Privacy Policy

Version 2026-10-08.1 · Effective 2026-10-08 · Applies to ninjahq.ai: the Ninja HQ website and the Ninja HQ administrator app

1. Who we are

Ninja HQ is operated by Peak Beyond, LLC (doing business as NinjaHQ) ("we", "us"), the controller (GDPR, UK GDPR) and business (US state laws) responsible for the personal information described here.

We have not appointed a Data Protection Officer because our processing does not require one. You can reach us about any privacy question through the request form.

2. Athletes and coaches

Ninja HQ gathers results that leagues, timing services and event organizers publish, to understand the sport and build better tools for the gyms and leagues that run it. Since September 30, 2026 this database is not public: only Ninja HQ administrators can view it, after signing in. A gym website that Ninja HQ runs for a gym may show that gym's own competition results.

What we hold

• Competition results: athlete name as the league publishes it, league, division and age group, event, host gym, date, placement, points and time.
• Derived information: rankings and statistics (wins, podiums, averages), the age group per league, a region worked out from the athlete's gym, and gender taken from the division name (for example "Female 13U").
• Profile details from public sources: home gym and years of training from public Ninja Sport Network (NSC) athlete bios, and a short bio and photo from the community-edited Ninja Warrior Wiki where one exists.
• Coaches: names of coaches listed on gym websites or named in public athlete bios, shown on gym pages.

We do not collect athletes' contact details, dates of birth, email addresses or any other private information, even where a source makes them available.

Where it comes from

Public results pages of the Ultimate Ninja Athlete Association (UNAA) and regional leagues (published through Ninja Master), Ninja Sport Network (NSC), and the public LinkIt competition catalog (WNL, FINA and other leagues), plus the Ninja Warrior Wiki and gym websites. Where a website's robots.txt asks automated tools not to visit, we respect it.

Why, and our legal basis

We process this information on the basis of legitimate interests (GDPR/UK GDPR Art. 6(1)(f)): reporting and ranking results from competitions whose results are already made public, for the benefit of athletes, families, gyms and fans. We have weighed these interests against athletes' rights, particularly children's (see section 13). We limit what we hold to sporting information, collect nothing private, keep it to administrators, and remove or correct profiles on request. You can object at any time, and we'll stop using your information unless there are compelling legitimate grounds, which for a sports results listing we generally will not claim.

Under US state laws, much of this is publicly available information. We still honor access, correction and deletion requests from athletes and their parents or guardians wherever they live.

3. Account holders

Ninja HQ accounts are for Ninja HQ administrators: the public website needs no account, and new accounts are created only by an administrator. For account holders we process:

Administrator access. For support, a Ninja HQ administrator can view the site as a particular account holder would see it. Every such access is logged, and the log is included when you download your data. Administrators never receive your sign-in codes or passkeys, and can't change your email address, add passkeys or delete your account while viewing as you.

Emails we send. Only service emails: sign-in emails with a one-time code and a sign-in button; codes to confirm it's you before sensitive changes; a link to confirm a new email address, with a notice to your previous address once it changes; notices when a passkey is added and when your account is deleted; and, if you use the request form, a confirmation of your request. Administrators get an alert about new privacy requests that doesn't include the requester's contact details. We send them through Resend (see section 6), don't track whether emails are opened or links clicked, and stop emailing an address after it bounces or is reported as spam. Legal basis: contract, and legal obligation for privacy-request confirmations.

We don't use your information for advertising, and we don't send marketing email.

4. All visitors

When anyone visits, our hosting provider processes technical data needed to deliver the site and keep it secure: IP address, browser and device type, the pages requested, and the time. We don't use it to identify or track you. To slow down password guessing and spam, we keep counters tied to an IP address, or to a one-way hash of an email address, for 15 to 60 minutes. Legal basis: legitimate interests (security and operating the service).

Visit statistics (first-party analytics)

To see which pages are useful and keep the site working well on every device, we measure visits ourselves. Nothing is stored on your device, no cookies or similar identifiers are used, and no data goes to any analytics company or other third party. When a page is viewed, the site sends our own server the page (for example "/gyms" or an athlete's profile), the page title, how long it was viewed, the website you came from (site name only), any campaign tag in the link, screen width, language, and a few actions such as following an athlete or clicking a link to another site (site name only). Our server adds your device type, operating system and browser (from the browser's standard User-Agent), an approximate location (country, region and city, from our hosting provider's network information), and whether you're signed in (yes or no, not who you are).

To count visits and page-to-page journeys without cookies, the server creates an anonymous visitor code from your IP address and browser, mixed with a random value that changes every day and is then deleted. Your IP address isn't stored, the code can't be turned back into an IP address, and the same person gets a different code each day, so visits can't be linked across days or to an account. Only Ninja HQ administrators can see the statistics, mostly as totals. Legal basis: legitimate interests (understanding and improving the service), with the opt-out below. If your browser sends Do Not Track or Global Privacy Control, we don't count your visits at all. You can also opt out on this browser.

4a. Enquiries and demo requests

If you use the form on our contact page, we receive your name, email address, organization, your role, the website you give us and your message. If you followed a gym's link to us, the form also sends that gym's referral code, and you can tell us who told you about Ninja HQ, so that we can thank them (a gym that introduces another gym gets a free month). We use these details only to reply, to talk with you about Ninja HQ and to credit that introduction, email them to our team through Resend, and keep them in our database (Upstash) for up to 24 months after our last contact, then delete them. We don't add you to a mailing list and don't send you anything you didn't ask for. To stop spam we check the form with a hidden field and a per-network limit. Legal basis: steps at your request before a contract and legitimate interests (answering business enquiries) (GDPR Art. 6(1)(b) and (f)).

4b. The community page and the gym and competition finder

Our community page shows what gyms on Ninja HQ chose to share with the sport: the gym's name and town, whether it offers adaptive classes or scholarships, its gear board posts and its athlete spotlights. A gym decides whether to appear there and can withdraw at any time. A spotlight is written by the gym, which confirms it has the athlete's permission (a parent's or guardian's for anyone under 18) before publishing; to have one changed or removed, ask the gym or send us a request and we will see to it. The finder lists gyms (name, town, website) and upcoming competitions (name, dates, host gym, league, where to register) from leagues' public calendars and gyms' own websites. It contains no athletes, coaches or other people. A referral code in a link (?ref=) names a gym, not you; it stays in the page address and is not stored in your browser.

5. Cookies and storage

We use only cookies that are strictly necessary, so there's no cookie banner and nothing to consent to. There are no analytics, advertising or third-party cookies.

The site doesn't use local storage or other device storage to track you. Our visit statistics work without cookies or device storage. The only exceptions: if you opt out of them, this browser stores a small "don't count me" setting (nhq_no_analytics) so the choice is remembered; and right after you sign in by email, a temporary flag (nhq_offer_passkey, session storage, deleted when read) lets the site offer to set up a passkey once.

6. Service providers and other sites

These providers act as our processors or service providers. They process data only on our instructions under data processing terms that include confidentiality, security and international transfer safeguards.

Links to other sites. Watching a video, opening Google Maps, registering for a competition, or visiting a league or gym website takes you to that site. Its own privacy policy then applies, and it may set its own cookies. Nothing is sent to those sites until you click.

We disclose information to authorities only when the law requires it, or when needed to protect someone's safety or our legal rights. If Ninja HQ were ever transferred to a new operator, this policy would continue to apply to the information transferred.

7. No sale, sharing or advertising

We do not sell personal information and do not share it for cross-context behavioral advertising (as the California Consumer Privacy Act defines those terms), and we haven't done so in the past 12 months. We don't use personal information for targeted advertising, and we don't make decisions about you that produce legal or similarly significant effects. We don't knowingly sell or share information about anyone under 16. We honor Global Privacy Control (GPC) signals as a request to opt out of sale and sharing. Since we do neither, a GPC signal doesn't change how the site works for you.

8. International transfers

Ninja HQ is run from and hosted in the United States. If you're in the European Economic Area, the UK or Switzerland, your information is transferred to the US under appropriate safeguards: the European Commission's Standard Contractual Clauses (and the UK Addendum) in our providers' data processing agreements, and the EU-US Data Privacy Framework where the provider is certified. You can ask us for a copy of these safeguards.

9. How long we keep data

10. Security

We use HTTPS everywhere with HSTS; passwordless sign-in with phishing-resistant passkeys or single-use email codes (limited attempts, hashed, 15-minute expiry); a fresh confirmation before sensitive account changes; email notices for new passkeys and email changes; random session tokens stored only as hashes; HttpOnly SameSite cookies, rate limiting on sign-in and forms, same-origin checks on account changes, a strict Content Security Policy that lets only our own code run and reports anything it blocks, and least-privilege administrator access with an audit log. No system is perfectly secure. If a breach creates a risk to you, we'll notify the relevant authorities and affected people as the law requires (for example, within 72 hours under the GDPR).

11. Your rights

Whatever the law where you live, we offer everyone these rights:

• Access and portability: get a copy of your information in a machine-readable format. Account holders can use My account → Download my data.
• Correction: fix inaccurate information. Change your name or email in My account, or send a request for athlete data.
• Deletion: delete your account in My account → Delete account, or ask us to remove an athlete profile.
• Objection and restriction: object to our use of information based on legitimate interests, or ask us to limit it while a question is resolved.
• Opt out of sale, sharing, targeted advertising and significant profiling. We don't do any of these. You can also opt out of our anonymous visit statistics (section 15).
• Withdraw consent where we rely on it. We currently don't rely on consent.
• No discrimination or retaliation for using your rights.
• Complain to a data protection authority, for example your local EU supervisory authority, the UK Information Commissioner's Office, the California Privacy Protection Agency or your state attorney general, the Office of the Privacy Commissioner of Canada, Brazil's ANPD, or the Office of the Australian Information Commissioner. We'd appreciate the chance to resolve your concern first.

How we handle requests

We reply within one month under the GDPR and UK GDPR (extendable by two months for complex requests), and within 45 days under US state laws (extendable by 45 days), telling you if we need more time. To protect people's information, we verify requests. Account holders confirm by signing in. For athlete data, we may ask a few questions to confirm you're the athlete, or a parent, guardian or authorized agent. We never ask for more than we need, and we delete verification details once the request is closed. An authorized agent can make a request with your written permission, and we may ask you to confirm it directly. If we decline a request, we explain why. Where your state law provides a right to appeal (for example Virginia, Colorado, Connecticut or Texas), reply to our decision to appeal, and a different reviewer will respond within the legal time limit, typically 45 to 60 days.

12. US state privacy notice (including California)

This section is the notice at collection and privacy policy disclosure required by the California Consumer Privacy Act as amended by the CPRA, and by the comprehensive privacy laws of other states (including Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana, Iowa, Delaware, New Hampshire, New Jersey, Tennessee, Minnesota, Maryland, Indiana, Kentucky, Rhode Island and Nebraska). In the past 12 months we have collected:

We don't collect precise geolocation, government identifiers, financial, biometric or health information. We use sensitive personal information only for purposes permitted without a right to limit, so we don't offer a "Limit the Use of My Sensitive Personal Information" link. Retention periods are in section 9. California residents may ask once a year about disclosures for direct marketing ("Shine the Light"). We make none.

Rights for residents of California and other states: to know and access, to delete, to correct, to data portability, to opt out of sale, sharing, targeted advertising and profiling, and to non-discrimination. Make a request below or email fullsend [at] ninjahq [dot] ai. We'll verify it as described in section 11. Metrics about the requests we receive are available on request.

13. Children

Accounts: Ninja HQ accounts are for adult administrators; you must be at least 16 to hold one. The site isn't directed to children under 13, and we don't knowingly collect personal information online from children under 13 (US Children's Online Privacy Protection Act) or offer accounts to children below the age of digital consent where they live. If we learn an account belongs to someone underage, we delete it.

Youth athletes: ninja competitions include youth divisions, and leagues publish those results. We hold the same sporting information and nothing private, visible only to Ninja HQ administrators. A parent or legal guardian can ask us to correct or remove a child's profile at any time. We treat these requests as a priority and don't ask the parent to justify them.

14. Rankings and automated processing

Rankings are calculated automatically from published results. Each finish earns points on one scale (25, 18, 15, 12, 10, 8, 6, 4, 2 and 1 for places 1 to 10), and those points are summed. Athletes are matched across leagues by name, which can occasionally combine or split people with the same name. Rankings are for information only and have no legal or similarly significant effect on anyone. If a ranking or match is wrong, ask for a correction. You can also object to being ranked and ask to be removed.

15. Your privacy choices

16. Make a request

17. Changes and contact

If we change this policy, we'll update the version and effective date above. For significant changes, we'll tell account holders on the site before the changes take effect. Questions: use the request form or email fullsend [at] ninjahq [dot] ai.