Privacy Policy

Last updated: 7 July 2026

BJJ Lab ("BJJ Lab", "we", "us") is a training journal for Brazilian Jiu-Jitsu, available worldwide with a primarily Saudi, European, and U.S. audience. This policy explains what personal data we collect, why, how it's handled, and the choices you have. For the purposes of data-protection law — including the EU/UK GDPR, the Saudi Personal Data Protection Law (PDPL), and the California CCPA/CPRA — BJJ Lab is the "data controller" responsible for your personal data. If you have questions, email contact@aeoholic.com.

Information we collect

Account information — your email address and password (passwords are stored securely by our authentication provider, never in plain text), and optionally your display name, belt rank, academy, and profile photo.
Training content you create — training sessions, techniques, game plans, training partners, injuries, challenges, and messages you send to the in-app AI coach.
Subscription status — whether you are on a free trial or an active subscription (managed through Apple and our subscription provider). We never see or store your card details.
Basic technical data — standard logs needed to operate and secure the service.

How we use your data

To provide the app: store your training data and sync it across your devices.
To operate accounts and authentication.
To provide AI coaching responses and quizzes.
To manage your subscription and free trial.
To keep the service secure and fix problems.

We do not sell your personal data, we do not "share" it for cross-context behavioural advertising, and we do not use it for third-party advertising.

Legal bases for processing

Where the GDPR or a similar law applies, we process your data on these bases:

Performance of a contract — to create your account and provide the features you ask for.
Legitimate interests — to keep the service secure, prevent abuse, and improve the app, balanced against your rights.
Consent — where required, such as optional push notifications; you can withdraw consent at any time.
Legal obligation — where we must retain or disclose data to comply with the law.

Service providers we use

We rely on a small number of trusted processors to run the app. Your data may be processed by:

Supabase — database, authentication, and file storage (your account and training data).
Apple — App Store distribution and In-App Purchase billing.
RevenueCat — subscription management (receives your subscription status and an anonymous user identifier).
DeepSeek — the AI provider that generates coach replies. When you message the AI coach, the text of your message (and general context like your belt level) is sent to this provider to produce a response. Please avoid sending sensitive personal information to the AI coach.

Health note. The injury log is a personal training journal, not medical data or medical advice. It is stored like your other training data and is never shared for advertising or sold.

Data retention & deletion

We keep your data for as long as your account exists. You can delete your account at any time from within the app (Settings → Account & security → Delete account). Deleting your account permanently removes your profile and training data from our systems. You may also email us to request deletion.

Security

Data is encrypted in transit, access is restricted per-user at the database level (row-level security), and passwords are never stored in plain text. No system is perfectly secure, but we take reasonable measures to protect your information.

Children

BJJ Lab is not directed to children. You must be at least 13 years old to use it, or older where your country sets a higher minimum age for consent to online services (for example, up to 16 in parts of the EEA). We do not knowingly collect data from children below the applicable age; if you believe a child has provided us data, contact us and we will remove it.

International data transfers

We operate globally, so your data — including for users in Saudi Arabia and Europe — may be processed and stored by our providers (Supabase, Apple, RevenueCat, DeepSeek) on servers outside your country, including in the United States and other regions. Where data is transferred out of the EEA/UK, Saudi Arabia, or another region with data-export rules, we rely on appropriate safeguards such as the providers' Standard Contractual Clauses and contractual security commitments. By using the app, you understand your data may be processed in these locations.

Your rights

Subject to your local law, you have the right to access, correct, export, and delete your personal data, to restrict or object to certain processing, and to withdraw consent. You can do most of this in the app — view and edit your data, export a copy, and delete your account — or email us at contact@aeoholic.com. We respond to verified requests within the timeframes required by applicable law and will not discriminate against you for exercising your rights.

Saudi Arabia (PDPL): you have the rights to be informed, to access your data, to request its correction, and to request its destruction. The Saudi Data & AI Authority (SDAIA) supervises these rights.
Europe / UK (GDPR): in addition to the above, you may lodge a complaint with your local data protection authority.
California (CCPA/CPRA): you have the right to know, access, correct, and delete your data, and to opt out of the "sale" or "sharing" of personal information — which we do not do.

Changes to this policy

We may update this policy from time to time. Material changes will be reflected by updating the date above and, where appropriate, notifying you in the app.

Contact

Questions about privacy? Email contact@aeoholic.com.