Privacy Policy

Last updated: August 23, 2026

This Privacy Policy applies to the Karate Training mobile application (Android package com.twofreshstudio.karatetraining and its iOS counterpart) and the website karatetraining.app, both operated by 2Fresh Studio ("we", "us"). It explains what data we collect, why we collect it, how long we keep it, who we share it with, and the rights you have over it.

1. Information We Collect

We collect the following categories of data:

• Account Information: your email address, display name, and authentication identifiers when you create an account (email/password, Sign in with Apple, or Google Sign-In). Providing this data is required to create an account; you can use parts of the app without an account.
• Training Data: the programs you follow, completed sessions, workout history, streaks, progress and performance metrics you generate while using the app.
• Purchase Information: if you buy a subscription, our payment partners (Apple App Store, Google Play) process the payment. We never receive or store your card number or banking details; we only receive a pseudonymous transaction record (product purchased, date, subscription status) needed to unlock your access.
• Device & Usage Data: device type, operating system version, app version, language, coarse non-precise region, and in-app interaction events (screens viewed, features used, session duration), collected through analytics in aggregated or pseudonymous form.
• Support Communications: the content of emails you send us when you contact support.

We do not collect precise location data, contacts, photos, microphone or camera data, health data, or advertising identifiers. The app contains no third-party advertising.

2. How We Use Your Information

We use the data described above to:

• Create and operate your account and sync your training data across your devices
• Generate and personalize your training sessions and recommendations
• Track your progress and show you your statistics
• Manage subscriptions and unlock purchased content
• Send you service notifications (e.g. training reminders you enable) — you can turn these off at any time in the app or in your device settings
• Measure aggregate app usage to fix bugs and improve features
• Respond to your support requests
• Detect and prevent fraud or abuse, and comply with legal obligations

Where the GDPR applies, we rely on the following legal bases: performance of a contract (account, training sync, subscriptions), legitimate interest (app analytics, fraud prevention), consent (optional notifications), and legal obligation (tax and accounting records for purchases).

3. Data Retention

We keep personal data only as long as necessary for the purposes described above:

• Account Information and Training Data: retained for as long as your account exists. When you delete your account, this data is permanently deleted from our production systems within 30 days, and removed from encrypted backups within 90 days.
• Purchase records: subscription status records are kept while your account exists; minimal transaction records may be retained after deletion where required by tax and accounting law (up to 10 years in France), then deleted.
• Analytics data: event-level analytics data is retained for a maximum of 14 months, after which it is deleted or only exists in aggregated, non-identifiable form.
• Support emails: retained for up to 2 years after the request is closed, then deleted.
• Data of users who never create an account: we do not store any server-side personal data for you; your training settings remain only on your device and are removed when you uninstall the app.

4. Account and Data Deletion

You can delete your account and all associated data at any time, directly in the app: Settings → Delete account. Deletion is immediate on confirmation and irreversible; residual copies are purged from backups as described in Section 3.

You can also request deletion by emailing us at team@karatetraining.app from the email address linked to your account. We process deletion requests within 30 days.

5. Data Sharing and Third-Party Service Providers

We do not sell your personal information, and we do not share it with third parties for their own advertising purposes. We share data only with the processors listed below, strictly to operate the service, under data-processing agreements:

• Supabase (database, authentication and backend hosting) — stores your account and training data. Privacy policy
• RevenueCat (subscription management) — processes pseudonymous purchase records to manage your subscription. Privacy policy
• Google Firebase Analytics (app analytics) — processes pseudonymous usage events. Privacy policy
• Apple App Store / Google Play (payments) — process subscription payments under their own terms and privacy policies.
• Expo (app updates and push notification delivery) — processes a pseudonymous push token if you enable notifications. Privacy policy

Beyond these processors, we may disclose information only: when required by law or valid legal process; to protect our rights, users' safety, or investigate fraud; in connection with a merger, acquisition, or sale of assets (you would be notified); or with your explicit consent.

6. Data Security

All data is encrypted in transit (TLS) and at rest. Access to production data is restricted by row-level security rules so that each user can only access their own records, and administrative access is limited to the developer. No method of transmission or storage is 100% secure, but we review and update our safeguards regularly.

7. Your Rights

Depending on your location (including under the GDPR and CCPA), you have the right to:

• Access and receive a copy of your personal data
• Rectify inaccurate or incomplete data
• Request deletion of your personal data (see Section 4)
• Object to or restrict processing of your personal data
• Data portability
• Withdraw consent at any time, without affecting prior processing
• Lodge a complaint with your supervisory authority (in France, the CNIL — cnil.fr)

To exercise any of these rights, email us at team@karatetraining.app. We respond within 30 days and will never discriminate against you for exercising your rights.

8. Children's Privacy

Our services are not directed to children under 13 years of age (or the equivalent minimum age in your jurisdiction), and we do not knowingly collect personal information from them. If you believe a child has provided us personal information, contact us and we will delete it promptly.

9. International Data Transfers

Our processors may store data in countries outside your country of residence, including the United States. Where data is transferred outside the European Economic Area, we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses and, where applicable, the EU–US Data Privacy Framework.

10. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will post the new version on this page and update the "Last updated" date; for material changes we will also notify you in the app. Continued use of the service after a change constitutes acceptance of the updated policy.

11. Contact Us

Data controller: 2Fresh Studio (Karate Training), Paris, France.

If you have any questions about this Privacy Policy or our data practices, contact us at:

Email: team@karatetraining.app