Flow State Jiu Jitsu

Privacy Policy

Last updated: October 18, 2026

Who We Are

Flow State Jiu Jitsu ("we", "us", "our") operates the website at this domain and the jiu jitsu academy located in Falcon, Colorado. This Privacy Policy explains how we collect, use, and share information about visitors, leads, members, and their guardians.

Information We Collect

  • Contact info you submit through forms on this site (name, email, phone, child's name and age where applicable).
  • Membership & waiver info required to participate (date of birth, emergency contact, signed liability waiver, billing details processed by our payment processor).
  • Attendance and progress recorded by coaches (check-ins, belt rank, achievements).
  • Newsletter subscriptions (name and email) submitted through our footer signup.
  • Basic technical data such as IP address, browser type, and pages visited, used to operate and secure the site.

How We Use It

  • To respond to inquiries and schedule trial classes.
  • To run memberships, billing, attendance, and class operations.
  • To send appointment reminders, account notifications, and (with your consent) promotional emails or texts.
  • To improve our website, programs, and member experience.
  • To comply with legal obligations and enforce our terms.

Flow State JJ App

Who we are

Flow State Jiu Jitsu ("we", "us") is a jiu jitsu academy at 10630 Maltese Point #130, Peyton, Colorado 80831, near Falcon. We make the Flow State JJ app for our members, our trial students and their families, on iPhone, Android and the web (flowstatejj.com/app), and a gym clock version that runs on the gym's own TV. This section explains what the app collects, why, who sees it, how long we keep it and how you can have it deleted. The rest of this page covers our website and the gym.

What the app collects and why

  • Account details. Your name, email address and password (we store only a scrambled one way version of the password, never the password itself), and if you add them, your phone number, profile photo and a short bio. Your belt, stripes and role at the gym. The app asks for your date of birth when you sign up. Adults in our adult classes may add their date of birth for their birthday. When you link the app to your gym membership with the 6 digit code from the front desk or from the email we send when you sign up, the app keeps that link. We use these to sign you in, show your profile and your training, and connect the app to your membership.
  • Attendance. Each class you are checked in to and how: the QR code at the front desk, the gym wifi button, your phone's location (if you choose it), or face scan from the mat cameras. Also your rounds, your answers to "Did you do X rolls?", your belt promotions and achievements. For coaches, the classes they coach. We use these to keep your attendance and progress, and to run the gym.
  • Location (optional, in the background). Only if you choose My phone's location as your check in method. The app then uses your phone's precise location in the background, even when the app is closed or not in use, to notice when you arrive at and leave the gym. It sends your position to our server when you arrive and while you are there (every few minutes on an iPhone, about every 10 minutes on Android when our server asks). For check in, your phone sends its position only from the gym or just outside it (the area around the gym that counts for check in, or no more than 75 meters beyond it): before it sends a position, it checks where it is against the gym's location as our server last gave your phone, and from anywhere else it sends none. When you leave, it tells our server that you left, with the gym's own location, never yours. After a visit, an Android phone that finds itself away from the gym tells our server only that it is no longer at the gym, with no position. The server checks each report against the gym's location and keeps only the times of your visits, not a record of where you have been. To check that location check in works, our server also keeps a short log of the most recent reports (a few hundred, from all members). Each entry names the member and the time, and says what the report was, whether it counted, the kind of phone and, only for a report from the gym or just outside it, how far from the middle of the gym it was. That log is kept only in memory and is cleared every time our server restarts. If you are one of the gym's admins and use Set the gym's location in the app, it sends that phone's current position once, when you tap it, to save it as the gym's location. We use your location only for check in: to record your class attendance and, if your kids train with us, to remind you to check them in. You can turn it off anytime in the app (Check in, then Face scan) or in your phone's settings.
  • Face scan (mat cameras). See the next section.
  • Video. The gym's mat cameras film classes, rounds, private lessons and seminars, and the app delivers to you the clips you appear in, by face scan or by the marker on your gear. You can also upload your own videos and save clips. Who sees a video is set by the gym: you see your own and your kids' videos and your class's film; coaches see class film and only the member videos sent to them; the gym's owner and admins see all of them. A training partner who gets a clip of a round with you can share it in the Photo Album or a chat.
  • Photos and videos you post. Photos and videos you share in chats, in the Photo Album (photos and videos up to 60 seconds) and on events. The app uses your camera or photo library only when you choose to take or pick one. Photos and videos you post can keep the location your phone's camera wrote into the file (many phones record where a photo or video was taken unless that is turned off in the camera's settings): the app sends the file as it is, and our server does not remove it, so someone who saves the file may be able to read that location. To leave it out, turn off location for your phone's camera before you take the photo or video.
  • Chat messages. The messages you send in direct messages, group chats, announcement chats and, for coaches, the coaching committee chat, with any emoji reactions. Messages others read go through a word filter, except in groups where joining needs approval, which show every word as typed (a member we know is under 13 still sees swear words starred).
  • Your training journal. What you write or say into your journal.
  • Push notification token. A code from Apple or Google, passed through Expo, that lets us send notifications to your phone, and your notification settings.
  • Microphone. Only while you are recording: the sound in a video you film in the app, a voice memo you send in a chat, or your journal when you dictate it. Dictation is turned into text by your phone's own speech service (Google on Android, Apple on iPhone), which may process the audio on its servers. A voice memo is kept like any other chat attachment.
  • Technical data. The internet address each request comes from (used to tell whether you are on the gym's wifi for the wifi check in, and to protect the service), and your phone's kind and app version (to fix problems).

Payments for memberships are handled on our website, and card details by our payment processor (Stripe). They are covered by the rest of this page.

Face scan (mat cameras)

Flow State Jiu Jitsu uses facial recognition to identify members in training and competition video and to record class attendance. With your consent, given in the waiver you (or your parent or guardian) sign, we create and store a face template (also called a faceprint) of you, or of your child, from footage of a short session at the marked mat camera. A face template is a set of numbers made from images of the face. It is biometric data, and it is not a stored photograph. It is used only to recognize you, or your child, in class and competition footage, so that your own clips reach your account, and to record attendance. A "That's me" or a face you pick in the app can add to your template.

We never sell this biometric data, and we never share it with anyone except a service provider that helps run these features under confidentiality obligations. We keep a face template only while the membership is active, and we permanently delete it and any face images that go with it when you ask (email flowstatejj@gmail.com), when the membership ends, or when you delete your Flow State JJ app account, whichever comes first.

Your consent is voluntary. You can decline it, or withdraw it at any time by contacting us, and we will then delete the biometric data and stop using facial recognition for you, or your child. Declining never affects your, or your child's, ability to train, and you can choose another way to check in.

Matches section 4, Facial Recognition and Biometric Data, of the Participation Agreement and the trial week waiver.

How we use it

  • To check you in and keep your attendance, rounds, rolls and belt progress.
  • To deliver your class film and your clips, and to let you share your own.
  • To run chats, announcements, events and the Photo Album.
  • To send you notifications you can turn off in your phone's settings or in the app.
  • To keep the app working and secure, and to fix problems.

We never sell your information, and we never use it for ads. The app shows no ads and contains no advertising services. Two outside services the app uses receive some information straight from your phone, described in the next section, and may use it to measure how their own service is used: GIPHY (the GIF search in chats) and Expo (app updates).

Who we share it with

Only service providers that help us run the app and the gym, and only what each needs for its job:

  • hosting and databases for our servers (Render);
  • storage for videos, photos and other files (Cloudflare R2);
  • push notifications (Expo, Apple and Google);
  • app updates (Expo): each time the app starts, it asks Expo's update servers whether a newer version is ready, sending the kind of phone, the app's version, a random id for this installation of the app and your phone's internet address;
  • the GIF search in chats (GIPHY): when you open the GIF search or search for a GIF, the app sends GIPHY the words you search for and a random id GIPHY gives the app, and tells GIPHY which GIF you picked and sent; a GIF shown in a chat is loaded from GIPHY. GIPHY sees your phone's internet address, but not your name or your account;
  • email delivery (Resend and Google);
  • speech to text, only when you dictate (Google on Android, Apple on iPhone);
  • payment processing on our website (Stripe);
  • an AI service that our staff tools use to help write messages and to answer questions on our website (Anthropic). It sees only what a staff member asks it about.

We may also share information when the law requires it. Inside the gym, what each person sees is set by their role (member, coach, admin, owner).

How we keep it safe

  • Every connection between the app and our servers is encrypted (HTTPS).
  • Passwords are stored only as a scrambled one way version.
  • Access is limited by role: a coach sees only what coaches need, and only the owner and admins manage members.
  • Links to videos and photos are signed and stop working after a few hours.

No system is perfectly secure, but we work to keep your information safe.

How long we keep it, and how to have it deleted

  • Delete your account in the app: Profile, then Delete account. It permanently deletes your app account and its data (your profile, videos, messages, journal, the attendance kept in the app and your location visit records) and asks the gym's system to delete your face data. A parent or guardian can delete their child's app account the same way while on the child's profile.
  • When your membership ends: when the gym marks you inactive, your face data is deleted, and your app account is hidden and locked within a few hours and deleted 7 days later. A parent whose child still trains with us keeps their account.
  • Videos: class rounds, clips, teaching and positional videos are deleted after 14 days unless you save them; your uploads, competition videos, private lessons and seminars are kept until they are deleted.
  • Photos, chats and the Photo Album are kept until they are deleted, or until your account is.
  • Location: the times of your visits are kept until your app account is deleted; the diagnostic log is cleared whenever our server restarts.
  • Face templates: as in the face scan section above.
  • To ask us to delete anything, or for a copy: email flowstatejj@gmail.com or call 719 256 0166. Some gym records, such as signed waivers and billing records, may have to be kept to meet the law.

Children

Many of our students are under 18. Our staff ask a parent or guardian to sign our waiver for each child who trains with us.

Your child's profile in your app. When your app is linked to your gym membership, the children on your family's gym record appear in your app, and you can switch to each child's profile. On it you can see your child's videos, attendance, belt promotions and rolls, set up face scan for your child, and choose whether clips of your child's own rounds are made for them (Track My Training).

A child under 13. A child under 13 is not allowed to have a login of their own. When someone signs up, our app asks for a date of birth and refuses a date under 13. A child under 13 should use the app only through the child's profile in a parent's app, on the parent's phone, with the parent there: the child's profile shows the child's videos, attendance, belts and rolls, but the app's messages and journal stay the parent's own while it is switched to a child. Please do not give a child your login to use on their own phone. If we learn that a child under 13 has a login of their own, we contact a parent.

A teen's own login. A member from 13 to 17 can have a login of their own, on their own phone.

What a teen's own login collects. The same as any member's login, as described above: the teen's name, email address, password and the date of birth given at sign up; if the teen adds them, a profile photo and a short bio; attendance, check ins, rounds and answers to "Did you do X rolls?"; the teen's answers to "That's me" and "Is this you?" and any use of Tap My Face, which can add to the teen's face template; the messages, photos, videos, GIFs, voice memos and emoji reactions the teen sends, events the teen marks Going, videos the teen uploads or saves, and any report or block; the training journal, typed or dictated; a push notification token and notification settings; and the internet address, the kind of phone and the app version.

Location. Precise location in the background, and the times of the child's visits, only if the child chooses My phone's location for check in. For a member under 18 it stays off until they turn it on. A photo or video a child posts can keep the location the phone's camera wrote into it.

Dictation. When a child dictates into the journal, the phone's own speech service (Apple or Google) turns it into text and may process the audio on its servers.

Face scan for a child is described in the face scan section above.

Who sees what a child posts. Every member and trial of the gym can see the Photo Album and each gym wide announcement chat, so they see what a child posts there. Members of a group chat the child joins see what the child posts in it. In each place they see the child's first and last name, profile photo and role at the gym. Our coaches and admins can read every named group chat, even ones they are not in, and can see a child's contact details in our member list. A training partner who gets a clip of a round with your child can share it in the Photo Album or a chat. A parent cannot read a child's chats or journal in the app, but can ask us for a copy (see below).

How we protect children. We know a member's age from the birth date on their gym record, or, when the gym has none, from the date given at sign up. A member we know is under 18 cannot start a direct message and is not listed for one. In groups where joining needs approval, a member we know is under 13 sees swear words starred. The GIF search shows only GIFs rated PG or milder.

We never sell a child's information and never use it for ads.

A parent's rights. A parent or guardian can ask to see what we hold about their child, ask us to stop collecting it, or have it deleted. Email flowstatejj@gmail.com, call 719 256 0166, or ask at our front desk. A parent can also delete a child's profile in the app: switch to the child's profile, open Profile, then tap Delete (the child's name)'s account. A teen can delete their own login in Profile, then Delete account. If the child still trains with us, the gym keeps its own records of the child's attendance and belts, and a new profile for the child, made from those records, can appear in the parent's app.

How long we keep it. We keep a child's app data while the child is a member or trial with us. When the gym marks a child inactive, the child's app account is hidden and locked within a few hours and deleted with its data 7 days later. Class videos and the Photo Album are kept as described above.

Contact

Questions about this policy or your information: email flowstatejj@gmail.com, call 719 256 0166, or visit us at 10630 Maltese Point #130, Peyton, Colorado 80831.

SMS & Email Messaging

SMS opt-in is collected separately at the time of form submission and is never shared with third parties for marketing. Full SMS terms, message frequency, and opt-out instructions are described on our SMS Consent page. You can unsubscribe from marketing email at any time using the link in any message we send you.

Sharing

We do not sell personal information. We share data only with vendors that help us operate the gym (for example, our payment processor, email/SMS providers, and membership-management software), and only as needed for them to provide that service. We may also disclose information when required by law.

Children's Privacy

Many of our programs are for minors. Enrollment information for a child is collected from a parent or legal guardian, who is the account holder of record. We do not knowingly collect information directly from children under 13 outside of the enrollment context.

Your Choices

You can request a copy, correction, or deletion of your personal information by contacting us. Note: we may need to retain certain records (e.g. signed liability waivers, billing records) to comply with legal obligations.

Contact

Questions about this policy? Call 719 256 0166 or reach out through our contact page.