BJJ Journal is a personal training journal. This policy describes what information the app handles, where it lives, and what control you have over it. The short version: your journal is yours, we collect almost nothing beyond what you write, and you can take your data or delete it entirely, yourself, at any time.
What we collect
Your account. An email address and a password, or a Google or Apple sign-in. That’s what an account is.
If you use Sign in with Apple you can choose Hide My Email, and Apple gives us a relay address instead of your real one. That works everywhere in the app — it just means the journal is tied to that address rather than the one you use elsewhere.
Signing in with Apple also gives us a token we store for one reason: so that deleting your account can tell Apple to revoke it. It is never used for anything else, and it goes when your account does.
What you write. Training sessions, notes, your Things to Work On page, competitions, promotions, training partners, instructors, schools, tags, and optional photos. All of it is content you create, entered by you, and visible only to you unless you choose to share it.
Optional profile details. Name, gender, birthdate, weight, training start date — all optional. They prefill things like competition divisions, and your start date also feeds your stats.
Feedback context. If you send feedback through the app, it includes your email (so we can reply), plus which tab you were on, your screen size, and a coarse platform description like “Safari on iPhone” — enough to diagnose a problem, nothing more.
Nothing else, unless you connect your YouTube channel (see Videos). No analytics trackers, no advertising identifiers, no location, no contacts, no behavioral profiling. The app doesn’t watch how you use it.
Where it lives
Your data is stored in a managed Postgres database hosted by Supabase, isolated per account and enforced at the database level. Our database host records the IP address and app or browser type of each signed-in session, as part of signing in; we don’t use them for anything else. Photos are compressed on your device and stored in a private bucket — they are not publicly accessible. The app is served by Vercel, and account emails (invites, password resets) and the feedback you send us are sent through Resend. These three providers process data on our behalf to run the service; none of them use your data for anything else.
Your data is never sold or rented, and we never show it to anyone. There are no ads in the app. A YouTube video played on a page you share may show YouTube’s ads (see Videos). There is no feed. Nobody reads your notes. The only things that ever leave your journal are a link you make yourself, which YouTube video is playing when someone presses play on one, and, if you connect your YouTube channel, the videos you upload to it with their title and description (see Videos).
How we protect your data
Encrypted in transit. Everything the app, this website and our server send travels over HTTPS, including our server’s calls to Google, YouTube and Apple, and each video’s upload from your device to YouTube. Email is the exception: account emails, and the feedback you send us, travel as ordinary email, which is encrypted between mail servers only when both support it.
Encrypted at rest. Our database host, Supabase, encrypts the data it stores, and its backups, with AES-256. On top of that, our server encrypts the two secrets of your YouTube connection before storing them: the token that lets the app upload to your channel, and each upload’s address, are encrypted with AES-256-GCM. The key is a secret of our server, kept apart from the database, so these can’t be read from the database alone.
Who can read your YouTube token. No app user, signed in or not, can read the tables that hold YouTube data directly. The app sees only your own connection’s state and your own uploads’ progress, through two database functions that never return the token or an upload’s address; apart from those, only our server’s functions and the database’s nightly clean-up touch the tables. Our server decrypts the token only when it needs it (to connect, check the connection, start or check an upload, or remove our access), never writes it to logs, and never sends it to your device. When you connect, Google’s sign-in also hands the app a short-lived token; the app discards it without storing or using it, and passes our server only a one-time code. To upload, your device receives only that upload’s address, kept in the app’s private storage until the upload ends.
Each account sees only its own data. The database enforces row-level security on every table: a signed-in account can read and change only its own rows, and photos sit in a private bucket where each account reaches only its own folder. A page you share is read through one server function that returns only what that link shows. The app and this website contain only a public key that can’t get past those rules; our privileged keys (the database service key, our Google and Apple client secrets, and the YouTube token key) are secrets on our server and are never in the app.
How long we keep it. Disconnect in Settings asks Google to remove our access, then deletes your token, your channel’s name and id, your made-for-kids answer and your upload records, even if Google doesn’t answer (your videos stay on YouTube, and their links stay in your sessions). An upload’s address is deleted from our server as soon as it learns that YouTube has the whole video, that YouTube has dropped the upload, or that you cancelled it, and otherwise by our nightly clean-up within 9 days of the upload’s start. Delete Account asks Apple to revoke your Sign in with Apple token and Google to remove our access to your YouTube channel, and goes ahead even if they don’t answer; it then deletes your photos and your account, and with it everything in your journal, straight away. Anything deleted, by you or by these clean-ups, stays in our database host’s encrypted backups until they expire, within 7 days. Feedback you’ve already sent us stays in our email until you ask us to delete it.
Who at BJJ Journal can see it. BJJ Journal is run by Swell Digital, LLC, and one person has administrator access. That access can read our database; what our server encrypts can’t be read from the database alone. That person uses it only to keep the service running and to fix a problem you report, and doesn’t look at data from your Google account (your YouTube channel’s details and uploads) unless you ask, for security, or when the law requires it. That person’s accounts with our database host, Google, our web host and our code host all use two-factor sign-in. No one else has access, apart from the providers named above that run the service for us.
Your journal is yours
Export, any time. Profile → Export downloads your complete journal as plain CSV files, readable in any spreadsheet app, with your Things to Work On page as a plain text file. No request form, no waiting.
Delete part of it, any time. You don’t have to delete your account to delete something in it. Any session, competition, promotion, partner or photo can be removed from inside the app, on its own. Deleted sessions and competitions wait in Recently Deleted for 30 days before they go for good. A match, a division or a match’s video link that you remove is kept out of sight for 30 days, then goes too. Everything else goes immediately.
Delete, any time. Profile → Delete Account permanently removes your account and your entire journal — sessions, photos, competitions, promotions, everything — immediately and irreversibly (copies in our database host’s encrypted backups expire within 7 days). We recommend downloading your data first; the app offers this right in the deletion flow.
One honest boundary. If training partners logged sessions with you, those entries are their records of their own training. Deleting your account deletes your journal entirely; it does not edit other people’s journals — the same way leaving a gym doesn’t remove you from your teammates’ memories.
Sharing
You can create a link to one competition, one match from a competition, or one training session, and send it to whoever you like — a coach, a teammate, a parent. Anyone with the link can read that page; they need no account and no app. You choose what goes on it, and you see exactly what they will see before you send it.
It names other people. A competition record is about the matches you had, so the page names your opponents. A match page names the one opponent in that match. We shorten each name to a first name and an initial — Eric C. If you want a page to show full names instead, you can switch that on when you create it. That’s your call to make about the adults you competed against, and it’s off unless you turn it on.
We don’t name opponents from juvenile divisions on a shared page. If any division on that competition reads as a juvenile bracket, or your profile says you were under 18 on the first day of the competition, everyone becomes “Opponent 1”, “Opponent 2” — and the full-names switch can’t override it. The opponent is someone else’s child and that isn’t yours to decide. We leave your notes and videos off that page too, because a note saying “tough match against Eric” hands back the name we just took away, and a video shows the person. A page like that shows results only. A match page follows its competition: a juvenile division anywhere on that competition, or your profile saying you were under 18 on its first day, makes the match page results only too, even if the match was on a later day. If a juvenile division turns up on that competition later, the page stops naming anyone from then on.
A session page shows what you logged. The technique, the date and class details, your instructors, the name of where you trained (never its address), your tags, your notes and video titles as you wrote them, and your videos (a YouTube video plays on the page; any other link stays a link). You can leave the notes (and with them the titles), instructors or location off when you create it. Training partners and photos aren’t on it. If your profile says you were under 18 on the session’s date, the notes and the videos are left off, and that can’t be switched back on.
A match page shows that one match. The event, its date and organizer, the division, your opponent, the result, its videos (a YouTube video plays on the page; any other link stays a link), and your notes and video titles. You can leave those off when you create it. Your competition notes, your placing and your other matches aren’t on it. If it shows results only, the notes and videos are left off.
Someone you send a session link to who uses BJJ Journal can add what’s on it to their own journal; that copy is theirs, and it stays after the link expires.
A link lasts 30 days. Then the page stops working, and about a week after its 30 days are up we delete our record of the link, including your name on it. There is no way to switch a link off early, so send it to people you mean to send it to. Deleting the competition or session in the app takes its link down with it, and a match’s link goes down when you delete the match, its division or its competition. Restoring doesn’t bring a link back.
We don’t track who opens a shared page. If someone presses play on a video there, YouTube knows that video was played (see Videos).
Videos
Videos you paste. In the app, a video link opens outside the app, in YouTube or your browser, like any other link. On a page you share, a YouTube video plays on the page instead. Nothing is loaded from YouTube until someone presses play. Pressing play loads YouTube’s player in its privacy-enhanced mode (youtube-nocookie.com). YouTube then receives what any embedded video sends it: the viewer’s IP address (which tells YouTube roughly where they are), details of their device and browser, which video it is and how it plays, and our web address (never a shared page’s link). YouTube may store information on the viewer’s device, and the video may show YouTube’s ads; YouTube says ads in privacy-enhanced mode aren’t personalized. YouTube uses this information to play the video, run and improve its services, personalize content, prevent fraud and abuse, and measure ads. BJJ Journal uses YouTube API Services to play these videos; what YouTube does with this is covered by the Google Privacy Policy, not this one. Any other link, like Patreon or Instagram, stays a link and opens that site.
Uploading to your YouTube. If you connect your YouTube channel, BJJ Journal uses YouTube API Services to upload videos you choose to it (Google Privacy Policy). Your video goes straight from your device to YouTube; it never passes through our servers. The title and description pass through our server once, to start the upload, and aren’t kept. We keep an encrypted token that lets the app upload to and read your channel, your channel’s name and id, which permissions you gave us, and your made-for-kids answer. For each upload we keep which session it’s for, its size, type, visibility and made-for-kids setting, the visibility YouTube applied, YouTube’s video id and status, and YouTube’s reason if it doesn’t accept the video. Until YouTube has the whole video (9 days at most) we also keep the encrypted address your device sends it to. We delete an upload’s record 28 days after it last changes. To keep within YouTube’s daily upload limit, we count how many uploads each account starts in a day, and delete those counts within two days, even if you disconnect. The link to each video is written into your session; it becomes part of your journal and stays until you edit it. Disconnect in Settings asks Google to remove our access, then deletes what we keep straight away, even if Google doesn’t answer. To check, or to remove our access yourself, visit security.google.com/settings/security/permissions; if you remove it there, we delete what we keep within 30 days. BJJ Journal’s use of information received from Google APIs follows the Google API Services User Data Policy, including its Limited Use requirements.
Apple Health (iOS app)
If you turn on Health sync in the iOS app, BJJ Journal writes your saved sessions to Apple Health as workouts — the date, the duration, and whether it was Gi or No-Gi. This is a one-way write that happens on your device: the app never reads anything from Apple Health, and nothing about your health ever reaches our servers or anyone else. You can turn this off any time, revoke access in iOS Settings → Privacy & Security → Health, and delete any workouts BJJ Journal created directly in the Health app.
Health Connect (Android app)
If you turn on Health sync in the Android app, BJJ Journal writes your saved sessions to Health Connect as exercise sessions — the date, the duration, whether it was Gi or No-Gi, and the title “Brazilian Jiu-Jitsu”. This is a one-way write that happens on your device: the app never reads anything from Health Connect, and nothing about your health ever reaches our servers or anyone else. You can turn this off any time, revoke access in Health Connect → App permissions, and delete any sessions BJJ Journal created directly in the Health Connect app.
We send account email only: invitations, password resets, sign-in confirmations, and replies to feedback you send us. No marketing, no newsletters, no digests.
Age
BJJ Journal is for adults — you need to be 18 or older to use it, and it isn’t directed at children. We don’t knowingly collect information from anyone under 18, and if we learn we have, we’ll delete it.
Changes
If this policy changes, the date at the top changes with it, and meaningful changes will be noted plainly rather than buried.
Contact
Questions: BJJ.Journal@swellhello.com, or the Share Feedback link in the app.