Legal

Privacy Policy

Last updated 20 October 2026

This policy explains what personal information RUSH Pilates ("RUSH", "we", "us") collects, why, and how we look after it. We follow the Australian Privacy Principles in the Privacy Act 1988 (Cth). RUSH Pilates is an Australian business based in Victoria.

Information we collect

• Account details: your email address and password. Your password is stored in scrambled (hashed) form by our sign-in provider; we can't see it.
• Your questionnaire answers: your goals, Pilates experience, equipment, available days, session length, preferred intensity, and any movements you ask RUSH to leave out (for example kneeling or twisting).
• Your safety acknowledgement: we record that you read and accepted the safety notice, and when. We don't store your answer to the question about pregnancy, injury or medical conditions.
• Your activity: your program, the sessions you start and complete, how long they took, exercises completed or skipped, your session ratings (such as "Too easy"), and changes you make to sessions.
• Purchases: whether you have bought Lifetime Access and the payment reference. Card details are entered directly with our payment provider, Stripe (or Apple or Google for in-app purchases). We never see or store your full card number.
• Launch list: if you join our launch list on the website, your email address and when you signed up. We only use it to tell you about the RUSH launch, and you can ask us to remove it at any time.
• Messages you send us, such as support emails.
• Technical information our hosting and database providers record automatically, such as IP addresses and timestamps in security logs.

Sensitive information

Some of what you tell us, such as movements you want to avoid, can say something about your health. Health information is "sensitive information" under Australian privacy law. We only collect it with your consent, only use it to tailor your sessions, and you can choose not to provide it. You can change or remove it at any time in the app.

How we use your information

• To create, adapt and deliver your personalised program and guided workouts.
• To keep your account secure and sync your data across your devices.
• To process and confirm your purchase.
• To send service emails you need, such as account confirmation, password resets and purchase receipts.
• To answer your questions and provide support.
• To understand, in combined form, how RUSH is used so we can improve it.
• To meet our legal obligations.

We do not sell your personal information. We will only send you marketing emails if you have agreed to receive them, and every marketing email will let you unsubscribe.

How RUSH builds and adapts your program

Your program and any changes you request (for example "I only have 10 minutes") are worked out by rules built into RUSH, using your answers and our exercise library. We do not currently send your information to artificial intelligence (AI) services. If that changes, we will update this policy before it happens.

Who we share it with

We use trusted service providers to run RUSH. They may only use your information to provide their service to us:

• Supabase (account sign-in and database). Your RUSH data is stored in Supabase's Sydney, Australia data centre.
• Stripe (card payments on our website).
• Apple and Google (if you use our iPhone or Android app or buy through their stores).
• Netlify (hosting our website and storing launch-list sign-ups).
• Microsoft (our business email).

Some of these providers are based outside Australia, mainly in the United States, and may access or process information overseas, for example for security, support or payment processing. We take reasonable steps to ensure they handle it in line with the Australian Privacy Principles.

We may also disclose information if required by law, or to protect someone's safety.

How we protect it

Information is encrypted in transit. Our database only lets each signed-in account access its own data. On phones, your sign-in session is stored encrypted on your device. No system is perfectly secure, but we take reasonable steps to protect your information from misuse, loss and unauthorised access.

How long we keep it

We keep your information while you have an account. If you delete your account (Profile, then Account, then Delete Account), your account and RUSH data are deleted from our database straight away. Copies may remain in our providers' encrypted backups for a limited period before being overwritten. Payment records held by Stripe, and any records we must keep for tax purposes, are kept for as long as Australian law requires.

Access, correction and your choices

• You can see and change your preferences in the app at any time.
• You can export a copy of your data from Profile.
• You can delete your account from Profile.
• You can ask us for access to, or correction of, the information we hold about you by emailing nicholas@rushpilates.com.au.

Children

RUSH is not designed for children. You must be at least 16 to create an account, and if you are under 18 you need a parent or guardian's permission.

Questions and complaints

Email nicholas@rushpilates.com.au. We aim to respond within 30 days. If you're not satisfied with our response, you can contact the Office of the Australian Information Commissioner at oaic.gov.au.

Changes to this policy

We may update this policy. If the changes are significant, we will let you know in the app or by email before they take effect.