Privacy Policy — Black Belt

Black Belt is a private Brazilian jiu-jitsu training journal for iPhone. Your journal is stored on your iPhone. There is no Black Belt account or sign-in, and we don’t operate a hosted training-journal database.

Data leaves your iPhone only in these cases:

Purchases, through Apple and RevenueCat.
Features you choose to use: anonymous usage data (off by default), WHOOP, Apple Maps place lookups, the competition calendar in older versions where available, a journal CSV or settings file you export, the iCloud Drive settings backup, and images or diagnostics you choose to share.

Each case is described below.

Journal and profile data

Training sessions, notes, techniques, partner names you enter, profile and rank history, your profile photo, goals, competition records, and data imported from Apple Health or WHOOP are stored in the app’s local database on your iPhone. There is no public profile, feed, messaging system, or advertising profile.

The journal is kept in the app’s private storage. Black Belt marks that storage as excluded from iCloud and computer device backups. iOS applies that setting, so we can’t promise how every device backup treats it. Black Belt itself doesn’t copy the journal to iCloud or to any server.

Black Belt does not back up your journal. You can export a readable CSV copy (see “Journal CSV export” below), but Black Belt cannot restore a journal from CSV files. If you lose or reset your iPhone, or delete the app, your journal cannot be recovered in Black Belt.

Some entry types were retired in September 2026: focus cycles, before- and after-training check-ins, training status, and return-to-the-mat plans. The app no longer creates or shows them. Entries saved by an earlier version stay in your local journal until you erase your data or replace the journal with an imported archive.

Journal CSV export (optional)

Export journal CSV in Profile › Settings › Journal makes a readable copy of your journal. If your subscription access has ended, the subscription screen offers the same export, so you can take your journal with you without paying.

The export happens only when you start it. The app prepares the CSV files on your iPhone and hands them to the iOS share sheet. You choose where they go, and that destination’s own terms apply. Nothing is sent to the developer.
The files contain what you wrote, such as sessions, reflections and rounds, belts, templates, goals, competition events and private match details, manual weigh-ins and profile text. That includes the partner name you entered for a round and the opponent name you entered for a match.
Location fields and self-reported wellness context (check-ins, training status and return plans) are included only if you turn on those options for that export. Both are off by default and apply to that export only.
Apple Health and WHOOP measurements, provider identifiers, photos, a session’s own partner text, and older technique text are never included.
A CSV export can contain private notes, competition details and, if you choose, places. Anyone you share the files with can keep them, so store and share them carefully.
Black Belt cannot import CSV files, so a CSV export is not a backup. The app’s temporary copy is removed when the share sheet closes.

Settings export and iCloud Drive settings backup (optional)

Export settings creates a .blackbeltsettings file and hands it to the iOS share sheet. You choose where it goes.
Settings backup is an optional copy of the same file in the app’s iCloud Drive folder. Apple stores it in your iCloud account under Apple’s terms.

Both contain exactly two preferences:

your appearance choice (system, light or dark);
whether you get a notification when a backup finishes.

They contain no sessions, notes, profile, templates, planning, locations, Apple Health data or WHOOP data. They are not journal backups.

Restoring settings applies those two preferences after you confirm. It doesn’t change your journal or your Health permissions.

Turning the settings backup off stops future backups but doesn’t delete the existing file. Deleting the backup in the app removes it, and so does Erase All Data.

Journal archives from an earlier version. If an earlier version saved a full journal archive (a .blackbeltarchive file), you can still import it with Restore existing journal archive. The app validates the file and asks you to confirm before it replaces the current journal. Such archives can contain notes, health information and locations, so store them securely. Black Belt 2.0 and later don’t create, change or delete them, including any journal archive an earlier version stored in iCloud Drive.

Purchases

Black Belt offers:

monthly and annual auto-renewing subscriptions, with a free trial for eligible new subscribers;
a one-time Founder lifetime unlock, which does not renew;
a free seven-day evaluation of the Founder unlock, offered once. It ends on its own and never charges you.

Prices and trial eligibility are shown before purchase. Apple handles payment; Black Belt never receives your payment details.

RevenueCat, a third-party service, processes your App Store purchase history and an anonymous app user ID that RevenueCat generates. It uses them to confirm what you have unlocked (app functionality) and to give us aggregate purchase reports (analytics). Black Belt sets no custom user ID or customer attributes, doesn’t connect that ID to your name or email, and doesn’t send RevenueCat your journal, profile or health data. RevenueCat’s handling is described in its privacy policy (https://www.revenuecat.com/privacy).

Your entitlement status is cached on your iPhone so you aren’t locked out while offline. That cache remains after Erase All Data, because the purchase belongs to your Apple Account, not to the journal.

The App Store privacy manifest declares Purchase History for App Functionality and Analytics, and User ID for App Functionality. Both are declared as not linked to you and not used for tracking.

Anonymous usage data (optional, off by default)

Profile › Settings › Journal has one switch, Anonymous usage data. It is off on a fresh install, and nothing is recorded or sent while it is off. It works only in builds that include a usage-data address, and a build without one collects nothing. From version 2.0.1, a build without that address hides the switch, unless you turned it on in an earlier version; then it stays so you can turn it off. The switch doesn’t affect purchase processing or WHOOP security requests.

When the switch is on, this version can send five kinds of event, each about how the app behaved:

that the app launched, and whether that was a fresh start or a return from the background;
which tab you opened: Train, Progress or Profile;
how long the Progress screen took to load, as a coarse range such as “2–5 seconds”;
that a subscription screen was shown, and where: the end of onboarding, the subscription gate, or Settings › Subscription. Never the price, the plan you looked at, or whether you bought anything;
that you turned the setting on.

Each upload carries the app version and build number, a random identifier created for that upload (used only to group it and its retries), and each event’s position within the upload. Events never contain your journal, belt or promotion history, Apple Health or WHOOP data, location, name, email, or anything you typed. They carry no account, device, installation or advertising identifier.

Events wait in a small, size-limited queue on your iPhone and may be uploaded in the background, about once an hour. The app sends them directly to a Cloudflare Worker the developer operates, with no third-party analytics SDK. Cloudflare is the hosting processor and necessarily sees your network address to deliver the request. The Worker doesn’t store your IP address or country, and it is configured with request logging off. Events are stored in Cloudflare Workers Analytics Engine, which Cloudflare documents as keeping data for three months.

Turning the switch off stops recording, cancels pending uploads and deletes the queue on your iPhone. Events already received can’t be retrieved or deleted individually, because nothing links them to you. Erase All Data also turns the switch off and deletes queued events.

The App Store privacy manifest declares these events as Product Interaction and Performance Data, used for Analytics, not linked to you, and not used for tracking. Performance Data also declares App Functionality for the separate operational performance traces described under WHOOP and App Attest; the anonymous-usage switch does not control those security-service traces.

Session location (optional)

You can tag a session with a place, only when you ask for it. The place you confirm (a name and coordinates) is stored in your local journal.

Use current location: iOS asks for when-in-use permission, either here or from the optional Location row during setup. The app takes a single location fix and sends those coordinates once to Apple Maps to look up a place name.
Place search: the text you type is sent to Apple Maps search. The app doesn’t attach a saved or current location to the search. To suggest a starting area, it may also look up the city for your device’s region setting.
Choosing a saved place or dropping a pin never contacts Apple Maps.

Apple handles these requests under its own privacy terms. Search text isn’t stored. Places aren’t included in settings exports or settings backups. You can revoke location access in iOS Settings; tagging is never required to log a session.

Voice notes (optional)

In the Log session screen you can talk through a class instead of typing. Black Belt asks for microphone and speech-recognition access the first time you use it.

The microphone is used only while you are recording a spoken note.
Speech is recognized on this iPhone only. Black Belt requires on-device recognition and doesn’t fall back to a server; if on-device recognition isn’t available, voice notes are unavailable. Your voice is not sent to Apple or anyone else.
The audio is never saved or sent anywhere. Only the text you keep is saved.
The text you keep is saved in your local journal, like typed notes. It isn’t included in settings exports or settings backups.
You can decline or later turn off microphone and speech-recognition access in iOS Settings. Typing notes keeps working.

Profile photo: you pick it with the iOS photo picker, which runs outside Black Belt and gives the app only the photo you choose. It is stored in the app’s local storage, and Erase All Data removes it.
Share images: Profile can make a promotion image (belt, stripes and promotion date; your name is left off unless you turn it on). Progress can make a training-calendar image from manually logged session days, with no Apple Health or WHOOP data. The image is made on your iPhone and leaves it only when you pick a destination in the iOS share sheet. That destination’s own terms apply.
Save Image: if you choose Save Image in the share sheet, iOS asks permission for Black Belt to add photos. Black Belt only adds the image you chose; it never reads your photo library.

Apple Health (optional)

If you connect Apple Health, Black Belt reads only the categories you enable, after iOS permission:

workouts and sleep;
heart rate, resting heart rate, heart-rate variability, respiratory rate and blood oxygen;
active energy.

It uses them for private training context, and to fill in an eligible manual session’s empty heart-rate and calorie fields. It doesn’t read steps.

Black Belt writes to Apple Health only when you turn on Write new sessions to Apple Health. It then saves your logged jiu-jitsu sessions as workouts.

A connected Health link can register for hourly background updates; Apple decides when an update is delivered. Imported data stays in your local journal and in the Health app. It isn’t included in settings exports or the iCloud settings backup, isn’t sent to the developer or any third party, and isn’t used for advertising.

Delete Apple Health data in Health & recovery removes the app’s local copy of imported Health data. It doesn’t delete records in Apple’s Health app. You can narrow or revoke access in iOS Settings, and manual logging keeps working.

Competition events and saved calendar data

Version 2.1 removes public Calendar browsing, refresh and event artwork downloads. It has no calendar address setting and sends no calendar or event-artwork requests. Your own events, registration and division edits, private matches and manual logging remain on your iPhone.

The app may read a public event list saved by an older version to plan reminders using a matching saved registration deadline or event time zone. It keeps the original date that copy was fetched; reading it does not make its dates current. If the saved data is missing, invalid or does not match your event, the app treats those dates as unavailable rather than guessing. This reader cannot download, replace or erase the saved copy. Removing Calendar does not itself delete your local events, their identifiers or the saved public data.

In older versions where Calendar is available and configured, opening or refreshing it downloads a curated public list from a Cloudflare Worker the developer operates; artwork loads from the same address. Those requests carry no journal data, health data, location, search text, account identifier, cookies or credentials. Region filters and adding events run on your iPhone. Cloudflare sees ordinary connection metadata, such as your network address; the Cloudflare logging described under WHOOP also applies. Following a registration link in those versions opens the organizer’s website, which has its own privacy policy. This app change does not retire the older-client service.

WHOOP and App Attest (optional)

Direct WHOOP is optional. In build 14 and later, before importing new WHOOP data, Black Belt asks you to allow downloading and keeping workouts, daily cycles, recovery and sleep in this iPhone’s journal until you delete that data. You can decline and keep using manual logging and Apple Health. Existing imported history is not deleted, and existing connections are not treated as having already made this choice. Disconnect stops access but keeps imported history; Delete WHOOP data or Erase All Data removes the app’s local WHOOP history.

When you choose to connect:

WHOOP’s sign-in page opens in an Apple web sign-in sheet that doesn’t share your browser cookies. Black Belt never sees your WHOOP password.
You authorize read access to WHOOP recovery, daily cycles, sleep and workouts, plus offline access so the connection can refresh.
The app sends the authorization code and its one-time PKCE verifier to the developer’s Cloudflare OAuth broker, which exchanges them with WHOOP. Refresh and revoke requests send the relevant token to that broker. The broker keeps WHOOP’s client secret out of the app. It is designed not to store these values or write them to its own log messages.
The returned tokens are stored only in this iPhone’s Keychain. They don’t sync to other devices.
The app downloads your WHOOP data directly from WHOOP’s API; the broker doesn’t relay it. That data is stored in your local journal. It isn’t included in settings exports or the iCloud settings backup, and isn’t sent to the developer or any third party.

Auto-import workouts is on by default. It turns WHOOP workouts whose activity name matches a list of martial-arts words (jiu-jitsu, BJJ, grappling, wrestling, judo and similar) into unconfirmed training sessions. You can edit the list or turn the option off. Workouts with no activity name are offered in Train for you to review. Other sports are never turned into sessions. Turning auto-import off doesn’t disconnect WHOOP or stop other WHOOP imports.

Disconnect WHOOP asks WHOOP to revoke access when a token is available, then removes the WHOOP tokens and this iPhone’s App Attest key from the app. Your imported WHOOP history stays until you choose Delete WHOOP data, a separate confirmed action that removes the app’s local WHOOP data. You can also revoke access from your WHOOP account.

App Attest. Every request to the WHOOP broker is protected with Apple’s App Attest, which proves the request comes from a genuine copy of Black Belt. To set this up, the app sends a separate App Attest verifier a key identifier and Apple’s one-time attestation object. After that, each broker request carries a signed assertion. The private key never leaves your iPhone’s Secure Enclave.

The verifier stores:

a SHA-256 digest of this app installation’s App Attest key identifier;
the device public key and a usage counter;
a registration timestamp;
short-lived, server-issued registration or migration codes.

Registered-key security records have no automatic expiry. Disconnecting WHOOP, deleting imported WHOOP data, or erasing the app’s local data does not delete the verifier’s registered-key record; the current protocol has no authenticated remote-delete operation. The privacy manifest declares this installation identifier as Device ID, linked to the app installation, used for App Functionality and not for tracking. Temporary codes and network-admission records have separate, short expiry periods.

Per-request proofs use two-minute challenge tokens tied to the key, request and a SHA-256 digest of the request body. The verifier therefore keeps no record of OAuth bodies or tokens. It doesn’t keep Apple’s attestation receipt or call Apple’s fraud-metric service.

For rate limiting, the verifier computes a SHA-256 digest of your network address. During new-key registration it stores that digest briefly, with a ten-minute window and a count. It doesn’t store the raw address. A digest of an address is still pseudonymous network data, not anonymous data.

Cloudflare logs. Both Workers necessarily process network metadata, such as your IP address. The app’s own log messages are limited to generated request IDs, route names, error categories, short shard identifiers and aggregate counts. They don’t include request bodies, tokens, attestation data, health data or journal data.

Separately, the Workers’ configuration enables Cloudflare’s platform invocation logs and sampled traces. Cloudflare documents that these can include the request method and URL, selected headers, user agent, coarse network or location attributes, and timing and status. Cloudflare keeps them for a limited period that depends on the account’s plan.

Cloudflare is the hosting processor. WHOOP’s own handling of your data is governed by WHOOP’s privacy policy.

Crash, hang and performance diagnostics

Apple’s MetricKit framework gives the app crash and hang reports and daily performance summaries.

Black Belt keeps at most 25 crash and hang records, for at most 30 days.
Performance summaries are reduced to coarse timing ranges for a few named app phases, stored with the app version, build number and the date of the measured period.
Nothing is uploaded. Profile › Settings › Diagnostics lets you view, export through the share sheet, or clear these records.

Local notifications

Black Belt schedules notifications on your iPhone only; none come from a server. They can include:

training reminders on the days and times you choose;
streak-at-risk and welcome-back notices;
competition reminders (registration deadline, competition tomorrow) for events in your list;
a trial-ending reminder;
notices that Apple Health workouts were imported or that a settings backup finished or failed.

The app asks for notification permission only after you act, never at launch:

during setup, if you open the optional Reminders row and continue;
once, after a successful session save, if this installation hasn’t asked yet;
when you turn on a reminder;
when you choose Allow notifications in Settings › Reminders.

A declined or decided request isn’t repeated. A request that fails before iOS records a decision may be retried later.

Training reminders use generic text. Streak and welcome-back notices can include session or streak counts. Competition reminders can include the event’s name and date. Health-import notices can include how many workouts were added. Notifications never include partner names, notes, health measurements, or wellness or recovery values. Notification settings stay on your iPhone, and Erase All Data removes them.

Widgets and Live Activity

The Home Screen widget and the session-timer Live Activity get their data from the app on your iPhone; neither uses the network. The widget can show this week’s sessions and goal, your streak, your last training day, and, in the before-class widget, the technique you’re working on, your own latest reflection question and your reminder schedule. It never shows notes, partner names, locations, or health or wellness values. Whether widget text is hidden on a locked iPhone depends on your iOS settings.

Restore

Restoring settings changes only the two preferences described above. Importing an earlier journal archive asks for confirmation and validates the file before it replaces the local journal. Keep the archive until you’ve checked the imported journal. If an error or recovery message appears, follow the steps shown and contact support if you can’t continue.

Journal CSV export, settings export, restore validation and diagnostics sharing use temporary copies owned by the app. Black Belt removes them when the share sheet closes or the restore finishes, fails or is cancelled.

Erase All Data

Erase All Data is an explicit, confirmed action in Profile › Settings › Journal. Before it reports success, it removes:

the local journal, including imported Apple Health and WHOOP data, and your profile photo;
WHOOP tokens and this iPhone’s App Attest key;
scheduled and delivered notifications and their preferences;
Health import choices and import progress markers, and the Write new sessions to Apple Health setting, which is turned off;
diagnostics, pending restores and the app’s temporary files;
this app’s settings backup in iCloud Drive.

If the settings backup can’t be deleted, or its deletion can’t be confirmed, the erase stops and can be retried; a cleanup failure leaves the journal in place. The app also tries to delete workouts Black Belt created in Apple Health, when Health access allows.

Some things remain:

a WHOOP retry deadline, until it expires, so the app respects WHOOP’s rate limits. It holds only a timestamp.
the subscription cache described under Purchases.
the verifier’s public-key record. The current protocol has no authenticated remote-delete operation, and the record contains no journal, health data, token or WHOOP account link.
files you shared outside the app, and journal archives saved by an earlier version.
records held by Apple, RevenueCat or WHOOP. Erase doesn’t cancel a subscription.

Analytics, advertising and tracking

Black Belt contains no advertising identifier, tracking domain, third-party analytics SDK or third-party crash-reporting SDK. The privacy manifest declares no tracking.

The only third-party SDK in the app is RevenueCat, for purchases. The opt-in usage data above is first-party.

Children

Black Belt is not directed to children and doesn’t knowingly collect personal information from them.

Changes to this policy

If behavior changes in a way that affects this policy, we will update this page and its effective date before shipping the change.

Contact

Questions about privacy: support@andeslabs.ai

Need help with the app? See Support. Terms of use for Black Belt are Apple’s Standard End User License Agreement, as presented on the App Store.