Privacy overview

CombatScore is a training journal that you share with your gym. That sentence captures the privacy posture. Below is the long-form version.

This is a plain-English summary. The legally binding document is the full privacy policy.

What we collect

Data	Why	Visible to
Account basics (name, email, DOB)	Identity, age-gating	You + your gym(s) + CombatScore
Training sessions	The product	You + the gym for that session
Bio, social links, photo	Profile rendering	You + your gym + (if you publish) the public
Combat score, streak, weekly goal	The product	You only (unless you publish)
Coach feedback you receive	The product	You + the coach + your gym
Payment details	Stripe handles cards	Never CombatScore — see Payments overview
Push tokens, device fingerprints	Anti-abuse + notifications	CombatScore + (hashed) abuse-detection
IP / user-agent	Rate limiting, anti-abuse	CombatScore only

Public vs private by default

Athletes default-private. Your profile is not publicly searchable until you toggle Profile → Make public.
Coaches default-public once their gym publishes them.
Gyms always public — they're businesses.
Managed kid accounts always private. No "make public" toggle exists for minors.

What your gym sees

Your gym owner and coaches see your training history at that gym plus your profile. They do NOT see:

Your training at other gyms (multi-gym is opaque to each gym).
Your private notes.
Your DMs with other athletes.
Your billing details outside your relationship with their gym.

What other gyms see

Nothing, unless you've granted them access (e.g. through a drop-in). Multi-gym athletes have one CombatScore identity but partitioned data per gym.

What the public sees

Only what you publish. Default: nothing. If you make your profile public, anyone with the URL sees your display name, belt, gym affiliations, and anything you've added to bio/press/social.

Third parties we share with

Stripe — payments, billing.
Clerk — auth.
Supabase — our database.
Anthropic / OpenAI — AI features (your raw data isn't used to train their models; we operate under enterprise terms with no training opt-in).
Resend — transactional email.
PostHog — product analytics (anonymized where possible).

We don't sell data. We don't run ad networks. We don't share with insurers, employers, or law enforcement except in response to a valid legal order.

Your rights

See Your data rights for export, deletion, and other controls. Parents managing minor accounts: see COPPA for parents.