privacy Protection Act (CalOPPA) grant you specific rights regarding your personal information:

The Right to Know: You can ask us what personal data we have collected about you and how we use it.

The Right to Delete: You can request that we delete your personal information, subject to certain exceptions (like if we need it to finalize an active booking or keep a payment record).

The Right to Non-Discrimination: We will never treat you differently or deny you service for exercising your privacy rights.

Do Not Sell: We do not sell or share your personal information for cross-context behavioural advertising, so there is nothing to opt out of; the footer link exists because California law requires it.

Do Not Track Signals: We honour Global Privacy Control and "Do Not Track". When your browser sends either signal, our page-view counter records the view without any visitor identifier, and nothing about you is stored.

9. Children

LiLo is for adults. We do not knowingly collect personal data from anyone under 16 (under 13 in the United States). If you believe a child has given us data, email us and we will delete it.

10. Contact and Requests

To exercise any right, ask a question, or ask a gym listing to be corrected or removed, email hello@yourlilo.com. We may ask you to confirm the email address a request comes from before acting on it.

  • Controller: LiLo, operated by Alex Braid, Los Angeles, California, United States
  • Email: hello@yourlilo.com

11. Changes to this Policy

When we change what we collect or how we use it, we update this page and the date at the top. For a significant change we also tell account holders by email.