This Privacy Policy explains what information Flowmora LLC, a Georgia limited liability company ("Flowmora," "we," "us"), collects when you use our application and website (the "Service"), how we use it, and the choices you have. The short version: we collect what's needed to run your training companion, we don't sell your data, and we don't show ads.
Email address and password (handled by our authentication provider; we never see your password), plus profile details you choose to provide: name, belt rank, years of training, gym, and training goals.
Sessions you log, including positions, submissions, rounds, sweeps, escapes, notes, training-partner records you create ("nemesis" entries and roll results), achievements, and timer activity.
When you use voice features, your speech is converted to text by your device's built-in speech recognition (Apple or Google, per your device settings). We receive only the resulting text transcript, which is processed by our AI provider to fill in your training log or answer your coaching question. We do not receive or store audio recordings.
Only if you tap "Use my location" in the event calendar: your device provides coordinates, which are converted to a city name to search for nearby events. We store the city name as your calendar preference — never your precise coordinates, and we never track location in the background.
Basic records of AI feature usage (used to enforce free-tier limits), and standard technical logs (such as IP address and request timestamps) generated by our hosting infrastructure for security and reliability.
We do not sell your personal information, and we do not use it for third-party advertising.
We share data only with the processors required to run the Service:
| Provider | Purpose | What they process |
|---|---|---|
| Supabase | Authentication & database | Account info, training data |
| Anthropic | AI coaching responses | Your questions, voice transcripts, profile summary, recent session summaries |
| Vercel | Hosting & serverless functions | Technical request logs |
| Google (YouTube API) | Video recommendations | Search terms derived from your coaching topics |
| Serper | Event search | Your chosen calendar location (city) |
| OpenStreetMap (Nominatim) | Converting coordinates to a city name | Coordinates, only when you tap "Use my location" |
| RevenueCat | App Store and Google Play subscription management | Your account ID, subscription status and purchase history from the App Store or Google Play (never card details) |
| PostHog | Product analytics — understanding which features are used so we can improve the Service | Feature-usage events tied to your account (e.g. screens viewed, sessions logged), belt rank, plan tier |
Payment processing (Stripe on the web; Apple and Google billing in their app stores) is handled by those providers under their own privacy policies — we never see your full card number. For app-store subscriptions, RevenueCat receives the store's purchase receipt so we can confirm your subscription is active.
Your training data is retained while your account is active so your history and progress features work. You can delete individual sessions in the app at any time. To permanently delete your account and all associated data, use Settings → Delete my account in the app — deletion is immediate. A subscription bought on our website is cancelled automatically. A subscription bought through the Apple App Store or Google Play is managed by that store and is not cancelled by deleting your account — cancel it in your App Store or Google Play subscription settings. You may also contact us at the email below and we will complete the deletion within 30 days.
Specific retention periods:
| Data | How long we keep it |
|---|---|
| Account and training data | While your account is active; erased immediately on account deletion |
| Encrypted database backups | Up to 30 days on a rolling basis, after which deleted data ages out permanently |
| Terms-acceptance records | While your account is active; deleted with the account |
| Technical and security logs | Typically 30–90 days, per our hosting provider's retention |
| Analytics events | Retained in aggregate; identifiers removed on account deletion |
| App-store subscription records (RevenueCat) | While your account is active; we request deletion when you delete your account. Apple and Google keep their own purchase records under their policies. |
| Payment and tax records | Retained by our payment processors as required by law (generally up to 7 years). We do not hold card data. |
We do not use your training data to train AI models, and our AI provider does not train on it.
Data is encrypted in transit (HTTPS) and protected at rest by our database provider with row-level security, meaning your training data is only accessible to your authenticated account. No system is perfectly secure, but we follow industry-standard practices.
If a breach occurs. If we become aware of a security breach affecting your personal information, we will notify you without undue delay — and, where the law requires it, within 72 hours of becoming aware — by email to the address on your account and, if appropriate, by notice in the app. That notice will describe what happened, what information was involved, what we are doing about it, and what you can do. We will also notify the relevant regulators where required.
The Service is not directed to children under 13, and we do not knowingly collect personal information from them. If you believe a child under 13 has created an account, contact us and we will delete it.
Wherever you live, you can access and correct your information in the app, export your training journal (Journal → Export), and delete everything (Settings → Delete my account). For anything else, email support@flowmorajiujitsu.com. We respond within 30 days (45 for California requests where an extension is permitted), and we never discriminate against anyone who exercises a privacy right — your price and features stay the same.
In the last 12 months we collected these categories of personal information:
| Category | Examples | Why |
|---|---|---|
| Identifiers | Email address, account ID | To create and secure your account |
| Customer records | Name, belt rank, gym, years training | To personalize coaching |
| Commercial information | Subscription status and history | To provide the paid plan |
| Internet activity | Feature-usage events, app interactions | To understand and improve the Service |
| Geolocation | Coarse city only, and only when you tap "Use my location" | To find nearby events |
| Other information you provide | Training notes, voice transcripts, rival notes | To log your training and generate coaching |
Sources: you, and your device as you use the Service. We disclose information only to the service providers listed in Section 3, for the purposes stated there.
We do not sell your personal information, and we do not share it for cross-context behavioral advertising — as those terms are defined by the CCPA/CPRA. We have not done so in the preceding 12 months, including for anyone under 16. We do not use or disclose sensitive personal information for purposes requiring a right to limit.
Your California rights: to know what we collect and why, to access a copy, to correct inaccuracies, to delete, and to not be retaliated against for exercising them. Use the in-app tools above or email us; we will verify your request using the email address on your account. You may use an authorized agent, in which case we may ask for proof of authorization.
Flowmora LLC is the data controller for the information described in this policy. Our legal bases for processing:
You have the rights to access, rectification, erasure, restriction, portability, and objection, and the right to withdraw consent at any time without affecting prior processing. Exercise them with the in-app tools or by emailing us.
International transfers. Flowmora is operated from the United States, and our providers (Section 3) process data in the US. Where personal data is transferred out of the UK/EEA, that transfer relies on the European Commission's Standard Contractual Clauses (and the UK Addendum) as incorporated into our providers' terms, together with appropriate technical safeguards including encryption in transit and at rest.
You also have the right to lodge a complaint with your local supervisory authority — in the UK, the Information Commissioner's Office (ico.org.uk). We would appreciate the chance to address your concern first.
We may update this policy from time to time. Material changes will be announced in the app or by email, and the effective date above will be updated.
Flowmora LLC
1832 Adagio Drive, Alpharetta, GA 30009
Privacy questions or requests: support@flowmorajiujitsu.com