Privacy Policy

Last updated: 6 October 2026

1. Data Controller & Legal Entity

Mat Log is a training companion and technique study platform designed for Brazilian Jiu-Jitsu (BJJ), submission grappling, and martial arts athletes. Mat Log is owned and operated by AVALANCHE FINANCIAL INC. ("we", "us", "our"), a corporation organized in the United States. Mat Log and Flow Roll are developed and provided as first-party products under AVALANCHE FINANCIAL INC.

This Privacy Policy governs your use of the Mat Log mobile application (iOS and Android) and the Mat Log website located at https://matlog.flow-roll.com/ (collectively, the "Service").

Under the General Data Protection Regulation (GDPR), UK GDPR, and applicable global privacy legislation, AVALANCHE FINANCIAL INC. acts as the Data Controller for all athlete personal data, session records, journal reflections, game plan nodes, and reference library notes processed within Mat Log. Our designated privacy contact is matlog@flow-roll.com.

2. Information We Collect

We adhere to strict data minimization principles. We collect only information necessary to deliver, authenticate, secure, and improve our athletic logging and study platform.

A. Account & Authentication Information

To use Mat Log, you create a personal athlete account. When you register with an email and password or authenticate using Google Sign-In or Sign in with Apple, we collect:

• Email address: Used for account identity, secure authentication, password resets, and critical service communications.
• Internal account identifier: A unique user UID generated by our authentication system.
• Authentication provider ID: A record indicating whether you authenticate via Apple, Google, or email/password.
• Display name: An optional athlete name or alias chosen by you.
• Birth year: Declared by you, and used only to decide how advertising may be shown. We ask for the year alone, never a full date of birth. See Advertising.
• Subscription status: Whether an AI Pro subscription is active, and when it expires. This is derived from your App Store or Google Play purchase and stored against your account so paid features can be unlocked. It is a status flag and an expiry date, not a payment record. See Subprocessors for the service that validates it.

Note: Authentication with Apple or Google is validated directly through native platform sheets. Mat Log never receives, handles, or stores your Google or Apple account passwords. Mat Log does not provide guest or anonymous accounts.

B. Profile & Athletic Information

You may optionally personalize your athlete profile with:

• Belt rank, promotion dates, and stripe progression count.
• Affiliated training academy or gym name.
• Current training goals, focus targets, and weight division or training preferences.
• Profile avatar photo (uploaded and stored in secure cloud object storage).

C. Training Content & Athletic Data You Create

The core of Mat Log consists of user-generated athletic and study content:

• Training Sessions: Dates, start/end timestamps, session duration, class type (gi, no-gi, wrestling, open mat, competition sparring), round count, techniques drilled, submissions, named training partners, and session reflection notes.
• Private Training Journal: Free-text journal entries, sparring reflections, mindset debriefs, and recovery notes.
• Game Plans & Position Maps: Situations, positions, tactical decision branches, cues, transitions, and escape routes.
• Technique Reference Library: Imported technique URLs (e.g., YouTube, Instagram, web clips), video titles, creator metadata, custom user tags, personal study notes, and cached thumbnail preview images stored in secure cloud storage. We do not host or store raw copyrighted video files.
• Focus Periods & Training Targets: Focus tags, target round counts, milestone deadlines, and training frequencies.

D. Share Extension & Clipboard Imports

When you use your device's native Share Sheet (iOS / Android) or paste a technique link into Mat Log:

• Mat Log receives only the shared URL and associated page title provided by the operating system share handler.
• Clipboard access is triggered only upon explicit user interaction (e.g., tapping "Paste" or answering an on-screen prompt to save a copied technique URL). Mat Log never reads, logs, or monitors your device clipboard in the background.

E. Technical, Device & Diagnostic Data

To maintain security, diagnose errors, and deliver real-time cloud synchronization:

• Device model, operating system version, and installed app version.
• IP address at the time of network requests, request timestamps, and API response metrics.
• Error logs and crash diagnostics.
• Usage data: Which screens you open and which features you use, with an identifier for this installation of the app, sent to Google Analytics while you are signed in and Share usage data is on. See Product Analytics.
• Push notification device tokens (APNs for iOS / FCM for Android), used exclusively to deliver transactional notifications if you enable push permissions.
• Local device preferences (such as App Lock toggle state, theme preferences, and local cache) stored securely on your device via SharedPreferences and UserDefaults.

F. Feedback You Send & the Rating Question

When you send feedback from the app (Profile → Send feedback, the Tell us button on an error message, or after answering “Not really” to “Enjoying Mat Log?”), we store your message, the optional topic you choose, the app version and the platform with your account. The message is then emailed to the Mat Log team at matlog@flow-roll.com with your account identifier and your account email address, so that we can reply to you. It is also posted to the Mat Log team's Slack workspace, where the team reads feedback, with your account identifier but not your email address.

Now and then, after you have used the app for a while, Mat Log asks “Enjoying Mat Log?”. The app records which step of that question you reached (shown, yes, not really, dismissed, or feedback sent) together with the app version and platform, so we can count how it is answered. This record stays with your account in our database, is not shared with anyone, and is not used for advertising. A rating you leave on the App Store or Google Play goes to Apple or Google, not to us.

G. What We Explicitly Do NOT Collect

• No raw video footage: We do not record, upload, host, or store video files of your sparring or rolling sessions.
• No payment card details: Payment is taken by the Apple App Store or Google Play Store, and purchase receipts are validated by RevenueCat on our behalf (see Subprocessors). We never handle, see, or store your credit card or banking details, and no payment instrument ever reaches Mat Log.
• No device contacts or address books: We never access your phone contacts. Training partner names in your logs are entered manually by you.
• No precise GPS or location tracking: We do not track or store your real-time geographic location.
• No health sensor / wearable background scraping: We do not pull background biometric sensor data from third-party health apps without explicit integration.
• No biometric data: Biometric authentication (Face ID, Touch ID, or device passcode) used for optional App Lock is handled entirely on-device by your operating system's Secure Enclave. Mat Log never accesses, collects, transmits, or stores your biometric templates or device passcode.
• No advertising identifiers: We do not collect the Apple IDFA or the Google Advertising ID (GAID). Mat Log shows no App Tracking Transparency prompt and enables no cross-app tracking, and our Android builds remove the advertising-ID permission. Any advertising we show is non-personalized. See Advertising.

3. How We Use Data & Legal Bases

Under GDPR Art. 6, UK GDPR, and international data protection laws, we must have a valid legal basis for processing your personal data. The table below outlines how we use your information and our corresponding legal basis:

4. No Sale or Sharing of Personal Data

We do not sell your personal data. We have never sold your personal data. We do not share your personal data with third parties for cross-context behavioral advertising, targeted marketing, or commercial profiling.

Under the California Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act (CPRA), Avalanche Financial Inc. does not "sell" or "share" consumer personal information as those terms are defined by California law.

We request non-personalized advertisements. We do not attach your account identifier, email address, training records, journal entries, or saved technique links to advertising requests. Google's advertising SDK processes device and network information to deliver and measure ads and prevent fraud. See Advertising for details and for the privacy choices available in the app.

5. Gym Linking & Private Data Isolation Guarantee

Mat Log is architected solo-first. It functions completely independently without requiring any gym affiliation. If your academy uses Flow Roll, you may optionally choose to link your account to your gym.

Our Absolute Data Isolation Guarantee:

• Verified Badges Only: Linking your gym only shares your account identifier to verify attendance check-ins and official belt promotions, marking those records gym-verified.
• Read-Only Gym Data: Linking allows Mat Log to display read-only academy schedules and announcements.
• Gym Events & Sign-ups: Mat Log shows the events your gym publishes, such as competitions and seminars. When you sign up for one or pull out, the app sends that request to your linked gym through Flow Roll. Each event shows the names of the members signed up, as your gym records them, which other linked members of your gym can see.
• Zero Access to Private Training Logs: Your gym, its head coach, instructors, staff, and other members CANNOT view, read, search, or export your private journal entries, session reflection notes, game plan trees, reference library clips, study notes, or focus targets.
• Unlink Anytime: You can disconnect your gym link at any time in the app. Unlinking does not delete your personal training log, journal, or reference library.

6. AI Features & Google Cloud Vertex AI

Mat Log offers optional AI-assisted features (suggesting a title and tags for a saved clip from its title and caption, and suggesting responses for a situation in your game plan) for users with an active AI Pro subscription. These features send text only; no video is sent to the AI.

Data Protection & Zero Model Training Commitments:

• On-Demand Processing: AI features run strictly on-demand when you explicitly tap an AI action button in the app.
• Enterprise Google Cloud Infrastructure: Prompts are transmitted over encrypted connections to Google Cloud Vertex AI (Gemini models) deployed in secure enterprise data centers.
• No Model Training: Under Google Cloud's enterprise terms and our data processing agreements, your prompts, training notes, and generated AI outputs are NEVER used to train, retrain, fine-tune, or improve Google's foundation AI models or any third-party models.
• Educational Disclaimer: AI-generated suggestions are automated informational tools designed for personal study. They do not constitute certified martial arts coaching, medical diagnosis, or physical therapy advice.

7. Technique Video Links & Share Extensions

Mat Log's Reference Library enables you to bookmark and catalog technique links from platforms such as Instagram and YouTube:

• No Video Hosting: Mat Log stores external web URLs, technique titles, creator names, user tags, and cached thumbnail preview images. Mat Log does not download, re-encode, or host full-length copyrighted video files.
• Third-Party Platform Terms: When you tap to view an external video link, your device opens the respective third-party platform or browser, governed by that platform's own privacy policy and terms of service.

8. On-Device Security & Biometrics

Mat Log provides an optional on-device App Lock feature to protect your training journal when passing your device to others:

• App Lock utilizes your device's native biometric authentication framework (Apple LocalAuthentication / Face ID / Touch ID on iOS; BiometricPrompt / Fingerprint / Passcode on Android).
• Zero Biometric Transmission: Biometric matching occurs entirely within your device's secure hardware (such as Apple's Secure Enclave). Mat Log never receives, accesses, transmits, or stores biometric identifiers or device passcodes.

9. Product Analytics & Crash Diagnostics

Mat Log uses Google Analytics for Firebase to learn which screens and features get used, so we know what to improve. While you are signed in, Google Analytics receives the screens you open (which page, never what is on it); named actions such as “a training session was logged” or “a clip was saved”, with fixed details like which app a clip came from; your device model, operating system and app version; and an identifier Google Analytics assigns to this installation of the app. It does not receive your Mat Log account identifier, your email address, or anything you write, tag or save. Google derives an approximate location (country, region and city) from the IP address a report arrives from. Mat Log does not collect your device's advertising identifier or Apple's identifier for vendor, and it tells Google Analytics not to use this data for advertising. Nothing is collected before you sign in. You can turn it off at any time in Profile → Share usage data; turning it off also clears what the app holds on your device and has not yet sent.

Mat Log also counts how the occasional “Enjoying Mat Log?” question is answered, kept with your account as described in Information We Collect. For crash and error diagnostics it uses Sentry. When the app crashes, or when a save is rejected by the server or a background step fails, Sentry receives a report containing the error and its stack trace, your device model, operating system version, app version, and your Mat Log account identifier. Sentry does not receive your email address, screenshots, a copy of the screen, or any training session, journal entry, situation, tag, or saved technique link. Mat Log does not attach your IP address to a report; as with any network request, Sentry’s servers see the address a report arrives from, and we have configured the project not to retain it. A report that only means your device had no network connection is discarded before it is sent. Our service providers process operational information needed to run the app and its backend services. When advertising is enabled, Google's advertising SDK also processes the device and network information described in Advertising below. We do not attach your training records, journal entries, or saved technique links to advertising requests.

10. Advertising

Mat Log may show a single banner advertisement on the Home screen, supplied by Google AdMob. Advertising is off by default. A remote configuration flag turns it on.

• Non-personalized only: We request only non-personalized ads, build no advertising profile, enable no cross-app tracking, and request neither the Apple IDFA nor the Google Advertising ID. We cap ad content at a PG rating.
• No app data reaches the advertising network: We never attach your account identifier, email address, training sessions, journal entries, tags, situations, belt rank, gym affiliation, attendance history, or saved technique links to an ad request, and we never disclose them to an advertising provider.
• Consent and privacy choices: Google's User Messaging Platform manages advertising consent where required and stores your choices. In supported US states, it also provides choices about the sale or sharing of personal information. When available, you can review or change these settings through Ad privacy choices in Profile. Choosing not to consent or opting out does not prevent you from using Mat Log. A privacy choice does not itself grant an ad-free subscription. We show a non-personalized ad only when Google's platform permits the request and the app's age and ad-free eligibility checks allow it.
• Birth year and age treatment: We ask for your birth year, and only the year, to decide how ads may be shown. We use the youngest age that birth year could imply during the current calendar year, so someone may receive younger-age treatment until the following year. Athletes whose calculated age is 18 or over may see ordinary non-personalized ads. Those whose calculated age is 13 to 17 may see ads under Google's under-age-of-consent treatment, which narrows what Google may serve them. Anyone whose calculated age is under 13 sees no advertising, and neither does anyone who has not answered.
• Ad-free access: AI Pro subscribers see no advertising. Neither do athletes whose linked gym holds a qualifying FlowRoll subscription. Neither exemption discloses anything extra to an advertising network.
• What the advertising SDK still collects: Google AdMob collects device and network information, such as device model, operating system version, coarse region, and IP address, to deliver an ad, cap how often it appears, and detect fraud. Google performs that processing under its own advertising disclosures. Mat Log does not control it.

11. Subprocessors & Service Providers

We disclose personal data only to vetted service providers (subprocessors) who process data on our behalf under strict data processing agreements and confidentiality obligations:

We may also disclose information if required by law, subpoena, or court order, or when we believe in good faith that disclosure is necessary to protect the rights, property, or safety of Avalanche Financial Inc., our athletes, or the public.

12. Data Retention & Account Deletion

We retain your personal data for as long as your account remains active. You maintain complete control over your data lifecycle:

• Direct In-App Deletion: You can delete your account at any time directly within the app by navigating to Profile → Account → Delete account.
• Email Deletion Request: You can also request complete account deletion by emailing matlog@flow-roll.com from your registered account email.
• Age-Restricted Accounts: If an account is restricted because its age declaration indicates that the account holder is under 13, access is blocked and the account is scheduled for deletion from active production systems 30 days after restriction. Contact support before that deadline if the age information was entered incorrectly.
• 30-Day Active Purge: When an account is deleted, your account profile, Firestore training documents, journal entries, game plans, and stored thumbnail images are permanently erased from active production databases within 30 days.
• Feedback: The copy of your feedback stored with your account, and the record of how you answered the rating question, are erased with your account. The email copy in the Mat Log team's inbox and the copy in its Slack workspace are kept so we can follow up and keep a support history, and are deleted on request.
• Usage Data: Google Analytics data is not linked to your account, so deleting your account cannot find or erase it. Google deletes it at the end of the retention period set for Mat Log in Google Analytics. To stop it being collected, switch off Profile → Share usage data.
• 90-Day Rolling Backups: Residual encrypted backup snapshots are overwritten on a rolling lifecycle within 90 days.
• Statutory Retention: We retain only non-identifying accounting and purchase records as strictly mandated by tax and statutory legal obligations.

Important Notice on App Store Subscriptions: In compliance with Apple and Google developer policies, deleting your Mat Log account deletes all personal data and cloud records but does not automatically cancel recurring subscriptions billed through Apple ID or Google Play. To prevent future charges, you must cancel your subscription directly in your device's Apple ID Subscriptions or Google Play Subscriptions settings.

13. Your Privacy Rights (GDPR, CCPA & Global)

Regardless of your jurisdiction, Mat Log provides comprehensive data privacy rights:

• Right to Know & Access: You have the right to request a copy of all personal information we hold about you.
• Right to Rectification: You have the right to correct inaccurate or incomplete personal information directly in the app or via support.
• Right to Erasure ("Right to be Forgotten"): You have the right to request permanent deletion of your account and training records.
• Right to Data Portability: You have the right to export your training sessions, journals, and game plans in a structured, machine-readable format (JSON / CSV).
• Right to Restrict or Object to Processing: You have the right to object to or restrict certain processing activities where our legal basis is legitimate interest. Product analytics can be switched off directly in Profile → Share usage data.
• Right to Withdraw Consent: Where processing is based on consent (such as AI features, gym linking, or push notifications), you may withdraw consent at any time without penalty.
• Right to Non-Discrimination: We will never deny services, charge different prices, or provide a lower quality of service for exercising your privacy rights.

How to Exercise Your Rights: Submit your request by emailing matlog@flow-roll.com. We verify requests against your registered account email and respond within 30 days (or within statutory timelines). If you reside in the EEA or UK, you also have the right to lodge a complaint with your local supervisory authority (such as the UK Information Commissioner's Office - ICO).

14. Data Security & Breach Response

We implement rigorous technical and organizational security measures:

• Encryption in Transit: All network traffic between the mobile application, web clients, and our backend servers is encrypted using modern Transport Layer Security (TLS 1.3 / TLS 1.2).
• Encryption at Rest: All database records, user authentication data, and cloud file storage are encrypted at rest using AES-256 encryption.
• Database Security Rules: Granular, server-enforced Cloud Firestore security rules ensure that each user can only read, query, and write to their own private records. Cross-account data leaks are strictly prevented at the database protocol level.
• Breach Notification: In the event of a confirmed security incident affecting your personal data, we will notify affected athletes and relevant regulatory authorities without undue delay, in full compliance with applicable breach notification laws.

15. Children's Privacy

Mat Log is not directed at children under the age of 13 (or under 16 where applicable under EEA/UK law). We do not knowingly collect personal data from children under these age thresholds. If the app's age declaration indicates that an account holder is under 13, we restrict access and schedule the account for deletion from active production systems 30 days after restriction. The account holder may contact support before that deadline to correct mistaken age information. Residual backups and records follow the retention periods in Section 12. If you believe a minor has created an account improperly, please contact us at matlog@flow-roll.com.

Advertising is age-gated separately, and more strictly than account access. No athlete under 13 sees an advertisement, and neither does any athlete who has not declared a birth year. Athletes aged 13 to 17 see advertising only under Google's under-age-of-consent treatment. We do not infer age from belt rank, gym membership, or sign-in method. See Advertising.

16. Cookies, Policy Changes & Contact

Cookies & Local Storage

The Mat Log website does not use third-party advertising cookies or cross-site tracking technologies. We use only essential browser local storage (localStorage) to remember your chosen visual theme (light or dark mode).

Changes to This Policy

We may update this Privacy Policy periodically to reflect app updates, new feature releases, or evolving regulatory requirements. The "Last updated" date at the top of this page indicates the effective version. For material changes, we will provide prominent notice within the mobile application or via email prior to changes taking effect.

Contact Information

If you have any questions, concerns, or requests regarding this Privacy Policy or our data protection practices, please contact us:

Entity: AVALANCHE FINANCIAL INC.
Email: matlog@flow-roll.com
Web Support: https://matlog.flow-roll.com/support
Website: https://matlog.flow-roll.com/