Alliance Jiu Jitsu Corona
Privacy and security
This page is about the Alliance Jiu Jitsu Corona app — the member app, the front-desk tablet and the sign-up form. The gym uses it to run memberships, check-in, billing and messages. Osoto (Ark Innovations) builds and runs the app for the gym.
Privacy
What the app keeps
- Your name, email, phone number and date of birth, and an emergency contact.
- Medical notes you or the gym add, for your safety on the mat.
- Signed waivers and agreements: the signature, the printed name, and the device or address it was signed from.
- Check-ins, class bookings and belt ranks.
- Your membership, bills, payments and refunds. Card and bank numbers are never kept: you type them on Stripe’s pages, and the app keeps only the card type and last four digits.
- The texts and emails the gym sends you, and messages between you and the gym in the app.
- Your text and email choices, and a record of what staff did in the app.
Who sees it
The gym’s staff. Coaches see names on class rosters. You see your own family’s details, nobody else’s. The app has no ads and no analytics, and your information is never sold.
Companies that handle it for the gym
- Vercel — runs the app (web hosting)
- Neon — the database
- Clerk — sign-in and two-step sign-in
- Stripe — card and bank payments, on Stripe's own pages
- Twilio — text messages
- Resend — email
- Cloudflare — encrypted backups, and the bot check on the sign-up form
- GitHub — runs the nightly encrypted backup
Texts and email
The gym texts you only if you said yes; reply STOP to any text to stop them. Marketing emails carry an unsubscribe link. Emails about your own account, like bills and receipts, aren’t marketing and have no unsubscribe link.
Your choices
You can see and fix most of your details in the app (Settings). Ask the gym to correct anything else, or to erase you. Erasing removes your name, contact details, birthdate, medical notes and signatures; past bills stay, without your name, because the gym must keep them for taxes. Backups still hold the old details until they expire, within 30 days.
Security
- Every connection is encrypted (HTTPS), and the database is encrypted where it is stored.
- Medical notes and signatures are encrypted again by the app itself.
- Sign-in is handled by Clerk; the app never sees your password. The gym can require two-step sign-in for its staff.
- Payments happen on Stripe’s pages; card numbers never reach the app.
- Each person sees only what their role allows, and staff actions are recorded in an activity record that staff can’t edit or delete.
- The database is copied every night, encrypted, to separate storage. Copies are kept 30 days.
Report a security problem
Email security@osotohq.com. Please tell us privately and give us time to fix it; don’t open or change other people’s information while testing. Details for researchers are in security.txt.
Questions about your own information? Ask the gym at the front desk, or write to the address above.