Privacy Policy.

JudoLytics is a sports analysis platform for judo. We help judokas, coaches, and club managers analyze match performance, track training and body measurements, monitor recovery, create development plans, and manage judo clubs.

The Dutch Data Protection Authority (Autoriteit Persoonsgegevens) is the Dutch supervisory authority for the protection of personal data. More information at autoriteitpersoonsgegevens.nl.

We only collect data that is necessary for providing our service or for which we have another legal basis. Below you will find an overview per category.

A coach or manager of your club can only add a document to your record if you gave that club separate consent for it. You get that question per club, separate from the consent for your own documents, and the coaches and managers of that club can see whether you said yes or no. Only you and the coaches and managers of that club see such a document. If a coach only works with certain groups, they only see it when you are in one of those groups. Your teammates never see it. A document your club adds belongs to you. It sits in your record, and we store it for you, not on the club’s behalf. You can delete any document yourself. The coaches and managers who can add documents can also delete a document the club added. You’ll get a notification when they do. If you withdraw your consent or leave the club, that club’s staff can no longer see the documents, and the club can’t add anything new.

If you did not record anything yourself during your trial, such as a training, match or measurement, and you come back after at least a week, you get 7 more days of Elite, once, without payment details. Our server decides this automatically, based on your trial, whether you have recorded anything and when you last used JudoLytics (signing in or opening the app). If you come back without having recorded anything, we may send you one email the next day, at most twice and at least 30 days apart. We do this on the basis of legitimate interest: anyone who could not really try the app yet gets a second chance. It is only a benefit; you lose nothing because of it. You can turn these emails off in your email preferences.

Explanation of legal bases: “Performance of contract” means that the processing is necessary to provide you with the service. “Legitimate interest” means that we have a business interest in the processing, always weighing it against your privacy interests.

When you link an opponent to an external profile, we retrieve additional data from publicly accessible sports databases at your request:

• IJF (International Judo Federation): Public match data, world rankings, competition history, and weight category via the IJF database (Judobase).
• JudoManager: National match data, statistics, and club information via the JudoManager API.

This data is cached to keep the platform fast, with a fixed retention period per type: a retrieved judoka profile is kept for at most one year after it was last fetched, and a tournament’s draw and entry list for at most 30 days. On your own device, the draw and entry list stay available for 7 days so the app works offline. If you linked the profile to an opponent in your account, the cache disappears as soon as you delete that opponent; if you only searched without linking, the cache expires with the retention period.

If you want to retrieve your own matches from JudoManager, the IJF database or a tournament website built with JudoShiai, you first confirm that the profile or competitor is you and authorize us to retrieve your matches on your behalf. This consent covers retrieving at your request, retrieving again later (for example to add video times), and preparing your matches the day after a tournament you are entered in. You can switch that last part off separately, and each time we retrieve automatically, we record for whom, from which source and for which tournament. We record your consent with its date and time, the version of the text and a fingerprint of the text you saw. If you are under 16, we also record that you confirmed your parent or guardian gives consent. From a tournament website we keep only your own matches, with your opponent's name and the result, never the full entry list. We do not retrieve anyone the organizer hides on the website. After your first confirmation we remember how your name and club are spelled there, so we can find you at the next tournament. Matches you confirm become regular matches in your account, which you can delete there yourself. You can withdraw your consent at any time via Settings > Privacy. After that we retrieve nothing more, and we immediately delete imported matches you had not confirmed yet.

JudoLytics offers the ability to join a judo club within the platform. Within a club, coaches, managers and, depending on your settings, fellow club members can view certain member data, but only to the extent you have set this yourself. One thing your club’s coaches and managers always see: which club sessions you are scheduled for and whether you attended. That is part of organizing a session. Your own sessions, the intensity, your reflections and your reason for canceling stay under your own settings. When you join a new club, nothing is shared by default until you make a choice.

You decide per topic who you share with, through the privacy settings in your dashboard. Each time you choose between not sharing, only your coaches, or your whole club. For a number of topics “your whole club” is deliberately not an option: those go to your coaches at most. This is what you can set:

• Match results, scores, and statistics. Can also be shared with your whole club.
• Opponent information and notes. Can also be shared with your whole club.
• Match plans. Can also be shared with your whole club.
• Sport measurements such as strength and fitness tests. Can also be shared with your whole club.
• Your weight and your match reflections. These go to your coaches at most, never to fellow club members.
• Training sessions and training reflections, your recovery checks, your development plan, and your tournament data. These too go to your coaches at most.

A sharing setting applies to all your data in that category, including data you entered earlier. If you set a category to private, coaches and fellow club members will no longer see your older data in that category either. You can change all of these settings at any time via your privacy settings in the dashboard.

We reserve the right to anonymize and aggregate your data for the following purposes:

When anonymizing, we ensure that:

• Data is aggregated at group level (minimum 5 users)
• Individual identifiers are irrevocably removed
• It is impossible to trace results back to individual persons
• Anonymized data is not combined with other sources for re-identification

Anonymized and aggregated data no longer falls under the General Data Protection Regulation (GDPR) and can therefore be used without restriction, including for external publication and marketing purposes.

Legal basis: Legitimate interest (Article 6(1)(f) GDPR). We have conducted a balancing test weighing the interest of product improvement and knowledge development in judo against your privacy interests. Since the data is fully anonymized, we consider the risk to your privacy minimal.

We do not retain your data longer than necessary for the purpose for which it was collected, unless a legal retention obligation applies.

We know your recovery, performance, and health data is personal. That is why security is not an add-on but the foundation JudoLytics is built on. Your data is protected in layers, from the connection with your browser to the way it is stored in the database. We take appropriate technical and organizational measures to protect your personal data against unauthorized access, loss, or modification. Below we explain, in plain language, how.

• Encryption: All your data is encrypted in transit (the entire app runs only over a secure HTTPS connection, enforced via HSTS) and encrypted at rest (encryption at rest via Supabase).
• Passwords stay secret, even from us: Your password is never stored as readable text. We keep only an encrypted, one-way version (bcrypt hashing with a salt). No one at JudoLytics can view or recover your password.
• Secure sign-in: Sign-in is via email and password or via Google (OAuth 2.0), with a PKCE-secured sign-in flow and optional two-step verification (MFA/2FA) via authenticator apps.
• MFA enforcement: Two-step verification is mandatory for administrator and support roles. Regular users can enable MFA voluntarily, with recovery codes. Once MFA is on, their own match, training and measurement data is only readable on a session that has completed the second step; this is enforced in the database, not in the app.
• Access control (Row-Level Security): At the database level, it is enforced that you can only access your own data. No other judoka or coach can see your data unless you choose to share it. This rule is enforced in the database itself, not only in the app, and is tested automatically.
• Documents sit in shielded storage: files attached to your record go into a closed storage area with no public links. Your browser cannot write to it directly; adding a file always goes through our server. Every file path starts with the judoka the file is about, so a deletion request hits exactly the right files and never someone else’s. If you delete your account, the files themselves are erased, not just the reference to them. A document always opens as a download, never inside the app itself.
• Notifications about documents and video links never name the file or title. When your club adds a document or video link to your record, you get a notification in the app, a push message and an email. You always get the email; you can turn the push message off. None of the three gives the name or title: a push message shows on your lock screen, and a file name or title can already say something about your health.
• Access on a need-to-know basis: Even within our own team, access to personal data is limited to what is strictly necessary. Internal keys and passwords are stored encrypted and rotated regularly.
• CAPTCHA protection: Cloudflare Turnstile protects the registration process against automated attacks.
• Rate limiting: Protection against brute-force sign-in attempts and API abuse.
• Security headers: A strict Content Security Policy and additional security headers counter common web attacks, such as clickjacking and code injection.
• Input validation: Everything you enter is checked both in your browser and on the server before it is stored.
• Continuous monitoring: We monitor the platform around the clock for errors and suspicious activity, so we notice and fix problems quickly.
• Audit logging: Administrative actions are logged for accountability and debugging.
• Automatic backups: Regular automatic backups are made, so your data can be restored after a technical failure and is not lost in an unexpected problem.
• Payment details never enter our system: Your card or bank details are processed solely by our payment partner Stripe, which meets the strictest payment-security standard (PCI-DSS). JudoLytics itself stores no card data.
• Stored in the European Union: Your data is held in a database within the European Union (Frankfurt, Germany) and is therefore covered by European privacy law.
• You stay in control: You can download all your data at any time or have your account and data permanently deleted, directly from your settings.

In short: your data is encrypted and technically isolated. No other user, not even a coach in your club, can see your data unless you choose to share it. Our database is hosted in the European Union; where we use service providers outside the EU, appropriate safeguards apply (see section 11). You remain the owner of your data and stay in control at all times.

No online service can guarantee absolute security. That is why we keep our protection up to date at all times and follow a set procedure if something does go wrong: in the event of a data breach that poses a risk to you, we report it to the supervisory authority within 72 hours and, where necessary, directly to you.

Think you have found a security issue? Let us know at info@judolytics.com. We take every report seriously.

Under the General Data Protection Regulation (GDPR), you have the following rights regarding your personal data:

JudoLytics uses cookies and local storage in your browser for the functioning of the application. Below you will find a complete overview of all cookies and storage mechanisms we use, divided into strictly necessary and optional (consent required).

Strictly necessary cookies and storage

These cookies and storage items are necessary for the website to function. They cannot be disabled.

Analytics cookies (consent required)

These cookies are only placed after your explicit consent via the cookie banner. You can withdraw or adjust your consent at any time.

Advertising cookies (consent required)

These cookies are used to measure the effectiveness of advertising campaigns. They are only placed after your explicit consent.

Embedded third-party content

Some pages embed third-party content. A video only plays when you click it, and that party may then set cookies. For YouTube, your browser does fetch the video’s preview image straight away. YouTube then sees your IP address and which video it is. We do not place cookies in advance.

The strictly necessary cookies and storage are required for the functioning of the service. Under the Dutch Telecommunications Act (Article 11.7a), prior consent is not required for these. Analytics and advertising cookies are only placed after your explicit consent via the CookieYes cookie banner. Fonts are self-hosted; no external requests are made to Google Fonts or other CDN services.

We share your personal data with the following service providers (processors) who process data on our behalf. We have concluded a data processing agreement with each processor in accordance with Article 28 GDPR.

SCCs = Standard Contractual Clauses: contractual safeguards approved by the European Commission for international data transfers (Implementing Decision (EU) 2021/914). The EU-US Data Privacy Framework is an additional safeguard: US organizations certified under the framework provide an adequate level of protection for personal data transferred from the EU (European Commission adequacy decision of 10 July 2023).

To display country flags, we load static images from a public flag CDN (flagcdn.com). This only exposes the IP address that every internet request requires; no account data is shared.

If you turn on push notifications, the push service of your own browser or operating system delivers them (Google, Apple, Mozilla or Microsoft). That service receives only the address at which your device can be reached and an encrypted message: it cannot read the content of the notification, and no account data is included. If you turn push notifications off, nothing is sent to these parties. To deliver notifications reliably, we keep a record per device of when a notification was sent, received and tapped, for as long as the notification itself is kept. Each device with push notifications also gets its own key, which lets it restore a lost subscription on its own; that key is removed as soon as you turn push notifications off or sign out.

For ad measurement, Meta is not a processor. For collecting and transmitting this data, we and Meta Platforms Ireland Ltd. are joint controllers (Article 26 GDPR); what Meta then does with the data, such as tuning and measuring ads, is Meta’s own responsibility. The arrangement is set out in Meta’s Controller Addendum (facebook.com/legal/controller_addendum). In short: we ask for your consent and give you this information, and Meta is responsible for its own processing. You can exercise your rights with us as well as with Meta; we pass any request about Meta’s processing on to Meta. How Meta processes data and how long it keeps it is explained in Meta’s privacy policy (facebook.com/privacy/policy).

For ad measurement, Google is not a processor but an independent controller: Google Ireland Ltd. (with Google LLC in the US) decides for itself what it does with the data we send it. The arrangement is set out in the Google Ads Controller-Controller Data Protection Terms (business.safety.google/adscontrollerterms). We switch off ad personalisation for this data. How Google processes data and how long it keeps it is explained in Google’s privacy policy (policies.google.com/privacy).

Some of our service providers are based in the United States. This means that your personal data may be processed outside the European Economic Area (EEA).

To ensure an adequate level of protection, we use:

• Standard Contractual Clauses (SCCs): Standard contractual clauses approved by the European Commission in accordance with Implementing Decision (EU) 2021/914.
• EU-US Data Privacy Framework: Some of our US-based processors are certified under the EU-US Data Privacy Framework, which provides an adequate level of protection under the European Commission’s adequacy decision of 10 July 2023.
• Data processing agreements: Written agreements have been concluded with all processors that comply with Article 28 GDPR.
• Additional technical measures: Encryption of data in transit and at rest.

JudoLytics is intended for judokas and coaches of all ages. Judo is a sport practiced from a young age, and we understand that minors may also use our platform.

In accordance with Article 8 GDPR and Article 5 of the Dutch GDPR Implementation Act (UAVG), consent from a parent or legal guardian is required for users under 16 years of age to create an account.

The platform offers the ability to enter recovery and health data (such as sleep quality and physical recovery). For minor users, the parent or legal guardian must give consent for the processing of this special category of personal data.

Ad measurement: we only send data to Meta about users whose stated year of birth shows they are certainly 16 or older, and only with consent for advertising cookies. Without a year of birth, or with a later one, nothing is sent to Meta. Our ads are aimed at adults (18+).

Google Ads: we only keep the click ID of a Google ad for users whose year of birth shows they are certainly 18 or older, and only with consent for advertising cookies. Without a year of birth, or with a later one, we keep nothing and nothing is sent to Google.

We do not actively verify age at registration. If we become aware that a minor is using our platform without parental or guardian consent, we will delete the relevant account and associated data. Parents or guardians can contact us at info@judolytics.com.

We may update this privacy policy from time to time, for example in response to new features, legal obligations, or changes in our service.

For substantial changes, we will inform you via:

• An email notification to the email address we have on file
• A notification within the application

The “Last updated” date at the top of this page is updated with each change. We recommend reviewing this privacy policy regularly.

Do you have questions about this privacy policy or about the processing of your personal data? Please contact us:

If you believe that we are not processing your personal data correctly, you have the right to file a complaint with the Dutch Data Protection Authority:

This privacy policy has been drawn up in conjunction with the Terms of Service of JudoLytics. In case of conflict between this privacy policy and the Terms of Service, this privacy policy prevails insofar as it concerns the processing of personal data. Terms of Service