Privacy Policy.

JudoLytics is a sports analysis platform for judo. We help judokas, coaches, and club administrators analyze match performance, track training and body measurements, monitor recovery, create development plans, and manage judo clubs.

The Dutch Data Protection Authority (Autoriteit Persoonsgegevens) is the Dutch supervisory authority for the protection of personal data. More information at autoriteitpersoonsgegevens.nl.

We only collect data that is necessary for providing our service or for which we have another legal basis. Below you will find an overview per category.

Please note: recovery data (sleep quality, physical recovery, energy, motivation, soreness) is considered health data within the meaning of Article 9 GDPR. We process this data exclusively on the basis of your explicit consent, which you provide by voluntarily entering this data. You can stop entering recovery data at any time and delete existing data.

Please note: a document can contain health data. A test result, for example, or a letter about an injury. We do not know what is inside it: there is no text recognition and nobody on our side opens your files. When you add a file, our server does check it automatically, without anyone reading along and without keeping anything: it rejects macros and other content that runs something or fetches something from outside when the file is opened, and in a CSV file any cell a spreadsheet would run as a formula. The app first makes a photo smaller on your device. Our server then removes the details a camera or phone writes into it, such as where and when it was taken. We only keep the image itself, with a small copy for the overview. That is why we treat every document as if it contains health data, and process it solely on the basis of your explicit consent (Article 9 GDPR). You decide what you add and whether you share it. If you withdraw that consent, sharing with your coaches stops immediately, including for documents that were already there. The files themselves stay until you delete them. You can do that at any time. The same goes for an overview report saved as a PDF in your record: that copy is a document like any other and stays until it is deleted. The retention period of the report in the app does not apply to it.

A coach or manager of your club can only add a document to your record if you gave that club separate consent for it. You get that question per club, separate from the consent for your own documents, and the coaches and managers of that club can see whether you said yes or no. Only you and the coaches and managers of that club see such a document. If a coach only works with certain groups, they only see it when you are in one of those groups. Your teammates never see it. A document your club adds belongs to you. It sits in your record, and we store it for you, not on the club's behalf. You can delete any document yourself. The coaches and managers who can add documents can also delete a document the club added. You'll get a notification when they do. If you withdraw your consent or leave the club, that club's staff can no longer see the documents, and the club can't add anything new.

Explanation of legal bases: "Performance of contract" means that the processing is necessary to provide you with the service. "Legitimate interest" means that we have a business interest in the processing, always weighing it against your privacy interests.

When you link an opponent to an external profile, we retrieve additional data from publicly accessible sports databases at your request:

• IJF (International Judo Federation): Public match data, world rankings, competition history, and weight category via the IJF database (Judobase).
• JudoManager: National match data, statistics, and club information via the JudoManager API.

This data is cached to keep the platform fast, with a fixed retention period per type: a retrieved judoka profile is kept for at most one year after it was last fetched, and a tournament's draw and entry list for at most 30 days. On your own device, the draw and entry list stay available for 7 days so the app works offline. If you linked the profile to an opponent in your account, the cache disappears as soon as you delete that opponent; if you only searched without linking, the cache expires with the retention period.

If you want to import your own matches from the IJF database or from JudoManager, you first confirm that the linked profile is yours and authorize us to retrieve your competition data from it. This consent also covers retrieving that data again later, for example to add video times to imported matches, and we record it with its date and time. Matches you confirm after importing become regular matches in your account, which you can delete there yourself. You can withdraw your consent at any time via Settings > Privacy. After that we retrieve nothing more, and we immediately delete imported matches you had not confirmed yet.

JudoLytics offers the ability to join a judo club within the platform. Within a club, coaches, administrators and, depending on your settings, fellow club members can view certain member data, but only to the extent you have set this yourself. One thing your club's coaches and administrators always see: which club sessions you are scheduled for and whether you attended. That is part of organizing a session. Your own sessions, the intensity, your reflections and your reason for canceling stay under your own settings. When you join a new club, nothing is shared by default until you make a choice.

You decide per topic who you share with, through the privacy settings in your dashboard. Each time you choose between not sharing, only your coaches, or your whole club. For a number of topics "your whole club" is deliberately not an option: those go to your coaches at most. This is what you can set:

• Match results, scores, and statistics. Can also be shared with your whole club.
• Opponent information and notes. Can also be shared with your whole club.
• Match plans. Can also be shared with your whole club.
• Sport measurements such as strength and fitness tests. Can also be shared with your whole club.
• Your weight and your match reflections. These go to your coaches at most, never to fellow club members.
• Training sessions and training reflections, your recovery checks, your development plan, and your tournament data. These too go to your coaches at most.

A sharing setting applies to all your data in that category, including data you entered earlier. If you set a category to private, coaches and fellow club members will no longer see your older data in that category either. You can change all of these settings at any time via your privacy settings in the dashboard.

We reserve the right to anonymize and aggregate your data for the following purposes:

When anonymizing, we ensure that:

• Data is aggregated at group level (minimum 5 users)
• Individual identifiers are irrevocably removed
• It is impossible to trace results back to individual persons
• Anonymized data is not combined with other sources for re-identification

Anonymized and aggregated data no longer falls under the General Data Protection Regulation (GDPR) and can therefore be used without restriction, including for external publication and marketing purposes.

Legal basis: Legitimate interest (Article 6(1)(f) GDPR). We have conducted a balancing test weighing the interest of product improvement and knowledge development in judo against your privacy interests. Since the data is fully anonymized, we consider the risk to your privacy minimal.

We do not retain your data longer than necessary for the purpose for which it was collected, unless a legal retention obligation applies.

We know your recovery, performance, and health data is personal. That is why security is not an add-on but the foundation JudoLytics is built on. Your data is protected in layers, from the connection with your browser to the way it is stored in the database. We take appropriate technical and organizational measures to protect your personal data against unauthorized access, loss, or modification. Below we explain, in plain language, how.

• Encryption: All your data is encrypted in transit (the entire app runs only over a secure HTTPS connection, enforced via HSTS) and encrypted at rest (encryption at rest via Supabase).
• Passwords stay secret, even from us: Your password is never stored as readable text. We keep only an encrypted, one-way version (bcrypt hashing with a salt). No one at JudoLytics can view or recover your password.
• Secure login: Login is via email and password or via Google (OAuth 2.0), with a PKCE-secured login flow and optional two-step verification (MFA/2FA) via authenticator apps.
• MFA enforcement: Two-step verification is mandatory for administrator and support roles. Regular users can enable MFA voluntarily, with recovery codes. Once MFA is on, their own match, training and measurement data is only readable on a session that has completed the second step; this is enforced in the database, not in the app.
• Access control (Row-Level Security): At the database level, it is enforced that you can only access your own data. No other judoka or coach can see your data unless you choose to share it. This rule is enforced in the database itself, not only in the app, and is tested automatically.
• Documents sit in shielded storage: files attached to your record go into a closed storage area with no public links. Your browser cannot write to it directly; adding a file always goes through our server. Every file path starts with the judoka the file is about, so a deletion request hits exactly the right files and never someone else’s. If you delete your account, the files themselves are erased, not just the reference to them. A document always opens as a download, never inside the app itself.
• Notifications about documents never name the file. When your club adds a document to your record, you get a notification in the app, a push message and an email. You always get the email; you can turn the push message off. None of the three names the file: a push message shows on your lock screen, and a file name can already say something about your health.
• Access on a need-to-know basis: Even within our own team, access to personal data is limited to what is strictly necessary. Internal keys and passwords are stored encrypted and rotated regularly.
• CAPTCHA protection: Cloudflare Turnstile protects the registration process against automated attacks.
• Rate limiting: Protection against brute-force login attempts and API abuse.
• Security headers: A strict Content Security Policy and additional security headers counter common web attacks, such as clickjacking and code injection.
• Input validation: Everything you enter is checked both in your browser and on the server before it is stored.
• Continuous monitoring: We monitor the platform around the clock for errors and suspicious activity, so we notice and fix problems quickly.
• Audit logging: Administrative actions are logged for accountability and debugging.
• Automatic backups: Regular automatic backups are made, so your data can be restored after a technical failure and is not lost in an unexpected problem.
• Payment details never enter our system: Your card or bank details are processed solely by our payment partner Stripe, which meets the strictest payment-security standard (PCI-DSS). JudoLytics itself stores no card data.
• Stored in the European Union: Your data is held in a database within the European Union (Frankfurt, Germany) and is therefore covered by European privacy law.
• You stay in control: You can download all your data at any time or have your account and data permanently deleted, directly from your settings.

In short: your data is encrypted and technically isolated. No other user, not even a coach in your club, can see your data unless you choose to share it. Our database is hosted in the European Union; where we use service providers outside the EU, appropriate safeguards apply (see section 11). You remain the owner of your data and stay in control at all times.

No online service can guarantee absolute security. That is why we keep our protection up to date at all times and follow a set procedure if something does go wrong: in the event of a data breach that poses a risk to you, we report it to the supervisory authority within 72 hours and, where necessary, directly to you.

Think you have found a security issue? Let us know at info@judolytics.com. We take every report seriously.

Under the General Data Protection Regulation (GDPR), you have the following rights regarding your personal data:

JudoLytics uses cookies and local storage in your browser for the functioning of the application. Below you will find a complete overview of all cookies and storage mechanisms we use, divided into strictly necessary and optional (consent required).

Strictly necessary cookies and storage

These cookies and storage items are necessary for the website to function. They cannot be disabled.

Analytics cookies (consent required)

These cookies are only placed after your explicit consent via the cookie banner. You can withdraw or adjust your consent at any time.

Advertising cookies (consent required)

These cookies are used to measure the effectiveness of advertising campaigns. They are only placed after your explicit consent.

Embedded third-party content

Some pages may embed third-party content. This content only loads when you use it, and may then set cookies from that party. We therefore do not place these cookies in advance.

The strictly necessary cookies and storage are required for the functioning of the service. Under the Dutch Telecommunications Act (Article 11.7a), prior consent is not required for these. Analytics and advertising cookies are only placed after your explicit consent via the CookieYes cookie banner. Fonts are self-hosted; no external requests are made to Google Fonts or other CDN services.

We share your personal data with the following service providers (processors) who process data on our behalf. We have concluded a data processing agreement with each processor in accordance with Article 28 GDPR.

SCCs = Standard Contractual Clauses: contractual safeguards approved by the European Commission for international data transfers (Implementing Decision (EU) 2021/914). The EU-US Data Privacy Framework is an additional safeguard: US organizations certified under the framework provide an adequate level of protection for personal data transferred from the EU (European Commission adequacy decision of 10 July 2023).

To display country flags, we load static images from a public flag CDN (flagcdn.com). This only exposes the IP address that every internet request requires; no account data is shared.

If you turn on push notifications, the push service of your own browser or operating system delivers them (Google, Apple, Mozilla or Microsoft). That service receives only the address at which your device can be reached and an encrypted message: it cannot read the content of the notification, and no account data is included. If you turn push notifications off, nothing is sent to these parties.

Some of our service providers are based in the United States. This means that your personal data may be processed outside the European Economic Area (EEA).

To ensure an adequate level of protection, we use:

• Standard Contractual Clauses (SCCs): Standard contractual clauses approved by the European Commission in accordance with Implementing Decision (EU) 2021/914.
• EU-US Data Privacy Framework: Some of our US-based processors are certified under the EU-US Data Privacy Framework, which provides an adequate level of protection under the European Commission’s adequacy decision of 10 July 2023.
• Data processing agreements: Written agreements have been concluded with all processors that comply with Article 28 GDPR.
• Additional technical measures: Encryption of data in transit and at rest.

JudoLytics is intended for judokas and coaches of all ages. Judo is a sport practiced from a young age, and we understand that minors may also use our platform.

In accordance with Article 8 GDPR and Article 5 of the Dutch GDPR Implementation Act (UAVG), consent from a parent or legal guardian is required for users under 16 years of age to create an account.

The platform offers the ability to enter recovery and health data (such as sleep quality and physical recovery). For minor users, the parent or legal guardian must give consent for the processing of this special category of personal data.

We do not actively verify age at registration. If we become aware that a minor is using our platform without parental or guardian consent, we will delete the relevant account and associated data. Parents or guardians can contact us at info@judolytics.com.

We may update this privacy policy from time to time, for example in response to new features, legal obligations, or changes in our service.

For substantial changes, we will inform you via:

• An email notification to the email address we have on file
• A notification within the application

The "Last updated" date at the top of this page is updated with each change. We recommend reviewing this privacy policy regularly.

Do you have questions about this privacy policy or about the processing of your personal data? Please contact us:

If you believe that we are not processing your personal data correctly, you have the right to file a complaint with the Dutch Data Protection Authority:

This privacy policy has been drawn up in conjunction with the Terms of Service of JudoLytics. In case of conflict between this privacy policy and the Terms of Service, this privacy policy prevails insofar as it concerns the processing of personal data. Terms of Service