Privacy Policy
Last updated 23 August 2026.
Studio Kata holds a studio's client list and financial records, which is about as personal as small-business data gets. This page says exactly what is stored, who else can see it, and what we deliberately chose not to collect.
No advertising. No data sales. No profiling. This site and the app contain no Google Analytics, no Facebook pixel, no session recording, and no advertising or cross-site trackers. Nobody is building a profile of you or your clients, and your records are never used to train machine-learning models.
The one measurement tool present is Cloudflare Web Analytics, which counts page views for our own hosting. It sets no cookies, does not fingerprint your device, and cannot follow you to any other website. Inside the app itself it is blocked outright by our content-security policy, so it only ever sees the public marketing pages.
Two kinds of data, two different roles
It matters which is which:
- Your account data — your email, your business details, your subscription. We decide how this is handled, so we are the controller of it.
- Your business records — your clients, their sessions, their packages, your income and expenses. You decide what goes in and why; we only store and process it on your behalf. In data-protection language, you are the controller and we are the processor. We do not look through it, mine it, or share it, and we access it only when you ask for support or when it is genuinely necessary to fix a fault.
What we collect
| Category | What it includes |
|---|---|
| Account | Email address, a securely hashed password (never the password itself), your display name, and sign-in timestamps. |
| Business | Studio name, timezone, locations you save, and optionally a Venmo or Zelle handle so balance pages can offer a pay shortcut. |
| Client records | Whatever you enter: name, email, phone, address, birthday, status, tags, and free-text notes including goals and any injuries or limitations you record. |
| Activity & money | Sessions and attendance, class packages and balances, payments you record, expenses, and receipt photos you upload. |
| Technical | Ordinary server logs kept by our hosting providers — IP address, timestamp, and which request was made — used for security and debugging, not for analytics. |
What we deliberately do not collect
- Card numbers. Subscription payments run through Stripe's own hosted checkout. Your full card number never reaches our servers.
- Your clients' payments. Venmo, Zelle, cash, and cheque all happen outside Studio Kata. We record only what you tell us happened — never a payment credential.
- Birth years. Client birthdays are stored as month and day only, because the app exists to wish someone a happy birthday, not to hold a date of birth.
- Anything from your device beyond what you type in — no contacts, no location, no camera roll. A receipt photo is uploaded only when you choose one.
Sensitive information
Notes about injuries, limitations, or physical goals are health-adjacent information about real people. Studio Kata is not a medical records system and is not designed for regulated clinical data. Please record only what you need to train someone safely, and make sure you are allowed to hold it under the rules of your profession and your jurisdiction.
Who else processes your data
We keep this list short on purpose. Each one is a company we pay to perform a specific job; none of them may use your data for their own purposes.
| Provider | What it does |
|---|---|
| Supabase | Hosts the database, sign-in system, file storage for receipt photos, and server-side functions. This is where your records actually live. |
| Cloudflare | Serves the website and app files and provides network protection. |
| Stripe | Processes your subscription payment to us, and stores the card details you give it. |
| Resend | Delivers our email — sign-in and password-reset messages, and the weekly backup below. |
| Cloudflare Web Analytics | Counts page views on the public pages. Cookieless, no fingerprinting, no cross-site tracking; blocked by policy inside the app. |
Two more are contacted directly by your browser when a page loads: Google Fonts (for the typefaces) and jsDelivr (which serves one pinned software library the app needs). Both necessarily see your IP address, as any server does when your browser requests a file from it. Neither receives any of your records.
The weekly backup email
Your account can email a complete export of your business records — clients, sessions, packages, payments, and expenses — once a week, as a JSON attachment, to an address you nominate. It exists so a studio is never one account problem away from losing its history.
Because it is a full export leaving our systems, it goes only to an address you set yourself, and to no one if you set none. Treat that mailbox as carefully as you would the records themselves, and remember that email is not encrypted end-to-end.
Links that work without a password
Two features produce links that anyone holding them can open: a client's package balance page, and a calendar subscription feed. They work this way because the things that use them — a text message to a client, a calendar app — cannot log in.
Each is protected by a long random address that cannot realistically be guessed, is never listed or indexed, and can be revoked or regenerated by you at any time, which instantly breaks the old link. Calendar feeds leave session locations out unless you explicitly turn them on, because for an in-home trainer a location is a client's home address.
How long we keep things
- While your account exists: your records stay as you left them, including when a trial or subscription has lapsed and the account is read-only.
- When you delete your account: your records are deleted from our live systems. Encrypted infrastructure backups roll off on their own cycle, generally within 30 days.
- Financial records: payment records held by Stripe are kept as long as tax and accounting law requires, independently of us.
Security
Traffic is encrypted in transit. Passwords are hashed, never stored in readable form. Every business's records are separated at the database level so one account cannot read another's, and receipt photos live in private storage reachable only through short-lived signed links. No system is perfect; if we ever discover a breach affecting your data, we will tell you promptly and plainly.
Your rights
- See it: everything we hold about your business is visible inside the app.
- Take it: CSV export is built in, always free, and works even on a read-only account. There is never a fee to get your own data out.
- Correct it: edit any record directly.
- Delete it: delete individual records, or ask us to delete the whole account.
Depending on where you live you may have additional rights — to object to processing, to restrict it, or to complain to a data-protection authority. Write to us and we will honour them. We do not sell personal information, and never have, so there is nothing to opt out of.
Children
Studio Kata is for businesses and is not directed at children. If you train minors, the client records you keep about them are your responsibility under the rules that apply to you, and you should have a parent's or guardian's consent before recording their details.
Where data is held
Our infrastructure is hosted in the United States. If you use Studio Kata from elsewhere, your data is transferred there.
Changes
If we change this policy materially, we will email account holders and update the date at the top of this page.
Contact
Questions about privacy, or a request about your data: [email protected]. A person reads it, usually within a business day.