Privacy Policy

Last Updated: August 19, 2026

KarateShowCase.com ("we," "us," or "the Platform") operates a web-based competition management and video hosting platform for martial arts athletes, coaches, and dojo administrators. This Privacy Policy explains what data we collect, how we use it, who can access it, and your rights regarding that data.

1. Information We Collect

Account Data

• Email address (used for login and communication)
• Display name and user role (athlete, coach, or administrator)
• Password (stored in hashed form via Firebase Authentication)
• Profile photo (if uploaded)

Athlete / Fighter Profile Data

• Name, belt rank, age division, weight class
• Competition history, tournament results, and match records
• Profile photos

Video & Media Data

• Match videos uploaded by users or coaches
• Video metadata (title, tournament name, date, opponent)
• YouTube embed URLs (where applicable)

Coaching Notes & Comments

• Text-based coaching notes attached to individual match videos
• Round-by-round scoring annotations

Event Participation

• RSVP answers to your team's tournaments, listings, and seminars

Messages You Send Us

• If you use a dojo's contact form: the name, email address, and message you type

Technical & Operational Data

• Standard server logs kept by our infrastructure providers for security and reliability
• Rate-limit counters on public forms and links that use a salted, one-way hash of your network address — we never store the address itself, and the same visitor produces unrelated hashes on different team sites
• We do not run behavioral analytics, session recording, or tracking inside team spaces. Our public marketing homepage — and only that page — uses Google Analytics (see Section 7)

2. How We Use Your Data

We use collected data exclusively for the following purposes:

• Platform functionality — to provide user accounts, video hosting, competitor profiles, tournament management, and coaching tools
• Coaching & training — to allow authorized coaches and administrators to review match footage and provide feedback
• Communication — to send important account-related notifications
• Security & reliability — to protect accounts, prevent abuse of public forms and links, and keep the Platform running

We do not sell, rent, or share your personal data with third-party advertisers or data brokers.

3. Data Storage & Security

All platform data is stored and processed on Google Cloud / Firebase infrastructure:

• Firebase Authentication for secure login and credential management (passwords are hashed; we never see or store them in plain text)
• Cloud Firestore for structured data (profiles, results, notes)
• Google Cloud Storage for uploaded media (photos), served only through an access-checked media gateway — protected images are never exposed at public storage addresses
• Cloud Functions and Cloud Run for the Platform's server-side operations

Security safeguards in place:

• Encrypted transmission everywhere (HTTPS/TLS), with strict security headers on every page
• Role-based access control enforced by server-side security rules — what each role can see and change is checked on the server, never only in the browser
• Least-privilege service design: each server component runs under its own narrow identity with only the permissions its job requires
• The database keeps a seven-day point-in-time recovery window, so an operational mistake can be rolled back without keeping long-term copies of your data

While we take reasonable measures to protect your data, no method of electronic storage or transmission is 100% secure. We cannot guarantee absolute security.

4. Who Can See Your Content

Access to your data depends on your role and your dojo's configuration:

• You — full access to your own profile, videos, and the coaching notes on your matches
• Your parent or guardian — a guardian linked to an athlete's record can view and manage that athlete's profile and photo
• Coaches — can view athlete profiles, match videos, and coaching notes within their own dojo; a coach from another dojo sees an athlete only if the Platform has explicitly assigned them to that athlete
• Dojo Administrators — can view and manage their dojo's data and memberships; they cannot edit an athlete's personal profile fields (photo, bio, goals), which belong to the athlete and their guardians
• Platform staff — can access account and operational data as needed for support and moderation. Private coaching notes are deliberately excluded from every support and moderation surface the Platform provides: within the product they are readable only inside your own dojo, and platform staff do not access them in the ordinary course of operating the Platform

Your content is not publicly visible to the general internet unless you or your administrator explicitly configure it to be, and you can hide your athlete profile from your team's roster at any time.

5. Children's Privacy (COPPA)

Many athletes on this platform are minors, and the Platform is built around that reality: a child's athlete record is created and managed by their dojo, and a parent or legal guardian can be linked to that record — a linked guardian views and manages the child's profile and photo from the guardian's own account.

• Accounts are for adults and teens. Creating an account requires confirming you are 13 years of age or older; children under 13 may not create their own KarateShowCase accounts. A child under 13 participates through an athlete record managed by their dojo and by their parent or guardian's own account
• We do not knowingly collect personal information directly from children under 13. If we learn that a child under 13 has created an account, we will promptly delete the account and its data
• Parents and guardians linked to an athlete's record can review and update the child's profile and photo directly, and may request deletion of the child's records at any time by contacting us

For athletes aged 13–17, we recommend that a parent or guardian consent to the athlete's participation and stay linked to the athlete's record.

6. Data Retention & Deletion

Your data is retained for as long as your account remains active. Deletion is built into the product, not a request queue:

• Download your data — from My Account → Your data, you can download a copy of the information your account holds (profile, memberships, athlete records, comments, RSVPs) as a file, any time
• Delete your account — from My Account → Delete account, behind a typed confirmation. Deletion runs immediately: your sessions are ended, and your profile, memberships, athlete records (including photos and videos), RSVPs, and notifications are deleted
• Coaching notes you wrote on teammates' videos are anonymized rather than deleted — the text stays with the video it was written about, attributed to "Former member" with your identity removed — so an athlete's coaching record stays whole
• Guardians: deleting your own account removes your link to a child's record; it never deletes the child's record, which stays with their dojo
• Dojo owners: an account that owns a dojo must transfer ownership (or contact us) before it can be deleted, so a team is never orphaned by accident
• Photo and video files are destroyed by a scheduled cleanup after their records are deleted, typically within 48 hours
• Deleted data remains recoverable to us through the database's seven-day point-in-time recovery window (Section 3); beyond that window, we operate no mechanism that can bring it back, and we run no backup archives of personal data of our own. Our infrastructure providers (Section 7) retain and delete data on their own schedules, described in their policies

What we deliberately retain: platform audit records of privileged actions (which reference accounts by internal ID, not by name), a dojo's own operational records (its sent-mail log and contact-form correspondence), and in-app notification entries, which expire on their own (read notifications after 90 days, all notifications after one year). Deletion also cannot reach what has already left the Platform: email delivered to inboxes, alerts posted to a dojo's connected GroupMe group, or data exports you downloaded. A dojo that leaves the Platform can request deletion of its entire team space; we archive it, provide the dojo a complete export, and then permanently purge it, keeping only a minimal record that the deletion happened.

7. Third-Party Services & Cookies

We use the following services to operate the Platform:

• Google Cloud / Firebase — authentication, database, file storage, and server infrastructure
• Netlify — website hosting and content delivery (Google's Firebase Hosting serves as a mirror)
• Microsoft Azure Communication Services — delivers all email the Platform sends (verification links, invitations, team email), from our own authenticated domain
• Google Fonts — typefaces, loaded from Google's servers
• YouTube — embedded video playback (subject to Google's Privacy Policy)
• GroupMe (Microsoft) — only if your dojo connects its own GroupMe group: the Platform then posts outbound alerts (announcements, event updates) into that group. Nothing is read back from the group, and no member data beyond the alert text ever goes to GroupMe
• Google Analytics — on our public marketing homepage only. Team spaces, member pages, and this page carry no analytics: a dojo's visitors are the dojo's, not ours to measure

Each service has its own privacy policy. Links from the Platform to external sites — for example, our merchandise store, which is operated by Fourthwall — lead to independent sites with their own policies; we send them no data about you.

Cookies: team spaces use only functional cookies and browser storage — your sign-in state, and a short-lived session cookie that authorizes your access to protected images. Our public marketing homepage uses Google Analytics, which sets first-party analytics cookies on that page; team spaces and member pages carry no analytics. We do not use advertising cookies, and we do not sell or share data with advertisers.

8. Your Rights

You have the right to:

• Access — download a copy of your data yourself, any time, from My Account → Your data
• Correct — update your own profile and, for athletes, the personal fields on your athlete record (or ask your dojo administrator for operational fields)
• Delete — delete your account yourself from My Account, immediately; or email us and we will run the same deletion for you after verifying the request
• Restrict — hide your athlete profile from your team's roster, or ask us to limit how your data is used
• Withdraw consent — revoke previously given consent at any time

For anything you cannot do in the product, contact us at info@KarateShowCase.com.

9. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be communicated via the Platform or email. Continued use of the Platform after changes constitutes acceptance of the updated policy.

10. Contact

For questions, concerns, or data requests:

Email: info@KarateShowCase.com
Website: www.KarateShowCase.com