Privacy notice

FairFightz is a members' platform for UK Muay Thai, kickboxing, MMA and other fight gyms. This notice explains what we hold about you, where it comes from, why, who sees it, how long we keep it, and your rights. It covers gym owners and coaches who log in, fighters listed by their gym, people put forward for an interclub (including juniors and their parent or guardian), people named on a fight poster or fight list, and gyms we contact before they join.

Who we are. FairFightz (fairfightz.com) is the controller of the personal data described here. Email us at hello@fairfightz.com about anything in this notice.

Where it comes from

• From you, when you sign up, use FairFightz or contact us.
• From a fighter's gym, which adds them and must have their agreement first.
• From fight posters, results and fight lists that gyms and promoters bring in.
• From public sources we check for you: Google Maps, a gym's own website and social media pages, and public results pages (see below).

What we hold

• Gym logins: name, email, a scrambled (hashed) password, role, and when you log in.
• Gyms: name, address and postcode, head coach, the one contact each gym chooses to share with other member gyms (name, phone, email), and our billing reference from Stripe.
• Fighters: real name and any nickname or other names they've fought under, men's or women's category, age, weight (and weights logged over time), stance, sport, class or belt, a photo, their fight record, gyms they've trained at, whether they're available to fight, and any other combat experience the gym declares (junior bouts, boxing, kickboxing, MMA, grappling).
• Licence and medical paperwork: a licence number if the gym enters one, and the expiry dates of the fighter's licence, medical and blood tests, so the gym knows when they're fight-ready. We never hold medical results, conditions or the documents themselves. Promoters and officials check those at the weigh-in.
• Fights, offers and results: fight offers between gyms (with a snapshot of both fighters at the time), sparring requests, “opponents wanted” posts, and each gym's own answer on how a fight went, with any link it gives as evidence.
• Messages between gyms on FairFightz, blocks, and reports about them.
• Fight lists a gym brings in to pair up: names, gyms, weights and records of the people on the list.
• Interclub entries: when a gym member puts their name forward from their gym's link, their name, weight, men's or women's, how many fights they've had and an optional note to their coach. No account is needed. Hosts see the entries a gym sends them.
• Juniors at interclubs: where a host accepts juniors (ages 8 to 17), we ask for the junior's date of birth but keep only their age on the day of the interclub, plus their parent or guardian's name and their agreement. See Juniors below.
• What a fighter sends from a fill-in link (only where switched on): their photo, weight, date of birth (to check they're an adult; once their coach decides, we keep their age, not the date), other combat experience, licence and medical expiry dates, and their agreement to be listed. The link works once, for 14 days, and needs no account.
• Gym details we find for you to check: when you sign up and type your postcode, we look your gym up on Google Maps (address, phone, website), read your website's home page for a link to your Instagram and, only if there isn't one, run one web search for it. You confirm or change each detail. We keep what you confirm, where each detail came from, and Google's ID for your gym; Google's other answers are deleted within a day.
• “Are these your fighters?” (only where switched on): when a gym signs up, we read that gym's own public website, Instagram and Facebook posts and show the coach the fighters they seem to name. The coach ticks each one before anything is saved; nobody unticked is added.
• A fighter's Muay Thai Records page (only where switched on): when a gym adds a fighter, we look up their public page on Muay Thai Records and show the gym each bout, with how far we trust it. Nothing goes on their record unless the gym ticks it, and those bouts are marked not yet confirmed until the other gym agrees.
• Past fights we find for a fighter (only where switched on, and only if the gym confirms the fighter agreed): one search of public results pages, with the page each fight came from. Nothing goes on their record unless the gym ticks it. This search never uses Muay Thai Records, Warrior Boxing, Tapology, Fight Record, Facebook or Instagram.
• Your Instagram, if you connect it: your account name, a login token (stored encrypted), and the post images you tick as fight posters. We see only your own account and delete the token when you disconnect.
• Set-up requests, removal requests, disputes and feedback: your name, email, phone (for set-up), how you're connected to the fighter, what you sent us and what we did about it.
• Gyms that haven't joined yet: a gym's name, town and public business details from posters and Google, and our notes on when we contacted it. We contact gyms one at a time, never by mass email.
• Running and protecting the service: simple counts of how the platform is used (logins, fighters added, offers sent), a log of admin actions, a copy of each email we send (including a short preview of any message it tells you about), phone alert subscriptions if you turn them on, and, for a day, the IP address and email of login attempts so we can stop password guessing. No advertising or third-party tracking.

Why, and our lawful basis

• Running the membership (logins, billing, support, emails about your account): to perform our contract with the gym.
• Listing fighters and matching them fairly and safely: our legitimate interest, and the gym's, in arranging fair, safe bouts. Gyms must have each fighter's agreement before listing them, and record when they did. Fighters on a gym's roster must be adults (18+).
• Licence and medical expiry dates: our legitimate interest, and the gym's, in making sure nobody is offered a fight with out-of-date paperwork. These are dates, not health information.
• Messages, reports and blocks: our legitimate interest in letting gyms arrange fights, and in keeping that safe.
• Fight records and results: our legitimate interest in accurate, checkable records. Every result shows where it came from. When the two gyms give different answers, we check with the promoter of the show.
• Interclub entries, including juniors: our legitimate interest, the gym's and the host's, in running the interclub, with the parent or guardian's agreement for anyone under 18.
• Finding a gym's details, and setting gyms up for them: to take the steps you ask for before joining (contract), and our legitimate interest in checking every gym is real.
• Contacting gyms that haven't joined: our legitimate interest in telling fight gyms about FairFightz, one gym at a time. Tell us to stop and we will.
• Finding fights from public pages (Muay Thai Records and the fight finder): our legitimate interest, and the gym's, in complete and accurate records. Because these fights come from other websites rather than from the fighter, this notice is how we tell them (UK GDPR Article 14). Anyone can ask us to remove a found fight with the removal form.
• Usage counts, logs and security: our legitimate interest in knowing whether FairFightz is useful, and in keeping it secure.
• Phone alerts: your consent. Turn them off on your device or in FairFightz at any time.

Juniors (under 18)

• Juniors are never listed on a gym's roster. They appear only as entries for a particular interclub whose host has switched juniors on.
• A junior can only be put forward with their parent or guardian's name and agreement.
• We keep their age on the day, not their date of birth.
• Their own gym sees their name, age, the guardian's name and any note. The host sees their name, gym, age, weight and number of fights, and that a guardian agreed, but not the guardian's name.
• Juniors' details are deleted a month after the interclub.
• A parent or guardian can use any of the rights below for their child, including the removal form.

Who can see what

• Fighter photos and declared experience: approved member gyms only. They aren't shown on any public page. A gym can download a share graphic of a booked or finished fight, with both fighters' photos, to post on its own social media.
• A gym's contact details: approved member gyms only.
• Messages: only the gyms in that conversation. FairFightz staff read a conversation only if someone reports it, and every such read is logged.
• People on a fight list who aren't on FairFightz: only the gym that brought the list in.
• Interclub entries: the entrant's gym and the host. When the card is published, the gyms taking part are told who's fighting whom.
• Private links a gym chooses to share: a fighter's fight passport shows their name, gym, weight, class, stance and confirmed fights (with opponents' names and dates), and a gym's calendar link shows its booked fights and paperwork expiry dates. Anyone with the link can open it, search engines are told not to list them, and we'll switch a link off if the gym asks.
• Scores and flags: FairFightz works out a match score (fair, check first or risky), safety flags (such as a recent stoppage or a big weight gap) and a class check from what gyms enter. Member gyms see these when matching. They are guidance for coaches, who make every decision; nothing is decided about a fighter by a computer alone. A fighter with missing paperwork, photo or declared experience isn't shown to other gyms until their gym adds it.

Who processes data for us

• Hosting: Fly.io (London). Database, uploaded files and backups: Supabase (London).
• Email: Resend. Emailed-in posters: Postmark (only where switched on).
• Card payments: Stripe (we never see or store card numbers).
• Maps and drive times: Google Maps (gym names, postcodes and locations), postcodes.io (postcodes only), and OpenStreetMap for addresses outside the UK.
• Reading posters and fight-list photos, web searches for a gym's Instagram name and a fighter's past fights, and finding fighters' names in a gym's posts: Anthropic (the image or text is sent to be read; it isn't used to train their models).
• Reading a signing-up gym's own public Instagram and Facebook posts, where switched on: Apify (the gym's page names are sent).
• Instagram connect: Meta, through Instagram's own login, only if a gym chooses to connect.
• Muay Thai Records lookups, where switched on: the fighter's name is sent to muaythairecords.com to find their page.
• Phone alerts: Apple, Google or Mozilla's push services deliver the alert, which can name a fighter.
• Error reports: Sentry, if switched on (details of what went wrong, which can include who was logged in).

Some of these are based in the USA. Transfers are covered by the UK International Data Transfer Addendum or the UK–US data bridge.

How long we keep it

• Messages: deleted 12 months after a conversation's last message. Copies of emails we send: 90 days.
• Fight lists: 90 days after the list's date.
• Interclub sign-ups, sign-up links, and entries on the card for people who aren't on FairFightz: a month after the interclub.
• Fill-in link replies: the date of birth is removed when the coach decides, and a reply nobody decided on is deleted 30 days after the link expires.
• Login attempts (IP address and email): 24 hours. Google's answers about your gym: 1 day.
• A gym that leaves: logins, contact details, and its fighters' photos and declared experience are deleted 90 days after it leaves. Its offers, sparring, posts and weight logs go at the same time (an offer someone raised a dispute about is kept with the dispute, and goes with it).
• Fight results, and each gym's answer about them: kept, because they are part of other fighters' records too. A fighter can ask for theirs to be anonymised (see below).
• Removal requests, disputes and feedback: 2 years after they're closed. Admin logs and usage counts: 2 years. Gyms we contacted that didn't join: 12 months after the last contact, or straight away if they ask. Applications we declined: 2 years, so the same gym can't re-apply under a new name. Phone alert subscriptions: when you turn them off or log out.
• Backups roll over within 30 days.

Keeping it safe

Data is encrypted in transit and stored in London. Passwords are hashed, Instagram tokens are encrypted, and staff access is limited and logged. If a breach put you at risk, we'd tell you and the ICO as the law requires.

Your rights

You can ask us to:

• give you a copy of what we hold about you;
• correct it;
• delete it or anonymise it;
• stop or limit how we use it, or object to it;
• give you what you gave us in a format you can take elsewhere.

Where we rely on your agreement, you can withdraw it at any time. Email hello@fairfightz.com. Fighters, or a parent or guardian, can also use the removal and correction form without logging in. We act within a month, and usually much sooner. If you're not happy with how we handle it, you can complain to the Information Commissioner's Office at ico.org.uk.

Cookies

One cookie, to keep you logged in. Your browser also remembers a few things on your own device to make FairFightz work, such as your place in a search and, if you turn on phone alerts, the alert subscription. No advertising or analytics cookies, so we don't ask you to accept any.

Changes

If we change this notice in a way that matters, we'll tell member gyms by email first. The date at the top shows when it last changed.