Privacy Policy

1. Controller and contact

The controller responsible for personal data processing on BJJMAXXING is:

Jason Gloger
Ostermannstraße 7
30171 Hannover, Germany

Email: bjjmaxxing@gmail.com

Send privacy requests to the email address above.

2. Data we process and why

Depending on how you use the platform, we process account and contact details, profile and sports information, content and interactions, event and matchmaking data, payment and integration data, and technical usage and security information. The details required depend on the feature.

• Art. 6(1)(b) GDPR: accounts, sign-in, platform features, event registration and administration, matchmaking, support, and integrations you request.
• Art. 6(1)(f) GDPR: operating and securing the service, troubleshooting, preventing abuse and fraud, and protecting or enforcing rights, taking affected people's interests into account.
• Art. 6(1)(a) GDPR: optional analytics, external media, marketing communications, and connections to third-party services where you consent. You can withdraw consent for the future through the privacy settings.
• Art. 6(1)(c) GDPR: where a specific legal retention or record-keeping obligation applies.

3. Hosting, delivery, and server logs

The website is delivered through Vercel. Page and API requests generate technical connection data such as IP address, time, requested address, referrer, browser and device information, and status or error data. This information is processed to deliver the service, maintain stability, diagnose errors, and defend against attacks. The legal basis is Art. 6(1)(f) GDPR and, where necessary to provide a feature you requested, Art. 6(1)(b) GDPR.

The repository does not define one retention period for hosting or server logs. Retention depends on the technical purpose and the provider's settings. Vercel's specific processing terms, retention periods, and international transfers cannot be established from source code alone.

4. Accounts and authentication

Registration and sign-in use information such as your email address, authentication data, user identifier, session information, and selected sign-in method. This includes email verification, password sign-in, password recovery, and OAuth sign-in options available in the code. Supabase Auth manages authentication and sessions; session information is associated with technically necessary cookies.

Your profile may contain a display name, age or date-of-birth information, nationality, belt, weight, team/gym, sports, profile image, and optional details. Information required for a feature is used to provide it. The primary legal basis is Art. 6(1)(b) GDPR.

5. Public athlete profiles, teams, and organizations

Profiles can be made public and shown at a public profile address. Depending on your profile settings, this may include your display name, image, belt, gym/team, nationality, social links, sports information, competition results, and statistics. Teams, gyms, organizations, coaches, and related public information may also have public pages.

Public pages can be accessed and shared from outside the platform, crawled by search engines, and shown in search results or previews. Profile and other approved images may appear as preview images. Search engine indexing or display is not guaranteed. Only make information public if you are comfortable making it accessible worldwide. Private profile settings limit the public profile view; they do not automatically make information separately published in public event or community areas private.

6. Community, posts, and interactions

Community features process posts, text, images and other uploaded media, and related information such as author, timestamp, comments, likes/reactions, and, where applicable, friendship or following relationships. Private or access-restricted areas are intended for authorized people. Moderators and organization roles may access content as needed for their duties.

Public community posts and public detail pages may be available through their own URLs, shared externally, and indexed by search engines. Changes or deletions on BJJMAXXING do not immediately remove copies or search engine caches outside our control.

7. Images, video, and storage

When you upload profile images, post images, logos, or event media, we process the file and related metadata to store it and display it in the areas you select. The platform uses Supabase Storage for stored media and Mux for certain video upload and playback features. Depending on visibility settings, media may be publicly accessible and delivered through a content delivery network.

Embedded videos or external media are loaded only after your selection in the privacy settings or other active release. When playback starts, the provider may receive connection data and playback information. Links to social networks open external websites, where their own privacy terms apply.

8. Events, tournaments, and live results

For event registration, administration, and documentation, we process information such as name, email address, date of birth or age class, weight, belt, nationality, team, profile image, registration status, check-in, consent and guardian details, and related communications, depending on the event. For the supported minor registration flow, details of a parent or legal guardian are processed and confirmation is requested; an entry may remain pending until confirmation.

Brackets, match pairings, live clock, points, penalties, submission type, winner, placements, and tournament results are processed to run and display a competition. Where a participant list or result is public, those sports records may be visible publicly and included in profiles, fight records, statistics, or rankings. People with organizer, jury, coach, or administrator duties may access information needed for that role.

9. Matchmaking and superfights

Matchmaking stores your likes/interests, passes, filters, matches, related profile and gym information, and messages you send in an unlocked conversation. BJJMAXXING internally processes the participating accounts to provide the feature. When interest is one-sided, your identity is initially hidden from the other athlete. When interest is mutual, the match is unlocked and relevant profile details are shown to the participants. The feature is therefore not fully anonymous. Administrators may access match and conversation data as required for organization or moderation.

After a new expression of interest, the other person may receive a notification email that does not reveal the interested athlete's identity before a mutual match. Transactional emails may contain recipient address, required message content, send time, and delivery metadata.

10. Gym location, distances, and maps

Matchmaking may calculate an approximate distance from the gym location in your profile to the gym location of the athlete shown (gym to gym). It does not require a private home address or current GPS position. The visibility of gym location follows the available profile settings.

A separate map feature may request browser geolocation after you take an explicit action. If you allow it, the device position is used to center the map or find nearby content. You can deny or change this permission in your browser. This position is not used for matchmaking distance. Depending on the map view, map data is loaded from CARTO or Google Maps. The Google gym map loads Google only after external media is enabled; connection and map data may then be sent to the relevant provider.

11. Presence and online status

The platform processes technical activity and timing information to show presence or online status and activity for signed-in users and certain guest users, and to support operations. Visibility and detail depend on the product view. The repository does not specify a general retention period for all presence data.

12. Training, health and WHOOP data, and AI features

Training logs may contain training date, duration, intensity, techniques, notes, images, and other sports information you enter. If you connect a WHOOP account, data is retrieved with your authorization, including workout time, strain, energy expenditure, calories, and heart-rate information. This may qualify as health data under the GDPR. Connecting WHOOP is optional; you can disconnect it in integration settings. WHOOP access tokens are managed server-side for the connected service.

When you use an AI coach feature, your prompts and the training, profile, or game-plan context needed for that particular response are sent to OpenAI for processing. Do not include information in prompts that the feature does not need. Availability depends on the feature and its configuration.

13. Email and communications

We send necessary service emails, for example for account and email confirmation, password recovery, tournament registration and check-in, guardian confirmation, profile claims, matchmaking, and superfights. This uses the recipient address, required message data, and delivery metadata. Resend is used for email delivery and newsletter/campaign features.

Marketing emails are separate from necessary service messages. Newsletter and campaign contacts are used according to the recorded marketing choice and applicable rules; you can unsubscribe. Delivery, open, or unsubscribe events may be processed to manage sending and maintain records. The source code does not define a general deletion period for these delivery records.

14. Payments

Stripe is used to process checkout and payment events for certain paid features or products. The order and transaction information needed for payment is processed between BJJMAXXING and Stripe. Stripe processes payment details such as full card information; BJJMAXXING does not store them for its own payment processing. Stripe's privacy information and the details shown at checkout also apply.

15. Analytics, performance data, and error diagnostics

PostHog product analytics, Vercel Analytics, and Vercel Speed Insights load only if you consent to analytics in the privacy settings and the feature is enabled in the production environment. They may process pseudonymous usage events, technical device/browser data, and performance metrics. PostHog is configured with automatic click and page-view capture disabled; session recordings are masked and configured areas are excluded. Identified analytics data may include a user identifier, language, environment, and onboarding attributes. The code filters certain fields, such as email, names, URLs, and tokens, from events.

Sentry is used for production error diagnostics when configured. Its configuration disables default personally identifiable information. Error events may include technical error, browser, device, and request information; whether an individual event also contains a user identifier or other details depends on the call site. Secrets and authentication tokens must not be included in error messages or events.

Optional analytics is based on your consent (Art. 6(1)(a) GDPR and, where device access is involved, § 25(1) TDDDG). Security and error diagnostics are based on legitimate interests (Art. 6(1)(f) GDPR) where consent is not required.

16. Cookies and local storage

We use technically necessary cookies for authentication, session management, and certain security or feature flows. The website stores your consent choice in your browser's local storage under the key bjjmaxxing-consent. Depending on the feature, local preferences, temporary form drafts, or navigation data may also be stored in Local Storage or Session Storage. Your browser may restrict or delete this storage; some convenience or sign-in features may then be unavailable.

Optional external media and analytics are not loaded until you make a choice. Email marketing preferences are not browser cookies. § 25 TDDDG applies where information is stored on or accessed from your device.

17. Providers and data transfers

• Vercel: hosting, delivery, operations, and performance diagnostics.
• Supabase: authentication, database, realtime features, and file storage.
• Resend: transactional email and, depending on your choice, newsletter/campaign sending.
• PostHog and Vercel Analytics/Speed Insights: optional product and performance measurement after analytics consent.
• Sentry: production error diagnostics when configured.
• Stripe: payment processing for paid offers.
• Mux: video processing and delivery in the relevant features.
• OpenAI: prompt and necessary context processing when using AI coach features.
• WHOOP and Google Maps: only when you use the relevant connection or map feature.
• CARTO: map data for interactive discovery and world map views.

Providers receive only data needed for their respective feature. The repository alone does not establish exact storage locations, all data processing agreements, transfer mechanisms, or provider retention periods. Details on potential international transfers and applicable safeguards depend on current provider terms and agreements actually in place. This notice does not claim a specific server region or contractual safeguard that cannot be verified from the project.

18. Retention and deletion

Account and profile data is generally kept while your account exists and the relevant feature needs it. Content, messages, match data, tournament records, results, and delivery or security records may be needed longer to operate the platform, moderate it, document events, or comply with legal obligations. The repository does not define concrete deletion periods for every data type.

Automatic cleanup is implemented for temporary guest accounts: accounts marked as non-permanent and with no activity for 90 days may be deleted by a scheduled system process.

The repository does not contain a complete self-service flow that automatically deletes all account data and content. To request account or data deletion, contact bjjmaxxing@gmail.com. We will review the request and delete or anonymize data where no legal obligation or overriding legitimate reason requires retention. Public posts, tournament results, and copies held by search engines or third parties may remain available outside the platform after deletion.

19. Your rights

Subject to legal requirements, you may request access, correction, erasure, restriction of processing, and data portability. Where processing is based on legitimate interests, you may object for reasons relating to your particular situation. You may withdraw consent at any time with effect for the future. You may also lodge a complaint with a data protection supervisory authority. To exercise your rights, contact us at the address above.

20. Changes to this policy

We update this policy when platform features, data processing, or legal requirements change. The current version is published on this page; its date appears at the beginning.