Privacy Policy

DojoSensei ("we", "our", or "us") is committed to protecting your privacy in accordance with the General Data Protection Regulation (GDPR), the Norwegian Personal Data Act (Personopplysningsloven), and applicable data protection laws.

Data Controller: Terry James Thorpe Publishing (Enkeltpersonforetak)
Org.nr: 928 134 636
Address: Sørlibakken 1A, 4073 Randaberg, Norway
Privacy Contact: privacy@dojosensei.com

This Privacy Policy explains how we collect, use, process, and safeguard your personal data when you use our karate class planning application.

We collect and process the following categories of personal data:

• Account Information: Email address, name, profile details (dojo name, role, belt rank, teaching preferences, and optionally your date of birth)
• Date of Birth (age-appropriate content): If you provide your date of birth, we use it to determine your age band so that training content is age-appropriate. Users we cannot verify as adults (under 18, or no date of birth provided) are not shown adult self-defence material — such as techniques targeting vulnerable areas, joint attacks, or defence-against-assailant scenarios — in AI Sensei answers. We use your date of birth only to compute an age band (“adult” or “restricted”); the date itself is never shared with third parties or embedded in cached content
• Class Plans and Content: Karate class plans, drills, templates, and curriculum data you create
• Usage Data: How you interact with the application, features used, and performance metrics
• Authentication Data: If you sign in with Google, we receive your basic profile information (email, name) from Google
• Communication Data: Messages sent through Sensei AI chat features, including conversation history retained for up to 90 days to provide continuity and personalization
• Voice Data: When you use voice chat features, audio from your microphone is transmitted in real-time over our voice service (Daily / Pipecat Cloud) to Deepgram for transcription, and text responses are sent to Cartesia for speech synthesis. Audio is processed in real-time and is not stored by DojoSensei or our processors beyond the active session
• Training Adaptations: Optional directive preferences describing how you need to train — for example “no deep stances”, “reduced intensity” or “no full contact” — so that AI-generated suggestions suit you. You choose these from a fixed list; there is no free-text entry, and the list contains no body areas, diagnoses or medical conditions. DojoSensei collects training instructions, not health information. Please do not enter medical details anywhere in the app
• AI-Inferred Preferences: Our AI Sensei may infer information about your karate experience, interests, and training preferences from your chat conversations. These inferences are stored with confidence levels and you can review, confirm, or reject them at any time (see Section 12)
• Technical Data: IP address, browser type, device information, and access logs. This includes your device’s time zone (for example “Europe/Oslo”), which we store on your profile so that dates such as grading deadlines, daily practice ticks and class days are worked out in your own calendar rather than in UTC
• Consent Records: Timestamps, versions of policies you have accepted, and IP address at time of consent for GDPR compliance verification
• Payment Data: Subscription tier, billing interval, and payment processor identifiers. Payment card details are processed exclusively by LemonSqueezy and are never stored by DojoSensei
• Student Roster Data (entered by instructors about others): If you use the Students feature, the details you record about the people you teach — display name, name, date of birth, belt and grading history, attendance, guardian contact details, and your own notes. This is personal data about someone other than you, and often about a child. See Section 14 for how it is handled and who is responsible for it

When you create an account and accept our Terms of Service and Privacy Policy, we record certain information to demonstrate your consent as required by GDPR:

• Timestamp: The exact date and time you accepted the terms
• Policy Version: Which version of the Privacy Policy and Terms of Service you accepted
• Marketing Preference: Whether you opted in to receive marketing communications

Purpose: This information is collected for legal compliance and consent verification under GDPR Article 6(1)(c).

Retention: Consent records are retained for 3 years from the date of consent, or 1 year after account deletion, to demonstrate compliance with applicable data protection laws.

We process your personal data based on the following legal bases:

• Contractual Necessity (Art. 6(1)(b)): To provide and maintain the DojoSensei service, save and sync your class plans, process payments, and fulfill our terms of service
• Legitimate Interests (Art. 6(1)(f)): To improve our service, ensure security, prevent fraud, analyze usage patterns, and personalize your AI Sensei experience through preference inference
• Consent (Art. 6(1)(a)): For optional features like marketing communications (you can withdraw consent at any time)
• Legal Obligation (Art. 6(1)(c)): To comply with applicable laws, tax obligations, and data protection regulations, including maintaining consent records

We process your personal data for the following purposes:

• Providing and maintaining the DojoSensei application and services
• Saving, syncing, and managing your class plans across devices
• Providing AI-powered features including Sensei chat assistance
• Keeping AI-generated training content age-appropriate: if you have provided a date of birth, we derive an age band from it and filter adult self-defence material out of answers for anyone we cannot verify as an adult. This protects minors and is applied cautiously — an unknown age is treated the same as a minor
• Improving and personalizing your user experience
• Ensuring security and preventing unauthorized access
• Complying with legal obligations and responding to legal requests
• Sending important service updates and notifications (essential communications)
• Analyzing usage patterns to improve our service (anonymized where possible)

We retain your personal data only for as long as necessary:

• Account Data: Retained while your account is active. Deleted within 30 days of account deletion request
• Class Plans and Content: Retained while your account is active. Deleted when you delete your account
• Sensei Chat Conversations: Retained for up to 90 days to provide continuity and personalization, then automatically deleted
• Chat Analytics Logs: Redacted of personally identifiable information (PII) before storage. Retained for up to 90 days for service improvement, then automatically deleted
• AI Cost and Usage Data: Retained for up to 12 months for billing and service monitoring, then deleted
• Voice Data: Processed in real-time only. No audio recordings are stored by DojoSensei
• Student Roster Data: Retained while the instructor keeps the student on their roster. Deleted when the instructor deletes the student, and automatically when the instructor closes their account — belt history and attendance are deleted with it (see Section 14)
• Consent Records: Retained for a minimum of 3 years from the date of consent, or 1 year after account deletion, to demonstrate compliance with applicable data protection laws
• Legal Obligations: Some data may be retained longer if required by law or for legitimate business purposes (e.g., tax records, fraud prevention)

Your data is stored securely using Supabase (PostgreSQL database) with:

• Encryption in transit (TLS/SSL) and at rest
• Row Level Security (RLS) policies ensuring data isolation between users
• Industry-standard security measures and access controls
• Regular security audits and monitoring

Your class plans and personal data are private and only accessible to you unless you explicitly choose to share them.

Share links:If you create a “Share link” for a class plan, a read-only copy of that plan's contents becomes accessible to anyone who has the link, without signing in. The link is unlisted (not indexed by search engines) and the class date is withheld unless you opt to include it; your name and dojo are shown only if you choose to add attribution. You can revoke a share link at any time from the plan's share dialog, which immediately disables public access.

We use the following third-party services (data processors) that may process your data:

• Supabase (Supabase Inc.): Database and authentication services. Data may be stored in the United States. GDPR-compliant with Standard Contractual Clauses (SCCs)
• Resend (Resend Inc.): Email delivery for transactional and marketing emails. Email addresses and email content are processed. GDPR-compliant with data processing agreement
• Google (Google LLC): Optional sign-in authentication and AI chat (Google Gemini). Chat conversations and user context are processed by Gemini to provide AI Sensei features; data is not used for model training under API terms. Data transfers covered by Google's EU-US Data Privacy Framework certification
• Deepgram (Deepgram Inc.): Speech-to-text transcription. When you use voice features, audio from your microphone is streamed to Deepgram for real-time transcription. Audio is not stored beyond the transcription session. US-based; transfers covered by SCCs
• Cartesia (Cartesia AI, Inc.): Text-to-speech generation. Text responses are sent to Cartesia to produce spoken audio for voice features. No long-term storage by Cartesia. US-based; transfers covered by SCCs
• Daily / Pipecat Cloud (Pluot Communications, Inc.): Real-time voice transport and orchestration. When you use voice features, your microphone audio and the synthesized reply are routed over Daily's WebRTC infrastructure to our voice service, which coordinates transcription, AI response, and speech synthesis. Audio is processed in real-time and is not stored beyond the active session. US-based; transfers covered by the EU-US Data Privacy Framework and SCCs
• OpenAI (OpenAI LLC): Text embeddings for knowledge search. Search queries are processed to generate semantic embeddings that power search functionality. Not used for model training under API terms. US-based; transfers covered by SCCs
• LemonSqueezy (Lemon Squeezy LLC): Payment processing and subscription management. Processes email, billing information, and payment card details. DojoSensei never receives or stores your payment card details. US-based; PCI DSS compliant; transfers covered by SCCs
• Sentry (Functional Software Inc.): Error monitoring and performance tracking. Collects technical error data and browser information. All personally identifiable information is stripped before transmission. Basic error monitoring runs under legitimate interest to keep the service stable; session replays (screen recordings) run only with your analytics-cookie consent and mask all text and block all media. US-based; transfers covered by SCCs
• PostHog (PostHog Inc.): Product analytics — usage events and feature-funnel metrics used to understand how the app is used and improve it. Loaded only with your analytics-cookie consent. Hosted on PostHog EU Cloud (Frankfurt, Germany), so your data stays within the EEA; session replay is not used
• Vercel (Vercel Inc.): Application hosting and serverless functions. Request logs and IP addresses may be processed. GDPR-compliant with data processing agreement
• Cloudflare (Cloudflare Inc.): Content delivery and security services. IP addresses may be processed for bot protection and performance optimization. GDPR-compliant

When we transfer personal data outside the European Economic Area (EEA), we ensure appropriate safeguards are in place, including Standard Contractual Clauses (SCCs) approved by the European Commission or reliance on adequacy decisions such as the EU-US Data Privacy Framework.

You have the following rights regarding your personal data:

• Right of Access (Article 15): Request a copy of your personal data and information about how it is processed
• Right to Rectification (Article 16): Request correction of inaccurate or incomplete data
• Right to Erasure (Article 17): Request deletion of your personal data ("right to be forgotten"), subject to legal obligations
• Right to Restrict Processing (Article 18): Request limitation of processing in certain circumstances
• Right to Data Portability (Article 20): Receive your data in a structured, commonly used format and transmit it to another controller
• Right to Object (Article 21): Object to processing based on legitimate interests or for direct marketing purposes
• Right to Withdraw Consent: Withdraw consent at any time where processing is based on consent
• Right to Lodge a Complaint (Article 77): File a complaint with your local supervisory authority if you believe your data protection rights have been violated

To exercise these rights, please contact us at privacy@dojosensei.com. We will respond to your request within one month.

You can withdraw your marketing consent at any time by:

• Clicking "Unsubscribe" in any marketing email
• Visiting Settings → Privacy in the app and updating your preferences
• Contacting us at support@dojosensei.com

Withdrawal of marketing consent does not affect the lawfulness of processing based on consent before its withdrawal, nor does it affect your account access or the core functionality of DojoSensei.

You can request complete deletion of your account and all associated data by:

• Visiting Settings → Account → Delete Account in the app
• Contacting us at support@dojosensei.com

Upon deletion, we will erase all personal data within 30 days, except:

• Consent Records: Retained for 1 year after account deletion for legal compliance (see Data Retention above)
• Anonymized Data: Aggregated, non-identifiable data may be retained for analytics
• Legal Requirements: Data required by law to be retained longer

DojoSensei uses AI-assisted profiling to personalize your experience:

• Conversation Analysis: Our AI Sensei may infer information about your karate experience, interests, and preferences from your chat conversations (e.g., your interest in kata vs. kumite, your experience level, training goals)
• Inferred Profile: These inferences are stored with confidence levels (low, medium, high) and are visible to you. You can confirm or reject any inference at any time
• Sentiment and Topic Tracking: Conversation sentiment and topics are analyzed to improve the relevance of AI responses and detect knowledge gaps where you may need more help
• Purpose: These inferences are used solely to personalize your AI Sensei conversations and provide more relevant training suggestions
• No Legal or Significant Effects: These profiles do not produce legal effects or significantly affect you. They do not determine pricing, access to features, or service availability

Your Control: You can view all AI-inferred data, confirm or reject individual inferences, and disable AI profiling entirely in Privacy Settings. When profiling is disabled, no new inferences will be stored. The legal basis for this processing is legitimate interest (Art. 6(1)(f)); you have the right to object at any time under Art. 21.

We use a small number of cookies and browser storage entries. We do not use advertising cookies, and we do not sell or share your data with advertising networks.

Strictly necessary — always active

These are required for the service to work and are not subject to consent:

• sb-…-auth-token: keeps you signed in (Supabase authentication)
• device-type (24 hours): serves you the mobile or desktop interface
• dojo-sensei-theme (1 year): remembers the theme you selected
• maintenance-bypass, preview-access: only issued during maintenance or private previews
• Browser local storage: your cookie choice itself, your saved plans and reference data for offline use in the installed app, and a record of whether audio has been enabled on iOS

Analytics — only with your consent

These load only after you accept the “Analytics” option, and never before:

• PostHog (ph_…_posthog, plus local storage): product analytics on how features are used, hosted on PostHog's EU Cloud in Frankfurt so the data stays within the EEA
• Sentry Session Replay: a screen recording around an error, with all text masked and all media blocked

Basic error reporting runs regardless of this choice, under our legitimate interest in keeping the service stable. It does not record your screen.

Third-party embeds

Some drill and kata pages show YouTube videos. The preview image for each video is fetched by our own server and passed on to you, so Google does not see your IP address when the page opens. Nothing is sent to Google until you press play — at that point the video player loads, and any cookies Google sets are governed by Google's own privacy policy.

Changing your choice

You can change your cookie preferences at any time from the cookie banner, or from Settings → Privacy. You can also clear cookies and local storage through your browser settings, though this will sign you out and reset your preferences.

Cookie preferences

Account holders must be adults. DojoSensei accounts are for karate instructors and adult practitioners. You must be at least 18 years old to create one, as set out in our Terms of Service. We do not knowingly allow anyone under 18 to hold an account, and we do not knowingly collect personal data directly from children. If you believe a minor has created an account, contact us at privacy@dojosensei.com and we will remove it.

Student records entered by instructors.Separately from accounts, our Students feature lets an instructor keep a roster of the people they teach — who are often children. Depending on what the instructor chooses to enter, a student record may contain a display name, given and family name, date of birth, belt and grading history, attendance, guardian name, guardian email, guardian phone, and free-text notes.

• Who is responsible: the instructor decides what to record about their students and is the controller of that information. DojoSensei stores and processes it on the instructor's behalf
• Consent is required before identifying details can be stored: our system will not accept a student's name, date of birth or guardian contact details unless the instructor has recorded that consent is held. This is enforced by the database itself, not merely requested. A student can be tracked by display name and belt history alone without it
• If you are an instructor: you are responsible for obtaining that consent from the student, or from a parent or guardian where the student is a child. The digital age of consent is 13 in Norway (Personopplysningsloven § 5) and varies between 13 and 16 across the EEA
• If you are a parent or guardian: to see, correct or delete what is held about your child, contact the instructor in the first instance. You may also write to privacy@dojosensei.com and we will locate the record, act on your request, and inform the instructor that we have done so
• Retention: student records are kept for as long as the instructor keeps them on their roster. They are deleted when the instructor deletes them, and automatically when the instructor closes their DojoSensei account. Belt history and attendance are deleted alongside the student record

We may update this Privacy Policy from time to time to reflect changes in our practices or legal requirements. We will notify you of significant changes by:

• Posting the updated policy on this page
• Updating the "Last updated" date
• Sending you a notification if the changes materially affect your rights

Your continued use of DojoSensei after changes become effective constitutes acceptance of the updated policy.

For questions, requests, or concerns about this Privacy Policy or your personal data, please contact us:

Data Controller: Terry James Thorpe Publishing
Org.nr: 928 134 636
Address: Sørlibakken 1A, 4073 Randaberg, Norway
Privacy Email: privacy@dojosensei.com

We will respond to data subject requests within one month, as required by GDPR Article 12.

Supervisory Authority: If you are not satisfied with our response, you have the right to lodge a complaint with the Norwegian Data Protection Authority:

Datatilsynet
Postboks 458 Sentrum, 0105 Oslo, Norway
Phone: +47 22 39 69 00
Web: www.datatilsynet.no

If you are located in another EEA country, you may also lodge a complaint with your local data protection supervisory authority. A list of authorities is available at edpb.europa.eu.