Last updated: October 19, 2026
The Guard BJJ ("we", "our", or "the app") is a Jiu-Jitsu training tracker developed by Luis Braga. We take your privacy seriously. This policy explains what data we collect, how we use it, and what your rights are. This policy applies to the Android version of the app distributed via Google Play.
Account information: When you create an account, we collect your name, email address, date of birth and age, gender, belt and stripes, and your school. If you sign in with Google, we receive the identifiers Google provides (such as your email and basic profile).
Training data: Training sessions you log, including date, duration, type, notes, technique, venue name and city, calories burned, and heart rate (per second, when it comes from an optional Bluetooth heart-rate monitor or from Health Connect). This data is stored locally on your device and, optionally, synced to our servers if you choose to create an account.
Health data (Health Connect): With your explicit permission, the app reads exercise sessions, heart rate, resting heart rate, weight, height, and total calories burned from Health Connect, plus your past history so it can build the body composition card. It writes exercise sessions, heart rate, and total calories of the workouts you save. Weight is only used to suggest an update to the weight in your profile and to make calorie estimates more accurate; you decide whether to accept it. We never share Health Connect data with third parties or use it for ads.
Body measurements: Your weight and height, used for heart-rate zones and calorie estimates. They are always stored in kilograms and centimetres; the unit you choose to see is a display preference only.
Injuries and championships: If you record them, we collect injuries (body part, severity, time off, whether surgery was needed, notes, and return goals) and championships.
Belt events and promotion messages: The belt events you record and the promotion messages you write.
Photos: Profile and workout photos that you pick with the system photo picker. They are stored locally on your device and, optionally, synced to our secure cloud storage. We do not access your photo library beyond the photos you pick.
Location: With your permission, your approximate location (rounded coordinates, with city and country), used to find a school near you and to suggest a venue. It is optional. You can deny or revoke it at any time; the app works without it.
Heart-rate monitor: If you connect a Bluetooth heart-rate monitor, we read its data in real time during your workout. The per-second heart rate is saved with the workout and synced to our servers if you have an account. It is not shared with third parties other than the service providers listed in section 5.
Purchases: Your purchase history, in the form of Google Play Billing purchase tokens. We do not receive your payment details.
Community activity: Who you follow and who follows you, your reactions, and your privacy settings.
Safety reports and blocks: If you report a profile, workout, or promotion message, we collect your user ID, the user ID of the person you reported, the reason you choose, the optional details you write (up to 500 characters), and a copy of the reported content. If you block someone, we store your user ID and theirs. We use this data only for safety and moderation. See our Terms of Service and Community Guidelines.
Notifications: If you allow push notifications, we store your Firebase Cloud Messaging token and which notifications you have read.
App activity and diagnostics: Google Firebase Analytics records app events and screen views, and Firebase Installations creates an app installation ID. Sentry receives crash reports and diagnostics, with no personal information by default.
Advertising: The app does not use the advertising ID and does not show ads.
Your training data is stored locally on your device in secure storage. If you create an account, data is synced to our servers hosted on secure infrastructure (Render), with a PostgreSQL database (Neon). Photos are stored on Cloudflare R2 behind access-controlled URLs.
Authentication tokens are encrypted with a key held in the Android Keystore and stored in the app's private storage, never in plain shared preferences.
We retain your data only for as long as necessary for the purposes described in this policy:
These providers process data on our behalf. We do not sell your data.
We do not sell, rent, or share your personal data with third parties for advertising or marketing. We do not use your data for cross-app or cross-site tracking. The providers in section 5 process data only on our behalf. Other users of the community see only what your privacy settings allow. Reports and blocks are used only for safety and moderation. The identity of the person who reports is never shown to the person reported.
The app is not directed at people under 16. We do not knowingly collect data from people under 16, and we delete it if we learn that we have. If you believe someone under 16 has provided us with personal data, please contact us so we can delete it.
We may update this policy from time to time. We will notify you of significant changes through the app or by updating the date at the top of this page.
If you have questions about this privacy policy or your data, contact us at: