Privacy Policy

Version 2 · Closed Beta (USA)

Information we collect

Everything below is collected directly from you, through your own use of the product.

Account & authentication data

Your email address, account creation date, email confirmation status, and last sign-in time. This is managed by our authentication provider (Supabase Auth) and is private to your own account.

Profile data (community-visible)

Your username, avatar, bio, city, and country are visible to any other signed-in BJJ Challenge user, so they can find and challenge you.

Athlete data (community-visible)

Your belt, weight, gender, primary style (Gi/No-Gi/Both), rating, and academy affiliation.

Private data

Your date of birth, if you choose to provide it, is never shown to other users. We only ever derive and display whether your profile counts as an “adult” profile — never the raw date. Your full legal name (if different from your username) is also private and never shown to other users.

Challenge, match, result & rating data

Challenges you send or receive, matches you participate in, reported results, disputes, and your rating history are visible to you and, where relevant, to the other participant in that challenge or match. Your current rating and completed-match summary are visible to any signed-in user as part of rankings and discovery.

Notifications & invites

In-app notifications about your own challenges, matches, and results. Invitations you create or claim to join BJJ Challenge.

Consent records

A record that you confirmed you are 18+ and agreed to these Terms and this Privacy Policy at signup, including which version of each document you agreed to and when. We do not record your IP address, device information, or location as part of this.

Privacy requests

If you submit a privacy request, we store the request type and your message so we can respond to it.

Safety & copyright reports

If you file a safety or copyright report, we store the report type, reason, your optional description, and a minimal snapshot of the reported content (only a username, or the specific challenge/match text you reported — never an avatar image, and never your full name, email, date of birth, or other private profile data about the reported athlete).

Avatars

If you upload a profile photo, it is stored privately and shown to other signed-in users only through a short-lived, generated link — it is never stored as a public URL.

How we use it

We use the information above only to operate BJJ Challenge: to run your account, show your profile to other athletes, run challenges and matches, calculate ratings and rankings, send you in-app notifications about your own activity, respond to your requests, and review safety/copyright reports.

We do not sell your personal information, and we do not use it for advertising.

Who can see what

• Public to any signed-in user: username, avatar, bio, city, country, belt, weight, gender, style, academy, rating, and completed-match summary.
• Visible only to challenge/match participants: challenge messages, match method notes, and dispute activity for challenges/matches you're part of.
• Private to you: your email, date of birth, full legal name, consent records, and your own report/privacy-request history.
• Visible to an administrator only: internal moderation notes on reports and privacy requests, and the full account record for moderation purposes.
• Not shown to other athletes, and not part of the ordinary admin interface: your raw date of birth is not displayed on your profile, through the normal community/public profile view, or in the ordinary admin screens an administrator uses — only a derived adult/not-adult status is ever shown there. It is stored as private account data. This describes how the product itself displays information; it is not a claim that no one with direct, infrastructure-level access to our database could technically read a stored value.

Service providers

We use two infrastructure providers to run BJJ Challenge:

• Supabase — our database, authentication, and file storage provider. Supabase hosts and processes essentially all of the data described above.
• Vercel — our application hosting provider. Vercel runs the BJJ Challenge web application and processes your requests to it.

We do not currently use any other third-party processor, analytics tool, advertising network, or tracking service. We have not independently verified, and do not represent, the specific physical region in which Supabase or Vercel host or process data for this project.

Cookies

We use a small number of cookies, described in full in our Cookie Policy — authentication/session cookies from Supabase Auth, and two short-lived cookies that limit how often you can request a data export or submit a report. We do not use advertising or analytics cookies.

Advertising, analytics & tracking

BJJ Challenge currently has no advertising, no analytics tools, and no third-party tracking of any kind. We do not use tracking pixels, behavioral advertising, or cross-site tracking technology.

Your choices & rights

• Access & portability: use Download my data to get a copy of essentially everything associated with your account, as a JSON file.
• Correction: most profile fields are directly editable from your athlete profile edit page. For anything else, use Submit a privacy request.
• Deletion: use Delete my account — see the section below for exactly what this does.
• Other requests (such as a question about your data, a correction we can't handle automatically, or anything not covered above): use Submit a privacy request. We review these manually.

Account deletion: what is removed, what is retained

Deleting your account is immediate and permanent. It substantially removes and anonymizes your personal information — it does not erase every historical record. Specifically:

Removed or anonymized:

• your username is replaced with a randomly generated, non-identifying value;
• your full name, bio, city, country, and avatar are removed;
• your weight, gender, and date of birth are removed;
• your primary style (Gi/No-Gi/Both) is removed;
• the method note on a match is removed, but only where our system can determine with certainty that you were the one who wrote it — the same standard applied to a challenge message you authored;
• your email is replaced with a non-deliverable placeholder, and your account is permanently locked;
• any academy affiliation is hidden from other users;
• any pending challenge or unclaimed invite you created is withdrawn.

Retained:

• your BJJ belt rank currently remains on record — this field is required by our current system and is not yet able to be cleared on deletion; we do not consider a belt rank alone to identify you;
• match and challenge history you participated in (that a match happened, who the participants were — shown as your anonymized identity, the status, the winner, and the reported win method/technique) remains on record, so the other participant's own history and rating stay accurate;
• your rating history remains on record for the same reason;
• the historical trail of match result reports and disputes (including earlier versions of a method note, if any) is retained unredacted, as an immutable record;
• any safety or copyright report you filed, or that was filed about you, remains on record in its minimized form (see Safety & copyright reports above) — a deleted account loses access to view reports it filed, but the record itself is retained for moderation history;
• your consent record (that you confirmed 18+ and agreed to these documents, and when) is retained;
• internal administrative audit records of actions taken on your account are retained.

We retain these specific items because removing them would either break another user's own accurate match/rating history, or because they serve as our own evidentiary/compliance record. We do not currently have a defined future deletion date for these retained records.

Security

We rely on our infrastructure providers' security controls (authentication, database access controls, and private file storage with time-limited access links) to protect your information. No online service can guarantee absolute security.

California disclosures

This section is provided for California residents, consistent with the California Online Privacy Protection Act. The categories of personally identifiable information we collect are listed in Information we collect above. We do not track visitors across third-party sites over time, and our systems do not currently respond differently to a browser's “Do Not Track” signal, because we do not perform the kind of cross-site tracking that signal is meant to address. We will notify you of material changes to this policy as described in Changes to this policy below. This policy's effective date is reflected by its version number at the top of this page.

Children

BJJ Challenge is an 18+ product and is not directed to children. We do not knowingly collect personal information from anyone under 18. If we learn an account belongs to someone under 18, we will remove it using the account deletion process described above.

Changes to this policy

We may update this policy as the product changes, especially as this Closed Beta evolves. If we make a material change, we will update the version number at the top of this page.

Contact

For a question about this policy or about your own data, use Submit a privacy request, or email [Contact email — to be provided before public launch]. BJJ Challenge is currently operated by [Operator legal name — to be provided before public launch].