Privacy Policy

This Privacy Policy describes how SupaHit (“we,” “us,” or “our”) collects, uses, shares, and protects your personal information when you use the SupaHit mobile app, VDojo web platform, and our website at supahit.com (collectively, the “Service”). Health-related data practices are covered in Section 5 of this policy.

1. Information We Collect

1.1 Account Information

When you create an account, we collect your first and last name (and an optional middle initial), your date of birth, your email address, and your password (stored as a cryptographic hash — we never store plaintext passwords). We use your date of birth to apply our age rules (see Section 8). We also record which version of our Terms of Service and Privacy Policy you agreed to, and when. You can correct or change your name in the app a limited number of times; we check each change and keep a private record of name changes that only SupaHit staff can read. You may optionally provide your phone number to enable SMS notifications (training reminders, message alerts, and account security). Dojo owners also provide their school name, address, phone number, and contact details during the VDojo setup process.

1.2 Profile Information

You may optionally provide a profile photo (avatar), martial arts disciplines, belt/rank history, and training preferences.

1.3 Training and Activity Data

We collect data you voluntarily log, including:

• Training sessions (date, duration, type, notes, training partners)
• Belt/rank progression and promotion history
• Goals and goal progress
• Class attendance and booking records
• Gamification data (XP, streaks, achievements)

1.4 Health-Related Data

If you use our injury tracking feature, we collect injury data including affected body area, severity, description, and recovery status. This data is classified as consumer health data under certain state laws. See Section 5 below for detailed information about how we collect, use, and protect this data.

1.5 Social and Communication Data

We collect content you create through social features, including:

• Posts, comments, photos, and videos shared in the social feed, and who each post is shared with (its audience)
• Messages sent through direct messages and channel conversations, and message requests between adults who do not share a dojo
• Mentions: when you tag someone, or are tagged, with @ in a post, comment, or message (we store who was tagged, not their name)
• Notifications we show you in the app about comments, mentions, and message requests (a notification names the person but never contains the text of a comment or message, and is deleted after a limited time)
• Follow relationships
• Post likes and interactions
• Reports you make about content or people, and our review of them
• Clubs you create or join, and the posts, photos, and videos you share in clubs

1.6 Payment Information

Payment details (credit card numbers, bank accounts) are processed directly by Stripe, Inc. and are never stored on our servers. We retain only Stripe customer identifiers, transaction references, and subscription status necessary to manage your account.

1.7 Device and Usage Data

We automatically collect:

• Device type, operating system, and app version
• General usage patterns (pages visited, features used, session duration)
• Push notification tokens (mobile only, with device-level consent)
• IP address (used for security and rate limiting; not used for precise geolocation)
• Error and crash reports, which help us find and fix bugs (see Section 4)

We do not collect precise GPS location data. The one exception is the optional “Find a dojo” feature described in Section 3.8: if you allow location access, your phone sends an approximate location (rounded to about one kilometre on your phone before it is sent) with a search, and we do not store it. If you have already allowed location for SupaHit, the Home screen also uses your approximate location each time you open it to show the nearest schools (see Section 3.8).

1.8 Website Analytics

Our marketing website uses Google Analytics 4 (GA4) to collect anonymized usage data, including pages visited, referral sources, and general geographic region (country/city level derived from IP address). Google Analytics uses cookies — see Section 9 for details.

1.9 Parental Consent Records

When a parent or legal guardian signs the parental consent form for a student under 18 in VDojo, we keep a record of exactly what was signed: the text and its version, the signer’s name and relationship to the student, the date and time, and how it was signed. We keep this record until the student’s 25th birthday (see Section 6).

2. How We Use Your Data

• Provide and operate the Service — display your training history, sync attendance with your dojo, process bookings, deliver notifications, manage subscriptions, and enable social features.
• Communications — send transactional emails (account confirmations, password resets, billing receipts, security alerts) and, for dojo members, relay messages sent by dojo operators through our email and SMS tools. If you provide your phone number and opt in to SMS notifications, we send training reminders, message alerts, and account security notifications via text message. You can opt out of SMS notifications at any time in your app settings.
• Analytics and improvement — understand usage patterns to improve features, fix bugs, and optimize performance. We use aggregated, anonymized data for these purposes.
• Safety and security — detect fraud, enforce our Terms of Service, prevent abuse, and protect users and the platform.
• Legal compliance — comply with applicable laws, legal processes, and government requests.

We do not use your personal data for targeted advertising. We do not sell your personal information to third parties.

3. Multi-Party Data Sharing Within the Service

The Service involves data sharing between different parties. Here is exactly who can see what:

3.1 Dojo Owners and Staff → Student Data

When you connect to a dojo (via invite code), the dojo’s authorized staff (owner, managers, and instructors based on their assigned role) can see:

• Your name, email, profile information, and avatar
• Your class attendance and booking records
• Your belt/rank progression and promotion history
• Messages you send in dojo channels

3.2 Opt-In Injury Sharing

If you enable the “Share with Dojo” toggle when logging an injury, only the severity level (low/medium/high) is shared with your dojo’s owner and managers for staffing purposes. Your injury description, specific body area, and notes are never shared. This feature is off by default and you can revoke sharing at any time. See Section 5 below for details.

3.3 Opt-In Training Log Sharing

If you enable “Share Training Log” in your privacy settings, your dojo’s owner and managers can see a summary of your recent training sessions (dates, durations, types). Your personal notes and training partner names are never shared. This feature is off by default.

3.4 Parent → Child Data

Parents and legal guardians who link to their child’s student record (via a dojo-issued invite code) can view their child’s attendance, class bookings, injuries, belt progression, and schedule. Parents can also book and cancel classes on their child’s behalf and log injuries for their child.

3.5 Social Feed Visibility

Each post has an audience that its author chooses: everyone, followers, your dojo, or only you. Adults’ posts are shared with everyone by default; a person under 18 can share a post only with their own dojo or keep it to themselves. Comments can be made by people who can see the post (a person under 18 can comment only inside their own dojo). Milestone posts (e.g., belt promotions) may be generated automatically if you have social sharing enabled. You can choose who may mention you (adults: everyone, people you follow, or no one; people under 18 can be mentioned only by members of their own dojo).

3.6 Messaging

Messages in dojo channels are visible to all channel members and to the dojo’s authorised staff. Direct messages are visible to the participants of the conversation. We may also review a message, or the conversation around it, when someone reports it or when our automated moderation flags it. Adults who do not share a dojo can message each other after a mutual follow or an accepted message request. People under 18 can message only members of their own dojo. An adult cannot start a private one-to-one message with a person under 18 (except that person’s linked guardian); dojo staff reach a person under 18 through a conversation that also includes a second adult, such as the linked guardian, the dojo owner, or a manager. Tagging someone in a message never adds them to the conversation.

3.7 Clubs

Clubs are public groups inside SupaHit. SupaHit provides an official club and a group for each martial art, and any user can create a club with a name, description, and logo. Joining a club is open: anyone signed in to SupaHit can find a public club, join it, and read its posts.

• Who can see what: a club’s name, description, logo, member count, and posts are visible to every signed-in SupaHit user, not only its members. Club posts appear only on the club’s page, not in your Home feed or your dojo’s feed. We do not show lists of a club’s members.
• How you appear: people in a club see you by your name, the same name you use everywhere in SupaHit. If you are under 18, people outside your own dojo see only your first name and last initial, with no profile photo.
• Automatic membership: you are added to the official SupaHit club and to a group for each martial art you record in your ranks or training. You can leave any group; we will not add you back.
• Club owners: the person who creates a club can remove posts from it, remove a member (who then cannot rejoin), change its description and logo, or delete it. Deleting a club deletes its posts and memberships.
• Moderation and reports: club names, descriptions, logos, and posts are checked by automated moderation, and you can report a club or a post and block a user. SupaHit staff review reports.
• Deleting your data: deleting your account removes your club posts and memberships. A club you created stays available without an owner.

3.8 Dojo Discovery (Find a Dojo)

Find a dojo lets signed-in SupaHit users search for martial arts schools near them. It lists two kinds of school: (a) schools that use VDojo, which are listed by default until their owner or an authorised manager turns the listing off in VDojo settings, and (b) other martial arts schools, taken from public business listings.

• Schools on SupaHit: a listing shows the school’s name, description, logo, address, phone number, email address, website, disciplines, and how far away it is. These are details the school has chosen to publish. We never show the school owner’s name, payment details, or any internal information.
• Other schools (public business listings): we load martial arts schools from open business-listing data published by the Overture Maps Foundation and Foursquare into our own database. These listings show only the details the public listing publishes: the school’s name, address, phone number, website, and disciplines (shown as inferred from the listing’s name and categories), and how far away it is. Business listings include data from Overture Maps Foundation (including data contributed by Meta, Microsoft and others) and Foursquare, used under open licences. We do not look anything up in those services when you search. These schools are not on SupaHit and have not asked to be listed, and the data may be out of date.
• Removing or claiming a listing: a school listed from public business data can ask us to remove its listing in either of two ways: with “Report or remove this listing” on its page in the app (this needs a SupaHit account; we keep the contact details and reason you give, and the request, to deal with it), or by contacting us (see Section 15, Contact Us). We may ask you to show that you are connected to the school before we act. The owner of a school can also claim its listing from VDojo. Claiming does not change anything on its own: SupaHit confirms that the person owns the school before the public listing is replaced or hidden.
• Inviting a school: on the page of a school that is not on SupaHit you can tap “Invite this dojo to SupaHit.” Nothing about you is sent to the school. SupaHit staff receive the invitation: the name and email on your account are included, and the invitation is recorded against your account. We use invitations to decide which schools to contact.
• Your location: you can search with your phone’s location, by typing a ZIP code, or by typing a city or school name (matched against school names and cities). If you use your phone’s location, the app asks for permission when you start the search, rounds it to about one kilometre on your phone, so that only an approximate location is sent, and sends it with that one search. If you have already allowed location for SupaHit, the Home screen also uses your approximate location, each time you open it, to show the nearest schools; it is rounded to about one kilometre on your phone, sent with that request only, and not stored. Home never asks for permission. A ZIP code you type is looked up in a table we host; it is not sent to any outside geocoding service. We do not store your location, a ZIP code you type, a name you search for, or your search history, and nothing is remembered between visits. To limit abuse we keep a count of requests per account (an account reference and a time, no location). You can decline location access and search by ZIP code or name instead.
• Requesting a trial class: trial requests go only to schools that are on SupaHit. If you are an adult, we send the details you enter (your name, email, phone, the discipline you are interested in, and your message) to that school only, where they appear as an enquiry in the school’s VDojo account. Anything you type in the message is shared with the school. We limit how many requests one person can send.
• Users under 18: a trial request from a 13 to 17 year old must include a parent or guardian’s name, relationship, and email or phone, and the parent’s contact must be their own, not the teen’s account email or phone. The school receives your first name and last initial, the parent’s name, relationship and contact details, the discipline you picked and any message you write, and never your own email, phone number, date of birth or surname. Anything you type in the message is shared with the school. Teens can still see a school’s public contact details and join with an invite code.
• Schools on VDojo: a school that uses VDojo is listed by default. A school that stays listed confirms that its listing details are accurate, are its own to publish, and may be shown to every signed-in SupaHit user. A school can turn its listing off at any time in VDojo Settings, and it disappears from search immediately.

4. Third-Party Service Providers

We share data only with service providers necessary to operate the platform. These providers process data on our behalf under contractual obligations:

• Supabase, Inc. — database hosting, authentication, real-time subscriptions, and file storage (images, videos, documents). Data stored in the United States.
• Stripe, Inc. — payment processing for subscriptions and purchases. Stripe processes payment card data directly and is PCI-DSS Level 1 certified. See Stripe’s Privacy Policy.
• Resend, Inc. — transactional and dojo-to-member email delivery. Receives recipient email addresses and message content.
• Twilio, Inc. — SMS message delivery for dojo communications and user-opted SMS notifications (training reminders, message alerts, account security). Receives recipient phone numbers and message content.
• Expo (820 Labs, Inc.) — push notification delivery on mobile devices. Receives device push tokens and notification content.
• Vercel, Inc. — hosting for the VDojo web app and marketing website. Processes IP addresses and request metadata.
• Google LLC — Google Analytics 4 on the marketing website only. Collects anonymized browsing data via cookies.
• RevenueCat, Inc. — manages SupaHit premium subscriptions bought in the mobile app through the Apple App Store or Google Play. Receives an app user identifier and purchase and subscription status. Apple and Google process the payment under their own terms.
• Functional Software, Inc. (Sentry) — error and crash reporting for the apps. Receives technical details about an error (the error message, device and app version, and the screen involved).
• Sightengine — automated image and video moderation. Photos and videos you upload (including profile photos and club logos) are checked to detect nudity, violence, and other content our Terms do not allow. We do not send your account details with them.
• OpenAI, L.L.C. — automated content moderation. The text of names, club names and descriptions, posts, and messages you send is checked by OpenAI’s moderation service to detect abusive content. We do not send your account details with the text.

We do not sell, rent, or trade your personal data to any third party for marketing, advertising, or any other purpose. We do not share data with data brokers.

5. Health and Training Data

Our separate Consumer Health Data Privacy Policy covers this in more detail. This section addresses our practices regarding consumer health data as required by the Washington My Health My Data Act (RCW 19.373), the Connecticut Health Data Privacy requirements, the CCPA/CPRA sensitive data provisions, and other applicable state health data laws.

5.1 What Is Consumer Health Data?

Consumer health data means personal information linked or reasonably linkable to a consumer that identifies their past, present, or future physical or mental health status. For SupaHit, this includes:

• Injury records — body area affected, severity level (low/medium/high), description, notes, date of injury, and recovery status
• Injury sharing preferences — whether you have opted to share injury severity with your dojo
• Training activity data that reveals health status — training frequency patterns, duration changes, and gaps in training activity that may correlate with health conditions

The following data is not classified as consumer health data: belt/rank progression, class attendance, gamification data (XP, streaks, achievements), social posts, or general profile information.

5.2 How We Collect Health Data

We collect consumer health data only when you voluntarily use the “Log Injury” feature in the SupaHit app, or when a parent logs an injury on behalf of their child using the “My Children” feature in the SupaHit app. We do not collect health data automatically, passively, from wearable devices, from third parties, or from any source other than your direct voluntary input.

5.3 Consent

We collect and process your consumer health data only with your affirmative, voluntary consent. Injury tracking is entirely optional. Sharing injury data with your dojo requires separate, additional consent via the “Share with Dojo” toggle on each individual injury record. This toggle is off by default. When enabled, only the severity level (low/medium/high) is shared with your dojo’s owner and managers. Your injury description, specific body area, and personal notes are never shared.

5.4 How We Use Health Data

We use your consumer health data only for: displaying your personal injury log, opt-in dojo staffing intelligence (severity only), dashboard injury alert counts (opt-in, aggregated), and parent visibility via the “My Children” feature in the SupaHit app. We do not use consumer health data for advertising, marketing, sale to third parties, profiling, automated decision-making, or employment/insurance/credit decisions.

5.5 Who Receives Health Data

Supabase, Inc. stores injury data with row-level security. Dojo staff receive severity-only data (opt-in) through a database function architecturally designed to prevent exposure of descriptions, body areas, or notes. Parents linked to a child’s record can view full injury details. No other third party receives consumer health data.

5.6 We Do Not Sell Health Data

We do not sell, rent, trade, or otherwise make available your consumer health data to any third party. We have never sold consumer health data and will not do so without first obtaining your separate, express written authorization as required by applicable law.

5.7 Your Health Data Rights

• Right to confirm: Ask us to confirm whether we are collecting or sharing your consumer health data.
• Right to access: Request a complete copy of all consumer health data we hold about you in a machine-readable format.
• Right to withdraw consent: Stop using the injury logging feature, or disable the “Share with Dojo” toggle at any time.
• Right to deletion: Delete individual injuries in-app, or request complete deletion by contacting privacy@supahit.com.
• Right to appeal: If we deny a request, appeal by emailing privacy@supahit.com with the subject “Health Data Rights Appeal.”

We process health data rights requests within 45 days and will not discriminate against you for exercising these rights.

5.8 Health Data Retention

Consumer health data follows the same retention rules as the rest of your data — see Section 6 below. One health-specific note: shared severity data access is revoked from your dojo immediately when you disable the “Share with Dojo” toggle, with no cached copies retained.

5.9 Geofencing

We do not use geofencing technology to collect consumer health data. We do not track your physical location in connection with health data collection or processing.

6. Data Retention

We keep this simple: when you ask us to delete your account, we delete your personal data right away, with no waiting period. The same applies to a child’s data deleted by a parent and to a dojo owner deleting their VDojo dojo. A small number of records are kept after deletion because the law or a safety need requires it; they are listed below, and nothing else is kept.

• Active accounts: We retain your data for as long as your account is active and as needed to provide the Service.
• Account deletion (individuals): Deleting your account immediately and permanently deletes your personal data, including your training log, injuries, goals, and ranks, and removes you from conversations. Backups are purged in accordance with our standard backup rotation. Some records are kept, as listed below. In particular, messages you sent remain in the conversations they were sent in, no longer linked to your account, and records a dojo holds about you as its student (for example its enrolment, attendance and payment history) stay with the dojo, which controls them.
• Parental consent records: A signed parental consent form for a student under 18, and the exact text that was signed, are kept until the student’s 25th birthday (their 18th birthday plus seven years), even if the account, the dojo, or the form is deleted, so that we can show what was agreed. Access is restricted. This is an exception to deletion requests.
• Safety and moderation records: Reports about content or people, and our decisions on them, may be kept for as long as needed to keep people safe, enforce our Terms, and meet legal obligations. When a report concerns a child’s safety or an intimate image shared without consent, we also keep a copy of what was reported and the conversation or posts around it for 12 months (longer if law enforcement or a court requires it), even if the account or the content is later deleted. Only SupaHit staff can see these copies.
• Opt-out records: We keep the phone numbers that have opted out of text messages (for example by replying STOP), so that we do not text them again.
• Children’s data: A parent deleting their child’s data results in immediate deletion, the same as any other deletion request.
• VDojo dojo deletion: Canceling a VDojo subscription does not delete any data — it only stops billing and access. A dojo’s operational data (students, classes, staff, messages, and every other operational record) is retained until the dojo owner explicitly deletes the dojo (self-service, in-app) or requests deletion through support, at which point it is removed immediately and permanently. See our Data Processing Agreement for details.
• Legal exception — financial records: Billing and transaction records are retained for 7 years regardless of any deletion request above, as required by tax law. This is the one case where deletion is not immediate.
• Other legal exceptions: We may also retain data subject to a legal hold or active dispute, or necessary to enforce our Terms or protect our legal rights, for as long as that need exists.
• Anonymized data: We may retain anonymized, aggregated data (from which no individual can be identified) indefinitely for analytics and improvement purposes.

7. Your Privacy Rights

Depending on your jurisdiction, you may have the rights described below. To exercise any of these rights, contact us at privacy@supahit.com. We will respond within 45 days (or as required by applicable law).

7.1 Rights Available to All Users

• Access: Request a copy of the personal data we hold about you.
• Correction: Request correction of inaccurate or incomplete personal data.
• Deletion: Request deletion of your personal data, subject to legal retention requirements.
• Data portability: Request your data in a structured, machine-readable format (JSON or CSV).
• Withdraw consent: Where processing is based on consent, withdraw your consent at any time.

7.2 California Residents (CCPA/CPRA)

If you are a California resident, you have additional rights under the California Consumer Privacy Act and the California Privacy Rights Act:

• Right to know: You may request the categories and specific pieces of personal information we have collected, the categories of sources, the business purpose for collection, and the categories of third parties with whom we share it.
• Right to delete: You may request deletion of your personal information, subject to legal exceptions.
• Right to correct: You may request correction of inaccurate personal information.
• Right to opt out of sale/sharing: We do not sell or share your personal information for cross-context behavioral advertising. No opt-out is necessary.
• Right to limit use of sensitive personal information: Injury data is classified as sensitive personal information. You may request that we limit its use to providing the Service. Contact privacy@supahit.com.
• Non-discrimination: We will not discriminate against you for exercising any of these rights.
• Authorized agents: You may designate an authorized agent to submit requests on your behalf with proper verification.

Categories of personal information collected (per CCPA categories): Identifiers (name, email, IP address); commercial information (subscription status, transaction history); internet/electronic activity (usage data, device info); sensory data (photos, videos uploaded by you); sensitive personal information (injury/health data, account credentials); inferences (training analytics derived from your activity data).

7.3 Texas Residents (TDPSA)

If you are a Texas resident, you have rights under the Texas Data Privacy and Security Act, effective July 1, 2024:

• Right to know: Whether we are processing your personal data and what data we hold.
• Right to access and portability: Obtain a copy of your personal data in a portable format.
• Right to correct: Request correction of inaccurate personal data.
• Right to delete: Request deletion of your personal data.
• Right to opt out: Opt out of targeted advertising, sale of personal data, and profiling that produces legal or similarly significant effects. We do not engage in targeted advertising, data sales, or automated profiling for decisions with legal effects.
• Sensitive data consent: We obtain your consent before processing sensitive data (including health/injury data) as required by the TDPSA.

To exercise your rights or appeal a decision regarding your request, contact privacy@supahit.com.

7.4 European Economic Area, United Kingdom, and Switzerland (GDPR)

If you are located in the EEA, UK, or Switzerland, the following applies:

• Data controller: SupaHit is the data controller for personal data collected through the Service. For student data processed through VDojo, the dojo operator is the data controller and SupaHit is the data processor.
• Lawful basis: We process personal data under the following bases: (a) contract performance — to provide the Service you signed up for; (b) legitimate interests — for security, fraud prevention, and Service improvement, balanced against your rights; (c) consent — for optional features like injury sharing, training log sharing, and marketing communications; (d) legal obligation — to comply with applicable laws.
• Additional rights: You have the right to: restrict processing, object to processing based on legitimate interests, lodge a complaint with your local supervisory authority, and not be subject to solely automated decision-making with legal effects.
• International transfers: Your data is transferred to and stored in the United States. We rely on Standard Contractual Clauses (SCCs) approved by the European Commission, and our sub-processors’ participation in the EU-US Data Privacy Framework where applicable, to provide adequate safeguards for these transfers.
• Data Protection Officer: Given our current size and processing activities, we have not appointed a formal DPO. For all privacy-related inquiries, contact privacy@supahit.com.

7.5 Other US State Privacy Laws

Residents of Colorado, Connecticut, Virginia, Oregon, Montana, and other states with comprehensive privacy laws have similar rights to access, correct, delete, and port their data. We honor all valid requests regardless of jurisdiction. Contact privacy@supahit.com.

8. Children’s and Teens’ Privacy

SupaHit is designed to meet the requirements of the Children’s Online Privacy Protection Act (COPPA) for children under 13, and applies additional protections to people aged 13 to 17.

Children Under 13

• Children under 13 cannot create their own SupaHit accounts.
• Data about children under 13 is collected only through a parent or legal guardian’s own SupaHit account, using the “My Children” feature to manage the child’s information on their behalf.
• When a parent adds a child directly through the “My Children” feature, we require an affirmative consent attestation (a parent/guardian consent confirmation, logged with a timestamp) before any information about the child is collected.
• When a child is already enrolled as a student at a dojo, a parent may instead link to that existing student record through a dojo-issued invite code: the dojo operator issues an invite token, and the parent claims it via their authenticated adult account. This verifies the parent-child relationship through the dojo as a trusted intermediary.

What We Collect About Children

Through the “My Children” feature, we collect only the following, and only what applies to your child’s actual use of the Service (a child not enrolled at a dojo will not have attendance or belt records, for example):

• Child’s name and date of birth (as provided by the parent, or by the dojo for an enrolled student)
• Class attendance and booking records, if enrolled at a dojo
• Belt/rank progression, if enrolled at a dojo
• Injury data (only when logged by the parent)

We do not collect email addresses, phone numbers, social media identifiers, photos, or any device identifiers from children under 13. Children under 13 do not have access to social features, messaging, or the public feed.

Third Parties Receiving Children’s Data

Children’s data is stored in our database hosted by Supabase, Inc. and is accessible to the child’s connected dojo staff for operational purposes (class management, attendance, belt promotions). No other third party receives children’s personal data.

Parental Rights

Parents and legal guardians may at any time:

• Review all personal data collected about their child using the “My Children” feature in the SupaHit app.
• Request correction of inaccurate data about their child.
• Request deletion of their child’s data by contacting privacy@supahit.com. We delete children’s data immediately upon a verified request — see Section 6 for our retention policy.
• Refuse further collection of their child’s data, which may require disconnecting from the dojo.

Teens (13 to 17)

• Date of birth and age: we use the date of birth given at signup, or entered by a dojo for a student. We make a good-faith effort and do not check ID. An account with no date of birth is treated as under 18.
• How a teen’s name appears: inside their own dojo, the dojo’s staff, its members, and the student’s own parents see their full name and photo. Everyone else sees only their first name and last initial (for example “Alex R.”), with no photo. There is no setting to change this.
• Strangers: people outside a teen’s dojo cannot find, follow, mention, or message the teen, and teens are not shown in search or suggestions.
• Parental consent: a parent or guardian signs a consent form before a dojo can enrol a student under 18 in a paid plan. We keep the signed record as described in Sections 1.9 and 6.
• Teens and the other sections of this policy: a person under 18 can use the training log, belts, goals, achievements and their dojo’s community, and can take part in weekly challenges, where the leaderboard shows them as first name and last initial.

9. Cookies and Tracking Technologies

Our marketing website (supahit.com) uses the following cookies and tracking technologies:

• Google Analytics 4 cookies (_ga, _ga_*) — used to distinguish unique visitors and track anonymized usage patterns. These are first-party cookies with a 2-year expiration. You can opt out via Google’s browser opt-out.

Analytics cookies are opt-in, not automatic: on your first visit, a cookie banner asks you to Accept or Decline before Google Analytics loads at all. Your choice is remembered in your browser so you’re not asked again. If your browser sends a Global Privacy Control (GPC) signal, we treat that as a standing decline and never load analytics for you, without asking. See Section 12 below.

The SupaHit mobile app and VDojo web app do not use cookies for tracking. They use Supabase authentication tokens stored in local/secure storage for session management only.

We do not use third-party advertising cookies, retargeting pixels, or cross-site tracking technologies on any of our properties.

10. Security

We implement industry-standard technical and organizational measures to protect your data, including:

• Encrypted connections (TLS/HTTPS) for all data in transit
• Row-level security (RLS) policies ensuring users can only access authorized data
• Role-based access control (RBAC) for VDojo staff permissions
• Rate limiting on authentication endpoints and API functions
• Cryptographic hashing of passwords (never stored in plaintext)
• Input validation and sanitization across all user inputs
• File type validation (magic-byte verification) for all uploads
• Timing-safe comparisons for security-sensitive operations
• Regular security audits of our codebase and infrastructure

No system is perfectly secure. We encourage you to use a strong, unique password and to enable any available security features on your device.

11. Data Breach Notification

In the event of a data breach that compromises your personal data, we will:

• Notify affected users without unreasonable delay, and within any deadline set by applicable law.
• Notify applicable regulatory authorities as required by law.
• Provide a description of the breach, the types of data affected, and the steps we are taking to address it.
• Offer guidance on steps you can take to protect yourself.

12. Do Not Track / Global Privacy Control

Our Service does not currently respond to Do Not Track (DNT) browser signals because there is no industry-standard protocol for DNT. We do honor Global Privacy Control (GPC) signals: if your browser sends one, our marketing website detects it (navigator.globalPrivacyControl) and never loads Google Analytics for you at all — no cookie banner, no analytics cookies, treated the same as if you had declined. We do not sell or share personal data for advertising regardless of GPC, so GPC has no separate effect on that front — its practical effect here is specifically to suppress analytics.

13. International Data Transfers

SupaHit is based in the United States. If you access the Service from outside the United States, your data will be transferred to and processed in the United States. We ensure adequate safeguards through:

• Standard Contractual Clauses (SCCs) approved by the European Commission
• Our sub-processors’ certifications under the EU-US Data Privacy Framework (where applicable)
• Contractual data protection obligations with all sub-processors

14. Changes to This Policy

We may update this Privacy Policy from time to time. When we make material changes, we will:

• Update the “Last updated” date at the top of this page.
• Notify you via email and/or in-app notification.
• Where required by law, obtain your consent before applying material changes to the processing of your data.

Your continued use of the Service after the updated policy takes effect constitutes your acceptance of the changes.

15. Contact Us

If you have questions, concerns, or requests regarding this Privacy Policy or your personal data, contact us at:

• Privacy inquiries: privacy@supahit.com
• General support: support@supahit.com
• Legal matters: legal@supahit.com