What we collect, what we never receive, and what you can ask us to do about it. Effective July 28, 2026.
RenewKit is the one kit that stores anything, and it stores it in a form we cannot read. Your client records are encrypted on your own device before they leave it, using a key that exists only inside your link. What sits on our hosting is scrambled text under an anonymous identifier. We hold your email address, a payment record, and those unreadable blocks.
This is the most important section on this page. RenewKit compares a client against themselves over time, which means it has to remember them. Those records are encrypted in your browser, before they leave your device, using a key generated on your setup page that exists only inside your own link.
What arrives on our hosting is a block of scrambled characters filed under an anonymous identifier. No name, no measurements, no notes, nothing readable. We hold no key, we cannot decrypt it, and neither could anyone who obtained a copy of the storage.
The other side of that: if you lose your link you lose the key, and the records cannot be recovered by us or by anybody else. The setup page says so before a key is generated.
We keep the encrypted blocks for as long as you are a customer, and delete them on request.
Your own setup — business name, colours, session rates, your terms — is carried in the part of your link after the # symbol. By the design of the web itself, that part of an address is never sent to a server. Not to ours, and not to anyone else's.
Because records are filed under an anonymous identifier, we cannot look yours up from your email address. Deleting from within the tool is the reliable route. If you want a stored block removed from our hosting and can supply the identifier your tool shows, write to privacy@trainerkit.co and we will remove it.
If you add your own Web3Forms key during setup, that button sends the review summary through Web3Forms to your own inbox. That is a service you signed up to and hold the key for; we are not in the path and never receive a copy. Web3Forms handles that data under their own terms.
Note that a summary sent this way leaves your device unencrypted, unlike the stored records described above. Without a key, the button opens your device's own mail app instead, and nothing leaves your device except the email you then choose to send.
Everything you record about the people you train — measurements, attendance, notes, review sheets — is yours, and you are the data controller for it. Collecting, storing, retaining, disclosing and disposing of it in line with the privacy law that applies where you practise is your responsibility, as is telling your clients what you hold and why.
We are not a party to that relationship. We hold your client records only in a form we cannot read, and we never receive the key that would change that.
Stripe takes the payment and gives us a record of the transaction: your email address, the amount, the country, and the last four digits of the card. We never receive or store your full card number. Stripe handles your payment details under their own privacy policy.
We keep purchase records for as long as tax and accounting law requires us to, which is generally seven years in Canada.
If you download a free guide or opt into our list, we hold your email address and any name you gave us, along with which emails you opened and which links you clicked. We use it to send you the thing you asked for and, if you agreed, occasional emails about our products.
Our email is run through Kit (formerly ConvertKit). Every email has an unsubscribe link, it works immediately, and unsubscribing from marketing does not stop us replying to a support request.
Our web host keeps standard server logs — IP address, browser, pages requested, timestamps — which we use to keep the site running and secure. We do not run advertising trackers, we do not sell or rent your information to anybody, and we do not build advertising profiles.
Fonts on our pages are served by Google Fonts, which receives the request as a normal part of loading a page.
The short list, and what each one gets: Stripe (payment details and your email), Kit (your email address and engagement), our web host (server logs, and the encrypted blocks described above), and Google Fonts (the request that loads a font). Where you have added your own Web3Forms key, that is your account and your relationship with them, not ours.
Some of these process data outside Canada, including in the United States. Where that happens they are bound by contractual terms intended to keep your information protected to a comparable standard.
You can ask us what we hold about you, ask us to correct it, ask us to delete it, and withdraw consent to marketing at any time. Write to privacy@trainerkit.co and we will respond within 30 days.
Depending on where you live you may have further rights — under PIPEDA in Canada, the GDPR in the UK and EU, or state privacy law in the US — and we will honour them. If you are unhappy with how we have handled a request, you can complain to your local privacy regulator; in Canada that is the Office of the Privacy Commissioner.
Our products are sold to fitness professionals and are not directed at children. We do not knowingly collect information from anyone under 16 through this website. Where a trainer records a client who is a minor, that is between the trainer, the client and their parent or guardian — and it reaches us only as a block we cannot read.
If we change this policy we will update the effective date at the top. Material changes will be sent to anyone on our list.
Lead Frog, 1500 West Georgia, Suite 1300, Vancouver, BC V6G 2Z6. Privacy questions and requests: privacy@trainerkit.co.