Privacy Policy
What we do with your data
Effective date: August 13, 2026
Who this is for
FlowRoll is a training log and community for Brazilian Jiu-Jitsu athletes, operated as an independent product. This policy covers the FlowRoll web app at flowroll.xyz and its API.
What we collect
- Account — your email address (for sign-in), and the name, date of birth, belt rank, profile photo, and optional home gym you provide during setup.
- Training data — the sessions you log: dates, duration, rounds, submissions, training partners, notes, and any photos or videos you attach.
- Social activity — who you follow, and the reactions and comments you leave on sessions.
- Coach conversations — messages you exchange with the in-app AI Coach, kept so your conversation persists (you can clear it anytime from the chat page).
- Feedback — anything you submit through the in-app feedback form.
- Usage & technical data — a simple count of the days you've visited, and standard server logs (including IP address) kept by our hosting provider. We run no analytics SDKs, ad trackers, or tracking pixels.
- API keys — if you create developer API keys, we store only a cryptographic hash of them.
How we use it, and on what basis
To run the app you signed up for (performing our contract with you): showing your logbook and stats, powering the AI Coach, letting you share sessions with people you choose. We also use limited data to keep the service secure and prevent abuse (legitimate interest — e.g. rate limits). We do not sell your data and do not use it for advertising.
The AI Coach
FlowRoll's Coach and weekly recap are powered by AI (Claude, from Anthropic). When you use them, your messages and relevant training context (session summaries) are sent to Anthropic's API to generate the response. Your conversations are stored in our database until you clear them or delete your account. Under Anthropic's commercial terms, API inputs and outputs are not used to train their models; Anthropic may retain them briefly (up to about 30 days) for abuse monitoring. Coach responses are AI-generated and are not medical advice.
Who else touches your data
Third parties that process user data on our behalf, and why:
- Supabase — hosts the database, authentication, and file storage.
- Anthropic — processes Coach messages and recap context, as described above.
- Vercel — hosts and serves the application, including standard server logs.
- Photon (OpenStreetMap / Komoot) — powers gym-name search; your gym search text is sent to their service.
- Resend — delivers sign-in and service emails.
- Sentry — error monitoring (technical error reports may include your account id), when enabled.
- YouTube (Google) — when the study feature is enabled, FlowRoll uses YouTube API Services to search technique videos (queries derive from your submission stats, not your identity). Use of that feature is also subject to the YouTube Terms of Service and Google Privacy Policy.
If FlowRoll is ever acquired or merged, user data may transfer to the successor under this same policy (we'd notify you). We disclose data in response to valid legal requests only when required to.
What others can see
You control your visibility. A public account's sessions are visible to signed-in users; a private account's sessions are visible only to followers you approve. Session photos and videos are stored privately and served through short-lived signed links. Profile photos are public. Your date of birth is never shown to anyone.
Retention & deletion
We keep your data while your account is active. Deleting a session, photo, or conversation removes it immediately, including the underlying files. Deleting your account (Settings → Danger zone) permanently removes your entire footprint — profile, sessions, media, conversations, social activity, and API keys — immediately. Copies in our encrypted backups expire within 90 days.
Your rights
- Access & export — see everything in the app; export your sessions programmatically via the API.
- Correction — edit your profile and sessions anytime.
- Deletion — in-app, self-serve, immediate (Settings → Danger zone).
- Anything else — email christianshields100@gmail.com and we'll respond within 30 days.
Children
FlowRoll is not directed at children under 13, and you must be at least 13 to create an account. If we learn we hold data on a child under 13, we will delete it.
Changes & contact
If this policy changes materially, we'll note it here with a new effective date. Questions: christianshields100@gmail.com.