Security & Privacy

• Student names and the contact information you add for their parents or guardians.
• Attendance records — which students attended which class session, and when.
• Recognition events — which students were recognized by which instructor, and for what.
• Belt rank, stripe history, and testing records you enter.
• Behavioral observations your instructors log during class.
• Parent email addresses, and the emails we send on your school's behalf.
• Your account information — school name, your email address, and billing details (processed by Stripe; we never see raw card numbers).

We do not collect GPS location, device identifiers, biometric data, or any health information.

• All data is encrypted in transit using TLS — the same standard used by banks and financial institutions.
• Our database encrypts data at rest.
• We use Supabase to manage our database infrastructure. Supabase is built on top of AWS.

• Only the people you invite — owners and instructors you add to your school.
• Instructors see only the students and sessions in your school. They cannot see data from other schools.
• Retention OS staff may access data for support and debugging purposes only — never for advertising or third-party sharing.

• We never sell your student data to anyone.
• We never share student data with advertisers, data brokers, or third parties.
• We do not use student names, contact information, or behavioral data to train AI models.
• The emails we send to parents are sent on behalf of your school — we are the delivery mechanism, not the sender.
• We handle minors' data with particular care. Parent contact information is used only to deliver the class updates you authorize.