How MoveMembers protects your gym and your members
This page says what the product does today, in short sentences, and nothing it does not do. Each statement matches the code or our own security checks. Where something is an option you switch on, we say so.
- Free forever
- No credit card
- No sales call
- 10countries, Thailand first
- 15languages, including Thai
- 0%commission on what you collect
Each studio can only reach its own records
Every studio on MoveMembers has its own members, payments, classes and settings. A signed-in user can only reach the studios their account belongs to.
We tested this directly. We signed in as one studio and tried to read and change the records of another. The request that named another studio's data was answered with the caller's own studio. Changes to a record that belonged to another studio were refused. No attempt reached another studio's records.
The tests are kept and can be run again, so the check does not depend on someone remembering to do it.
Sign-in limits that slow down guessing
Owners and managers sign in with an email address and a password. Passwords are stored as a one-way scrypt hash, never as text.
- Sign-in attempts are limited per network address and per email address
- An account locks for a while after repeated wrong passwords, and the count starts again after a good sign-in
- An address that does not exist gets the same answer, in the same time, as a wrong password, so nobody can use the form to find out who has an account
- A session is signed by the server and has a fixed end date that the server checks on every request
- Changing the password, switching on two-step sign-in or choosing to sign out of every device ends older sessions
- The session cookie cannot be read by page scripts, is only sent over HTTPS in production and is not sent with most requests that start from other sites
- Two-step sign-in with an authenticator app, and backup codes, are available on owner accounts. It is an option each owner switches on
- Members sign in with a one-time code sent to their email, and the number of codes anyone can ask for is limited
Each person can do what their role allows
A studio sets what each role can see and do in Settings under Team and access. Owner, admin, coach and front desk start with different rights, and the owner can adjust them.
The server checks the right on every action. Hiding a button on a screen is not the only protection.
Changing settings, the team and the rights themselves belongs to owners and managers. It cannot be handed to another role by ticking a box.
A studio can also switch on a PIN for its staff, for a tablet at the front desk. With the PIN switched on, sensitive actions ask for it again: refunds, deleting a payment or a member, adjusting credit and exporting data. Wrong PINs are limited, 20 tries in 15 minutes for each person.
Payments are checked on the server
- Prices and totals are worked out by the server from your catalogue. A changed price sent from a browser is not trusted
- A refund can never be larger than what was actually paid, after any discount or gift card
- A sale sent twice from the same ticket, for example by a double tap, is recorded once
- Stripe messages are accepted only when their signature checks out, and the signature is checked before anything is written
- If Stripe sends the same message again, the payment is not counted twice
- Card numbers are never stored by MoveMembers. Card details are typed on Stripe's pages, not ours
- Each studio is paid on its own Stripe account, connected through Stripe Connect
The public API is built on standard sign-in
Apps connect through OAuth with PKCE, which is required for every app. The return address must match exactly what the studio registered, and a sign-in code can be used once. Refresh tokens change at each use, and if an old one is replayed, the whole family is revoked.
Each call is limited to the scopes the app was given, and an app of one studio cannot read or change another studio.
App secrets are stored hashed. Webhook secrets are stored encrypted. Outgoing webhooks are signed, so the receiving system can check they come from MoveMembers, and calls are rate limited.
Exports, outgoing addresses and the browser
- CSV exports neutralise any cell that starts with =, +, - or @, so a hostile name typed into a form cannot run as a spreadsheet formula when staff open the file
- When a studio enters a web address for the server to call, such as a webhook or a connector, it must be a public address. Private and internal addresses are refused, and every redirect is checked again
- Every page is served over HTTPS, and browsers are told to use only HTTPS for two years
- Browsers are told not to guess file types, to keep the site out of frames on other sites, to share little in the referrer and to leave the microphone and location switched off. The camera is allowed on our own pages only
- Keys and passwords are kept outside the code repository. The keys a studio saves for its integrations are never sent back to the screen in full
The assistant does not see member records
The assistant that answers questions in the app uses a language model from Anthropic. It answers from the help guide, from the list of what the product can do and, when it helps you set something up, from the names of the studio's classes and messages and its settings.
It is not given member records. The checks on the server refuse to send a request that carries member data.
What you type to the assistant is sent with the question, so do not type a member's personal details into it.
Servers in Europe, and backups kept away from the server
The MoveMembers servers are in Europe, with IONOS.
The database is backed up automatically every 4 hours. Each backup is checked for integrity and copied off the server.
You keep your data, and you can take it with you
Your data is kept while your account exists.
You can export your data at any time. In Settings, open Data & history, then Export data. You get your member list, payments and memberships as CSV files. An owner or manager can also download Data export, one file with members, memberships, payments, attendance, waivers and grades.
The owner can delete the account in Settings, on the Security tab, under Sensitive zone, with Delete the account. It asks for the password again and sends a confirmation link by email that works for 2 hours. Once the link is used, everything the account holds is erased from our live system straight away: members, memberships, payments, bookings, classes, staff, settings, performance results, conversations and their messages, support messages and their files, email history and the account's log. We keep only one line that says the account was deleted, when and by whom. There is no recycle bin and no waiting period, so the app first downloads a copy of your data to your device. Backups made before that are not edited. They drop out as old backups are removed, as described under Backups and hosting.
You can also ask us to delete your data: email hello@movemembers.com. We delete it within 30 days. Backups made before that drop out as old backups are removed.
Who handles data on our behalf
These are the services that process studio data for MoveMembers. Some only apply if the studio chooses them.
| Service | What it is used for | What it receives |
|---|---|---|
| Stripe | Card payments, and each studio's own Stripe account | Payment details typed on Stripe's pages, and the amounts to charge |
| Postmark | Sending email: confirmations, reminders, receipts and sign-in codes | The recipient's address and the text of each email |
| IONOS | Hosting of the servers, in Europe | The studio's records, as stored by the product |
| Google Drive | Storage of backup copies away from the server | The backup files |
| Anthropic | The language model behind the assistant and behind the translation of message templates | What you type to the assistant, the help guide, the names of the studio's classes, messages and settings, and the text of a message template when the studio asks for it to be translated. Never member records |
| LINE | Messages to members, only when the studio connects its own LINE Official Account | The messages the studio sends through its account |
| WhatsApp (Meta) | Messages to members, only when the studio connects its own WhatsApp Business account | The messages the studio sends through its account, with the member's phone number |
| Twilio | Text messages (SMS) to members, only when the studio connects its own Twilio account | The text of each message and the member's phone number |
A new service that handles studio data is added to this list before it is used.
Found something? Tell us
Email hello@movemembers.com and describe what you saw and how to repeat it. Please do not use real member data, and please do not try to reach another studio's records.
A report goes to the people who run the product.
What is an option, and what is not covered here
- Two-step sign-in and the staff PIN are options. A studio that does not switch them on does not have them
- A password is only as strong as the one chosen. Use one that you do not use anywhere else
- The assistant sends what you type to it. Keep personal details out of your questions
- This page covers MoveMembers. It does not cover the Stripe, LINE or Google accounts that a studio holds itself
Questions owners ask
Can another studio see my members?
No. Each studio only reaches its own records. We tested it by signing in as one studio and trying to read and change another's, and no attempt reached the other studio.
Does MoveMembers store card numbers?
No. Card details are typed on Stripe's pages, and Stripe handles them. Each studio is paid on its own Stripe account.
Where is my data stored?
On servers in Europe, hosted by IONOS. Backups are made automatically every 4 hours, checked for integrity and copied off the server.
Can I export my data?
Yes, at any time. In Settings, open Data & history, then Export data. You get CSV lists of members, payments and memberships, and owners and managers can also download Data export, one file with the whole account.
How do I get my data deleted?
An owner can delete the account in Settings, on the Security tab, and everything it holds is erased from our live system straight away. You can also email hello@movemembers.com, and we delete it within 30 days. Backups made before that drop out as old backups are removed.
Does the assistant read my member list?
No. It is not given member records, and the server refuses a request that carries member data. It does receive what you type to it, so keep personal details out of your questions.
Can I turn on two-step sign-in?
Yes. Owner accounts can use an authenticator app, with backup codes. It is an option you switch on in your profile.
How do I report a security problem?
Email hello@movemembers.com with what you found and how to repeat it.
See how your studio would be set up
Free up to 20 active members, no credit card, no time limit.
- Free forever
- No credit card
- No sales call