Cookie policy

As of 7 August 2026 the tools described on this page are not switched on yet. The tag container that would load them is empty, and today the only cookie this site sets is the staff one described further down.

This page is published ahead of them on purpose. It describes what STEPFIT is adding, what each one does, and what it means for you — so that it is already accurate on the day they start running rather than catching up afterwards. When they go live, this section is the part that changes.

STEPFIT is adding measurement and advertising tools to this site: Google Analytics, Google Ads, a Meta (Facebook and Instagram) pixel, Microsoft Clarity, and a visitor identification service called retention.com.

That is a real change and it is worth being blunt about it. These tools set cookies, they use identifiers that persist between visits, some of them report your visit to a company that also sees you on thousands of other sites, one of them records what happens on the screen, and one of them tries to work out who you are.

They exist so a small studio can tell whether an Instagram post filled a class. That is a fair thing to want. It is still your visit, so the rest of this page says what each one does in plain terms, what we have ruled out, and what you can do about it.

Two things do not change. Card details are never on this site — payment happens on Stripe. And the pages where you actually type something that matters — the booking flow with the waiver signature, a child’s name and an emergency contact, and the careers form with your home address — are kept out of session recording and visitor identification entirely, and none of what you type is sent to any of these companies.

A cookie is a small file a website asks your browser to keep and hand back on your next visit. It is how a site remembers something about you between pages. Some cookies are needed for a site to work at all; others exist to count visitors, or to recognise you again, or to build a profile for advertising.

The same rules in this policy apply to the other ways a site can store or read things in your browser — local storage, device and browser characteristics, an advertising identifier. Calling those something other than cookies would not change what they do.

One, and only staff ever receive it.

When Monica or Carolina signs in to the admin area to post a class or check a roster, we set a cookie called sf_admin that keeps them signed in for twelve hours. It holds a signed session token and nothing else — no name, no email, no browsing history. It is marked so that no script on the page can read it, and it is deleted when they sign out.

If you are booking a class or reading this page, you will never be issued this cookie. Every other cookie described below is set by one of the companies named, not by us.

We want to know basic things: how many people reached the site, where they came from, which pages they read, and how many finished a booking.

Google Analytics does most of that. It sets first-party cookies — names beginning _ga — that hold a randomly generated number for your browser. That number is how it tells a returning visitor from a new one and stitches your pages into one visit. It does not contain your name or your email. It does mean Google, which sees an enormous share of the web, receives a record of your visit to this site.

Vercel Analytics and Speed Insights measure page views and loading speed without cookies. They do not identify you and do not follow you to other websites. They were here before any of the rest and they stay.

Google Tag Manager is the loader that all of this is configured through. Tag Manager itself sets no cookies; the tags inside it do.

None of it runs on the admin area.

Microsoft Clarity records how pages are used: where the pointer moved, what was clicked, how far you scrolled, and a replay of the page as it appeared. It is a video-like reconstruction, not a recording of your camera or your microphone. It sets its own cookies — _clck and _clsk — to tie the parts of one visit together, and the recordings sit on Microsoft’s systems under Microsoft’s privacy statement.

This is the tool on the list with the most obvious way to go wrong, so here is the line we have drawn. Clarity does not run on the booking flow, the careers form, or the contact form. Those are the pages where you type a signature on a liability waiver, a child’s name and age, an emergency contact’s phone number, your home address, or a message meant for us. A recording of somebody signing a waiver is not something to leave to a default setting, so those pages are excluded from recording rather than masked and hoped about.

On the pages it does run on — the home page, the class list, the schedule, the blog — the only thing there is to type is an email address in the "tell me when a class is posted" box, and text you type is masked. If you ever find a field on a recorded page that takes more than that, tell us through the contact page and we will treat it as a fault.

STEPFIT advertises on Google and on Meta’s platforms — Facebook and Instagram — and both need a tag on this site to work the way they are sold.

The Meta pixel reports actions on this site back to Meta: that a page was viewed, that a booking was completed. It sets a first-party cookie called _fbp, and Meta can match what it receives against a Facebook or Instagram account. If you have ever wondered why a studio you looked at once starts appearing in your feed, this is the mechanism.

Google Ads tags do the same job on Google’s side: they record that a click on an ad ended in a booking, and they can add your browser to a remarketing audience so an ad for STEPFIT can be shown to you elsewhere.

What these have in common, and what the measurement tools above do not, is that they are cross-site. They are useful to us because they are useful to Google and Meta, and they are useful to Google and Meta because they see you in a great many other places too.

To be precise about where they run, because the previous section drew a line and this is the exception to it: these tags do count a completed booking, so a "booking finished" event reaches Google and Meta. What reaches them is that a booking happened, not what was in it. Your name, email, phone, emergency contact, the minor’s details and the signature are not passed to any advertising tool, and the pages carrying those fields are still excluded from session recording and from visitor identification.

retention.com is different from everything above and deserves its own heading rather than a line in a list.

Analytics counts visits. This service tries to put a name to one. It takes signals from your visit and matches them against a database built from many other sites and sources, and where it finds a match it can tell us that a particular person — with a name and an email address — was on this site, even though you never filled anything in here.

That is what it is for and there is no gentler way to describe it. It runs on the public marketing pages only: never on the booking flow, never on the careers form, never on the admin area.

If that is not something you want, the controls at the bottom of this page are the practical answer — the service depends on tracking that browser privacy protections and tracker blockers are specifically built to interfere with. You can also write to us through the contact page and ask not to be matched, and we will pass that on.

Some of these are choices made specifically to keep this page shorter:

• Language. English and Spanish are separate addresses — /classes and /es/classes. Your language is in the link you followed, so there is nothing to store.
• Club mode. The dark high-contrast display setting is remembered by your own browser, in local storage, on your device. It never reaches us and it tells us nothing about you.
• Booking. A booking is submitted and confirmed by email. There is no account, no login, and no session to keep for a customer. Nothing on the booking path depends on a cookie.
• Fonts. The typefaces are served from this site rather than from a font network, so loading a page does not announce your visit to anyone else.

Two parts of booking and finding us hand you to another company, and their cookies are theirs, not ours.

Paying. Card payment happens on Stripe’s own hosted checkout page, at a stripe.com address. Stripe sets the cookies it needs there to process the payment and to detect fraud, under Stripe’s privacy policy at stripe.com/privacy. Your card details are never entered on getstepfit.com.

The map. The Tampa page can show a Google map of the venue, and it does not load until you press the button that loads it. Press it and you are loading a piece of Google, which may set cookies at that point. Never press it and nothing is requested from Google and nothing is stored. The address and a plain link to directions are on the page either way, so you never have to load the map to find us.

Links out to Instagram or anywhere else behave the same way: once you are on their site, their policy applies, not this one.

The previous version of this page said there was no banner because there was nothing to ask about. That was true then and it is not the reason any more, so here is where it actually stands.

Florida does not have a law requiring a site to get your permission before setting a cookie, and the Florida Digital Bill of Rights — which does create rights around targeted advertising and the sale of personal information — applies to companies far larger than this one. So the honest position is that a banner is a choice here rather than a legal formality, and a banner that appears only to be clicked away is not privacy.

What is not a choice is being told. That is what this page is: every tool named, what each one does, and which pages each one is kept off. If a banner is added it will be one that actually holds the advertising and identification tools back until you answer, because a banner that loads everything first and asks afterwards is worse than none.

The booking-page exclusions above are not conditional on any of that. They apply whether or not anything is ever asked.

Every browser lets you block or delete cookies and clear local storage, usually under Settings, then Privacy. Blocking all of it will not stop you booking a class — nothing on the booking path depends on a cookie.

Blocking third-party trackers does more than deleting cookies does, and most browsers now have it built in. Safari and Firefox do it by default. Chrome has settings for it. A tracker blocker extension will stop most of what is described on this page, and we would rather say so than pretend the choice is only ours to give.

You can opt out of Google Analytics across every site with Google’s own browser add-on at tools.google.com/dlpage/gaoptout, and you can control ad personalisation in your Google account and in your Facebook or Instagram settings.

Two honest notes. "Do Not Track" is a browser setting almost nobody acts on, and we do not act on it either. Global Privacy Control is a newer signal with real legal force in some states, but not one we currently detect automatically — so today the browser controls above and a message to us through the contact page are what work, and this paragraph will change when that does.

The privacy policy covers what we collect when you book, how long we keep it, and how to ask for a copy or a deletion. This page covers what is stored on, or read from, your device.

If we change this policy we will update the date at the top. If we add a tool that is not on this page, this page changes before it goes live, not after.