Kyu · Legal

Privacy Policy

Last updated: September 6, 2026

This policy explains how Kyu handles personal information when you use our website and martial arts school management service. Kyu is operated by Callum McKenzie. For privacy questions or requests, email support@getkyu.app.

Information we collect

• Account and sign-in information: your name, email address, profile image where provided, authentication identifiers, and school memberships. Clerk provides our authentication service.
• Training and school records: student profiles, track and rank placements, curriculum progress, attendance, lesson schedules, instructor assignments, feedback, help requests, and information submitted by you, your guardian, or your school. A school can maintain a student profile for someone who does not have a login.
• Participation and communications: invitation details, event responses, lesson absence notices, announcement views, and messages you send to support. Announcement authors with permission can see who has viewed their announcements.
• Technical information: request and device information needed to operate and secure the service, such as IP addresses and browser information, plus first-party usage and reliability metrics. If you enable notifications, we store the device subscription or push token needed to deliver them.

Google sign-in

If you choose Google sign-in, Google shares the basic identity information authorized on its consent screen, such as your name, email address, profile picture, and account identifier, through Clerk. We use this to authenticate you and connect you to your Kyu account. Signing in with Google does not give Kyu access to your Gmail messages, Google Drive files, contacts, or Google Calendar events. Calendar subscriptions are a separate feature.

How we use information

We use information to provide account access, maintain training records, show schedules and progress, deliver invitations and updates, support schools and families, prevent misuse, and understand usage and service reliability. We do not sell personal information or use Google sign-in information for advertising.

Who can access it

Your school controls access to its records through roles, permissions, instructor assignments, and guardian relationships. Authorized instructors, school administrators, and linked guardians can access the records their permissions allow. Membership in another school does not by itself grant access to your records in this school. Kyu administrators may access information when needed to operate, support, or secure the service.

We use service providers to deliver Kyu, including Clerk for authentication, Vercel and our server hosting provider for hosting, and Resend for email delivery. Notification delivery, where enabled, also involves browser or mobile push providers, including Expo and the relevant device platform. These providers process information needed for their services. Information may be processed outside your country. We may disclose information where required by law or reasonably necessary to address fraud, security incidents, or threats to people's safety.

Calendar subscriptions

If you subscribe using your device's calendar app, that app and its provider can retrieve and store the events in your feed. The private subscription URL acts as an access credential: anyone who has it can read the feed without signing in. Keep it private and replace or disable it in Kyu if it is shared accidentally. Removing a subscription from Kyu does not erase copies already stored by a calendar provider.

Cookies, local storage, and metrics

Kyu and its authentication provider use cookies or browser storage for sign-in, security, and application preferences. Disabling necessary storage may prevent sign-in from working. Kyu's first-party metrics measure named screen visits and aggregate API reliability; they do not record screen contents, form entries, or session replays. Screen metrics use daily pseudonymous account identifiers and honor the browser's Do Not Track setting. Operational request counters still run. Usage history and request aggregates are retained for 35 days.

Retention, security, and your choices

We retain account and training information as needed to provide the service, maintain school records, resolve disputes, and meet applicable obligations. Retention depends on the kind of record and your school's requirements. Deleted information may remain in backups until those backups are replaced or expire. We use access controls and encrypted connections to protect information, but no service can guarantee absolute security.

You can manage available account settings, turn off device notifications, and disable calendar subscriptions. To request access, correction, export, or deletion of personal information, contact your school or email our support address. We may need to verify your identity and coordinate with the school that maintains your records. Deleting a login does not automatically delete a school's training records. Your rights and any exceptions depend on applicable law; contact us if you wish to exercise them.

Children and guardians

Kyu supports schools that teach children, including student profiles managed by guardians and authorized school staff. Schools and guardians must ensure they have the permissions and consent required to provide a child's information and enable access. A child's records are not intended for public display. Guardians can contact the school or Kyu to ask about their child's information or request correction or deletion. Please contact us if you believe a child's information was provided without required authorization.

Changes and contact

We will update the date on this page when this policy changes and provide additional notice where required. Questions and requests can be sent to support@getkyu.app.