← Back to Agon

Terms & Conditions

Last updated: September 30, 2026

1. Who we are

Agon is self-hosted fitness studio management software (the “Software”), developed and distributed from Spain by Edoardo Casciotta (“we,” “us,” “our”). These Terms govern your download and use of the Software and of the optional online services described in Section 4. If you have questions about these Terms, contact us at support@agon-studio.dev.

Provider: Edoardo Casciotta
Carrer d'Aragó 526, 08013 Barcelona, Spain
support@agon-studio.dev

2. License

Subject to these Terms, we grant you a non-exclusive, non-transferable license, free of charge, to download, install, and use the Software to manage your studio. The Software is proprietary and closed-source; we retain all rights not expressly granted to you. No payment, account, or activation is required to use the version you download under these Terms.

3. Self-hosting and your responsibilities

The Software is installed and runs on your own computer. Your studio, client, scheduling, and membership data is stored locally on that machine. We do not host, store, or have access to that data — see our Privacy Policy. Because your data lives on hardware you control, you are responsible for backing it up, securing the device it runs on, and keeping the Software updated. You are the data controller for the personal data of your clients and staff that you manage with the Software, and you are responsible for complying with applicable data protection law (such as the GDPR) for that data.

4. Optional online services

Some optional features rely on services operated by us: remote connectivity for your clients' mobile app and booking widget (a Cloudflare Tunnel on a studio-specific hostname under agon-studio.dev, together with a directory service that maps your studio's id to its public URL and holds a sealed offline-booking mailbox) and, only if you opt in, error diagnostics. For these services we act as a data processor on your behalf, under the Data Processing Agreement in Section 6. These services are provided “as available”; we may change or discontinue them, giving reasonable notice where possible. The Software's local features do not depend on them.

5. Third-party services

The Software can connect to services you choose and configure yourself — for example an AI provider using your own API key, an email account or SMTP server, or a payment provider for collecting payments from your own clients. Your use of those services is governed by your agreements with their providers, and we are not responsible for them.

6. Data Processing Agreement (Article 28 GDPR)

This section is the data processing agreement required by Article 28 of the General Data Protection Regulation (GDPR). In it, “you” means the studio using the Software, acting as data controller, and “we” means Edoardo Casciotta, acting as data processor. It applies only to the optional online services described in Section 4. The Software's local features are not covered, because they process data only on your own computer and we have no access to it.

6.1 Subject matter, nature and purpose

We process personal data on your behalf only to provide these services:

  • Remote connectivity: relaying encrypted traffic between your studio's computer and your clients' mobile app and booking widget, through a Cloudflare Tunnel on a studio-id.agon-studio.dev hostname operated on our Cloudflare account.
  • Directory and offline mailbox: storing the mapping between your studio's id and its public URL, and holding sealed offline-booking requests, which only your studio's installation can decrypt, until your installation collects them.
  • Error diagnostics: only if you opt in under Settings → Privacy, receiving technical error reports from your installation and from your clients' mobile app and booking widget, to diagnose and fix malfunctions.

6.2 Duration

Processing lasts for as long as you use these services, and ends as described in Section 6.10.

6.3 Types of personal data and categories of data subjects

The data subjects are your studio's clients and staff, including anyone who uses your mobile app or booking widget. For remote connectivity, the personal data is whatever passes through the connection between their devices and your studio's computer, such as booking, account and profile data, together with technical connection data such as IP addresses. Offline mailbox items contain booking requests, but they are sealed and we cannot read them. For error diagnostics, the data is technical error data (error type and message, stack trace, app version, operating-system details and your studio's id); despite automatic scrubbing, it may incidentally contain identifiers.

6.4 Processing only on your instructions

We process personal data only on your documented instructions. Your use of the Software and of its settings — for example, enabling remote connectivity or turning error reporting on or off under Settings → Privacy — together with these Terms, constitutes those instructions. We do not process the data for any other purpose, unless required to do so by European Union or Member State law to which we are subject; in that case, we will inform you of that legal requirement before processing, unless that law prohibits such information on important grounds of public interest. We will tell you if, in our opinion, an instruction infringes data protection law.

6.5 Confidentiality

Only Edoardo Casciotta has access to the personal data processed under this section and to the accounts used to provide these services. If anyone else is ever authorized to access it, they will be bound by an obligation of confidentiality.

6.6 Security measures (Article 32 GDPR)

We apply the following technical and organizational measures:

  • Encryption in transit (TLS) for the tunnel, the directory service and the diagnostics service. Relayed traffic is decrypted and re-encrypted at Cloudflare's edge on its way to your studio's computer.
  • We do not store the traffic relayed through the tunnel.
  • Offline mailbox items are sealed end to end: they are encrypted on the client's device with your studio's public key, and only your studio's installation holds the key to open them.
  • Error diagnostics are off by default. Before a report leaves the device, email addresses and phone numbers are redacted and request contents and authentication headers are removed. A reduced mode, available on request, limits each report to the error type and the stack trace.
  • Access control on the accounts used to provide these services, with multi-factor authentication on the administrative accounts.

6.7 Sub-processors

You give us general written authorization to engage the following sub-processors:

  • Cloudflare, Inc. (United States) — tunnel, DNS, and the directory service (Workers and Workers KV). Cloudflare operates a global network, so data may be processed outside the EU/EEA; transfers are safeguarded by the EU-US Data Privacy Framework and the Standard Contractual Clauses.
  • Functional Software, Inc. (Sentry) (United States) — error diagnostics, only if you opt in. Data is stored in Sentry's EU data region (Germany); the Standard Contractual Clauses apply where applicable.

Each sub-processor is bound by a data processing agreement imposing data protection obligations equivalent to those in this section, and we remain responsible to you for its performance. We will give at least 30 days' notice of any intended addition or replacement of a sub-processor on this website or in the Software's changelog. If you object, you may stop using the affected service — by no longer using remote connectivity or by turning off error diagnostics — before the change takes effect.

6.8 Assisting you

Taking into account the nature of the processing, we will assist you, as far as possible, in responding to requests from data subjects exercising their rights, and in meeting your obligations under Articles 32 to 36 GDPR (security, notification of personal data breaches, data protection impact assessments and prior consultation), taking into account the information available to us. Because we do not store relayed data, most requests can be handled directly in the Software; for error reports, we can locate and delete them on request.

6.9 Personal data breaches

We will notify you without undue delay after becoming aware of a personal data breach affecting data processed under this section, with the information available to us, so that you can meet your own notification obligations.

6.10 End of processing

We do not store relayed data, so there is none to return or delete. Your directory entry and any offline mailbox items are deleted when you reset or stop using remote connectivity, or on request at support@agon-studio.dev; mailbox items are also deleted as soon as your installation collects them, and in any case after 7 days if they are never collected. Error reports are retained for up to 30 days and then deleted automatically; turning off error diagnostics stops new reports, and we will delete existing ones earlier on request. This applies unless European Union or Member State law requires us to keep the data.

6.11 Information and audits

On request, we will make available to you the information reasonably necessary to demonstrate compliance with Article 28 GDPR, and we will allow for and contribute to audits, including inspections, by you or an auditor you mandate. Given that these services are provided free of charge, audits are limited to what is proportionate: normally written information and documentation, including our sub-processors' certifications and reports, with reasonable advance notice.

6.12 Precedence

For the processing of personal data, this section prevails over any conflicting provision in the rest of these Terms.

7. Acceptable use

You agree not to reverse engineer, decompile, resell, sublicense, or redistribute the Software, except to the extent that applicable law expressly permits it or with our prior written permission, and not to use the Software or the online services for any unlawful purpose or in a way that disrupts them for others.

8. Future versions and distribution terms

We may change future versions of the Software, its features, and the terms on which it is distributed — including by introducing paid versions or plans. We will give notice of such changes (for example on this website or within the Software) before they take effect. Versions you have already installed keep working under the terms under which you obtained them.

9. No warranty

The Software and the online services are provided free of charge, “as is” and “as available,” without warranties of any kind, whether express or implied, including but not limited to implied warranties of merchantability, fitness for a particular purpose, and non-infringement, except to the extent such warranties cannot be excluded under applicable law.

10. Limitation of liability

To the extent permitted by applicable law, we exclude all liability for any damage or loss — including loss of data, revenue, or profits — arising out of or related to your use of, or inability to use, the Software or the online services. This exclusion does not apply to liability for wilful misconduct (dolo) or gross negligence, or to any other liability that cannot be excluded or limited under applicable law, including mandatory consumer-protection law.

11. Governing law

These Terms are governed by the laws of Spain, without regard to conflict-of-law principles. Any dispute not resolved informally will be subject to the jurisdiction of the courts of Barcelona (Spain). This is without prejudice to the mandatory consumer-protection rules that apply to you: if you are a consumer resident in the EU, you keep the protection of the mandatory law of your country of residence and the right to bring proceedings in the courts of that country.

12. Changes to these Terms

We may update these Terms from time to time. Material changes will be notified by posting an updated version on this page with a new “Last updated” date and, where required by law, by direct notice. Consistent with Section 8, changes apply to versions and services obtained or used after they take effect.

13. Support and contact

Support and feedback are handled by email, on a best-effort basis, at support@agon-studio.dev. Questions about these Terms can be sent to the same address.