Politique de confidentialité

Scope & contact

BJJ Training App (“we”, “us”) operates this website and app. This notice describes the processing we control. A linked provider may also process data under its own notice. Questions or privacy requests can be sent to support@bjjtraining.app.

This is a training journal, not a medical service. Injury and weight entries can still be sensitive and receive the same private-by-default access controls as other account data. Gyms that use the app also keep their own records about the people they teach; this notice explains what those records hold and who can see them.

Data we process

• Account and identity: email, name, optional phone, avatar, belt, role, the date of birth you give us, authentication/session records, signed-in devices and their last activity, locale, and preferences.
• Training: journal text, dates, techniques, partners, outcomes, goals, review history, belt history, timer presets, private lessons, coach feedback, and legacy Training Mode cards.
• Health-adjacent and competition: injury notes, daily injury pain scores from 0 to 10 that you choose to log, weight and weight goals, perceived effort, readiness signals, competitions, matches, and target divisions.
• Travel: saved gyms, locations, private training places you save, planned training dates, and reminder preferences.
• Media: photos or other journal media you choose to upload to the private journal-media storage bucket.
• Video Library: public YouTube, Instagram, TikTok, or X links you save, plus your title, creator, position, technique, tags, rating, study status, favorite choice, and notes. When you play a saved YouTube video in your Library, the player is given this site's address so it can report the playback position, video length, and playlist part, which the app stores with that item to show your progress and resume point. No Library notes or account details go to YouTube. When you add a public YouTube or TikTok link, the canonical link is sent to that provider's oEmbed service to request a title and creator suggestion. Your Library notes, categories, account id, and other private app data are not included in that request. After you save a public YouTube or TikTok link, a background job also sends that public link, never your notes or account, to the provider about every 29 days to refresh its public title and creator, and for YouTube the app stores one copy of the public thumbnail for up to 29 days between refreshes. This refresh runs whether or not Video Discovery is on, and one shared record is kept per public video, whoever saved it. If you import a public YouTube playlist, its public video list is read through the YouTube Data API. Instagram and X links are not sent to their providers for metadata. Links to private study sites such as Submeta or BJJ Fanatics, and Smoothcomp competition links, are stored as links only and never fetched. After Play, an authenticated same-origin wrapper may fetch allowlisted official TikTok embed HTML; that HTML is not stored. The bulk-transfer tool parses a selected CSV or XLSX file in your browser; it does not upload or retain the raw file. Only structured candidate rows are sent after you prepare or confirm an import, and bulk import makes no provider metadata or media request. After you sign in, an approved TikTok short-share link may be sent to TikTok only to follow bounded redirect headers and identify its canonical public video URL; the app does not read the response page or send cookies or a referrer. If you use the installed app's Android or ChromeOS share action, the app briefly checks the shared URL, text, and title to find one supported public link; it discards the raw text and title, stages only the validated link in the add form, and never saves without your action.
• Video Discovery (release-gated): when separately release-enabled, the Discovery feature can store one shared provider resource and, where approved, one deduplicated thumbnail for the same public video across multiple savers. It publishes only provider title/creator details and aggregate contributor counts after a user explicitly opts in to app-wide contribution and the item is eligible and enabled for contribution; saver identities, notes, ratings, tags, journal/coaching context, and other private Library fields never enter Discovery. Existing Library items remain private until their owner completes a one-time review. Completing that review does not enable app-wide contribution. Users can disable app, gym, or item contribution; gyms are off by default and may set a minimum contributor threshold. Required-reason reports, gym suppressions, site moderation, and permanent takedowns are audited. Provider players are click-to-load: no provider iframe is created until the user presses Play.
• Gyms and gym operations: gym membership, role, invitations, guardian relationships, program enrollment, signed waiver history, occurrence attendance, grading, gym-authored incident evidence, coach notes about a child, event registrations, orders, and per-Gym athlete-private scope grants and revocations. Each Gym keeps a roster record for each person it teaches, which can include their name, preferred name, email, date of birth, home gym, rank, experience and injury notes given to the Gym, and training, media, competition and travel consents. When you sign a Gym waiver in the app, at the Gym's check-in tablet, through a public Gym form or through a waiver link the Gym sends you, the Gym keeps the waiver text you agreed to, your typed signature and the time, a hashed network address and browser details as evidence, and your separate media-release and communications choices. Gyms can record private lesson schedules and lesson packages for you, import their existing roster, record their coaches' certifications and checks (with the credential number, expiry date and an uploaded proof, visible to the Gym's roster managers, who get reminders 90, 60 and 30 days before one expires), and record competition teams, entries, corner assignments and youth-to-adult transition decisions. When available, members and verified guardians can reserve or cancel class spots, and an adult member and a coach, manager or owner of their Gym can keep a private written thread, with copied video links, that only those two people can read. When Coaching Workspace is available, it also stores participation choices, assigned plans, and messages in authorized coaching conversations.
• Gym check-in tablet: a Gym's check-in tablet shows the first name and last initial of its active members, with a Waiver needed badge when one is missing, so members can tap in, and records each check-in as attendance for the Gym. When available and the Gym turns them on, a tablet can stay paired for up to 24 hours, and a member can show a check-in code from their phone that expires after 15 minutes; a guardian can show one for a child. The tablet can read a code with its camera; the image is read on the tablet and never leaves it.
• Kiosk walk-in sign-up: when a Gym turns on sign-up at its check-in tablet, an adult who is new to the Gym types a name, an email or phone number, a date of birth and, when the class has a waiver, a typed signature. The Gym keeps these as a guest record with the waiver acceptance (a hashed network address and browser details as evidence), the class check-in, and a follow-up for its staff. The tablet shows the same screen whether or not the email or phone belongs to an app account and never signs anyone in; if it matches one account, the Gym's staff confirm or dismiss linking it.
• Public Gym forms: when you ask to visit, register for a drop-in or event, or send a question from a published Gym page or embed, the Gym receives what you enter: name, email and phone, and for a drop-in or event your date of birth, a guardian's name and relationship for someone under 18, home gym, rank, experience, any injury notes you choose to give, and your waiver, terms and media-release choices. A question keeps your message and whether you agreed to be contacted. If the Gym already has a guest record with the same email and name and a compatible date of birth, it reuses that record instead of creating another. We store a hashed network address to limit abuse. The Gym's staff use these records to follow up and run the class. If you register for a drop-in on a Gym's page on this site while signed in, and the email you type is your account's verified email, the Gym's staff also see that the registration came from your BJJTraining.app account, with your account name, and can confirm or dismiss linking it to your account. We never link it on our own, and never for someone treated as under 18, a registration that names a guardian, or a date of birth that differs from the one on your account. Confirming links the Gym's whole guest record for you, including earlier visits and notes on it, and later drop-ins you register there while signed in join that record. A linked visit joins your account data: the guest record and its visits, waivers, orders and check-ins are included in your account export, and deleting your account removes the link while the Gym keeps its record, set inactive. Once it is linked, the Gym's drop-in and event lists show your email and rank only if you become a member and share your contact details. Linking does not share your journal or other app data with the Gym.
• Announcements and notifications: Gym owners and managers can send announcements to the whole Gym and, when available, to chosen classes. A class send reaches members in those classes who are not known to be under 18 and, if chosen, verified guardians who can view that athlete's training; a guardian without that access is left out. When available, a send can be scheduled up to 90 days ahead or marked Urgent, which only adds an in-app badge. The app stores the title, message, audience, urgency and schedule, and shows the sender's name. In-app notifications record what was sent and when you read or snoozed it (up to 14 days). A Gym using attendance tools sends its household billing contact and verified guardians an in-app reminder when no one in the household has checked in for 14 days.
• Integrations: calendar-feed token metadata; browser push endpoint, encryption keys, browser information, category preferences, and delivery state when Web Push is enabled; encrypted Gym Slack/Discord webhook URLs, selected events, redacted delivery status, and an athlete's separate belt-promotion sharing consent.
• Billing and Gym payments: for your own plan, Stripe customer and subscription identifiers, plan status and invoices. When you pay a Gym through the app, that Gym is the merchant and Stripe processes the payment on the Gym's own Stripe account: your name and email are given to Stripe to create a customer for that Gym, and the app keeps the order (items, amounts, your name and email, a shipping address when an item ships, whether you agreed to save a card, and the card reader used in person). Stripe calculates sales tax from the shipping or Gym address. Gift card and stored-value balances keep only a protected claim code. We do not store full card numbers; Stripe holds card details.
• Signup waitlist and Gym claims: your email, the consent text you accepted, and where you came from (the source and referring page) when you ask to be told when signup reopens; and the documents a person uploads to prove they run a Gym, which are deleted after the claim is decided, normally within 24 hours.
• Public belt badges: when available and you create one, anyone with its link can view that snapshot of your belt history. Badge pages ask search engines not to index them. Nobody treated as under 18 can create one.
• Support and security: support messages, email, optional name, IP address, user agent, referrer, rate-limit records, audit events, and server logs.
• AI operations: selected training context sent for a requested feature, generated output/cache, provider/model, token counts, latency, cost, and redacted error metadata. If AI Coach chat is separately enabled, this also includes saved conversation transcripts, requested actions and their history, context preferences, short notes you confirm for AI Coach to remember, and encrypted personal API keys with consent and connection metadata when you connect a provider account.

Purposes & legal bases

Where data-protection law requires a legal basis, we rely on:

• Contract: account, journal, goals, billing, export, and the features you request.
• Consent: public member directory publication, athlete-private per-Gym sharing scopes, showing your name on the Community board, a coach's choice to show their profile or rank on a public gym page, a Gym manager's confirmations before publishing the gym page or showing it on another website, browser push, weekly digest email, a guardian's per-child daily summary email, and athlete-controlled belt-promotion sharing to a Gym's Slack or Discord destination. Voice recording is disabled for this release. You can withdraw consent without affecting earlier processing.
• Legitimate interests: security, abuse prevention, support, service reliability, and aggregate privacy-focused performance measurement, balanced against user rights.
• Legal obligation: tax, accounting, fraud prevention, lawful requests, and records we must retain.

We do not sell your training, injury, weight, travel, or voice data. We do not sell any personal information or share it for cross-context behavioral advertising, and we do not use Gym or member data to advertise to you.

Gym records & athlete-private sharing

• You can use BJJ Training App without a Gym, and one account can belong to several Gyms at once or move from one Gym to another. Each Gym sees only what this section describes for its own relationship with you, and a new Gym sees nothing private until you grant it.
• A Gym's directory listing (its name, location, description and directions) is public. The rest of its gym page stays private until a manager publishes it after reviewing a checklist of every field the page shows and confirming three statements about it. A manager can unpublish at any time, which also removes the page from every other website it was shown on.
• A Gym that publishes its page can also show its class schedule and its visit and question forms on its own website, once embedding is available and a manager lists each website and confirms both that they manage the Gym and may show these details there, and that visitor form submissions go to the Gym under this notice. The embedded view loads from BJJTraining.app, sends no sign-in cookies, never shows member names, and shows only the offers, prices and coaches already on the public gym page. Forms sent from it go to that Gym exactly as they do on the gym page. The Gym can remove a website at any time, which stops the embed there within a minute, or remove all websites at once.
• Accepting an invite or membership never grants athlete-private data by itself.
• A Gym can invite you by email. If you already use BJJ Training App with another email, you can join with that account instead, and the Gym then sees both email addresses. While public sign-up is closed, when a Gym invites an email address that has no account yet, our authentication provider creates an account for that address before the person accepts, so the invite link can work. While sign-up is open, that invite creates no account: its link leads to sign-up, and an account exists only if the person signs up. Pending invite accounts that nobody accepted or signed in to within 30 days are listed for our review; they are not removed automatically, and we remove one only after manual review. Contact support@bjjtraining.app if you did not expect an invite and want that account removed. Gym staff can also link a roster record they already keep to one of their members' app accounts, and that member then sees the Gym's attendance and ranks for that record in the app.
• You can leave a Gym at any time, though an owner must hand over ownership first, and a Gym can remove you. Either way your membership ends, the Gym's roster record of you is set inactive but kept with its attendance, ranks and waivers, your future booked class spots are released, and the active private-data scopes for that Gym are cleared. When that leaves nobody a household subscription covers training at that Gym, leaving ends the subscription when its current billing period ends: it does not renew, nothing is charged or refunded now, and the payer and the Gym are told. If it cannot be set to end automatically, the payer and the Gym are told so it can be stopped. While someone it covers still trains there, it keeps billing until it is cancelled, and a payer who left is told so. If you left, declined an invite or withdrew your own request, you can ask to rejoin, and the Gym's owners and managers see the request and can invite you again. If the Gym removed you, contact the Gym to return.
• Gym-authored operational records stay separate from athlete-private data: membership identity and status, program enrollment, waiver status, occurrence attendance, and gym-authored incident evidence are role-authorized records for the Gym.
• Stripes a Gym records on a program rank are Gym-authored records too. Staff who manage the roster record each stripe with its number, the date, and the staff member who awarded it, and a promotion starts the count again. A verified guardian who can view a child's training sees that child's stripes, with the awarding coach's name, in family activity and, if they turned it on, the daily summary email. Your account export includes your stripes without the awarding staff member.
• Staff of a Gym where you are an active member see the current belt you recorded in your own belt history, its stripes or degree, and the month and year you reached it. When the Gym has recorded its own rank for you, staff see the Gym's rank first. A former member's belt and the belt of a roster record without an active member account are not shown, and your own belt never appears on public, directory or Community lists through this rule.
• You can add a rank or stripe record a Gym keeps about you to your own belt history. The entry records where that promotion came from with a link to the Gym's record, so it is not added twice. The link is removed if the Gym permanently deletes that record or the Gym itself, and the Gym cannot see or change your belt history through it. Adding a Gym record sends no belt-promotion update to any Gym. Belt history can include youth belts, which also appear on badges and certificates when those are available.
• If both the gym and member publish, the public gym page can show the member's name, avatar, and belt. The member can revoke directory publication in Settings; pages are rendered dynamically so revocation takes effect on the next request. Members a Gym knows to be under 18 are never listed on a public gym page and cannot turn on directory sharing.
• A coach appears in a published gym page's coach list and class schedule, including on the Gym's own website, only when the Gym lists the coach's profile and the coach turns on Show my profile on the public gym page in Settings. A coach's rank appears there only after that coach also turns on Show my rank on the public gym page. Both are off by default, gym staff cannot turn them on for a coach, and turning either off removes it on the next request.
• Linked athlete contact details and every private category require an active accepted athlete-Gym relationship and the exact athlete-approved per-Gym scope. The scopes are coach_feedback, training_summary, journal_entries, readiness, wearable_readiness, goals_focus_plans, practice_priorities, competition, weight, injuries, and contact_details.
• Your goals are private by default. If you turn on Share with my gym for a goal, the coaches of each Gym you granted goals_focus_plans see that goal's name and progress counts, never its description or notes. The same scope shows them the title and week of your active Focus Plan block. Coaches never see the goals or Focus Plan blocks of a member the Gym knows to be under 18. With journal_entries, coaches also see how many of your sessions in the last 30 days include a written reflection, never the reflection text. Turning sharing off for a goal takes effect on the next read.
• Daily injury pain scores stay private to you. The injuries scope shares injury details only and never includes pain scores, and no Gym role can read them.
• The separate practice-priorities choice shares counts of athletes with active canonical technique goals and due review cards with each Gym you choose. These private study priorities can appear in every Gym where you explicitly enable that choice. It does not share goal titles, notes, review ratings, or medical information; a scheduled review is not a claim about ability.
• Each private category starts off by default, is individually revocable, is audited, and takes effect on the next read. Leaving a Gym, deleting an account, or deactivating a Gym clears the active scopes for that relationship, and rejoining requires a fresh grant.
• For child profiles, the guardian relationship must be verified and accepted before separate child permissions can be granted. Staff cannot grant those child permissions from the admin flow. A person a Gym asks to add as a guardian can decline, and a guardian can end their own access to a child at any time; the Gym keeps the child's records.
• A verified guardian who can view a child's training can share a child without their own account with that Gym's coaches, choosing coach feedback, a training summary from class attendance, or both. Sharing is off by default, set per child and per Gym, recorded each time it changes, and can be stopped at any time from the same place. Stopping it, losing View training, or the relationship ending removes the child from coach views on the next read. Coach feedback for that child is a coach note shared with the child's guardians. A child with their own account shares from that account instead.
• Coach notes about a child stay with the Gym's coaches until a coach shares a note. A shared note is shown only to that child's verified guardians who can view training, in their family activity and, once the daily summary email is available and they turn it on, in that email. Removing a note hides it from guardians at once.
• Public member directory publication and belt-promotion consent are separate choices from these private-data scopes. The member can revoke directory publication in Settings, and belt-promotion consent only controls that one outbound post type.
• A Gym owner or active manager can choose to post schedule changes or announcements to a validated Slack or Discord webhook. A belt promotion is never queued unless that athlete separately opted in for that Gym; disabling consent blocks later promotion posts.
• Community is off unless it is turned on for the service. When it is on, the Community page shows a weekly board for each Gym. Other active members of that Gym see your qualifying class count and scheduled mat hours for the week under an anonymous label that changes every time the board loads, whatever your directory setting. Your first name and last initial appear only if you turn on Show my name in Community for that Gym; turning it off or leaving the Gym removes your name on the next load. Anonymous rows appear only when at least three anonymous members trained that week; otherwise the board shows only their count. A Gym's owners and managers choose whether the board ranks classes, mat hours or lets members choose, and can set one monthly class target that shows only the Gym total and your own count. Members a Gym knows to be under 18 never appear on the board.
• When Community is turned on, a gym owner can allow comments on that gym's team posts. Only active adult members of the gym can comment, never members under 18. Adult members and the gym's owners and managers can read a comment, which shows your first name and last initial only if you chose to show your name in Community, and an anonymous label otherwise. Owners and managers can hide any comment, you can delete your own while it is visible, and every comment, hidden or not, is deleted after 12 months or with your account.
• Membership and scope evidence remain private records after publication is revoked; revocation stops future disclosure rather than deleting the membership.

AI & disabled voice transcription

Social Assist AI is disabled by default. If it is separately release-enabled, an authorized Gym manager must give fresh consent for every request, and any athlete-linked source also requires current athlete or guardian consent. The feature sends the bounded deterministic caption and public Gym context to one pinned provider and model, creates a separate AI sibling draft, and does not change the deterministic source draft. It does not fall back to another model or provider and never publishes automatically. Raw provider requests and responses are not retained; only the approved sibling draft and sanitized operational evidence remain. The deterministic drafting workflow remains independently available when Social Assist is disabled.

AI features run only when you request them. Selected journal text, reflections, goals, training statistics, or competition context may be sent to OpenAI, Anthropic, or Google Gemini according to the feature's provider configuration. Structured generation can try another configured provider or model if a request fails. The provider used can therefore differ between requests. Do not include information about another person unless you have permission.

AI Coach chat is disabled by default and requires separate activation and access approval. If available to you, it stores your conversation transcript and requested action history. It also keeps up to 50 short notes that you confirm for it to remember and sends the newest of them with every message, including to a personal-key provider; you can delete them one at a time or all at once under What AI Coach remembers. New conversations have journal, goal, and injury context enabled by default; this can include journal reflections, active goals, and injury location, severity, and recovery status in the context sent with your request. Daily injury pain scores are never included in that context. While journal context is on for a chat, AI Coach can also draw a chart of your sessions, rounds, and techniques landed or caught, save it in the conversation, and send its numbers to the provider; turning journal context off for that chat turns charts off too. If you connect your own API key, you select an approved provider and model and accept the displayed provider disclosure. Supported personal-key providers are OpenAI, Anthropic, Google Gemini, and xAI. Keys are encrypted in the app; requests use the connected provider account, whose terms and data controls also apply. Removing a key does not erase earlier conversations or data already received by that provider.

Voice transcription is disabled for this release. Recording controls are not shown, the browser Permissions Policy denies microphone access, and the voice endpoints reject requests before they read an upload or contact a provider, so BJJ Training App does not collect or send voice audio. The public demo does not offer voice recording. Re-enabling recording requires a new release review and a point-of-action privacy notice.

OpenAI Responses requests set store=false. This does not promise that a provider retains no data; provider safety, abuse-monitoring, legal, and account-specific controls may still apply. The app uses structured response caches for up to 24 hours, but cache expiry does not itself delete the stored row. Raw prompts and model output are excluded from routine application logs; saved AI Coach transcripts and generated plans are product records with their own lifecycle.

The Video Library transfer tool offers a model-agnostic prompt that you may copy to an external model to prepare a CSV or XLSX file. BJJ Training App does not send that document or prompt to an AI provider. Remove sensitive material first and review the privacy terms of the external service you choose.

Analytics & browser storage

Necessary cookies and browser storage keep sessions, theme, locale, and short-lived app handoffs working. The journal also keeps an unsaved entry in this browser so you do not lose it, Gym staff taking roll call offline keep those check-ins in this browser until they sync, and a pending email change is remembered here until it is confirmed. These stay on the device until they are sent or cleared. The installed app caches only static app files such as scripts and icons, never your records. Vercel Web Analytics and Speed Insights collect route-level, device, geography, and performance measurements designed not to identify an individual; query strings and fragments are removed before Web Analytics events are sent. You can disable both for the current browser below or in Settings under Your data.

Sentry provides essential error reporting so we can detect and fix crashes in the browser and on our servers. It receives a minimized stack trace, route path, release identifier, runtime details, and a random request or event identifier. Before an event is sent, the app removes account identity, cookies, authorization headers, form and request bodies, query strings, URL fragments, and stack variables, and replaces your IP address with a placeholder. We do not enable Sentry Logs, Session Replay, profiling, user feedback, or release-health sessions. Essential error reporting remains active in Preview and Production when the app is available; it is separate from optional browser performance traces. Those browser traces use the analytics preference below, at a 10% Production sample, and stop when you opt out.

Google Analytics and campaign/referrer attribution cookies are disabled for this release. Supplying a Google measurement ID does not activate tracking. Application-managed email is turned off unless it is enabled for the service; digest preferences and an unsubscribe flow are implemented, and the weekly worker is not scheduled. When it is on, we send Gym invites, shop receipts and card-update requests, plus the weekly digest (your sessions, streak and goal names) and a guardian's per-child daily summary email only to people who turn them on.

Service providers

• Supabase: authentication, Postgres database, Storage, and backups. Sign-in, confirmation, password-reset, and invite emails are sent by our authentication provider's mail delivery, which may use Resend.
• Vercel: hosting, request/runtime logs, Web Analytics, and Speed Insights.
• Sentry: minimized application errors and optional browser/server performance traces for reliability and incident response. The app removes the identity, credentials, request bodies, query strings, and fragments listed above, and replaces the IP address, before sending.
• Stripe: checkout, subscriptions, invoices, portal, fraud controls, and payment records for our plans, plus online card, in-person (Terminal), and sales-tax processing for Gyms that connect their own Stripe account. For Gym payments, the Gym and Stripe each receive the payment and customer details, and the Gym's terms and Stripe's privacy notice also apply.
• YouTube (Google): receives a canonical public YouTube link when an authenticated user requests add-form suggestions, when a saved link's public title, creator, and thumbnail are refreshed about every 29 days, and when a user imports a public playlist through the YouTube Data API. The app stores that public metadata and an unaltered thumbnail for up to 29 days between refreshes. The privacy-enhanced player is created only after Play. We do not send private Library notes, categories, ratings, or saver identity. BJJ Training App uses YouTube API Services; see the YouTube Terms of Service and the Google Privacy Policy.
• TikTok: approved short-share redirect resolution may identify a canonical public video. Official URL-based oEmbed may supply public title/creator details when a link is added and again about every 29 days. After Play, an authenticated same-origin wrapper may render allowlisted official embed HTML and load embed.js only inside that sandbox. TikTok thumbnail storage remains disabled; no oEmbed HTML or provider script is persisted.
• Instagram: metadata and thumbnail collection remain disabled. If Video Discovery is separately release-enabled and the public creator permits embedding, an official Instagram embed is created only after Play; otherwise the app keeps the external-link fallback.
• OpenAI, Anthropic, and Google Gemini: receive requested AI context through configured generation or, if separately enabled, AI Coach chat. xAI: is also supported for AI Coach chat using a personal API key. The providers used depend on the feature configuration or the account you connect; listing a supported provider does not mean every request is sent to it.
• Resend: may deliver the sign-in, confirmation, password-reset, and invite emails our authentication provider sends. It also supports application email, which is disabled for this release; when it is on, Resend delivers Gym invites, shop receipts, card-update requests, and the digest and guardian summary emails people choose to receive, and receives the recipient address, subject, and message. A Gym invite email carries the invite and Gym ids as message tags, and a failed send or a bounce or complaint for that email is recorded on the pending invite without the address or message text.
• WHOOP and Strava: if separately enabled and you connect an account, the app stores encrypted connection credentials and consent/history records. WHOOP can provide selected recovery data; Strava receives activities you choose to publish. Disconnecting a provider and deleting its earlier activity or app history are separate actions.
• Your chosen calendar service: receives the planned sessions, competitions, private lessons, or Gym class schedule in a read-only feed only after someone adds its bearer URL to that service. Anyone with the URL can read that feed until it is rotated or revoked.
• Slack or Discord: receives only the event content a Gym owner or manager selected after configuring a validated webhook. Webhook URLs are encrypted at rest and are not shown again.
• Photon (komoot, OpenStreetMap data): when place search is available and you search for a place in a map pin picker, our server sends the search text and your language to Photon and shows up to five places. Your browser never contacts Photon, no account details are sent, and we do not store or log the search text.
• OpenStreetMap tile servers: when you view a travel map or a map pin picker, your browser loads map images directly from tile.openstreetmap.org, which receives your IP address, browser details, and the map area you are viewing. No account details are sent.
• Browser push services: when Web Push is available and you opt in on a supported device, your browser's push provider receives an encrypted notification for that device. Availability depends on service configuration, browser support, and your device settings.

External Class Booking automation remains disabled; ordinary in-app class schedules and reservations are separate. Providers may process data in other countries under their contracts and transfer safeguards.

Retention

• Account, training, injury, weight, travel, and media data: kept until you delete the relevant record or a verified account-deletion request is completed, unless a legal/security exception applies. No inactivity auto-delete is currently applied.
• Shared Gym records: membership, guardian, coaching, signed waiver, grading, and commercial records have their own relationship and retention rules. Leaving a Gym or deleting one manager's account does not erase all shared Gym records. Signed waiver records carry retention and legal-hold settings; those settings do not guarantee automatic deletion when a date passes. A Gym cannot be deleted while it still has members other than its owner.
• A Gym's own record of you: each Gym keeps its roster record of you with its attendance, ranks and stripes, waivers, orders, and payments. Deleting your BJJ Training App account sets that record inactive and removes its link to your account, but does not delete the Gym's record. Ask the Gym to correct or delete it, or contact support@bjjtraining.app and we will pass your request to the Gym.
• Content written for others: team posts and announcements, coach feedback, lesson-thread posts, coach messages, notes for guardians, lessons a coach recorded for a student, and the rank, stripe, promotion, and incident records a Gym keeps stay after their author deletes their account. They show the name on the author's account when it was deleted, never an email or account id, and a deleted sender's scheduled posts are cancelled. A staff direct message conversation stays with the other person, with the deleted person's messages under the name on their account. The other person can read it but can no longer reply, and it is deleted once both people have deleted their accounts. Belt promotion attestations and goal list templates stay without a name. Comments a member wrote on team posts are deleted with that member's account. Ask the Gym or support@bjjtraining.app to remove a specific item.
• Deletion safety evidence: after completion, we retain a service-only SHA-256 fingerprint of the account ID to reject stale account recreation and authorize cleanup of late Stripe records. It is excluded from account exports and normal data APIs, but can be linked by someone who already knows the account ID. No fixed purge is currently enforced.
• Directory, athlete-private scope, and guardian consent evidence: kept with the membership or guardian relationship to prove the current choice. Revocation or relationship end stops future disclosure on the next read. When you leave a gym, delete your account, or the gym is deactivated, active scopes for that gym are cleared and a rejoin requires fresh regrant.
• Public Gym form submissions: kept by the Gym until it deletes them; no automatic purge currently applies.
• Notifications: deleting a notification hides it; the record stays until your account is deleted.
• Integration credentials and delivery state: personal calendar and push rows are deleted with the account; rotating or revoking a calendar feed invalidates its bearer URL. Shared gym webhook configuration remains with the gym when one manager leaves, while that manager's creator reference is cleared. Delivery queues are operational state, not portable account content.
• Video Discovery: personal settings, publication choices, gym choices, and reports are deleted with the account and active aggregate counts update immediately. A shared public resource or thumbnail may remain while another Library item/publication references it or while a report, suppression, moderation, takedown, legal, or security retention need applies. Exact unreferenced resources are removed through bounded cleanup; unrelated shared objects are not scanned or deleted. Global permanent suppression prevents republishing that provider identity.
• Support and audit records: kept while needed to resolve the request, secure the service, and meet legal obligations. No automatic fixed-period purge is currently claimed.
• Sentry error and performance records: retention follows the organization's configured limits and Sentry's applicable service controls. Resolving an error report is separate from deleting its stored events.
• AI: structured response caches are usable for up to 24 hours; expired rows can remain until maintenance or account deletion. Operational metadata and saved generated content have separate account or Gym lifecycles. Provider retention depends on the provider, endpoint, connected account, settings, and applicable terms, including safety, abuse-monitoring, or legal exceptions.
• AI Coach chat: if enabled, conversation transcripts, action history, and usage remain with the account. Archiving a conversation does not delete it. Removing a personal API key deletes that credential from the app, not earlier conversation records or provider copies. The account export includes visible conversations and sanitized connection metadata, but excludes key material and internal transport state. No automatic fixed-period transcript purge is currently applied. Saved AI Coach memories have no expiry and stay until you delete them; deleting one stops AI Coach reading it but leaves the note in the conversation where you confirmed it.
• Social Assist AI: actor references are removed when an account is deleted. The approved sibling draft follows the ordinary account and Gym content lifecycle, while sanitized operational evidence is retained with the Gym so budgets and provider use remain auditable. Gym-scoped evidence is retained with the Gym and removed when the Gym is deleted.
• Vercel: analytics, performance, and runtime-log retention depend on the service, configured plan, and applicable provider controls. Turning off optional browser analytics stops new collection through those components; it does not erase earlier provider records.
• Stripe: Stripe and we may retain transaction and billing records for tax, accounting, fraud, dispute, and legal requirements after account closure. Gym orders, refunds, and receipts are Gym records: after you delete your account they stay with the Gym with your name and email, and the customer the Gym's Stripe account holds for you stays with that Gym, so the Gym and Stripe can meet tax, accounting, and dispute obligations.
• Backups: deleted data may remain inaccessible in provider backups until the provider’s backup cycle expires.

Your rights & choices

• Correct profile data in Settings > Account using Edit profile and Save changes, and change preferences in Settings > Preferences.
• Revoke each gym's athlete-private scope grants individually or all at once, revoke gym directory sharing and belt-promotion webhook consent separately, rotate or revoke calendar feeds, change in-app notification categories, and control anonymous analytics in the relevant Settings or gym surface.
• Leave a Gym, turn off your public coach profile or rank for each Gym, and, as a guardian, decline a guardian request or end your own guardian access to a child. Ending guardian access does not cancel a subscription you pay for; you can still see and cancel it in Household billing.
• Browser push notifications are optional per-device opt-in from Settings and can be turned off per browser at any time. Application-managed weekly email delivery is disabled for this release; any existing email preferences and unsubscribe choices remain separate records. The guardian daily summary email is off unless a guardian turns it on for a child, and My kids or the unsubscribe link in each email turns it off.
• If AI Coach chat and personal provider keys are available to you, you can remove a connected key in Settings and delete AI Coach's saved memories under What AI Coach remembers. Review the provider disclosure before connecting an account; its privacy controls also govern requests billed to that account.
• Download a versioned JSON account manifest covering every reviewed app data domain. Journal media is represented by stable object paths and an inventory; the JSON does not embed media binaries or expiring signed URLs. Contact support@bjjtraining.app if you also need help retrieving the binary files.
• Download the flat, editable records from your private Video Library as CSV or XLSX. These files can contain private notes and should be stored and shared carefully; study segments and linked technique graphs remain in the complete account JSON export.
• Request access, correction, restriction, objection, portability, or deletion by contacting support@bjjtraining.app. We may verify identity and normally respond within the period required by applicable law.
• Use self-service account deletion in Settings > Data or contact support@bjjtraining.app. The workflow cancels linked Stripe billing for your own plan and any Gym membership subscription you pay for as a household's billing contact, and removes the app's Stripe customer before erasing live app data. If a Gym has disconnected its Stripe account from the app, its membership subscription cannot be cancelled from here: when you request deletion you are told it may still charge you, and the Gym's owners and managers are told to cancel it in their own Stripe account. Stripe can retain transaction records required for tax, disputes, fraud prevention, or law. Account deletion does not delete the records a Gym keeps about you or the content you wrote for others; see Retention. If you were the last person a household subscription covered who still trained at a Gym, that subscription is set to end when its current billing period ends, and its payer and the Gym are told; if it cannot be set to end automatically, they are told so it can be stopped.

Self-service deletion uses a durable, retryable workflow: it first resolves gym ownership, then cancels billing, removes the account's journal-media prefix, removes direct identifiers from retained security evidence, deletes live database domains, and removes Supabase Auth last. If you own a gym with other active members and no other active manager, transfer ownership or add another active manager before retrying. Provider legal records and expiring backups may outlive the live-account deletion window described above.

Children & security

The service is not directed to children under 13. Every account needs a date of birth, and people under 13 cannot have an account: we refuse any date less than 13 years ago, so no account holds one. We ask for it when you create an account with email, or after you first sign in if your account came from Google, a Gym invite or before we asked. A child under 13 can still train at a Gym as a roster record a parent or guardian manages. The date on your account decides the protections for people under 18 described below, and Gyms never see the date itself. If the date you give shows you are under 18, you cannot later change it to an adult date yourself; contact support@bjjtraining.app to correct it. It is included in your account export and deleted with your account, and the copy sent at sign-up stays with your sign-in record until then. Users who are not legally able to consent in their country should use it only with a parent or guardian. For email-less child profiles, the guardian relationship must be verified and accepted first, and then the child's separate permissions can be granted from the guardian's own account. We use TLS, access controls, row-level database policies, private Storage, rate limiting, and audit/security monitoring, but no system can guarantee absolute security.

Gyms that run youth programs keep records about the children they teach, such as name, date of birth, guardian links, attendance, ranks and stripes, waivers, coach notes, and check-in codes. A child does not need an account. We treat a person as under 18 when the date of birth on their own account, or one any Gym's roster records, is less than 18 years ago or, when no Gym has recorded a date of birth, when a Gym lists them as a child. A date of birth you give us never overrides a Gym's record that you are under 18. With none of these on file, we treat the person as an adult. A person treated as under 18 is never listed on a public gym page, never appears on the Community board, cannot comment there, and is never in a private coach thread, and coaches never see their goals or Focus Plan blocks. Waivers use the age of majority for the waiver's jurisdiction to decide when a guardian must sign, and when you sign for yourself in the app, the date on your account counts too.

For help, visit the Help Center or email support@bjjtraining.app. We may update this notice when processing changes and will update the date above.