Privacy Policy

Effective date: August 28, 2026
Last updated: October 27, 2026

In The Core Athlete, Inc. (“In The Core,” “ITC,” “we,” “us,” or “our”) operates the gym at 5455 Spine Road, Suite F, Boulder, Colorado, and the website at traininthecore.com. This policy explains what personal information we collect, why we collect it, who we share it with and how, how long we keep it, how we protect it, and the choices you have. It covers both our website and the information we collect when you train with us in person.

If you have a question about anything here, email aaron@traininthecore.com or call 970-443-0590.

1. The short version

• We collect the information we need to schedule you, train you safely, and get paid.
• We never see or store your full payment card number. Card details go straight to Stripe.
• We share information with the service providers that run our booking, waiver, payment, email, automation, online program and hosting systems, and with nobody else, unless the law requires it.
• We do not sell your personal information, and we do not share it for targeted advertising.
• You can ask us what we hold about you, correct it, or ask us to delete it, at any time.

2. Information we collect

2.1 Information you give us directly

Website inquiry forms. Our contact form and our Join Our Program forms collect your name, phone number, email address, the subject of your inquiry, and whatever you write in the message field.

Youth and team inquiries. The Join Our Program form is normally completed by a parent or guardian on behalf of an athlete. It collects the athlete’s first name and age, their sport and competitive level, what they are working toward, anything we should train around (which may include injuries or health limitations), the parent or guardian’s name, phone number and email address, the best time to call, how you heard about us, and, if someone referred you, that person’s name. The team and group inquiry form collects what you are asking about, a team, club or group name, the sport and age group, the approximate number of athletes, what you hope the training achieves, and your name, role, phone number and email address. You can also tick a box on that form to receive occasional email updates.

Online program waitlist. The ITC Perform waitlist form collects your first name, your email address, your main goal and where you plan to train.

Waiver and health screening. Before training, every participant signs a waiver through WaiverForever. It collects the participant’s full legal name, date of birth, email address and mobile number; where the participant is under 18, the parent or guardian’s full legal name, relationship, email address and mobile number; an emergency contact’s name, relationship and phone number; answers to a health screening questionnaire; and an electronic signature, initials, and a record of when the waiver was signed.

The health screening answers are sensitive information. They cover matters such as heart conditions, chest pain, dizziness or fainting, orthopedic problems, blood pressure and heart medication, and breathing conditions. We ask for them for one reason: so that the coach on the floor can train the participant safely.

Booking and account information. When you book a class or a session through our scheduling system, we collect your name, email address, phone number, the classes or sessions you book, your attendance and cancellation history, any package or class-pack balance you hold, and any notes you add to a booking. If you choose to create a scheduling account, that account is held by our scheduling provider and secured by a password we never see.

Accounts. Our website does not offer client accounts. If you create a scheduling account, it is held by our scheduling provider, as described above.

Payments. When you pay us, you enter your card details into a payment form served by Stripe. Those details go directly from your browser to Stripe over an encrypted connection. They do not pass through our website or our systems, and we never receive or store your full card number, expiry date, or security code. What we do receive from Stripe is the amount, the date, the last four digits of the card, the card brand, the name on the card, and whether the payment succeeded. Where you have agreed to keep a card on file for a package or membership, that card is stored by Stripe, not by us.

Online programs. If you join ITC Perform, our online training program, your account, training logs, messages with your coach, and any photos or videos you send for form checks are held in the app that runs the program, provided by Everfit.

Communications. If you email us, call us, or message us, we keep a record of that correspondence.

2.2 Information we collect automatically

When you visit traininthecore.com, our hosting provider’s servers automatically record your IP address, the browser and device you are using, the pages you request, the time of the request, and the page that referred you. This is standard web server logging and it happens on every website.

We use Google Tag Manager on our site. Tag Manager is a container that loads measurement tags; when it is active it may set cookies and transmit technical information about your visit to Google.

We use Google Analytics 4 to understand how people find and use this website. Analytics sets cookies in your browser and sends Google information about your visit: the pages you view, how long you spend on them, the approximate region you are in, and the device and browser you are using. It does not receive your name, email address, phone number, or anything you type into a booking, inquiry or waiver form. Google processes this data as described in the Google Privacy Policy. If you would rather not be measured, Google publishes a browser add-on that turns Analytics off on every site you visit, and blocking cookies in your browser settings has the same effect here.

We use Google reCAPTCHA v3 on our inquiry forms to stop automated spam. reCAPTCHA collects hardware and software information from your browser and sends it to Google for analysis. Your use of reCAPTCHA is subject to the Google Privacy Policy and Terms of Service.

Our Contact page shows a Google Map. When the map loads, your browser sends Google technical information about your visit, as described in the Google Privacy Policy.

Our site sets cookies that support the functions above and keep our own staff signed in to manage the site. You can block or delete cookies through your browser settings, though some parts of the site may not work properly if you do.

Our site does not currently respond to browser “Do Not Track” signals, because there is no common standard for how to interpret them.

2.3 Blog comments

Comments are closed on our articles. We do not accept new comments, and we do not collect anything through a comment form.

2.4 Photographs and video

We photograph and record training sessions, competitions, and events, and we use those images to show the work our athletes do: on this website, on our social media accounts, and in print and advertising materials.

Consent for this is given in Section 6 of our waiver, the Photo, Video, and Social Media Release, which every participant or their parent or guardian signs before training. That release covers the participant’s image, likeness, voice, first name, and general training results. Because training happens in shared group settings, we cannot administer photo and video permissions on an individual basis during a session.

If you have a specific concern, for example a safety, custody, or privacy circumstance, raise it with us in writing at the address in Section 7.8 of the waiver, or at aaron@traininthecore.com, and we will work with you in good faith. Any accommodation applies to future use; it cannot recall material already published.

3. How we use your information

• To schedule and deliver training. Booking you into classes and sessions, managing class-pack and package balances, tracking attendance, and running the gym day to day.
• To run the gym. Weekly internal reports on bookings and packages, emailed to our staff, which can include athletes’ names.
• To train you safely. Coaches review health screening answers and emergency contact details so they can adapt a session and respond if something goes wrong.
• To answer you. Responding to inquiries submitted through our forms, by email, or by phone.
• To take payment. Processing payments, issuing receipts, applying packages, and handling refunds and chargebacks.
• To send you the messages that go with a booking. Booking confirmations, reminders, schedule changes, waiver status, and similar operational messages, by email and by SMS where you have given us your number.
• To keep the records we are required or advised to keep. Signed waivers, health screenings, and payment records, for insurance and legal purposes.
• To send optional news and updates. Only if you have opted in, for example by ticking the box on the waiver that says “send me ITC schedule changes, training updates, and news by email.” You can withdraw that consent at any time.
• To keep the website working and secure. Preventing spam and abuse, diagnosing faults, and understanding which pages people use.
• To comply with the law. Including responding to lawful requests and defending legal claims.

4. Who we disclose your information to, and how

We do not sell your personal information. We do not share it for targeted or cross-context behavioral advertising. We disclose it only to the service providers listed below, who process it on our instructions so that we can run the business, and to the limited categories of recipient described after that.

In every case, information reaches these providers by one of three methods: it is transmitted over an encrypted HTTPS connection when you submit it through a form, a booking page or an app, and is stored in that provider’s system; it is passed between two of these providers over an encrypted connection, for example when Make reads records from our scheduling system or ClassPass sends us a booking; or it is sent by encrypted email between our staff. We do not transfer personal information on physical media, and we do not post or fax it.

We may also disclose personal information:

• To professional advisors (our accountants, insurers, and lawyers), where they need it to advise us;
• To emergency and medical responders, if a participant is injured or becomes unwell at the gym and treatment or transport is needed;
• Where the law requires it, including in response to a subpoena, court order, or lawful request from a public authority, and to establish, exercise, or defend a legal claim;
• In a business transfer, if In The Core Athlete, Inc. is sold, merged, or reorganized, in which case your information would move with the business and this policy would continue to apply until you were told otherwise.

Most of our service providers are based in the United States. Some, such as Make, are based elsewhere, so your information may be processed outside the United States.

5. How long we keep your information

• Signed waivers and health screenings: for as long as we may need them to defend a claim. In practice this means at least three years after your last visit, and longer for anyone who signed as a minor, because the time limit for their claims can run past their eighteenth birthday.
• Booking and attendance records: for as long as you are an active client, and for a reasonable period afterward.
• Payment records: for at least seven years, as our tax and accounting obligations require.
• Website inquiry form submissions: kept in the website database for up to 12 months, then deleted.
• Marketing contacts: until you unsubscribe, after which we keep a minimal record of the unsubscribe so we do not email you again by mistake.
• Server logs: for a short period, for security and spam prevention.
• Website email log: a record of the emails our website sends, kept for 14 days, then deleted automatically.
• Automation records in Make: the data from each run for 7 days, then deleted automatically, and the log of package emails sent until we delete it.
• Emails: emails our staff and our website send and receive are kept in our Google Workspace email accounts.

6. How we protect your information

• Encryption in transit. The whole of traininthecore.com is served over HTTPS, so anything you type into a form on our site is encrypted between your browser and the server. Our booking, waiver, and payment providers do the same.
• Payment card data never touches our systems. Card entry happens on a Stripe-hosted form. Stripe is certified to PCI DSS Level 1, the highest level of certification available to a payment processor. Because we never receive card numbers, they cannot be exposed by a breach of our website.
• Access is limited to the people who need it. Website administration is restricted to named accounts held by our staff and our website agency. Health screening answers and emergency contact details are made available to the coaching staff who need them to run a session safely, and are not published or shared beyond that.
• Passwords are never stored in readable form. Website account passwords are stored only as a one-way encrypted hash. Scheduling account passwords are held by our scheduling provider, not by us.
• Automated abuse protection. Our website forms are protected by Google reCAPTCHA, which blocks automated and spam submissions.
• Backups. We take full backups of the website and its database so that we can restore them after a failure.
• Vendor selection. We use established providers with published security practices for scheduling, waivers, payments, and email rather than building our own.

No method of transmission or storage is completely secure, and we cannot guarantee absolute security. If we ever become aware of a breach affecting your personal information, we will notify you and any regulator as the law requires.

7. Your choices and your rights

You can ask us at any time to:

• Tell you what we hold about you, and give you a copy;
• Correct anything that is wrong or out of date;
• Delete your information, subject to records we are required to keep, in particular signed waivers and payment records, which we cannot delete on request while the relevant retention period is running;
• Stop marketing emails, which you can also do yourself using the unsubscribe link at the bottom of any of them. Operational messages about a booking you have made are not marketing, and will continue;
• Stop SMS messages, by replying STOP to any text we send.

Email aaron@traininthecore.com to make any of these requests. We will respond within 45 days. We may need to verify your identity first, and we will not charge you.

Colorado residents

The Colorado Privacy Act gives Colorado residents rights of access, correction, deletion, data portability, and the right to opt out of the sale of personal data, targeted advertising, and certain profiling. We do not sell personal data, do not use it for targeted advertising, and do not profile anyone in a way that produces legal or similarly significant effects, so those opt-outs do not arise here, but the access, correction, deletion, and portability rights are available to you through the address above.

If we decline a request, you may appeal by replying to our decision or writing to the same address with “Privacy Appeal” in the subject line. We will respond to an appeal within 45 days and explain our reasoning. If you are not satisfied, you may contact the Colorado Attorney General at coag.gov.

8. Children and minors

We train young athletes, and we welcome them. Our website, however, is written for adults.

• Minors do not sign up on their own. Inquiry forms, waivers, bookings, and payments for anyone under 18 are completed by a parent or legal guardian, who provides the athlete’s information to us.
• Each athlete has their own scheduling account. For anyone under 18, a parent or guardian creates and manages that account. We do not knowingly collect personal information directly from a child through this website.
• What we collect about a young athlete is what a parent gives us: first name, age, sport and level, training goals, anything to train around, health screening answers, and, from the waiver, full legal name and date of birth. We use it to place them in the right group and to coach them safely. We do not use it for advertising and we do not disclose it beyond the providers listed in Section 4.
• Parents and guardians are in control. You can ask us at any time to show you what we hold about your child, correct it, or delete it, subject only to the waiver and payment records described in Section 5. You can also withdraw consent for future use of your child’s image under Section 6 of the waiver.

If you believe a child has given us information directly without a parent’s involvement, email aaron@traininthecore.com and we will delete it.

9. Other websites

Our site links out to our scheduling provider, our waiver provider, our partners, and our social media accounts. Once you follow one of those links you are on someone else’s site, governed by their privacy policy, not this one. We are not responsible for their practices, and we encourage you to read them:

• Acuity Scheduling
• Stripe
• WaiverForever
• Google
• Intuit Mailchimp
• ClassPass
• Everfit
• Make

10. Changes to this policy

We will update this policy when our practices change, for example if we add a new booking, payment, or measurement tool. The effective date at the top always tells you which version you are reading. If a change materially affects how we handle your information, we will say so on this page and, where it matters, tell you by email.

11. How to contact us

In The Core Athlete, Inc.
5455 Spine Road, Suite F
Boulder, Colorado
Phone: 970-443-0590
Email: aaron@traininthecore.com

Please put “Privacy” in the subject line so your message reaches the right person quickly.