Legal
Privacy Policy
Last updated: February 2026
Overview
HouseOfGrapplers ("we", "us", "our") operates the houseofgrapplers.com website and platform. This policy explains how we collect, use, and protect your personal information.
Information we collect
We collect information you provide directly:
- Account information (name, email address)
- Academy information (academy name, member data)
- Usage data (attendance records, belt promotions, class schedules)
- Payment information (processed securely by Stripe)
How we use your data
- Provide and maintain the platform
- Process transactions and send related information
- Send notifications you've opted into
- Respond to support requests
- Improve the platform based on usage patterns
Data storage & security
Your data is stored securely on Supabase infrastructure with row-level security policies. Each academy's data is isolated — no academy can access another's information. We use industry-standard encryption for data in transit and at rest.
Sub-processors
We share data with the following service providers to operate House of Grapplers. Each is contractually bound to process data only on our instructions.
| Provider | Purpose | Data shared | Location |
|---|---|---|---|
| Clerk (Clerk, Inc.) | Authentication | Email, name, password hash | USA |
| Supabase (Supabase, Inc.) | Database hosting | All app data | USA (us-east-1) |
| Vercel (Vercel, Inc.) | Hosting, analytics, edge caching | IP, request metadata, page views | USA |
| Stripe (Stripe, Inc.) | Payments (Connect + direct) | Name, email, payment card metadata (PCI handled by Stripe) | USA |
| Mux (Mux, Inc.) | Video upload, playback, CDN | Video files, viewer metadata | USA |
| Resend (Resend, Inc.) | Transactional email | Email address, message content | USA |
| Upstash (Upstash, Inc.) | Rate limiting cache (Redis) | User ID, request counts | USA |
| Amazon Web Services (AWS S3) | Object storage for uploaded files | User-uploaded files (photos, documents) | USA |
| OpenAI (OpenAI, Inc.) | AI training-plan + dossier generation | User-submitted text content | USA |
| Google Analytics (Google LLC) | Web analytics | IP (anonymized), browsing behavior | USA |
If we add or change sub-processors, we'll update this page and notify materially-impacted users.
Cookies
We use a small number of cookies. None of them are used for cross-site advertising.
- hog_attribution — first-party cookie used for first-touch marketing attribution (recording which UTM source, referrer, or landing path brought a visitor to the site). Set only when UTM parameters are present in the URL or a qualifying external referrer is detected. Retained for 90 days.
- Clerk session cookies — strictly necessary cookies set by our authentication provider to keep you signed in.
- Stripe — payment-session cookies set during checkout to process transactions and prevent fraud.
- Vercel Analytics — anonymous, aggregated traffic measurement. No personal identifiers are collected.
- Google Analytics — analytical cookies used to understand usage patterns at an aggregate level, where enabled.
You can opt out by clearing cookies in your browser or by configuring your browser to block them. Blocking strictly-necessary cookies (such as Clerk session cookies) will prevent you from signing in. We honor "Do Not Track" signals where technically supported.
Your rights
You may request access to, correction of, or deletion of your personal data at any time via our contact form.
Changes
We may update this policy from time to time. We'll notify you of any material changes by posting the new policy on this page and updating the date above.