Privacy Policy
This policy describes how OP BJJ handles personal data in the OP BJJ application. It is written to match what the software actually does — the tables it holds, the third-party services it calls, and the retention periods that run automatically.
Controller: Lazzat Omir, sole proprietor, 7 Dombyra Street, Medeu District, Almaty A25C8G2 (050010), Republic of Kazakhstan. Contact: support@opbjj.com.
Throughout this policy, "OP BJJ", "we" and "us" mean the controller named above.
If you are in the EEA or the UK, please read Section 6 — the controller is located in Kazakhstan, which does not have an EU adequacy decision.
1. What we collect, and why
Account data
Handle, display name, email address, hashed password, belt grade and stripes, and optionally: weight class, gi preference, city, and country. We need this to operate your account — legal basis: performance of a contract.
Your name for your academy
If you join an academy, we ask for your first and last name so its coaches know who you are. We only ask when you join an academy; solo athletes are never asked. Your name is shown only to that academy's staff — on its roster, at roll call and on its other staff screens. It is never public, and other members never see it; they see your display name and @username. A coach confirms your name and may correct a spelling, and that correction is logged. You can change it in Profile at any time; a change is shown to your coaches as not yet confirmed. If you leave the academy, its staff lose access to it. It is never sent to our AI provider. It is included in your data export and deleted when you delete your account. Legal basis: performance of a contract — it is part of the academy membership you asked for.
How you found us
When you create an account we record which channel you arrived from — a platform, a campaign, or a creator's own disclosed link — and, if you came through one, that creator's link id. We record it once, at registration, and we do not update it afterwards.
This is not share tracking. We do not know who shared anything with you, we do not identify the person whose post you saw, we record nothing about who viewed a shared card, and there is no code or parameter attached to a card anyone shares from this app. There are no referral codes and no view counts.
It appears in your data export and it is erased with your account. Legal basis: legitimate interests (knowing which channels our own marketing reaches).
Age bracket
During onboarding we ask which age range you fall into. We never collect a date or year of birth from you — the bracket is all we need. We use it to set your belt division and to keep profiling and marketing off for athletes under 18. Legal basis: legal obligation. The only birth year we hold is the one an academy enters for a child on its roster; see Section 4.
Training log
Check-ins, technique practice records, sparring and competition results (including opponent names where applicable), class intensity, round duration, and any notes you write. This is the core product. Legal basis: performance of a contract.
If you tell the coach what you hit or missed in training, we may offer to add those attempts to your log. We find them in your own message by matching technique names; no extra AI step is used. Nothing is added until you tap to confirm. A confirmed attempt is a normal entry in your training log and counts wherever attempts you log yourself count, including your academy's stats if you train at one. Suggestions you don't confirm are deleted (Section 7).
Sparring and competition results
These records name your opponent. A result belongs to both athletes; the implications for deletion requests are explained in Section 8. Legal basis: legitimate interests (maintaining accurate competitive records for both parties).
When you upload a roll, we send the video to Google's Gemini service so it can read the roll for you. Reading your rolls is the service you signed up for. Before the first upload we ask you once to keep AI on or turn it off, and nothing is sent until you choose. You can change this any time in Settings › Privacy.
A roll you upload before choosing a plan. If you upload a roll while setting up your account, before you choose a plan, we store it privately and do nothing else with it: it is not screened, analysed or sent to Google, and no one else can see it. When you choose a plan, the read starts by itself; you do not tap anything. If you have not yet answered Keep AI on or Turn it off, we ask you then, and if AI is off the roll is not sent. If you don't choose a plan within 30 days, we delete it.
AI features — video analysis pipeline
If you use video analysis features, the following processing occurs:
- Pre-upload screening: Before your clip is stored, a still frame is extracted and sent to Google Gemini for safety and relevance screening. This is a fail-closed gate — if screening fails, times out, or returns an ambiguous result, the upload is rejected and no data is stored.
- No publication. Footage you upload for analysis is private to your account. It is never shown on a public feed, never shown to other athletes, and we never publish it. The only way anything from a roll leaves the app is a share card you create and post yourself (see Terms, Section 5); a card shows a frame or clip of your footage only if you confirm that everyone in it agreed. Your academy's coaches do not see your analyses unless you send one to them. On the Overpowered plan you may grant one named coach at your own academy read access to one analysis of your choosing, including its moment stills (a "coach handoff"); the coach can view the stills but not download them, the grant covers that analysis only, you can revoke it at any time, and revoking it ends the coach's access immediately. A short note you attach to the handoff, and any reply the coach writes, are stored with the grant and included in your data export.
- AI analysis: If you request analysis of a clip (game plan, competition report, positional breakdown), the video file is sent to Google Gemini for processing. The model returns structured analysis data which is stored in our database. Analysis output — positional assessments, technique classifications, suggested focus areas, round breakdowns — is stored against your account. Your footage itself is kept only while it is one of your most recently stored rolls (Section 7); what Google retains is governed by Google's API data-use terms for the service tier we operate on, not by a commitment we are in a position to make on their behalf.
What Google may do with it. Your footage, voice notes and messages are processed by Google's Gemini models (Gemini API or Vertex AI) on a paid Google Cloud account, primarily in the USA. Google may keep them for a limited time, in any country where it has facilities, only to detect abuse of its service and to meet legal requirements. Google does not use this content to train or improve its models.
What the analysis does not do. Our analysis reads positions, movements and techniques. It does not identify anyone by their face, and it does not create or store a faceprint, a voiceprint, a fingerprint, a scan of hand or face geometry, or any other biometric identifier. The details you give at the Spotlight step — what you were wearing, which side you started on — are used once, to tell you apart from your partner in that clip, and are stored with that analysis only.
Other people in your footage. Training footage almost always shows a partner. When you upload, you confirm that you have their agreement — that confirmation is what we rely on to handle their image, and we take it at face value. Their footage is never published, is used only to produce your analysis, is visible only to you and to a coach you send that analysis to, and is deleted from storage on the schedule in Section 7.
If you appear in someone else's footage and want it removed, email support@opbjj.com and tell us what you can — roughly when it was filmed, which academy, and who uploaded it if you know. You do not need an account here for us to act on that. We will locate the footage and remove it, and we will tell you when it is done.
You can switch AI features off in Settings at any time. Switching them off stops future processing; it does not retroactively delete stored analysis results unless you separately request deletion.
Legal basis: performance of a contract. These features are the service you asked for; you can switch them off at any time in Settings.
AI coaching chat
If you use the coaching chat, your messages and context are sent to Google Gemini to generate responses. Chat history is stored to provide session continuity. Coach chat also uses what you've asked it to remember (competition dates, what you like to work on, and, if you choose to save them, areas you're training around) and the areas you picked in onboarding. Legal basis: performance of a contract. These features are the service you asked for; you can switch them off at any time in Settings.
Voice notes
If you record a voice note to log a session, the audio is sent to Google Gemini once, to turn it into a draft log. We do not store the audio: it is discarded as soon as the draft comes back, and only the entries you choose to save are kept, in your training log. Legal basis: performance of a contract. You can switch AI features off in Settings at any time.
Networks your academy belongs to
If your academy is affiliated with a network, such as a franchise or an association, and its owner chooses to share, we may give that network anonymous totals — for example how many adults train or how many were promoted — that don't identify you. They never include your name or anything about you as an individual, and never anything about athletes under 18: those athletes are left out before anything is counted. Legal basis: the legitimate interests of your academy in running its affiliation. The network does not receive your personal data through OP BJJ.
What your academy's coaches see
If you are a verified member of an academy and 18 or over, its coaches see your attendance and your belt, which the academy uses to run its classes and promotions, and your Roll IQ trend: your latest Roll IQ figure and how it changed over the last 30 days. They see a roll's full read only when you send it to them (a coach handoff, described above). Legal basis: the legitimate interests of your academy for attendance and belt. The Roll IQ trend is on by default and rests on a switch you control, "Share my Roll IQ trend with my academy" in Settings › Privacy: we tell you once when your membership is verified, your coaches stop seeing the figure as soon as you switch it off, and each change is recorded with its date and the version of this policy that applied. Athletes under 18 are never part of it.
Your academy's owner and coaches also see your technical performance: the share of the techniques you logged as tried in the app that landed, over the last week, month or year, always shown with the number of tries, and only once you have logged at least 10 tries in that period. It comes only from what you log yourself, never from an AI read of your rolls. They use it to see who is improving and who is excelling, and it is pooled into the average of the classes you attend regularly. Members on the kids' belts are never ranked: for them the academy sees attendance only. Legal basis: the legitimate interests of your academy in running its classes and promotions.
Questions to your coach
If you are 18 or over and a verified member of an academy whose plan includes it, you can send one coach of your academy a short question, and you can point it at one moment of one of your own rolls. Only that coach sees it, next to what your academy already sees about you (described above). They never see your Roll IQ or any AI read of your rolls through it. The coach can answer in writing or mark it answered in person, and you can send one reply. You can take a question back at any time: the coach loses it at once, including the moment of your roll, and it also ends when you or the coach leaves the academy. You keep your own copy. Members under 18 cannot send questions. Questions and answers are in the data you download, deleted when you delete them or your account, and otherwise a year after the last message. None of it is ever sent to an AI model. Legal basis: your consent, given by sending a question, which you withdraw by taking it back.
What your academy records when it follows up
When your academy's Churn Radar flags a member who has been away longer than usual, its owner or a coach can record that they called, texted or sent a note in the app, or that they set the flag aside for a while. If a member has been away for weeks, the academy can record whether they are still a member and, if they left, the date and a reason it picked from a fixed list (price, schedule, injury or health, moved, lost motivation, coach or atmosphere, switched gym or sport, or don't know). The academy keeps each record with its date and the staff member who made it, and only its owner and coaches see it. It uses the records to see who to reach and what reaching out kept.
"Injury or health" is kept only on that member's record for staff: it is not in any export the academy makes, and it is removed when your account is erased. None of these records is sent to an AI model except in two ways. Counts that name no one are, such as how many members left for each reason; "Injury or health" is only ever a count. And if you are 18 or over and have switched AI on, the kind and date of a follow-up on you (for example "called on 3 Sep") can be shown to your academy's AI analyst next to your first name and last initial when its staff ask about members who are away. The words of a note, the answer to "Still a member?" and the reason a member left are never included, and members under 18, members who have not switched AI on and members imported from other software are only ever counted. The data you download includes all of these records about you, with the reason. Legal basis: the legitimate interests of your academy in keeping its members.
If you leave your academy, its owner can record, for up to a year after you left, that they called or texted you, with the date. If you train there again within 14 days of that contact and are still training there 31 to 60 days after it, the academy counts you as won back. The record holds only whether it was a call or a text, its date and who recorded it, never what was said. Only the owner sees it, it is never sent to an AI model, and the data you download includes it. When your account is erased it is deleted, unless your academy also keeps you in its own gym software, where it stays on that record. Legal basis: the legitimate interests of your academy in winning back members who left.
Training highlights for your academy (optional)
If you are a verified member of an academy and 18 or over, you can choose to share training highlights with it. This is off unless you switch it on, on its own screen (Profile › Share training highlights with your academy), which names the academy and says who sees it, why, what is shared, what is never shared and how to stop. Once a week we make a short summary from a fixed template, with no AI: how many sessions you trained that week, the names of the techniques you logged (from our technique list), how many rolls you logged, and your current goal. It never includes anything you wrote, your notes, voice recordings, coaching chats, videos, Apple Health data, self-ratings, wins or losses, or anything about an injury or your health. No health data is shared with your academy.
You see each summary in the app for 24 hours before your academy can, and you can skip any week. The owner and staff coaches at your academy see the summaries you have not skipped on your member page in OP BJJ, and nowhere else: not in emails, notifications, digests or exports, and never sent to an AI model. Your academy cannot see whether you said no, cannot require you to share and cannot ask for more. You can stop on the same screen with one tap: sharing ends at once and past summaries are removed from your academy's view in OP BJJ. Anything your academy already copied or wrote down is its own record, so ask it directly to remove that. Leaving the academy turns sharing off, and members under 18 cannot switch it on. Deleting your account deletes your summaries. We keep a record of when you switched it on or off and which wording you were shown, with your other consent records. Legal basis: your consent, which you can withdraw at any time without any effect on your membership.
Retention insights for your academy
If you are a verified member of an academy, its coaches can ask for a short explanation of a change in your attendance. When they do, your training record is sent to Google Gemini to produce that summary: your attendance pattern, the class types you attend, rounds and intensity, your technique success rates, which submissions you have been caught in, any break you logged in the app (its type and dates), and your latest reply to a message from that academy's coaches in the last 90 days (if it mentions an injury, only that it mentions a physical setback). The summary never names an injury or a body part; it says "a physical setback" at most.
Your email address, your training notes, your coaching chats and your uploaded footage are never included.
The summary may suggest an everyday cause — a schedule change, a plateau, a physical setback, or simply a break from training. It is a prompt for your coach to talk to you. It is not a finding about your health, it is not a medical opinion, and no decision about your membership, your pricing or your access is made automatically from it. Summaries are kept for 90 days and then recomputed from current data.
Legal basis: the legitimate interests of your academy in supporting the members it trains. You can object at any time — email support@opbjj.com and we will exclude you from retention insights, and your coaches will see nothing in place of them.
AI use paid for by your academy
If your academy pays for your roll analyses, its owner can see how many of its AI credits your analyses used, and when, and the daily cap they set for you. They see how many analyses you have left; they never see your footage or your coaching chats through this. Legal basis: performance of a contract — it is part of the academy membership you asked for.
What other athletes can see. Your public profile and any leaderboard you appear on show your handle, display name, belt and stripes, your academy if you have joined one, your streak, and your performance aggregates. They never show your email, your age, your weight, your notes, your footage, or your coaching chats. You can leave every board in Settings → Privacy. If you are under 18, you are on no board until you switch boards on yourself in Settings → Privacy, and the junior board is shown only inside your own academy (Section 4).
AI summaries for your academy: competition results
Your academy's staff can also ask the academy's AI analyst about competition results recorded in OP BJJ for adult members: the event, division and result, shown with your first name and last initial. It never sees your footage, training notes or coaching chats. Results of athletes under 18 are only ever counted, never named. If you object to retention insights (above), you are excluded from this too.
Training partner tags
When you analyse a roll, you can say who you rolled with by their username. That person gets one notification and can confirm, decline or untag it later; nothing counts until they confirm. When they confirm, we copy onto your roll their belt on that day and, only if they have switched on Share my weight class with partners who tag me (off unless they turn it on), whether they are heavier, lighter or within 5 kg of you — never their weight. You and your academy's staff can see it on your roll, as with the rest of the roll. It isn't public. If they untag or delete their account, it's removed from your roll. They never see your footage unless you share it. Anyone can switch off Allow partners to tag me in Settings → Privacy. Athletes under 18 can't be tagged and can't tag anyone.
If you start setting up an academy
If you start setting up an academy on our website or in the app, we keep your name, email address, the academy's name, location and size, and your App Store country so we can help you finish. If you agreed to it, we email you a link to finish and up to two reminders, each with an unsubscribe link. If no plan is bought, we delete these details after 12 months.
Records your academy imports
If your academy moves to OP BJJ from other gym software, its owner can import the member list and attendance from a file exported from that software, or have that software tell us as things happen, through a private link the owner sets up in that software's own automations or with an automation service such as Zapier: each check-in, and when a member signs up, starts a membership or cancels. From those messages we keep only the name, the day, the software's own member number when it sends one, and whether the membership is still active (a cancellation marks it as ended). For each person we keep only the first name, last name, adult belt, the date they joined, the software's own member number when the file or the software gives one, whether their membership is active, the name of their membership when the file has one (for example "Adult Unlimited", so the academy can set a price for each membership), and the days they trained in the last 400 days, with the class name when the file has one. Email addresses, phone numbers, payment details and notes in the file are never stored. Instead of the email or phone, we keep a one-way code made from the email or phone in your export or in a message from the software, used only to recognise the same person: a member who joins the app, or a later message from the software about them; it is deleted with the import. When a member who joins the app matches an imported record, their imported training days become part of their attendance history, so they are counted once; a match by name alone is only linked when staff confirm it. The academy uses these records to see attendance and who has stopped coming, with the same rules it uses for members of the app. These records are never sent to an AI model. The academy decides what to import, can delete all of it at any time, and it is deleted with the academy's account. For these records your academy is the controller and OP BJJ processes them on its behalf. Legal basis: the legitimate interests of your academy in running its classes and keeping its members. To have your record removed, ask your academy or email support@opbjj.com.
See your academy before you sign up
If you own or run an academy, you can try the preview at opbjj.com/academy/start without an account: pick your gym software, drop its export (members and check-ins), and see your own members, check-ins and Churn Radar. Your file is read and counted on your own computer; its contents and every member's name stay in your browser tab, are never sent to us, and are gone when you close the tab. The only thing the page sends is what you give on the email step: your email address, the name of your software (chosen from a list) and five counts you have just seen on the screen (members, active members, visits, and the first and last month of visits). Nothing is saved to your device either. We keep those for 90 days so that we can tell you when saving your academy opens, and then delete them; a repeat of the same address is the same record, and nothing is sent to an AI model. The page loads no script, font or tracker from any other company. If you save an academy later, that is a separate step with its own notice. Legal basis: your consent, given by continuing on the email step beside the wording you see there. To have your email removed sooner, write to support@opbjj.com.
Avatar images
Profile photo uploads are screened for NSFW content by Google Gemini before being stored in Cloudflare R2. The screening call is fail-closed. Legal basis: performance of a contract (providing a profile feature); legitimate interests (platform safety).
Security data
Hashed IP addresses and hashed user-agent strings are recorded against security events (login attempts, rate-limit triggers, abuse signals). We store hashes, not raw values. Legal basis: legitimate interests (fraud prevention and service security).
Anonymous step totals
To see where our website and sign-up lose people, we count how many times each step is reached, for example "landing page shown", "Get started tapped" or "plan screen shown", as one total per step per day. A count stores no account, name, email address, device identifier, cookie or IP address, and nothing is stored on your device for it, so a count can never be linked to you or to anything else we hold. Legal basis: legitimate interests (knowing which parts of our sign-up work).
Payment data
We do not collect or store payment card details. Payment is processed by Paddle.com Market Limited acting as Merchant of Record — Paddle is the seller of record for your purchase, not a processor acting on our instructions, and it is the entity that charges you and issues your invoice. We receive from Paddle: subscription status, plan ID, subscription ID, billing period dates, and the amount and currency of each transaction. These are stored in our database to determine your entitlements. Legal basis: performance of a contract.
One introductory offer per person. When you start an introductory offer on our website, we keep one-way codes (hashes) made from your email address, your card's brand, last four digits and expiry, your Paddle payment method and your Paddle customer ID. They can't be turned back into those details and aren't linked to your account. We use them only to check whether an introductory price or a free trial has been used before. In the iOS app, Apple checks trial eligibility for your Apple Account and we don't receive these details. We keep them for 3 years, including after your account is deleted. Legal basis: legitimate interests (preventing repeat use of a one-time offer).
2. What we do not do
- We do not sell personal data.
- We do not build advertising profiles.
- We do not share your training log with other academies.
- We do not read your AI coaching chats to build a profile of you. The one place we produce an assessment about you rather than a record of you is the retention insight described in Section 1, which your own academy asks for and which never uses your chats, your notes or your footage.
- Marketing email is off unless you turn on "Product news by email" in Settings › Privacy.
- We do not use tracking pixels or third-party analytics cookies.
- We do not fingerprint your device.
- We do not publish your footage, and there is no way for another athlete to find it. A share card you choose to create is saved to your device or your share sheet; we don't post it anywhere. We do not share it with any third party except for the AI processing described above, and we do not use it to train AI models without your explicit consent.
3. Legal bases summary
| Processing activity | Legal basis |
|---|---|
| Operating your account | Performance of a contract |
| Training log and competition records | Performance of a contract |
| Public leaderboards | Adults: legitimate interests — a ranking product is what this service is — with an opt-out you control in Settings. Under 18: your consent, given by switching boards on in Settings → Privacy; you can switch them off at any time |
| AI video analysis, coaching chat and voice notes | Performance of a contract — these are the service you signed up for. You can switch them off in Settings at any time |
| Areas you train around (health information) | Explicit consent, given when you save the area. You can withdraw it by deleting the area in Profile |
| Letting your coaches give you space (optional; your Sore taps after class) | Explicit consent, given by switching it on in Settings → Privacy (off unless you do); you withdraw it by switching it off |
| Pre-upload NSFW screening | Legitimate interests (platform safety) |
| Academy roster management by coaches | Legitimate interests of the academy |
| Your name for your academy, shown to its staff | Performance of a contract |
| Your academy-paid AI use, shown to its owner | Performance of a contract |
| Retention insights for academy staff | Legitimate interests of the academy (you can object) |
| Training highlights shared with your academy (optional) | Your consent, given on its own screen; you can withdraw it at any time |
| Questions to your coach (optional) | Your consent, given by sending a question; you withdraw it by taking the question back |
| The academy preview without an account (your email, your software's name, five counts) | Your consent, given beside the email field |
| Children on an academy's roster (no account) | The academy's own basis, as controller; we process the record on its instructions (Section 4) |
| Abuse prevention and security audit trail | Legitimate interests |
| Age-appropriate divisions and no profiling of minors | Legal obligation |
| Payment entitlement sync from Paddle | Performance of a contract |
| One introductory offer per person | Legitimate interests (preventing repeat use of a one-time offer) |
| Transfer to the controller in Kazakhstan | Explicit consent — the transfer clause in Section 6 below and in Terms Section 7, accepted when you create an account |
Health information. If you save an area you're training around, in onboarding or in coach chat, we treat it as health information. We only keep it with your explicit consent. It's used only to adjust your own plan and chat, never shown to your gym, coaches or any network, and you can delete it anytime.
Letting your coaches give you space (optional). If you are an adult member of an academy and switch on Let my coaches give me space in Settings → Privacy (it is off unless you do), a Sore tap after class can take you off your academy's list of members to reach and show your coaches a quiet "give them space" card for a while instead. Your coaches see only that card: never the word sore, the tap itself or any reason. We keep the switch and its changes as consent records. Switch it off and it stops at once.
4. Children and young athletes
Children under 13 cannot have an account. Sign-ups from children under 13 are refused before any record is created. We do not knowingly collect personal information from anyone under 13, in line with the US Children's Online Privacy Protection Act (COPPA) and equivalent rules elsewhere. If you are a parent or guardian and believe a child under 13 has created an account here, email support@opbjj.com and we will delete it and everything in it. We will not ask you to prove anything first.
Children under 13 on an academy's roster. An academy can add a child to its own roster so the coach can take attendance and track belts. The child has no account and never uses the app. The record holds the child's name, birth year (never a full date), belt and stripes, classes, attendance, promotions and short coach notes chosen from a fixed list, plus a parent's name and email. The academy is responsible for this record (it is the controller) and we hold it on the academy's behalf (we are its processor). Nothing about the child is public, nothing is sent to any AI provider, and we never use the parent's email for our own purposes. It is used only for notes the academy chooses to send about that child, each with a link to stop them. To see, correct or delete the record, ask the academy. You can also write to support@opbjj.com and we will pass your request to the academy within 5 business days. If the academy no longer uses OP BJJ, we will act on it ourselves. When the academy removes the child, or 90 days after its plan ends, the record is deleted.
Athletes aged 13 to 17. Young athletes hold a full account and use the same features as everyone else, including video analysis and the coaching chat. We do not restrict features by age, and we do not require a guardian's permission before the app works. A young athlete makes their own AI choice — the same one-time question, Keep AI on or Turn it off, that everyone else answers — and no guardian has to confirm it. Public boards are off for them until they switch boards on themselves in Settings › Privacy.
If a young athlete joins an academy, the same rule applies to their name: only that academy's staff see it, and it is never public.
Three things are different:
- Divisions. Athletes under 16 are ranked on a separate junior ladder, never against adults, and juniors follow their own belt progression.
- Boards are off until you turn them on. If you are under 18, you do not appear on any leaderboard until you switch boards on yourself in Settings → Privacy, and you can switch them off again at any time. The junior ladder is never public: it is shown only to verified members of your own academy, and nobody outside your academy — signed in or not — can see a junior's place on it.
- No profiling or marketing. We do not profile a young athlete's data for advertising or personalisation, and we do not market to them. This applies whichever country or US state they live in.
Age is a bracket, never a date. During onboarding we ask which age range you fall into. We never collect a date or year of birth from anyone with an account. The only birth year we hold is the one an academy enters for a child on its roster (above), because junior divisions and belt ladders are set by birth year.
We do not ask for a guardian's email. A young athlete's account works on its own, with the safeguards in this section. A parent or guardian can, at any time and without an account of their own, ask us to switch AI processing off for an athlete under 18, take them off public leaderboards, give them a copy of the athlete's data, or delete the account entirely. They write to support@opbjj.com and we act on it. We will not put a parent or guardian through an identity check before acting on a request that reduces what we hold or what we process — the cost of a wrongly-honoured switch-off is one athlete losing a feature they can turn back on, and the cost of a wrongly-refused one is a young athlete's data staying somewhere a parent asked it not to be.
Everyone gets the same warnings. The risk of injury, and the fact that AI output is not coaching and not medical advice, are stated in the app at the point they matter — before an upload, on every analysis, and in the coaching chat — for every athlete regardless of age.
Academies are responsible for holding a parent or guardian's agreement for every junior member they enrol or add to their roster, and for the safeguarding obligations of their jurisdiction and affiliation. See the [Academy Terms](/academy-terms), Sections 2 and 11.
5. Third-party processors
| Processor | Purpose | Data transferred | Where |
|---|---|---|---|
| Cloudflare, Inc. | Hosting (Pages, Workers), database (D1), object storage (R2) | All application data passes through Cloudflare infrastructure | D1 weur; R2 eu |
| Cloudflare Stream (Cloudflare, Inc.) | Video ingest, transcoding, storage and playback of footage you upload for analysis | Video files and their generated thumbnails | Cloudflare's global network |
| Google LLC (Gemini API / Vertex AI) | AI video analysis, NSFW screening, coaching chat, voice notes | Video frames/clips, voice-note audio, chat messages, account context | USA (Google Cloud) |
| Google LLC (Sign-In) | OAuth identity confirmation (if you choose Google Sign-In) | Email address, Google account ID | USA |
| Paddle.com Market Limited | Merchant of Record — seller of record for all purchases, payment processing, tax calculation and remittance, invoicing | Name and email for billing, subscription and transaction events | UK/EU |
| Resend (Plus Five Five, Inc.) | Sending account emails: sign-in and verification codes, receipts of rights requests, and parent notes an academy sends | Email address, the message content | USA |
| Apple Inc. (Sign in with Apple) | Identity confirmation if you choose Sign in with Apple | Apple account ID, email address or Apple relay address, name if you share it | USA |
We have data processing agreements with each processor where required by GDPR.
A note on Paddle's role: Paddle is not a processor acting on our instructions in the way Cloudflare and Google are. As Merchant of Record it is the seller in your transaction and an independent controller of the payment data you give it. Paddle's own Privacy Policy governs what it does with that data.
6. International transfers
The controller is located in Kazakhstan. OP BJJ operates as a sole proprietor in the Republic of Kazakhstan. Kazakhstan is not covered by a European Commission adequacy decision under GDPR Article 45. If you are in the EEA or the UK, your personal data is therefore transferred to a third country without an adequacy finding.
The safeguards relied on for these transfers are the Standard Contractual Clauses in place with each processor, together with the technical and organisational measures described in Section 10. Administrative access from Kazakhstan is covered by our own assessment of that transfer, which we will share on request at support@opbjj.com. Your explicit consent to that administrative access — the clause below, which you accept when you create an account, and which is recorded on your consent ledger as "transfer_kz" with the country you signed up from — is the basis for the Kazakhstan leg, and for nothing else.
Transfer clause. I understand my data will be accessible from Kazakhstan, outside the EEA, which has no EU adequacy decision, and I consent to that transfer.
Where your data sits in practice:
| Destination | What goes there | Basis |
|---|---|---|
| Kazakhstan | Administrative access by the controller (support requests, abuse review, account administration) | Your explicit consent (the transfer clause above, accepted at signup), together with our transfer assessment (available on request) |
| EU (Cloudflare) | Database (D1 weur) and object storage (R2 eu) — stored at rest in Europe; the Worker code that serves requests runs on Cloudflare's global network, so a request is processed at the edge location nearest to you | Standard Contractual Clauses; EU-US Data Privacy Framework where applicable |
| US (Google) | AI analysis and screening content, only if you enable AI features | Standard Contractual Clauses; EU-US Data Privacy Framework |
If you do not want your data processed in the United States, do not enable AI features — the training log, belt records, and all non-AI features operate without sending data to Google.
7. Retention
Retention periods are stored as data in the application and enforced by a scheduled sweep that runs daily. The schedule below is what actually runs:
| Data | Retention period |
|---|---|
| Login sessions | 30 days |
| OAuth state tokens | Minutes (short-lived) |
| Abuse-throttling records | 2 days |
| Per-view video analytics records | 90 days |
| Security audit trail | 2 years |
| Training log and competition records | 5 years, then anonymised |
| AI analysis results | Deleted when you request deletion of the associated clip or your account |
| Coaching chat history | Deleted on account deletion |
| Uploaded footage | Your most recent rolls keep their video — the number for your plan is shown in Settings → Billing, and is never more than 10 on Pro or 20 on Overpowered; Free plans keep no footage. For older rolls we delete the video (the stored file and the streaming copy) and keep your analysis, its score and its moments, with one still frame per moment, for as long as the roll exists. A roll you mark Keep keeps its video while it is within your plan's stored rolls. Deleting a roll, or your account, deletes the video, the stills and the analysis. |
| Training partner tags | While the roll exists; removed when the partner declines or untags, or deletes their account |
| Academy setup details (no plan bought) | 12 months, then deleted |
| Analysis follow-up chat | Deleted with the analysis, or on account deletion |
| Attempt suggestions from the coach chat | 72 hours to confirm, then deleted 3 days later. Confirmed attempts are kept as part of your training log |
| A roll uploaded before you chose a plan | Deleted after 30 days if you don't choose a plan |
| Your answer to the AI question (Keep AI on / Turn it off) | Kept with your account as a record of your choice; deleted on account deletion |
| Voice-note audio | Not stored — discarded as soon as the draft log is returned |
| Onboarding answers | Deleted on account deletion |
| Your name for your academy | Deleted on account deletion |
| In-app notices (belt and stripe changes from your coach) | 365 days |
| Home note (the short line on your Home screen) | 90 days, and replaced whenever your training changes |
| Advanced insights daily read | 7 days |
| What your coach remembers | Injuries 42 days unless you keep them; competition dates until the day after the event; likes and dislikes 180 days. You can delete any of it anytime in Profile |
| "Not now" on a suggestion to remember an area (the area only, no consent, nothing saved about the injury) | 14 days, so the coach doesn't ask again; included in your export and deleted with your account or when you delete what your coach remembers |
| Areas you train around | Kept until you change or remove them, or delete your account |
| Promotion evidence media | Deleted on account deletion; the promotion decision is retained (see Section 8) |
| Retention insights for academy staff | 90 days, then recomputed |
| Training highlights (the weekly summaries) | Until you stop sharing or leave the academy, and at most 120 days; deleted on account deletion. The record of your choice is kept with your consent records |
| Questions to your coach and the answers | Until you delete them, and at most a year after the last message; deleted on account deletion |
| Children on an academy's roster (no account) | Until the academy removes the child (deleted at once); if the academy's plan ends, 90 days, then deleted within 30 days |
| The academy preview without an account (your email, your software's name, five counts) | 90 days, then deleted |
| Billing event records (subscription and payment events from Paddle) | 7 years (tax, accounting, and payment-dispute evidence). Diagnostic payload fields are pruned on erasure; only the transaction record needed for the tax obligation is retained. |
| Consent records and rights-request audit trail | 6 years (evidence that we handled them correctly — deliberately outlives the account) |
| One-per-person introductory offer check (one-way codes) | 3 years, not linked to your account, kept after account deletion |
8. Deletion — read this carefully
When you request account deletion in Settings, we:
- Hold the account for 30 days so you can change your mind. During this period your account is hidden from other users, but you can still sign in — the grace period would be worthless if it locked you out of the account you were given a month to recover.
- Anonymise the account rather than deleting every row.
We are explicit about step 2 because "we delete everything" is usually untrue when another athlete's verified record is involved.
Your sparring and competition results name your opponent. If we hard-deleted your rows, your opponent's verified match history and rating would silently change — we would be rewriting someone else's record to honour your deletion request. Instead, we strip every identifier from your account (handle, email, display name, avatar) and retain only the bare anonymous result. Your handle is permanently retired and cannot be re-registered.
What is deleted outright:
- Your AI coaching chat history
- Your uploaded footage — both the stored file and the streaming copy
- Any footage you submitted as promotion evidence — the video files and their streaming copies, including every attachment on a submission
- Your profile photo (removed from storage, not merely unlinked)
- Your AI analysis results
- Your training notes
- The diagnostic contents of your billing event records
What is retained in anonymised form:
- Match and competition results (opponent-facing record only)
- Belt grade at time of result (for leaderboard integrity)
- Your academy's record that a promotion was awarded — the decision, not the footage behind it
On promotion decisions specifically. If you submitted footage to support a belt promotion, the footage is deleted — that is your video and your body, and it goes. What remains is your academy's record *that a decision was made*: the promotion, its date, and who awarded it, with your submission's title and notes stripped.
We keep that record for the same reason we keep sparring results: it is not solely yours. A belt promotion is your academy's decision about its own grading standards, and it is the answer to "why does this person hold this rank." Destroying it would remove your gym's ability to account for a promotion it awarded. The evidence itself — the video — has served its purpose once the decision is recorded, so nothing is kept that needs to be kept.
On payment records specifically. Payment event payloads are pruned on erasure — they are diagnostic data, not evidence of anything you consented to, so there is no reason to keep them once you are gone. What survives is the minimum transaction record we are required to retain for tax and accounting purposes, and the consent and rights-request trail described in Section 7. That trail is deliberately kept: it is the evidence that we handled your erasure request correctly, and destroying it would remove the only proof that we honoured the request you just made.
Security and fraud records we keep after deletion. A few technical records survive because deleting them would let a deleted account, or someone pretending to be you, undo a safeguard. None of them holds your name, email, handle, content or footage, and each is tied only to the anonymised account number:
- A one-way code of your Apple sign-in identifier, so a deleted account can't be re-linked or replayed.
- The record that you used your one free onboarding analysis, so it can't be claimed again.
- The record of your deletion request itself.
- The version counter of your AI-permission choices, so an old "allow" can never come back after you withdrew it. Your permission history itself is deleted.
- Request keys that stop a paid action from being charged or run twice, with their contents removed.
- A charge that was still being settled with our AI provider when you left, kept only until it settles.
- The address of a stored video whose deletion our storage provider hasn't yet confirmed, kept only until it does.
9. Your rights
The rights below are the GDPR and UK GDPR set. If you are a California resident, see Section 11 — the rights are similar and our response window is 45 days.
You have the following rights over your personal data:
- Access: Receive a copy of the data we hold about you.
- Rectification: Correct inaccurate data.
- Erasure: Request deletion (subject to the anonymisation rules above and our legal retention obligations).
- Restriction: Ask us to stop active processing while a dispute is resolved.
- Objection: Object to processing based on legitimate interests.
- Portability: Receive your training data in a machine-readable format.
- Switch off AI features: You can turn video analysis and the coaching chat off at any time in Settings. They are part of the service rather than something you consented to separately, so switching them off changes what the app does for you rather than withdrawing a permission. Analyses you already have stay in your Film Room until you delete them.
Self-service: Export and deletion are available in Settings. Both require you to confirm who you are — your password, or a fresh sign-in if your account uses Google. Export is immediate and arrives as a JSON file. Deletion starts immediately and completes after the 30-day hold described in Section 8 — the request is registered at once and your account is hidden from other users from that moment, but it stays accessible to you for the whole 30 days so you can cancel the request. The erasure itself runs at the end of the hold.
Everything else: Contact support@opbjj.com. We respond within one month, as required by GDPR Article 12. If your request is complex, we may take up to two months and will tell you why.
You may also complain to your national data protection authority. In the UK: the Information Commissioner's Office (ico.org.uk). In the EU: your member state's supervisory authority (listed at edpb.europa.eu).
10. Security
- Passwords are hashed with PBKDF2.
- Sessions are HTTP-only, Secure, SameSite-restricted cookies with a 30-day lifetime.
- All traffic is served over HTTPS with HSTS.
- We maintain an administrative audit trail and a breach register with the statutory 72-hour notification clock.
- Pre-upload AI screening gates are fail-closed: a timeout or error results in rejection, not publication.
- Subscription entitlement checks are fail-closed: a missing or unreadable key is treated as not entitled.
11. United States — state privacy rights
If you live in a US state with a comprehensive privacy law — including California, Colorado, Connecticut, Virginia, Oregon, Texas, Montana, and others — you have the right to know what personal information we hold about you, to receive a copy of it, to correct it, to delete it, and not to be discriminated against for exercising those rights. Use the export and deletion tools in Settings, or email support@opbjj.com. We respond within 45 days, and we will tell you if we need longer. We do not sell personal information and we do not share it for targeted advertising, so there is no opt-out for those to offer. If we refuse a request you may appeal by replying to our response; we will answer an appeal within 45 days and tell you how to contact your state Attorney General if you are still unsatisfied.
We do not use or disclose sensitive personal information beyond providing the service, so the right to limit its use does not arise. We do not sell or share personal information, so there is no 'Do Not Sell or Share My Personal Information' mechanism to offer.
We are not a data broker. We do not collect personal information about people who have no direct relationship with us, and we are not registered as a data broker in California, Vermont, Texas or Oregon, because we are not required to be.
12. Changes
We version this document. Material changes are notified in the app before they take effect, and your recorded agreement is always tied to the specific version you were shown at the time.
*Privacy Policy v2026-10-29.1 · OP BJJ · support@opbjj.com*