Privacy Policy

Koaryu provides studio management software for independent martial arts schools. “Koaryu,” “we,” “us” and “our” mean the operator of koaryu.app and the Koaryu app.

This Privacy Policy explains how we collect, use, share and protect personal information when you visit koaryu.app, create or use a Koaryu account, are added to a studio’s records, or pay a studio through Koaryu. It should be read with our Terms of Service, which use the same defined terms, such as “Studio,” “Staff User,” “Studio Data” and “Payer.”

This policy does not cover how a studio itself collects or uses information outside Koaryu. Each studio has its own privacy practices.

Koaryu handles personal information in two different roles.

• For our own customers and visitors. We decide how to use account, subscription, support and website information about studios and their staff. For this information we act as a “business” or “controller.”
• For Studio Data. Records a studio keeps in Koaryu about its students, guardians, leads, Payers and staff belong to the studio. We process them on the studio’s behalf and according to its instructions, as a “service provider” or “processor.” The studio decides what to collect and is responsible for giving notice and obtaining any consent required.

The information we handle depends on how you use Koaryu. Most of it is entered by studio staff; some comes from you directly, from the sign-in provider you choose, or from Stripe.

Koaryu does not ask for government ID numbers, precise location, or health or medical information, and we ask studios not to store them in free-text notes.

You can sign in with a Google or Microsoft account instead of a password. Sign-in is handled by Supabase, our authentication provider.

• Google shares your name, email address and profile picture.
• Microsoft shares your account identifier, name and email address.

We use this information only to sign you in, link you to your existing Koaryu account and show your name on your profile. We never receive your Google or Microsoft password, and we do not request access to your email, files, contacts or calendar.

Koaryu’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. You can remove Koaryu’s access at any time from your Google or Microsoft account settings.

We use personal information to:

• provide the Service: sign you in, show each staff member the records their role allows, and run attendance, ranks, leads, reports and exports;
• manage Koaryu Core subscriptions and, where enabled, Koaryu Payments;
• send service messages, such as email confirmations, password resets, staff invitations, and billing, security and policy notices;
• answer support requests and investigate problems you report;
• keep Koaryu secure, including enforcing access controls, keeping audit records and preventing fraud and abuse;
• measure and improve reliability and performance, using aggregated measurements that don’t identify you; and
• comply with the law and enforce our Terms.

We don’t sell personal information, show advertising, or use Studio Data to market to students, families or leads. We don’t use Studio Data to train artificial intelligence models. Koaryu does not make automated decisions that have legal or similarly significant effects on anyone: features like rank eligibility help staff, but people make the decisions.

Within your studio

Staff Users see Studio Data according to their role. For example, Instructors can work with student profiles, attendance and ranks but cannot see billing.

With service providers

We use the following providers to run Koaryu. They process personal information only on our instructions and only as needed to provide their services to us.

Stripe also uses some information for its own purposes, such as fraud prevention and legal compliance, under the Stripe Privacy Policy.

Other situations

• People who help us. Contractors and professional advisers who need access to help us build, maintain and support Koaryu, under confidentiality obligations and only as needed.
• Legal and safety. When we believe in good faith that the law, a court order or a valid legal request requires it, or that it is needed to protect the rights, property or safety of Koaryu, our users or others.
• Business transfers. As part of a merger, acquisition, financing or sale of assets, subject to this policy’s protections.
• With permission. When you or your studio direct us to share information.

When a studio subscribes to Koaryu Core, Stripe Checkout and Stripe’s billing portal collect the payment details. We send Stripe the studio’s name and internal references, and receive back subscription and payment status. We never receive full card numbers.

With Koaryu Payments, staff add a Payer’s name, email, phone and address, which we share with Stripe to create invoices and checkout pages. Payers enter their own payment details on Stripe’s checkout page and accept autopay terms there. We keep a record of that acceptance, including the terms version, the time and Stripe references, so the studio can show the charge was authorized. Stripe may email receipts and invoices to Payers directly.

Account emails, such as sign-up confirmations, password resets and staff invitations, are sent for us by Supabase and may come from Supabase’s sending domain rather than koaryu.app. Stripe may send billing emails, such as receipts and invoices. We may also contact you about your account, a support request, security or changes to our terms.

Koaryu does not send marketing email or text messages, and it does not message students, families or leads on a studio’s behalf. If we ever offer marketing email, it will include a way to unsubscribe.

Koaryu uses only the cookies and browser storage it needs to work. We don’t use advertising or analytics cookies, and we don’t load third-party analytics, advertising or tracking scripts.

The demo keeps your changes in your browser only and sends nothing to us. To measure page speed, the site sends anonymous timing data with no user or studio identifiers. Fonts are served from koaryu.app, so loading a page does not contact other companies’ font servers.

You can block or delete cookies in your browser settings, but you won’t be able to sign in without them. Because we don’t track you across other websites, we don’t change our practices in response to browser “Do Not Track” signals. We treat a Global Privacy Control signal as a request to opt out of the sale or sharing of personal information, which we don’t do in any case.

• Your account. We keep account details while your account exists. When you request deletion, it is scheduled 30 days out so you can cancel. We then delete your sign-in account, staff profile and studio roles. Records you created for a studio stay with that studio but are no longer linked to you. We keep a minimal record of the deletion request, including the email address, and audit entries that refer to an internal ID, to show the request was carried out and for security.
• Studio Data. We keep it for as long as the studio has a Koaryu account, including after a subscription ends, so the studio can come back. An Admin can ask us to delete the studio’s data, and we will do so within 30 days of confirming the request, apart from the exceptions below.
• Archived students. Archiving hides a student from active lists but keeps the record. Permanent deletion is available on request from an Admin.
• Support requests. We keep them while the studio’s account is active so we can see past issues, and delete them with the studio’s data.
• Billing and payment records. We keep them for as long as tax, accounting and other laws require.
• Technical logs. Our hosting providers keep logs for short periods set by their own retention schedules.
• Backups. Deleted information can remain in encrypted backups until those backups are replaced in our normal backup cycle. We don’t restore deleted information from backups except to recover from an incident.

We may keep information longer where the law requires it, or where we need it to resolve disputes, enforce our agreements or protect against fraud and abuse.

We use safeguards designed for the kind of information studios keep, including:

• membership and role checks on every request, so staff see only what their role allows;
• database row-level security, with direct browser access to studio tables turned off;
• encryption in transit (HTTPS) and encryption at rest by our database provider;
• private storage for student photos, shown only through short-lived links;
• audit records of sensitive actions, such as promotions, billing changes and exports;
• card and bank details handled only by Stripe, a PCI DSS Level 1 certified service provider; and
• limiting access within Koaryu to the people who need it.

You help too: use a strong, unique password or a secured Google or Microsoft account, and remove staff access promptly. No method of transmission or storage is completely secure. If a security incident affects personal information, we will notify affected studios and, where the law requires, individuals and regulators.

Many studios teach children, so Studio Data can include information about minors, such as names, dates of birth, guardians, photos, attendance and ranks. Studio staff enter this information. Children do not use Koaryu or have accounts, the Service is not directed to children, and we don’t knowingly collect personal information directly from children under 13.

Studios are responsible for giving parents and guardians notice and obtaining their consent where the law requires it, and for handling their requests. If you believe a child has given us personal information directly, contact us at koaryu@outlook.com and we will delete it.

What everyone can do

• Update your profile in Account settings.
• Delete your account in Account settings. Deletion is scheduled 30 days out and can be cancelled until then.
• Export studio records. Admins can download CSV exports from Reports, and Front Desk staff can download some of them.
• Ask us for a copy of your information, or to correct or delete it, by emailing koaryu@outlook.com.

Rights under privacy laws

Depending on where you live, including California and other U.S. states with privacy laws, and the European Economic Area, the United Kingdom and Switzerland, you may have the right to:

• know what personal information we hold about you and get a copy;
• correct inaccurate information;
• delete your information;
• receive your information in a portable format;
• opt out of the sale or sharing of personal information or its use for targeted advertising (we don’t do these);
• object to or restrict certain processing, and withdraw consent; and
• appeal our decision on your request.

How to make a request

Email koaryu@outlook.com from the address on your account, or describe your relationship to Koaryu if you don’t have an account. We verify requests by confirming control of the account email, and may ask for more information where needed. You can use an authorized agent, who must provide your signed permission. We respond within the time the law requires, and we won’t treat you differently for exercising your rights.

If we decline your request, you can appeal by replying with “Appeal” in the subject line. If you’re not satisfied with the result, you can contact your state attorney general or your local data protection authority.

If your request concerns records a studio keeps about you, such as a student or Payer record, we will refer it to that studio, as described in Koaryu’s role for studio records.

This notice describes the categories of personal information we have collected in the past 12 months, as defined by the California Consumer Privacy Act and similar state laws. The sources, purposes and retention periods are described above.

We have not sold or shared personal information for cross-context behavioral advertising in the past 12 months, including that of consumers under 16. We use sensitive personal information only to provide the Service and keep it secure, and not to infer characteristics about anyone. We don’t disclose personal information to third parties for their own direct marketing.

Koaryu is designed for studios in the United States, and information is stored and processed in the United States. If you use Koaryu from elsewhere, your information will be transferred to the United States, where data protection laws may differ from those where you live. Where the law requires it, we rely on appropriate safeguards for these transfers, such as the European Commission’s Standard Contractual Clauses.

If the GDPR or UK GDPR applies, we rely on these legal bases: performing our contract with you or your studio; our legitimate interests in running, securing, supporting and improving Koaryu, balanced against your rights; compliance with legal obligations; and your consent where we ask for it, which you can withdraw at any time. You can also lodge a complaint with your local supervisory authority.

We will update this policy when our practices or the law change. We post the new version on this page with a new effective date and record it in the revision history below. If we make a material change, we will notify account owners by email or through a notice in Koaryu before it takes effect.

For privacy questions or requests, email koaryu@outlook.com. Signed-in users can also open Help from the account menu and choose Contact support. Please include your studio’s name and your account email so we can find your records.

If your question is about a studio’s records about you or your child, please contact that studio first.