Reel Dojo Privacy Policy
Effective date: October 21, 2026. Version 2026-10-21-beta-9.
Who operates Reel Dojo
Momentum Dev LLC operates Reel Dojo and its website at reeldojo.app. Contact [email protected] with privacy, access, correction or deletion requests. This policy covers the invited adult beta and the public information website. The current Play test is restricted to approved testers. Play installation access is separate from app membership and the explicitly approved messaging pilot; installing the app does not grant wider account or chat access.
Account and training data
We process your account email and authentication records, display name, membership access, and the training information you choose to save: video links, recordings, notes, folders, disciplines and progress. Recordings may include the image or voice of other people. Obtain their permission before recording or sharing them.
Profile photos
You may choose a profile photo from a file you select. The app creates a small square thumbnail; it uploads that thumbnail to Supabase, not the original file. The service validates it and removes embedded metadata. Your current photo can appear to linked partners, members of your active gym, participants in a pending connection request or QR pairing, and people in a group you have joined, subject to current access and blocking rules. It can appear in messaging, partner lists and other people pickers. Use a picture you have permission to share. Change or remove it in Account. Active copies are replaced or removed, but earlier versions can remain in restricted backups under the retention limits below. Someone who already viewed a photo may have kept a copy.
Saved personal and gym logins
On supported builds you can add a separately approved gym account and switch between it and a personal account. Each authenticates independently and keeps its own library, messages, permissions and analytics choice. Saved account credentials stay in device-only encrypted storage on Android or iOS; browser credentials remain in temporary page memory. Removing a saved login or signing out removes those saved credentials from this device, subject to reported cleanup failures. It does not delete cloud data or revoke other devices. Everyone using the same shared gym login acts as that identity and can access its shared library and messages; it is not a separate private workspace for each person. A gym login does not by itself grant membership or a paid subscription.
Device registration and access limits
Supported builds send an app-generated random installation identifier, a device label, registration and last-use times and authenticated session identifiers to Supabase to operate account device limits and prevent account-sharing abuse. A random registration secret stays in protected device storage; the server stores its hash. This is functional and security data, separate from optional usage analytics. We do not use IMEI, SIM identifiers, advertising IDs or a hardware fingerprint for this feature. An installation can be registered to each account you authenticate. The installation identifier survives sign-out so an ordinary sign-in does not use another slot; removing or reinstalling the app or explicitly registering a replacement can create a new identifier. Account can show registered devices and remove their cloud access where enforcement is active. Device metadata, including removed registrations used for abuse checks, is retained with the account until account deletion, subject to restricted backup and necessary security retention. Removing access does not erase local copies or attest which physical person holds an account.
Terms acceptance records
The app keeps a dated, versioned acceptance record on your device, including your age confirmation, agreement to the terms and acknowledgement of their training-risk and liability provisions. The record is associated with the signed-in account identifier when available; signed-out local use has a separate record. A new account or changed terms can require renewed acceptance. These local records check acceptance and remain until replaced or app storage is cleared. When you first enable sign-in-based chat history, Supabase also records the policy version, the acceptance time asserted by the app and the server enrollment time; this is not a general server log of every terms acceptance.
Storage and sharing
Your library is stored on your device. When enabled and selected, sync sends account-linked metadata to Supabase and new uploaded recordings to Bunny Stream for processing and private playback. Local video thumbnails stay on the device. Existing recordings do not automatically become backed up when you sign in. Keep your originals and do not rely on an incomplete upload as a backup. Private shares, partner links, calendars, gyms, class schedules and announcements disclose selected information to their permitted participants.
Device access and communications
Camera and microphone access are used when you scan or record. Imported media comes from the files you select. Notification permission controls notification display. You can deny or withdraw optional permissions in device settings, although the corresponding feature may then be unavailable. The beta does not import your address book or request device location. Firebase may process installation identifiers, device push tokens, app/device configuration and notification delivery information independently of notification-display permission. Message alerts can include the sender display name and group name, including on the lock screen according to your phone settings. On supported Android builds, alerts can also show a short message excerpt. Turn off Show message previews in notification settings to hide message text on that phone; silencing a chat turns off its alerts. For delivery, the service briefly processes an excerpt (up to 160 characters), encrypts it at rest with a service-managed key, and removes it after its five-minute expiry during periodic cleanup. The worker encrypts the excerpt for the receiving installation before sending it through Firebase; Firebase does not receive readable private message text. The receiving phone decrypts it locally for notification display. Sender/group names and delivery identifiers still travel as notification metadata. Excerpts are unavailable on older builds or after expiry or key failure; these show a generic alert. Attachments, message/history keys and recovery secrets are not included in alerts. Hiding previews clears existing chat alerts on that phone. Notifications already displayed on another device cannot be recalled by deleting a message or account. You can silence a chat; coach and gym announcement preferences are separate. Resend processes account emails and Cloudflare routes support emails to our monitored inbox. External communications opened by older builds are governed by the external service policies.
Private messages and metadata
When the private messenger is enabled for your account, message text and attachments are encrypted on participant devices before Supabase stores or relays them. Authorized devices use message keys to read that content. With sign-in-based chat history, Supabase also stores an encrypted archive of available message keys and a protected, service-managed recovery key for your account. Signing in to the same approved account on a new phone can restore that saved history without a separate recovery code. Momentum Dev LLC and authorized service administrators can technically recover the keys and decrypt private messages; this is not an encryption model that prevents service access. Protect your account email and sign-in access. This does not encrypt all app data end to end. Supabase also processes account and participant identifiers, display names, group titles, device public keys, encrypted key deliveries, timestamps, sizes, delivery status and access controls to operate messaging. Filtering your linked-partner list, readable message drafts and readable message search indexes stay on your device. Where online GIF search is configured, opening the GIF tab and searching connects directly to KLIPY, which receives search terms and request information such as IP address and browser/device details. Selecting Send also reports the selected GIF and its search term to KLIPY; we do not include your account email, member identifier, chat name, recipients or other message text in those requests. The GIF link and its title are encrypted inside the message. The image itself loads directly from KLIPY on participant devices, outside chat encryption, and is not copied into our attachment storage. Viewing a GIF therefore discloses a media request to KLIPY, needs internet access and may stop working if the provider removes it. KLIPY operates under its own privacy policy and terms. Saved GIF attachments retain the encrypted attachment storage described above; your keyboard and selected attachment providers have their own practices.
Contact and text invitations
When this feature is enabled, you can share an invite link through a messaging app you choose, or select one contact through the phone contact picker or enter a number to open a text draft. Reel Dojo does not request broad address-book access, upload contact names or phone numbers, send the message automatically or track delivery. The app you choose and, for SMS, your carrier process messages under their own practices and charges. The invite contains a single-use link that can be used by anyone holding it, so send it only to the intended person and avoid forwarding it. Supabase stores member identifiers, a hash of the invite code, the sender’s connection choice, status and timestamps. Invites expire after 14 days and can be cancelled while pending; records can remain for account history, export, deletion review and necessary security handling.
Invitation links and installation
The public invite page does not look up member information or connect accounts merely because it is opened. The invite code is carried in the link fragment. If you choose its Google Play install link, the code is included in the install referrer and is shared with Google Play. The Android app can retain the pending code on your device to let you review it after installation; a failed handoff can require reopening the original link or pasting its code. The referrer does not convey permission to connect accounts. Automatic partner linking requires an explicit in-app choice associated with your verified signed-in account and completion of the required terms and library setup. An app-only invite does not link accounts. Invites do not create accounts or grant membership; owner approval remains required during this test.
Message reports and recovery
Reporting a private message requires you to preview and explicitly submit selected readable content. Authorized moderators can review that disclosed content, any selected attachment and the identifying context needed to handle the report. A report does not disclose other chat history, room keys or recovery secrets. After accepting the revised privacy terms, available chat keys sync automatically using service-managed recovery, without a separate recovery code. A new phone restores the last successfully synced keys; offline or unfinished saves may leave recent messages unavailable on another phone. History saves and restores in the background, and interrupted updates retry automatically without a manual sync step. Existing manual encrypted archives are preserved and are not automatically decrypted using the new service key. This feature cannot recreate older keys that were never saved and no longer exist. Reporting remains the normal moderation workflow, but it is not a technical limit on authorized service access under the service-managed model.
Message retention and deletion
Cloud chat records are retained to provide the conversation, subject to its removal controls, account deletion and necessary moderation and security handling. A configured disappearing-message period stops ordinary access to message content when it expires; encrypted cloud records and attachments may remain until reviewed cleanup and backup retention complete. Your account deletion request includes your messages and related active messaging records; required cleanup is checked before completion is confirmed. Account deletion removes your active managed key, your managed and legacy history archives and required messaging records. Managed history stores encrypted keys and device identifiers in separate sender-specific pieces. Account deletion removes the pieces owned by or originating from your account across managed cloud histories, while preserving other participants’ unrelated history. The app excludes deleted accounts when saving again; an outdated save cannot restore the removed cloud pieces. Deletion completion requires the managed history cleanup checks as well as the existing backup and provider checks. Saved keys can decrypt independent archived copies of removed or expired messages. Removing access or a cloud copy, or revoking a device, cannot remotely erase keys, screenshots, exports, offline copies or independent recovery files already held by another participant. Report disclosures and necessary protected security or deletion records follow the review and retention limits below. Backups and pending provider or storage cleanup may delay completion; we do not promise instant physical erasure of every copy.
Website and service providers
Cloudflare Pages hosts our information website and sample-content app demonstration. Cloudflare may process website requests, including IP addresses, browser information, request paths and security information, to deliver and protect the site. Following an email link uses your email service. Supabase provides account authentication, database and selected sync/storage services; Bunny Stream processes uploaded videos and private playback; Firebase, Resend and Cloudflare provide the communications described above. Providers may process information in the countries where they operate.
External video services
Opening or embedding YouTube, Instagram, Facebook, TikTok or another saved link, or loading a supported public video thumbnail when its message preview becomes visible, connects to that provider, which may receive device and network information under its own policy. Reel Dojo does not control those services or guarantee that every link will play inside the app.
Optional product analytics
Reel Dojo offers optional product analytics to signed-in users. Collection stays off on each device until you explicitly opt in; declining does not prevent normal app use. If you opt in where that feature is offered, Reel Dojo sends account and installation identifiers, app and device information, version and locale, fixed screen and feature-action categories, operational timing and error categories, your optional self-reported belt and enabled discipline categories to Supabase. Custom discipline names are grouped as Other. Belt rank is independent of the color theme, and enabled categories do not establish that you trained in them. Authorized operators view aggregate reports through a private authenticated dashboard. These event payloads exclude technique names, notes, video links or content, email, display name, IP address and authentication or playback tokens. Provider requests may separately create network logs.
Analytics controls and retention
You can use the app without optional analytics. When analytics is available, you can change your choice in Settings. Raw analytics events are retained for up to 90 days; aggregate daily totals may remain afterward. Withdrawal stops collection on this device, clears its unsent events and requests deletion of account-linked raw analytics. If server cleanup cannot finish while offline, the app displays an error and you can retry online. A choice on one device does not automatically opt in another account or device. New data categories require an updated disclosure and renewed consent.
Diagnostics and service logs
Reel Dojo offers a voluntary Report a problem action. It sends a fixed problem category, platform, app version and opaque diagnostic reference, without notes, names, URLs or media. Problem reports are kept for up to 90 days. Masked test replay and Sentry reporting remain disabled. Where the Android private crash marker is included, opted-in analytics can report a fixed fatal-Java-crash category on a later launch, without a message, stack, screen recording or private content. This does not measure every crash or operating-system freeze. Providers may independently log IP addresses, timestamps, device information and authentication, delivery, processing or security outcomes. Information you send to support is processed to handle your request. Service logs and support records are distinct from optional product analytics.
Support, moderation and security
Support requests and reports include the information you submit and, where applicable, basic app/device diagnostic context. Authorized operators use them to resolve problems, investigate abuse and secure the service. Do not submit passwords, sign-in codes or unnecessary private media. We use the described service providers to operate the app and may disclose information when required by law or necessary to investigate abuse and protect people or the service. We do not sell beta data or use it for advertising or cross-context advertising.
Retention and deletion
Account and cloud library data are retained to provide the service until you remove them or request account deletion, subject to stated feature limits and necessary legal/security retention. Support and moderation records may be retained while needed to resolve requests or investigate abuse. Deletion requests require identity verification. We explain any data that must be retained and confirm the request status; logging out or uninstalling does not delete cloud data. Before confirming completion, we remove the required account data, revoke shared access, check affected backups, and verify that our video provider accepted deletion or the video was already absent and its API no longer returns it. Unconfirmed cleanup inside the provider remains tracked; API absence does not prove every physical copy was erased. See the account deletion instructions.
Deletion response and recovery copies
Our response targets are to acknowledge deletion requests within 7 days of receipt and complete them within 30 days after identity verification. If necessary cleanup or a legitimate retention obligation delays completion, we explain the reason, the remaining steps and an updated expected date. Supabase Pro retains restricted daily database backups for up to 7 days; they can contain older account data after active data is removed. Additional protected recovery copies we control can remain until affected data is removed or those copies are verified unaffected. A new daily backup does not itself remove older backups. We confirm completion only after affected managed backups are no longer available for restore and affected recovery copies we control are removed or verified unaffected. Replacement copies must exclude the deleted account and its active data. Any restore must stay inaccessible until later deletions and access revocations have been reconciled. We explain necessary retained categories and reasons to the requester.
Deletion requests and completion notices
Request deletion by emailing [email protected]. The monitored inbox is handled by an operator who verifies identity and reviews the required cleanup. Automatic account-deletion recovery, backup checks and completion emails are not active in the first Play test. We provide request status and confirm completion only after the required checks finish; unfinished cleanup is not reported as complete. Minimal protected deletion and upload receipts may remain for security, restore suppression and provider follow-up. They are not publicly accessible.
Deletion records and restore protection
A separate protected Cloudflare deletion record can retain account and request identifiers and timestamps for restore suppression and documented security or provider follow-up. These are account-linked technical records, not anonymous data. The deletion record excludes email addresses, names, training notes, passwords and video content. We explain necessary retained categories and reasons when responding to a request.
Your controls and security
You can choose sync settings, manage sharing, block or report inappropriate messages, silence chats, deny optional permissions and contact us about your data. Private chat content uses the device encryption described above. Sign-in-based chat recovery permits authorized service access. Library sync, uploaded training videos, account and group metadata, and readable content you explicitly report have their separately described access controls. This beta messaging integration has not received an independent security audit. We also use encrypted connections and account-based access controls. No internet service can guarantee perfect security.
Beta eligibility and updates
The beta is for invited adults aged 18 or older and is not intended for children. Contact [email protected] to request access to or correction of your account information or to ask about retention of a particular category. We verify ownership before releasing account information or making destructive changes. We update this policy when relevant features or data practices change and display the current version in the app and on the website. Materially expanded consent requires a new disclosure and renewed acceptance.
Momentum Dev LLC