Privacy

The short version

We collect what we need to teach you kung fu and to keep your account safe. We do not sell anything about you, we do not run advertising trackers, and there is no cookie banner because there is nothing on this site to consent to beyond the cookies that make it work.

The most sensitive thing we hold is the video you record of yourself. It lives in private storage, it is only shown to you and to the teacher grading it, and it is deleted 90 days after grading unless you choose to keep it.

What we collect, and why

To give you an account — your email address, a hashed password, your display name, your handle, and your date of birth. We keep the date of birth because we have to be able to show we check that everyone is 18 or over. Lawful basis: performing our contract with you.

To teach you — which stones you have completed, your XP, your streak, quiz answers, drill logs, and the videos you submit for grading. Lawful basis: performing our contract with you.

To keep the account safe — sign-in times, the six-digit codes we email you, which devices you have used, and IP addresses attached to security events and to actions an administrator takes. Lawful basis: our legitimate interest in preventing account takeover.

Because you asked us to — a public profile at your own handle, marketing email, and permission to be filmed. Each of these is off until you turn it on, and each can be turned off again. Lawful basis: your consent.

To know whether the videos are being watched — we record that a video was played and that it was watched to the end, against your account. We do not record what you looked at, for how long, or from where. Lawful basis: our legitimate interest in knowing whether the teaching works.

Your videos

Submissions are identifiable footage of your body, so they get their own treatment:

• You have to give separate permission before you can send the first one.
• They go into private storage. Every link to one is signed and expires

within minutes.

• Only you and the teachers grading you can watch them.
• They are deleted 90 days after grading, unless you choose to keep one on

your profile.

• We only show a clip to other students if you tick the exemplar box on

that particular submission, and you can withdraw that at any time.

Who else sees your data

We use a small number of companies to run the service. They only handle what they need to, and only to do the job we have given them:

• Resend — sends our email. Sees your email address, your name and the

contents of the message. United States.

• Cloudflare — stores all media, and sits in front of the site as CDN

and firewall. Sees your videos and images, and the IP address and metadata of your requests.

• OVH — hosts the application and the database in Canada. Sees

everything in the database.

Captions are generated on a machine we own, so no third party hears the audio. We do not use third-party analytics.

We will add to this list before, never after, sending anyone new your data.

Where your data lives

The application and the database are hosted in Canada. Canada holds an adequacy decision from the EU and is recognised as adequate by the UK, so data can move there from the UK and Europe without extra safeguards.

If we ever move the service somewhere without that status, we will tell you first, put the appropriate legal protections in place, and ask for your consent again where we need it.

How long we keep things

• Your account — while it exists, and 30 days after you delete it, then

it is purged.

• Submission videos — 90 days after grading, unless you keep one.
• Security and administration logs — 90 days.
• Your XP history — kept after deletion, but with your name and account

detached from it, so our own totals stay honest without being about you.

What you can do

• See it — download everything we hold about you as a file, from your

settings.

• Delete it — close your account from your settings. We remove your

personal details, hard-delete your media and submissions, and anonymise what has to remain.

• Correct it — most of it is editable in your profile. Ask us for

anything that is not.

• Withdraw consent — turn off marketing, make your profile private, or

withdraw an exemplar permission, at any time, without giving a reason.

• Complain — to us first, please, but you can go to your national data

protection authority. In the UK that is the Information Commissioner's Office.

Cookies

We set cookies to keep you signed in and to remember the browser you have already verified. That is all of them. There is no advertising or analytics cookie on this site, which is why we do not ask you to click through a banner.

Changes

The date at the top of this page is the version, and it is the version recorded against your consent. If we change something that matters, we will tell you and ask again.

Contact

Use the "Ask for help" button in Messages, or write to the postal address we publish on request.