Privacy Policy

1. Data-minimalism, by design

Agon is self-hosted: the Software runs on your own computer or server, and your studio's operational data — client records, bookings, memberships, attendance, and payment history for your studio's customers — is stored in a local database on that machine. We (Agon, the vendor) never store, transmit to our servers, or have access to that operational data. This section describes the only data we do collect: billing and account information needed to run the subscription itself.

2. Data we collect

We collect the minimum personal data needed to sell and support the subscription:

• Billing information: name, email address, and payment details, collected and processed directly by our payment processor, Stripe. We do not store your full card number ourselves — Stripe handles that per its own privacy policy and PCI-DSS obligations.
• Account/license information: your email address, subscription plan, and license key status, used to validate your subscription and let the Software run.
• Support correspondence: anything you send us by email (e.g. to hello@agon-studio.dev) when requesting help.
• Basic website analytics: aggregate, privacy-respecting usage data about this marketing site (agon-studio.dev) itself — not the Software you run locally.

3. What we do not collect

We do not collect, store, or have any access to your studio's client data, booking data, class schedules, attendance records, or any personal data about your studio's own customers. That data is created, stored, and managed entirely within the Software on your own infrastructure, under your control, and you are the data controller for it under applicable data protection law (such as the GDPR).

4. How we use your data

We use the billing and account data described above to:

• process your subscription payments and the 7-day free trial;
• issue and validate your Agon license key;
• send billing receipts and essential service communications;
• respond to support requests; and
• comply with our own legal and accounting obligations.

We do not sell your personal data, and we do not use it for third-party advertising.

5. Connecting a Google or Microsoft account (Email OAuth)

From within the Software, a studio manager may optionally connect a Google (Gmail) or Microsoft (Outlook/365) account so the Software can send booking, membership, and marketing emails to that studio's own clients as the studio manager themselves, instead of from a generic address. This is entirely optional; studios can also configure their own SMTP server instead.

This connection uses OAuth and requests only a send-only permission — Gmail's gmail.send scope, or Microsoft Graph's Mail.Send permission. The Software never requests, and cannot use this connection to read, search, or otherwise access the contents of that mailbox or any other Google or Microsoft data.

Consistent with Section 1, the resulting access credentials are encrypted and stored locally within the Software's own database, on the studio's own infrastructure. We (Agon, the vendor) never receive, transmit to our own servers, or have any access to these credentials, or to the content of any email sent through them. A studio manager can disconnect a connected account at any time from within the Software, which revokes the Software's access to send further emails.

Agon's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

6. Data sharing and processors

We share billing data with Stripe, Inc., our payment processor, solely to process payments and provide the self-service billing portal used for cancellation. We may also use standard infrastructure providers (e.g. hosting for this website, email delivery) that process data on our behalf under their own data processing agreements. We do not share your data with other third parties except where required by law.

7. Data retention

We retain billing and account data for as long as your subscription is active and for a reasonable period afterward as needed for accounting, tax, and legal compliance purposes. Since your studio's operational data never reaches us, its retention and deletion are entirely up to you within the Software.

8. Your rights

If you are located in the EU/EEA or another jurisdiction with similar data protection law, you have rights to access, correct, delete, or port the personal data we hold about you, and to object to or restrict certain processing. To exercise any of these rights regarding the billing/account data described in Section 2, contact us at hello@agon-studio.dev. Because we never receive your studio's client data, requests relating to that data should be directed to your studio (the data controller), not to us.

9. Security

We rely on reputable, PCI-DSS-compliant infrastructure (Stripe) for payment data and apply reasonable technical and organizational measures to protect the limited account data we hold. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

10. International transfers

Our processors, including Stripe, may process data outside the EU/EEA. Where this occurs, we rely on the processor's own appropriate safeguards (such as Standard Contractual Clauses) for international data transfers.

11. Changes to this policy

We may update this Privacy Policy from time to time. Material changes will be reflected by an updated “Last updated” date on this page and, where required by law, communicated directly.

12. Contact

Questions about this Privacy Policy, or requests regarding your personal data, can be sent to hello@agon-studio.dev.