Privacy

The short version

We collect what running the platform needs, we say what that is, and we don’t sell it. Where we could have built something invasive and didn’t, that’s written down below rather than left to trust.

What we collect

• Account basics. Your email address, and whatever you choose to put on your profile.
• Date of birth. Asked once, first thing when you create your account, however you sign up. It keeps under-13s off the platform; keeps the agreements for gender and orientation, health intake, and being listed as looking for someone, and marketing email, for people 16 and over; keeps looking for a practice partner for people 18 and over; and decides whether 18+ verification is possible for the account. It is never shown to other users.
• What you do here. Experiences you join, skills and practice you log, portfolios, messages, tickets and orders.
• Documents you file. Waivers, releases, intake and questionnaire forms you fill in for an instructor or host, including your signature and the date you signed.
• Payment details are handled by Stripe. Card numbers never reach us.

Sensitive information

Some of what people put on Arsclepius is sensitive by any definition: injury and health notes on an intake form, the disciplines you practice, gender and orientation if you fill them in, and the fact that an account has opened the 18+ tier or uses partner seeking.

We treat all of it as sensitive rather than ordinary profile data. It is never sold, never rented, never used to target advertising, never used to build a profile of you for anyone else, and never used to train any machine-learning model, ours or anybody else’s. Gender and orientation have their own visibility controls in Settings → Privacy and default to the narrowest setting you chose.

Documents, waivers and intake forms

A filled-in intake or medical questionnaire is sealed. It is stored for you and for the instructor or host you filed it with. Their team can open it too: for an event, the event’s owner and anyone they invited as a collaborator, because those are the people running the door, and for a course or an offering, anyone who can edit it. Nobody else on the platform can open it. Beyond that:

• It is never read by our software. Its contents are not parsed, indexed, searched, summarised, or used to generate anything.
• It is never sent to any AI model, including the ones that draft practice plans. Where a plan needs to work around an injury, the instructor writes that constraint in their own words, and only their sentence is used.
• It is never overwritten. Filling a form again supersedes the old version; the signed original is kept so a waiver can still be produced later.

If you do not have an account. An instructor can email you a link to a document instead of asking you to sign up. Filling it in stores the email address you give, the name you print, your signature and your answers, filed to the instructor who sent it, and everything in this section applies to it. To see what we hold about you, or to ask us to delete it, write to privacy@arsclepius.com.

Please do not file clinical records here. See the Health information section of the Terms for what this platform is and is not.

Website analytics

We count visits to our public pages. What is recorded is a daily total per page, the referring website’s domain, any campaign tag on the link you followed, a coarse device type, whether the visit was somebody’s first (only if they allowed counting return visits; see Cookies and browser storage), whether the reader was signed in, and the hour of the day it happened.

Location is recorded as country, state or province, and city, together with the hour. We do not work that out from your address ourselves. Our hosting network does it at the edge and passes us only the answer, so a city is all our code ever learns about where you are. City-level counts are what tell us whether the people reading this are our neighbours or on the other side of the country, which is the difference between running a class in Queens and running it online. It is coarse by design: a city and an hour, never a street, a postcode, or a set of coordinates.

Your address is read for one other reason, and it is worth saying plainly. Pages anyone can reach without an account, this counter included, limit how fast the same connection can hit them, and that check needs something to count against. It counts against a scrambled form of your address that changes every day, is held for the few minutes the check covers, and is then deleted. The address itself is never stored, and it is never used to work out where you are.

We also count signups by channel. If you allowed counting return visits, your browser keeps a note of the site that sent you and any campaign tag on the link, and hands that one fact back if you go on to create an account. Without it, a signup is still counted, as having come from nowhere in particular. What is stored is a daily count: that a campaign brought in four people today. Your account is not in that row, and nothing links it to you.

Two honest notes about that. A city is a rough guess made from network routing, so yours may be wrong by some miles or occasionally wrong outright. And while these are counts rather than records of people, a count can be small: on a quiet day a city with one visit in it is one visit. There is still nothing in the row that identifies anyone and nothing that can be joined to an account, but we would rather say that plainly than call it anonymous and leave it there.

What is not recorded: your IP address, which is read only for the rate check above and is never written onto a count, your browser’s user-agent string, any cookie or visitor identifier, or a row that represents you. “Signed in or not” is worked out by checking whether a login cookie exists, without opening it: no account is looked up and the count keeps the yes/no, not the who. We separate the two because the point of these numbers is the people who have not signed up, and members reading the same public pages were drowning them out. Page addresses are stripped in your browser before anything is sent, so a username in a profile URL never leaves your device. “First visit or not” is a yes/no your browser reports about itself, and only if you said yes to counting return visits. There is no identifier behind it, which means we can see how many people return and cannot see whether you did.

We do not use advertising trackers, and there is no third-party analytics script on the site. Everything the site keeps in your browser is listed in the next section.

Cookies and browser storage

Some things are kept in your browser, as cookies or in its local storage. Most are needed for the site to work at all and are always on. Two are optional, and nothing optional runs until you say yes. We ask the first time you visit, and you can change your answer at any time from Cookie choices, which is also at the bottom of our public pages and in Settings → Privacy. The answer is kept in your browser, so each browser you use has its own. If your browser sends a Global Privacy Control signal, we take it as no to both and do not ask, and it overrides a yes you gave before you switched it on. A yes you give from Cookie choices while the signal is on is your choice for this site, and it stands.

Always on, because the site needs them:

• Signing in. Cookies from Supabase, our login provider, that keep you signed in, and one that remembers which sign-in this browser has already told us about, so we email you once about a new sign-in rather than on every visit. They last until you sign out, or up to 400 days.
• Security. A cookie that lasts ten minutes and protects the step where you connect a Canva account, if you do. When we switch it on, Cloudflare’s check that a person rather than a script is signing in also runs here; see Who else handles your data.
• Your settings on this device. Local storage that remembers what you chose and keeps the app quick: a tip or notice you closed, a draft you have not posted yet, a filter, the companion’s panel, a tour you have seen, copies of pages you already opened, and this cookie answer itself. One of them is a count of how many times you have opened the app on this device, so that the questions about notifications and installing the app wait until your third visit instead of meeting you on your first. All of these stay in your browser: none is sent to us, and none is used to follow you.

Optional, and off until you say yes:

• Counting return visits. A yes/no note that this browser has been here before, a note that this tab’s visit has started, and the site and campaign tag that sent you this visit. They are what let us count new and returning visitors and which links bring in people who sign up, as described under Website analytics. None of them holds a name, an account or an identifier, and saying no deletes them. With this off we still count the page view, and nothing is kept in your browser for it.
• Maps from Google. Event and venue pages can show a Google map. When one loads, Google receives your IP address and can set its own cookies, under Google’s privacy policy. With this off, each map waits until you tap Show map, and that tap loads only that one map. The Open in Google Maps link works either way.

A few features reach another company only when you use them: the location box in Explore’s filters and the address field when you create an event or a place load Google’s place search, and a GIF in a chat loads from Google’s Tenor, for whoever searched for it and for everyone who sees the message. Those are listed under Who else handles your data. We put no advertising cookies, no social media pixels and no third-party analytics on the site.

Email measurement

We do not measure whether you open our email or which links you click. Nothing we send carries an open pixel or a rewritten link, marketing or service.

What is recorded is what happened to the message itself: that it was sent, delivered, delayed, bounced, or reported as spam, against the address it went to. That is how an address that bounces stops being mailed. If we ever start measuring opens and clicks it will be marketing email only, meaning the newsletter and announcements you opted into, and the sentence you agree to when you subscribe will say so before you agree to it.

Why we collect it

To run the platform and give you the features you asked for, to take payments and pay hosts, to keep people safe and enforce the guidelines, to meet our legal obligations, and to understand whether what we make is worth making. Where the law requires your consent rather than one of those reasons, we ask for it separately and you can withdraw it.

AI features

Some tools on Arsclepius draft text for you: practice plans, agendas, event and course descriptions, document drafts, practice summaries. When you use one, the material you are drafting from is sent to Anthropic, which runs the model and returns the draft. Anthropic does not use it to train models.

What is never sent: your private messages, your intake and medical questionnaires, and the waivers and forms you have signed. A drafting tool can only open the two kinds of document that exist to describe training, meaning a skills assessment an instructor set for you and a training note they wrote. Everything else your instructor holds for you is closed to it, whether or not anyone remembered to label it.

AI features are something you trigger, never something that runs over your data in the background. The one case where a tool reads material of yours on somebody else’s action is your instructor asking for a draft practice plan for you, which can see the assessments and notes above, plus the training constraint they wrote themselves.

Who else handles your data

Each of these receives only what its job needs, and none of them may use it for their own purposes.

• Vercel hosts and delivers the site.
• Supabase runs the database, file storage and authentication.
• Stripe handles payments, host payouts and identity verification.
• Resend delivers our email.
• Anthropic runs the models behind the AI drafting tools described above.
• Canva, only if you connect your Canva account, so designs can move between it and Arsclepius.
• Cloudflare, if a bot check appears when you sign in, sign up, reset a password or use the support form. Your browser sends Cloudflare details about the device and connection so it can tell a person from a script, and we get back only a pass or a fail.
• Google, for address lookup when you type a venue or filter by place, maps on event and venue pages if you allow them or tap Show map, GIFs in chat (loaded from Tenor by whoever sends or sees one), and calendar links you choose to open.
• ipapi.co, if you press Use current location while setting up your account. Your browser asks it where you are and it answers with a country, state, city and postcode, which we put in the form for you to check or change. Because your browser does the asking, ipapi.co sees your IP address. Skip the button and nothing is sent.
• OpenStreetMap, if you press Use current location in Settings → Profile. That button asks your device for its coordinates and sends them to OpenStreetMap’s lookup service, which turns them into a country, state, city and postcode for the form. The service is run from outside the United States. Nothing is sent unless you press the button, and the coordinates themselves are never stored.

Your calendar link

Settings → Connected apps can issue you a private web address that Google Calendar, Apple Calendar or Outlook can subscribe to. There is none until you ask for one.

What is published at that address is what is already on your Arsclepius agenda: events you host, events you hold a ticket for, the code printed on each of those tickets, private sessions with the other person’s name on them, and your practice days. There is no password on it. The address is the secret, so anyone who has it can read your schedule, and so can the calendar company you paste it into, for as long as you stay subscribed. We record when a calendar app last read it, so you can tell whether your subscription is working.

Reset the link or turn it off at any time from Settings → Connected apps. The old address stops working immediately, and every device you subscribed will need the new one.

We do not sell your data, and we do not share it for cross-context behavioural advertising. If Arsclepius ever introduces a data-sharing feature, it will be opt-in.

Age verification

The 18+ areas of Arsclepius open only after an identity check, which we use Stripe Identity for. Before it starts we ask you to agree to it separately, and we record the date you did.

Stripe collects your name, images of your identity document, facial images including a scan of facial geometry used to match your selfie to your document, and information about the device used. Stripe uses them to verify you and to detect fraud, and returns a result to us. What lands in our database is a yes or no, the date it happened, and the fact that you consented. We never receive or store your document, your photos, or your facial geometry. Where the date of birth printed on your ID can be read, Stripe returns it to us once, at the moment the check completes. We use it only to confirm you are over 18, and we do not store it.

Stripe deletes the images and the facial geometry once verification is complete and its own retention obligations allow, and in no case keeps the biometric identifiers longer than three years. You can ask us to delete your verification data at any time; we then redact the verification on Stripe’s side as well, and Stripe keeps only what its own legal obligations require. Stripe’s privacy policy is at stripe.com/privacy.

How long we keep it

• Your profile and the things that are only about you, for as long as the account is open. Closing it removes your sign-in and deletes your profile details, your practice and skill history, your disciplines, your albums and the files in them, your avatar, your saved settings and your connected apps.
• What you made for other people, kept after you close the account with your name replaced by “Deleted account”. That is messages and the photos and videos attached to them, comments, the events, courses, services and experiences you ran and the media on them, and the documents you authored. Deleting those would take other people’s records with them.
• Your record of what you agreed to, and when, and to the exact wording you were shown, for as long as the account is open. Closing it deletes these too.
• Signed waivers, releases and intake forms, for seven years after signing, because their whole purpose is being producible later. They survive account closure for that reason, tied to the instructor who holds them rather than to your profile.
• Orders, receipts and payout records, for seven years, for tax and accounting.
• Age verification result, for as long as the account is open, then deleted with it.
• Security and moderation logs, up to two years.
• Marketing consent and unsubscribe records, kept after you unsubscribe, because proving you were taken off the list requires keeping the record that you were.
• Website analytics, indefinitely, because it is daily counts with nobody in them: a page, a place, an hour, and a number.

Where it is held

Arsclepius is operated from the United States and your data is stored and processed there, by us and by the providers listed above. If you use the platform from elsewhere, you are sending your data to the United States.

How we protect it

Access to every row is enforced by the database itself rather than by the app asking politely, so a bug in a page cannot hand someone another person’s records. Private messages are encrypted at rest with keys the application cannot read back in bulk. Accounts can turn on two-factor authentication in Settings. Traffic is encrypted in transit. Payment card details never touch our servers.

No system is perfect. If a breach affects your personal information, we will tell you and the relevant regulators as the law requires.

Your rights and your control

Depending on where you live you may have the right to see what we hold, get a copy, correct it, delete it, limit how we use sensitive information, or object to a use. We honour these requests wherever you live, not only where they are mandatory, and we will not treat you differently for making one.

• Get a copy of everything: Settings → Account → Export.
• Delete your account and data: Settings → Account. Closing is immediate, permanent, and cannot be undone. Everything that is only about you is deleted. What other people’s records depend on stays under an anonymous “Deleted account”, and signed waivers and financial records are kept for the periods above. A few things have to be settled first, such as money still held from one of your events or an upcoming event that still has ticket holders. Settings → Account lists them.
• Profile visibility and who can message you: Settings → Privacy.
• Which email and notifications you get: Settings → Notifications. Marketing email unsubscribes from any message, no login needed. Unsubscribing, unticking a topic, or deleting your account takes you off at once, including at the company that sends our email. Unsubscribing through one of our emails, or marking one as spam, also stops announcements to that address; email about things you did continues.
• Anything else, including correcting something you cannot change yourself, or asking us to delete your age verification: write to privacy@arsclepius.com. We answer within one month, or 45 days where a US state’s law gives that.
• No account? If you bought a ticket as a guest, filled in a form an instructor emailed you, or joined our mailing list, write to privacy@arsclepius.com from the address you used. We confirm the request by replying to that address, then do what you asked.

Children

Arsclepius is not for anyone under 13, and we do not knowingly collect anything from them. If the date of birth given is under 13, signing up stops there: the account is never finished, and any sign-in already started is ended. If you believe a child under 13 has an account, tell us at privacy@arsclepius.com and we will remove it.

If you are 13, 14 or 15, you cannot agree on your own to us storing your gender, orientation or health information, to being listed as looking for someone, or to marketing email, so those parts stay off for your account. Looking for a practice partner is for people 18 and over.

Contact

Arsclepius LLC is the controller of the personal information described here. Privacy questions and requests go to privacy@arsclepius.com.