Privacy Policy

Last updated: 14 November 2026

This is a translation. The Czech version of this policy is the binding one.

This policy describes how the operator of the TatamiTime app processes personal data in accordance with Regulation (EU) 2016/679 (GDPR) and Czech Act No. 110/2019 Coll., on the processing of personal data.

1. Controller of personal data

2. What data we process

• Account: name, e-mail address, password (stored only as a hash); when you sign in with Apple or Google, the identifier of your account with that service, and the e-mail and name the service passes to us.
• Profile: nickname, profile photo, a text about yourself, belt and stripes with their dates and your earlier belts, favourite technique, home gym and favourite gyms, country and language.
• Gym membership: requests for a pass, for an entry and for a free first class, passes and their validity, entries (attendance) and how they were paid, including a sport card, your role at a gym and membership of its team.
• Training log: the trainings you write down (place, length, sparring rounds, note, tags) and your answers to the question after training.
• Content you create: posts, photos and videos, comments, reactions, messages in the gym's chat and private messages including voice messages, files and folders in the gym's Files, announcements, seminars and sign-ups for them; whom you follow and whom you have blocked.
• Reports: what you reported and what was reported about you (with the text as it was at that moment), and how a moderator decided.
• Location: when you look for gyms and events nearby, the app sends your position to the server; the server uses it only for the answer: it does not write it to the database, and it writes the address of the request to its operating logs without the parameters, so without the position. When you look up the address of a seminar's venue, the server passes the text you search for and a position rounded to roughly a kilometre to the Mapy.cz service, without any data about you. When you allow the question after leaving a gym ("Ask after leaving the gym"), your phone itself watches the surroundings of your gyms; only which gym you were at and from when until when goes to the server, never your position, and of that the server stores only that it has already asked you about that gym and day.
• Device: the address for delivering notifications (push token), the type of device and the language of the app.
• Errors of the app and the server: when the app crashes or runs into an error, a technical record is sent (type of device, version of the system and of the app, place in the code). It does not contain your name, your e-mail or the content you write. An error on the server is recorded with the address of the request, from which we first remove your position, and the place in the code.
• Server operating logs: IP address, time, the address of the request without its parameters (so without the position and the text you search for), and the identification of the app or browser.

The app does not process special categories of personal data (health, biometric data and the like), shows no advertising, does not track you across other apps and websites, and performs no automated decision-making or profiling. We do not sell data.

3. Purpose and legal basis

4. Who sees your data and how long we keep it

Other signed-in users see your name, nickname, profile photo, belt with stripes, your posts and comments and the number of your trainings per day; whoever has a gym as their home gym shows in that gym's list of people. With a public profile they also see the dates of your belt and stripes, your earlier belts, the text about yourself, your favourite technique and your home gym. The announcements and seminars you write are seen by everyone signed in, messages in a gym's chat by its team. Files in the gym's Files are seen by those their space is for (the whole team, the coaches, the people chosen or only you) and always by the club's coaches and owners. The author of a file or a folder and the club's coaches and owners can share it with anyone in the app, outside the gym too: that person can then read it (a folder with everything in it now and later) until the share is taken back; they cannot change anything in it.

A post someone shares as a link is seen on the web by anyone who has the link: your name, belt, the text and the first photo. The profile photo loads from an address that needs no sign-in.

The coaches and owners of a gym where you have a pass, an entry or a request, or which is your home gym, see your name, photo, belt and your passes and attendance at their gym, including the sport card used. Private messages are seen only by their participants and, when reported, by a moderator.

When administering the app and moderating, the operator has access to the data of your account, to your passes, attendance and log; of the messages in chats and of private messages he sees only the reported ones.

We keep the data as long as you have an account. Deleting the account deletes it at once and for good; what stays (mainly the paid passes and the attendance kept by the gym without your name) is described on the page Deleting your account and data.

• We keep the list of notifications in the app for 90 days.
• The sign-in on a device that has not opened the app for 60 days stops being valid.
• An uploaded file you do not use in a post, a message or the gym's Files within a day is deleted.
• What is deleted in the gym's Files stays in the trash for 30 days, then it is deleted for good, with the file in the storage.
• The code for resetting a forgotten password is stored only as a hash; the next request overwrites it, and a successful change of the password or the deletion of the account deletes it.
• We keep the server's operating logs for 30 days and the error records for 90 days.
• We keep reports and a moderator's decisions as long as the account of the person the report is about exists; they are deleted with that account. The reports you made stay after your account is deleted, without your name.

5. Recipients of personal data

We pass data on only to the extent necessary:

• Hetzner Online GmbH (Germany): the app's servers and the storage of photos, videos, voice messages and the gym's Files (Hetzner Object Storage, Nuremberg),
• Seznam.cz, a.s. (Czech Republic): sending e-mails about the account from the operator's mailbox; the Mapy.cz service when looking up an address (the text searched for and an approximate position, without any data about you),
• Apple and Google: signing in with their account, delivering notifications (APNs, Firebase Cloud Messaging) and the maps in the app,
• 650 Industries, Inc. (Expo), USA: delivering notifications to the phone (the push token and the text of the notification),
• Functional Software, Inc. (Sentry): error records of the app and the server, stored in the EU,
• public authorities, where the law requires it.

Data is transferred to the USA in the case of Apple, Google and Expo, on the basis of the European Commission's adequacy decision (EU–U.S. Data Privacy Framework) or standard contractual clauses.

The gym where you have a pass or an entry processes the data about your membership as a separate controller.

6. Your rights

• the right of access to the data (Art. 15 GDPR),
• the right to rectification (Art. 16) — most data you correct right in the app,
• the right to erasure (Art. 17) — see Deleting your account and data,
• the right to restriction of processing (Art. 18),
• the right to data portability (Art. 20),
• the right to object (Art. 21),
• the right to withdraw consent at any time (notifications and location: in the settings of your phone and of the app),
• the right to lodge a complaint with the supervisory authority.

You exercise your rights by e-mail to radek.bryknar@gmail.com. A complaint can be lodged with the Office for Personal Data Protection (Úřad pro ochranu osobních údajů), Pplk. Sochora 27, 170 00 Praha 7, Czech Republic, www.uoou.cz.

7. Children

The app is meant for people aged 15 and over. Younger people may use it only with the consent of their legal guardian. If we find that an account without such consent belongs to a younger child, we delete it.

8. Security

Communication with the app is encrypted (HTTPS), we store passwords only as a hash, and the sign-in on the phone is kept in its secure storage.

9. Changes to the policy

We may update the policy; the version in force is always on this page. We will announce substantial changes by e-mail or in the app.