Privacy Policy

Aikido Network

Effective date: 2026-09-16 Last updated: 2026-09-16

1. Who we are

Aikido Network ("Aikido Network," "we," "us") is a community platform for aikido practitioners, dojos, and organizations. The service is operated by MARTIAL ART NETWORK LLC, a single-member limited liability company organized in the State of Washington, USA.

Postal address: 4129 M L King Jr Way S., Seattle, WA 98108 Privacy contact: privacy@aikido.network Data controller: MARTIAL ART NETWORK LLC is the controller of the personal data described in this policy for the purposes of the EU/UK General Data Protection Regulation (GDPR), and a business for the purposes of the California Consumer Privacy Act as amended (CCPA/CPRA).

This policy covers aikido.network and all subdomains, our email communications, and any related services we operate. It does not cover third-party sites we link to, or the independent practices of dojos that use our platform.

Dojos and organizations: where a dojo uses Aikido Network to manage its own roster, events, or member records, that dojo is an independent controller of the data it enters, and we act as its processor for that data. The dojo's own privacy notice governs how it uses member information. We remain the controller for account, billing, security, and platform-analytics data.

2. Summary

3. Information we collect

3.1 Information you give us

Account and profile information. Email address, display name, password (stored only as a salted hash — we never see it), and anything you choose to add to your profile: real name, dojo affiliation, rank/grade and promotion history, years of practice, teacher or lineage, biography, profile photo, location (city/region), and links to your own sites or social accounts.

Content you create. Posts, comments, replies, messages, dojo pages, event and seminar listings, photos and other uploads, reactions, and follows. Photos may carry embedded metadata (EXIF), including camera details and, if you have not disabled it, GPS coordinates.

Communications. Support requests, bug reports, abuse and moderation reports, and any correspondence you send us, including the contents and any attachments.

Payment information. If you buy a subscription, pay a seminar fee, or pay dojo dues through the platform, payment is processed by Stripe. Stripe collects your card or bank details directly; we never receive or store full payment card numbers. We receive and store a Stripe customer identifier, the last four digits and brand of the card, billing name, billing address and country, currency, transaction amounts and dates, subscription status, and refund or dispute status.

3.2 Information we collect automatically

Device and connection data. IP address, browser and operating system, device type, language and time-zone settings, and referring URL.

Usage data. Pages viewed, features used, links clicked, search terms entered on the platform, session timestamps and duration, and — because the platform is built on Phoenix LiveView — the interaction events sent over the WebSocket connection that keep the page in sync.

We do not profile you. We build no interest profiles, derive no preferences from your behaviour, and rank nothing by inferred interest. You see what you have subscribed to — the dojos you have joined, the people and dojos you follow, the events you signed up for — in the order it happened. Nothing is chosen for you on the basis of what we think you like, and we have no plans to change that. If it ever did change, this policy would say so before it took effect.

Server and security logs. Requests, response codes, error traces, rate-limit and abuse-prevention signals, and login attempts (successful and failed). Cloudflare processes request data at the network edge to filter malicious traffic.

Cookies and similar technologies. See §6.

3.3 Information from other sources

If a dojo administrator adds you to a roster, we receive the information that administrator supplies about you. If you do not already have an account, we will contact you within one month of receiving that information to tell you what we hold, who supplied it, why, and how to object, correct it, or have it deleted.

Is providing this information required? An email address and password are required to create an account — without them we cannot provide the service, and there is no obligation to give them except that you cannot register otherwise. Payment details are required only if you buy something. Everything else — real name, photo, rank, dojo, biography, location — is entirely optional, and leaving it out costs you nothing but the corresponding feature.

3.4 What we do not want

Please do not post or send us sensitive information you do not want on a community platform — in particular, health, injury, or medical information. Aikido involves physical training, and injuries come up in conversation. We do not ask for and do not want medical records, diagnoses, treatment details, or insurance information. If a dojo needs to collect medical waivers or injury reports from its members, it should do so through a system built for that purpose, not through free-text fields here. See §11 for the Washington-specific consequences of health data.

CCPA sensitive personal information. We collect account log-in credentials, which are "sensitive personal information" under California law. We use them only to authenticate you and secure your account — a purpose for which the right to limit use does not apply — and we do not use or disclose them to infer characteristics about you.

4. Why we use your information, and our legal basis

For users in the EEA, UK, and Switzerland, GDPR requires us to have a legal basis for each processing purpose:

Where we rely on legitimate interests, we have weighed those interests against your rights and concluded they are not overridden. You can object to that processing — see §9. You can ask us for a summary of any of these balancing assessments.

We do not use your personal data to train machine-learning models, and we do not sell or disclose it to anyone who does. [Delete or amend if this stops being true — this is the kind of statement regulators and users hold you to.]

5. Automated decision-making

We do not use automated decision-making technology to make significant decisions about you as California law defines that term — decisions about financial or lending services, housing, education enrollment or opportunity, employment or independent contracting, or health care services. Nothing we do falls into those categories, so the CCPA's ADMT pre-use notice and opt-out obligations do not apply to us.

Separately, for GDPR Art. 22 purposes: we do not make decisions producing legal or similarly significant effects about you by purely automated means. Automated systems flag content and accounts for spam and abuse, but enforcement actions that suspend or remove an account involve human review, and you may contest any such decision by contacting us.

We do not profile you at all — see §3.2. What you see follows from what you subscribed to, not from anything inferred about you, so there is no ranking decision to object to under Art. 21.

6. Cookies and similar technologies

We do not use analytics or advertising cookies. We run no third-party analytics on this service — no Google Analytics, no tag manager, no advertising or tracking pixels. Because we set no non-essential cookies, there is no cookie banner to accept or reject. If we add analytics later we will update this policy and obtain consent before setting any such cookie.

Global Privacy Control. We honor the Global Privacy Control (GPC) and similar opt-out preference signals. If your browser sends one, we treat it as a valid request to opt out of any "sale" or "sharing" of your personal information and to reject non-essential cookies. We do not sell or share personal information and set no non-essential cookies, so there is nothing for the signal to switch off — but we will continue to honor it if that ever changes.

Do Not Track. There is still no common standard for DNT, so we do not respond to DNT headers. We do respond to GPC, as above.

7. Who we share information with

We do not sell your personal information for monetary or other valuable consideration. We disclose it to the following categories of recipients, for the business purposes described:

Service providers and processors

Each of these processes data on our instructions under a data processing agreement. The table above is our current sub-processor list. Adding a new one is a material change to this policy, so it follows §15: we give account holders at least 30 days' notice by email before it takes effect, which is your opportunity to object.

We do not sell or share your personal information, including for cross-context behavioral advertising, and have not done so in the preceding 12 months.

Other disclosures

Other users and the public. Your profile, posts, dojo pages, and event listings are visible according to the visibility settings you choose. Content you post publicly can be seen, copied, and indexed by search engines. Deleting it here does not remove copies others have made.

Dojos and organizations. If you join a dojo on the platform, that dojo's administrators can see your profile, membership status, rank records, event registrations, and payment status for dues paid through the platform.

Legal and safety. We may disclose information where we believe in good faith it is necessary to comply with a law, regulation, subpoena, or court order; to enforce our Terms; to detect or prevent fraud, abuse, or security incidents; or to protect the rights, property, or safety of our users or the public. We will notify you before responding to a request for your data unless we are legally prohibited from doing so, or notice would create a risk of harm to someone.

Business transfer. If the business is sold, merged, or reorganized, personal data may transfer as part of that transaction. We will notify you before your data becomes subject to a materially different privacy policy, and will make continued adherence to this policy a condition of the transfer to the extent we are able.

Aggregated and de-identified data. We may publish or share statistics that cannot reasonably be used to identify you (for example, "aikido practitioners in 42 countries use Aikido Network"). We maintain de-identification and commit not to re-identify such data except to test our de-identification.

8. International data transfers

Aikido Network is operated from the United States and our infrastructure is US-hosted. If you are in the EEA, UK, or Switzerland, your personal data is processed in the United States, where the law differs from your own.

We are directly subject to the GDPR. Because we offer this service to people in the EEA and UK, our processing falls under Art. 3(2) GDPR (and the UK equivalent), and we apply the GDPR to it in full. When you submit your data to us yourself, that is not a Chapter V "transfer" — there is no separate exporter and importer — so no transfer mechanism is required for it, and your GDPR rights apply to us directly.

Onward disclosures. Where personal data does move between us and our sub-processors, or from an EU-established party to a US recipient, we use the European Commission's Standard Contractual Clauses (2021/914), the UK International Data Transfer Addendum for UK data, and the equivalent Swiss mechanism, supported by transfer impact assessments for each provider. Where a recipient is certified under the EU–U.S. Data Privacy Framework and its UK Extension and Swiss–U.S. framework, we may rely on that certification in addition to, but never instead of, contractual safeguards.

We do this because the DPF's future is not settled: the EU General Court dismissed the Latombe challenge to the adequacy decision in September 2025, that decision was appealed to the Court of Justice of the EU in October 2025 and remains pending, and the US Privacy and Civil Liberties Oversight Board has lacked quorum since January 2025. The adequacy decision is valid today, and we do not want your data's protection to depend on it staying that way.

You may request a copy of the safeguards we use by writing to privacy@aikido.network.

9. How long we keep information

We do not retain personal data indefinitely. Our schedule:

On deleting your account, we ask whether you want your posts and comments removed along with it, or detached from your identity and left in place so community threads stay readable. If you choose detachment, the content stays but no longer displays your name, profile, or any identifier linking it to you, and we do not retain a mapping back to you.

Where deletion is not immediately possible for technical reasons, we isolate the data and prevent further processing until deletion is possible.

10. Your privacy rights

10.1 Everyone

Whatever jurisdiction you are in, you can:

• Access the personal data we hold about you, and download a machine-readable export of your account and content from privacy@aikido.network
• Correct inaccurate information — most fields are editable directly in your profile
• Delete your account and associated data from privacy@aikido.network
• Withdraw consent for marketing email at any time
• Opt out of non-essential email using the unsubscribe link in any such message (transactional and security messages cannot be switched off while your account exists)

Records a dojo controls. Where a dojo entered records about you — roster membership, rank history, event registrations, dues — that dojo is the controller of those records and we act on its instructions. We will forward your access, correction, or deletion request to the dojo within 5 business days, tell you who to contact there, and act on its instruction. Your own account, profile, content, billing, and log data are ours to act on directly, and the rights above apply to them without qualification.

10.2 EEA, UK, and Switzerland (GDPR)

You additionally have the rights to: restrict processing (Art. 18); object to processing based on legitimate interests, including profiling (Art. 21) — and to object to direct marketing at any time, absolutely; data portability in a structured, commonly used, machine-readable format for data processed by consent or contract (Art. 20); and not to be subject to solely automated decisions with legal or similarly significant effects (Art. 22 — see §5).

Withdrawing consent does not affect the lawfulness of processing carried out before the withdrawal.

Complaints. You may lodge a complaint with the supervisory authority in your country of residence, place of work, or where the alleged infringement occurred. In the UK this is the Information Commissioner's Office (ico.org.uk). We would appreciate the chance to address your concern first.

Our EU/UK representative. We have not appointed a representative under Art. 27 GDPR or its UK equivalent. You can reach us directly at privacy@aikido.network, and we answer requests from the EEA and UK on the same terms as any other.

10.3 California (CCPA/CPRA)

California residents have the rights to:

• Know the categories and specific pieces of personal information we collected, the sources, our business purposes, and the categories of third parties, service providers, and contractors to whom we disclosed it in the preceding 12 months — and, on request, information collected beyond that 12-month window for anything collected on or after January 1, 2022, unless doing so proves impossible or would involve disproportionate effort, in which case we will explain why in detail
• Delete personal information we collected from you, subject to statutory exceptions (for example, records we must keep for tax purposes or to complete a transaction)
• Correct inaccurate personal information
• Opt out of sale or sharing — we do not sell or share personal information, so there is nothing to opt out of; we honor GPC signals regardless, and will publish a Do Not Sell or Share My Personal Information link if that ever changes
• Limit the use of sensitive personal information — we use sensitive personal information (log-in credentials) only for purposes exempt from this right, so there is nothing to limit; we will say so if that changes
• Non-discrimination — we will not deny service, charge different prices, or provide a different quality of service because you exercised a privacy right

Categories collected in the preceding 12 months, and how long we keep each:

Sources. Directly from you; automatically from your device and browser; from dojo administrators who add you to a roster; from identity providers if you use social sign-in; and from our payment and infrastructure providers (for example, Stripe's confirmation that a payment succeeded).

Disclosures for a business purpose. In the preceding 12 months we disclosed identifiers, customer records, commercial information, internet activity, and audio/visual information to the service providers and contractors listed in §7, for the purposes stated there. [We did not sell or share any category of personal information. / The categories sold or shared, and the third parties who received them, are: ___ — match this to your choice in §7.]

Authorized agents may submit requests on your behalf with written permission signed by you; we may ask you to verify your identity directly and to confirm you granted the authority.

Verification. We verify requests by asking you to respond from the email address on the account, or, for requests not tied to an account, by asking for enough information to match you to our records. We will not create new records or retain the information you supply for verification beyond what is needed to process the request.

10.4 Other US states

Residents of Colorado, Connecticut, Virginia, Oregon, Texas, Montana, and other states with comprehensive privacy laws have broadly similar rights of access, correction, deletion, portability, and opt-out of targeted advertising, sale, and profiling in furtherance of decisions producing legal or similarly significant effects. We extend the rights in §10.1 and §10.3 to all US residents regardless of state, so you do not need to work out which law covers you.

Appeals. If we decline your request, you may appeal by replying to our decision or writing to privacy@aikido.network with "Privacy Appeal" in the subject. We will respond within 60 days — sooner where we can — with our decision and reasoning, and will tell you how to contact your state Attorney General if you disagree.

10.5 How to exercise any of these rights

Use the self-service tools by emailing privacy@aikido.network, or email privacy@aikido.network.

We confirm receipt within 10 business days, describing how we will verify your identity and when you can expect an answer.

We complete requests within one calendar month (GDPR — extendable by two further months for complex or numerous requests) or 45 days (US state laws — extendable by a further 45 days). If we need an extension we will tell you within the original period, and why.

There is no charge unless a request is manifestly unfounded or excessive, in which case we will tell you the fee before doing the work, or explain why we are declining.

11. Children and young people

11.1 Accounts are for adults

Aikido Network accounts are for people aged 18 and over. Our sign-up asks for your date of birth, uses it once to check your age, and does not store it. We do not knowingly create an account for anyone under 18.

Because we offer no accounts to children, we do not operate a parental-consent flow, do not have linked parent and child accounts, and do not run any feature designed for use by children.

11.2 Young people on dojo rosters

Aikido is practised by children, and a dojo may record a young member in its own roster — a name, a rank, promotion dates. Where that happens, the dojo is the controller of that record and we process it on the dojo's instructions. The dojo is responsible for whatever permission its own law requires from the parent or guardian, and the dojo's privacy notice governs what it does with the information.

A roster entry is not an account. We do not create a login for that young person, do not collect their email address, do not enable posting or messaging from a roster entry, and do not run analytics or advertising against it — we run none on this service at all.

11.3 If a child's information reaches us anyway

If we learn that someone under 18 has created an account, or that a dojo has entered information about a child beyond what its roster requires, we delete it promptly and close any account involved.

A parent or guardian may ask what we hold about their child, have it deleted, and object to further processing, by emailing privacy@aikido.network. We answer these by hand; there is no self-service parent portal.

11.4 For dojo administrators

Upload the minimum your dojo actually needs to run its roster. In particular, do not send us photographs, medical or injury information, home addresses, or dates of birth for young members. If your dojo needs to hold that information, hold it in your own records.

We do not profile anyone, at any age, for advertising or for ranking.

12. Health information — Washington State

Washington's My Health My Data Act (and Nevada's SB 370) regulate "consumer health data" more strictly than most privacy laws, define it broadly enough to reach information about bodily functions, physical activity, injuries, and health-related purchases, and give Washington consumers a private right of action.

We do not solicit, require, or use consumer health data. There is no field anywhere on Aikido Network that asks for injury history, medical clearance, insurance details, or fitness measurements, and we ask you not to volunteer them (§3.4).

Where a user nonetheless writes something health-related into a post, comment, message, or support ticket, that text is stored as ordinary user content. We do not extract it, index it as health information, use it to infer anything about your physical or mental condition, use it to rank anything, or disclose it to any third party for any purpose other than hosting. You can delete such content yourself at any time, or ask us to remove it at privacy@aikido.network and we will do so.

We do not sell consumer health data, and we will not — the Act requires a signed, specific authorization for any sale, and we do not seek one and have no process for obtaining one.

13. Security

We protect your information with measures appropriate to the risk, including: TLS encryption in transit and encryption at rest for our database and backups; passwords stored only as salted hashes using a modern key-derivation function; access to production systems limited to the operator and protected by multi-factor authentication; rate limiting and bot filtering at the network edge; regular dependency and vulnerability patching; and backups tested for restorability.

Account access for support. To investigate a problem you have reported, or one we have detected, the operator may access your account to diagnose the issue. Every such access is recorded — who did it, when, for how long, and why — and any change we record in our activity log during that access carries a record that we, not you, made it, so it is never mistaken for your own action.

We maintain a written information security program with an assigned owner, annual risk assessment, documented safeguards, and periodic testing.

No system is perfectly secure, and we cannot guarantee absolute security. If a breach affecting your personal data occurs, we will notify the relevant supervisory authority within 72 hours where GDPR requires it, and notify you without undue delay where the breach is likely to result in a high risk to your rights, or where US state law requires notice.

You are responsible for keeping your password confidential and for using a strong, unique one. Tell us immediately at security@aikido.network if you believe your account has been compromised.

14. Third-party links

Dojo pages, profiles, and posts may link to external sites — dojo websites, federation pages, social media, video platforms. We do not control those sites, and this policy does not apply to them. Read their privacy policies before providing information.

15. Changes to this policy

We may update this policy. When we do, we will change the "Last updated" date and post the revised version here. For material changes — a new purpose, a new category of recipient, or anything that reduces your rights — we will give notice by email or an in-product notice at least 30 days before the change takes effect, and, where the change requires it, ask for your consent. We keep previous versions available at https://gitlab.com/martial-art-network/martial-art-network/-/commits/main/priv/legal/privacy-policy.md.

16. Contact us

We aim to answer privacy inquiries within five business days, and to complete rights requests within the deadlines in §10.5.