Privacy
Last updated 18 August 2026. Armbar is a record of grappling rounds for a single gym. This page says exactly what it stores about you, why, and how to make it stop.
Who is responsible
[Your name or company name], [Your postal address], is the data controller. For anything on this page, including a request to see or delete your data, write to caydenchern@gmail.com.
What is collected
- Your username and email address
- Given when you register. The username identifies you to everyone else in your gym. The email address is used to confirm the account and to contact you about it — never for marketing.
- Your password
- Stored only as a bcrypt hash. The password itself is never written down, and cannot be recovered from what is stored — not by us either.
- Rounds you record
- Who you rolled with, how many submissions each of you got, which discipline, how long the clock ran, and when. This is the point of the service. Each round is visible to the other person in it and to everyone in your gym.
- Photographs you upload
- A profile photo, a banner, and images attached to competition records. All optional, all visible to your gym. Nothing is scanned, analysed or used to identify anyone.
- Profile details
- The disciplines you train and a daily training-time goal. Both optional.
- Your timezone
- Read from your browser at sign-in, as an IANA name such as “Asia/Singapore”. Used to put your sessions on the right calendar day. It is not a location, and no location is collected.
What is not collected
There is no analytics, no advertising, no tracking pixels and no third-party scripts of any kind. Your data is never sold or shared for anyone else's marketing. Nothing here is used for automated decision-making or profiling.
Cookies
One cookie, named armbar_session. It holds an encrypted reference to your account so you stay signed in, lasts 90 days, and is marked HttpOnly and SameSite. It is strictly necessary for the service to work, which is why there is no cookie banner — there is nothing optional to consent to. Signing out deletes it.
Why it is allowed (lawful basis)
- Performing our contract with you covers your account, your rounds, and your gym membership. These are the service.
- Legitimate interests covers keeping the record accurate and the account secure — including retaining confirmed rounds after an account closes, so other people's records stay true.
- Consent covers the optional things: photographs, disciplines, and your training goal. You can remove any of them at any time from your profile.
Who else can see it
Other members of your gym see your username, photo, rating, and the rounds you have had. A gym is joined with a code, so this is not public — but treat anything you put on your profile as visible to everyone in the room.
Three companies process data on our behalf, and only to run the service:
- Supabase — hosts the database and the image storage.
- Vercel — hosts and serves the application.
- Resend — sends account emails.
Each is bound by a data processing agreement and may not use your data for its own purposes. Where these services move data outside your country, they do so under the transfer safeguards published in their own terms.
How long it is kept
Your account and its contents are kept while the account is open. When you delete it, everything that identifies you is erased immediately — your username, email address, photographs, disciplines and timezone — and your password is replaced with a value no password can produce.
Confirmed rounds are not erased, and this is the one thing worth reading twice. A round is a record of something two people did together: it set your opponent's rating and it is part of their history as much as yours. Deleting it would silently rewrite their record to remove a session they actually fought. Instead, the round stays and your name is removed from it — it shows as “Former member”, attached to nobody.
UK and EU GDPR provide for this directly: the right to erasure does not apply where processing is necessary for the establishment or defence of legal claims, or where it is overridden by the rights of others (Article 17(3)). If you believe this balance is wrong in your case, write to us and say so.
Your rights
If you are in the UK, EU or another jurisdiction with comparable law, you can ask us to:
- give you a copy of your data, in a portable format;
- correct anything inaccurate;
- delete your account — you can do this yourself, under Account on your profile, without asking anyone;
- restrict or object to how we use it;
- withdraw consent for anything given on that basis.
Write to caydenchern@gmail.com. We will respond within one month. There is no charge.
If you are not satisfied with our answer you can complain to [Your data protection authority]. You do not have to come to us first.
Security
Passwords are hashed with bcrypt and repeated failed sign-ins lock an account temporarily. Everything travels over HTTPS. Access to the database is restricted to the application, and row-level security is enabled on every table so no other route can read it.
No system is perfect. If you find a security problem, please tell us at caydenchern@gmail.com before disclosing it publicly, and we will work with you.
Children
Armbar is not intended for under-16s, and accounts should not be created for them. If you believe a child has registered, tell us and the account will be closed.
Changes
If this notice changes in a way that affects you, the date at the top changes and we will tell you in the app before the change takes effect.