Privacy policy

Data on your device

An account is required to use the app, and your training data is saved to your account (see below). This device also keeps a local copy so the app stays fast and works offline: your profile, sessions, game plans and techniques in the browser's local storage, changes waiting to sync, and the cached app files of the installed app. Your sign-in is kept in a secure browser cookie. Clearing the app's data on this device removes the local copy, not your account.

If you create an account

Creating an account asks for an email address and a password. We store a secure hash of your password — we never see the password itself. Your training data is saved to our servers (a PostgreSQL database run by Neon, hosted in the United States) so it follows you across devices. Coaches: gyms, classes, members, attendance and billing notes you enter sync the same way. You can also sign in with Google or X. Then we receive only your name, email address and profile photo from them — never your password, posts, contacts or anything else.

Outside Quebec / United States hosting

When you create an account or use a feature that needs a connection, your data may leave Quebec and be processed in the United States by our hosting providers, and — if you use AI features — by Groq, under our arrangements with them. We use those providers so the service can run (sync, hosting, and on-demand AI you request).

AI features

Photo reading (class schedules and curriculum photos), session parsing, translation, AI-written coaching, plans and reports, and AI transcription send only the content needed for that specific task to our AI provider (Groq), and only when you tap to use the feature (the AI Coach tip after a saved session is the one automatic exception, described below). Agreeing to this policy alone does not turn the other AI features on. GrappleSmart does not train AI models on your content.

AI Coach: when you use the AI Coach (the tip that appears automatically after you save a session while signed in, the weekly coach's read you ask for, and coach chat), your profile coaching fields (belt, stripes, preferred format, goal, weekly target, game style, your coaching goal in your own words, weight and the optional injury note), your recent logs and your next competition date are sent to our AI provider (Groq) to generate advice. Your gym's focus and curriculum week are added when your coach assigned them. The AI Coach fields (weight, game style, coaching goal and injury note) are not shown to coaches. They are all optional: you can leave them blank, and the coach then works from your logs alone.

Cloud voice: when it is on and available, your voice recording and its transcript are sent to our processing provider (Groq, in the United States) to transcribe it and clean up BJJ terms, then returned to you. Clips are not kept by us after processing. You can turn cloud voice off in the menu; on-device voice keeps audio on your phone.

AI output can be wrong. Treat it as a helper, not as medical, legal, or professional coaching advice.

Other services we use

Push reminders: if you turn on reminders, your browser gives us a push address and its encryption keys. We store them with your language and time zone and use them to send class and plan reminders through your browser's push service (Google, Mozilla, Apple or Microsoft). You can turn reminders off in the app.

Payments: passes and dues are paid through Stripe Checkout, on the gym's own Stripe account. Your card details go to Stripe, not to us; we keep the pass or due, its amount and the Stripe session reference.

Email: account emails, such as email verification and password reset links, are sent through Resend.

Technique videos: when you search for a technique video, the search words are sent to the YouTube Data API.

Clip reviews: clip links you send to your coach are shared with that gym's coaches. We store the link, not the video.

Sharing your logs with your gym: off by default. Only if you turn on "Share my training logs" for a gym, that gym's owner and the teachers of your own classes can see your session log summaries, the finishes you got and what you tapped to (for example in your progress sheet and in class insights, which compare what a class logged with its plan). Your AI Coach fields are never shown. You can turn it off anytime in Profile, under My gyms; your coaches then stop seeing your logs.

Public pages

Coaches can publish a public schedule page for their gym. Only the information the coach chooses to publish is visible to anyone with the link. Coaches should not publish other people's personal information without their consent.

Coach-entered information about others

When coaches enter members, attendance, or billing notes, that may include other people's personal information. The coach or gym must have the authority to collect and enter that information. We process it only to provide the service. If your information was entered by a coach and you want access, correction, or deletion, email us.

Trial registration and health questionnaire

When you register for a trial class, the gym asks for your contact details, an emergency contact, your age, a short health questionnaire (Q-AAP) and your signed waiver. This includes health information, so we treat it as sensitive: only that gym's coaches can see it, it is used only to keep you safe on the mats, and never for anything else. The gym keeps these records as its own (see below).

What we never do

No advertising and no cross-site tracking. We never sell your personal information, and we don't share it except to operate the app (hosting, usage analytics, AI features you request) or when the law requires it.

Usage analytics (Vercel Web Analytics)

To learn which features help, we count page visits with Vercel Web Analytics, run by our host Vercel in the United States. It sets no cookies and doesn't follow you across sites. It receives the page address (with links' secret codes and anything after "?" removed), the referring site, and your browser, operating system, device type and approximate location (country, region, city), which Vercel derives from your connection without storing your IP address. We also count a few first-time steps on this device — creating an account, logging your first session, opening the coach desk, using voice, importing a gym site or a curriculum photo — as a step name only. We never send your name, email, training notes or anything you type. Visitors are counted for a single day and can't be linked across days.

How long we keep data

Export a copy of your data anytime from your profile (portability). Clear your training data with "Reset all data" — on this device, and in your account too when you are signed in (your account and gym memberships stay). Erase your account and server data with "Delete account" under Danger zone in your profile; both ask you to confirm first.

After you delete your account, we remove your account and synced data from our active systems promptly. Residual copies may remain in our database provider's backups until they expire in its normal backup cycle.

Records a gym keeps about you — payments, dues and signed trial waivers — stay with that gym after you delete your account, because they are the gym's business records. Ask the gym, or email us, if you want them corrected or removed. When you delete your account, your active recurring passes are cancelled with Stripe first; if that cancellation fails, the account is not deleted and you can try again.

Trial health questionnaire answers and emergency contacts are erased automatically 24 months after the sign-up; the gym keeps only the record of who signed the waiver and when. Daily usage counters (AI and import limits) are erased after 30 days.

Security

We take reasonable steps to protect personal information we hold. No system is perfect. If you're concerned about your account or data, or you think something went wrong, email us at grapplesmartapp@gmail.com. If a privacy incident could cause you serious harm, we will notify you and Quebec's Commission d'accès à l'information, and we keep a register of incidents as Law 25 requires.

Your rights

Under Quebec's Law 25 and Canada's privacy laws you can request access, correction or deletion of your information by emailing us. You can also export your data from your profile, or delete your account as described above.

Children

Accounts are not intended for anyone under 14. If you're under 18, please use the app with a parent or guardian. Gyms often teach kids: a coach may enter a child's name, belt and birthday, and a parent may register a child for a trial class. For a child under 14, the coach or gym must have a parent's or guardian's consent — the app asks the coach to confirm it — and trial registration for anyone under 18 requires a parent's or guardian's consent. Parents can ask the gym or us to access, correct or delete their child's information.

Changes to this policy

If this policy changes, we'll update the date above. Material changes will be flagged in the app.

Contact

Questions about your privacy? Email us at grapplesmartapp@gmail.com.