JIRI COMBAT
DEEN
Privacy policy

Privacy

Last updated: 31 October 2026
This is a translation for your convenience. The German version is legally binding.

In 30 seconds

FrankfurtAccount, profile and training data live on servers in the EU.
0 trackersNo ads, no analytics, no selling of your data. Ever.
Health = your yesWeight, pain, sleep only with your explicit consent.
AI without your nameOpenAI gets no name, email or Apple/Google account – only what the answer needs.
Camera stays localThe rep counter runs on the iPhone. No image leaves your device.
One tap for everythingDownload your data, withdraw consent or delete your account – right in the app.

Controller

Adelina Petras
Sankt-Anna-Straße 31, 41464 Neuss
Email: support@jiricombat.app

No data protection officer is currently appointed. We answer privacy questions directly at support@jiricombat.app.

We have carried out a data protection impact assessment (Art. 35 GDPR) – because of health data, AI and users from 16.

The data map

Every kind of data JIRI processes – open one for what exactly, what for, where, who sees it, how long and why we may. Filter above.

Account & sign-in

Sign in with Apple or Google

Account
What exactlyEmail address and name as Apple or Google pass them on (with Apple possibly an anonymous relay address), an account ID, time of registration and last sign-in.
What forSo you can sign in and your data is back on any device.
WhereSupabase, data centre in Frankfurt (EU).
Who sees itOnly you. We see your email only for support requests.
How longUntil you delete your account.
Legal basisContract (Art. 6(1)(b) GDPR).

Profile

Fight name, age, weight, sports

Health
What exactlyFight name, age, gender, current and target weight, combat sports, strength focus.
What forSo JIRI can tailor training, nutrition and coaching to you.
WhereSupabase, Frankfurt (EU).
Who sees itOnly you. In the admin area we see fight name, age, sports and whether onboarding is complete – no weights.
How longUntil you delete your account. Or right away if you withdraw your consent.
Legal basisContract; for weight and body data your explicit consent (Art. 9(2)(a) GDPR).

Calibration

Equipment, schedule, injuries, diet

Health
What exactlyHeight, training place and equipment, mat sessions and work/school hours, strength experience, known injuries (e.g. “left knee”), nutrition goal, diet and intolerances.
What forSo JIRI avoids exercises that load your injuries and plans around your week.
WhereSupabase, Frankfurt (EU).
Who sees itOnly you.
How longUntil you change it or delete your account. Or right away if you withdraw your consent.
Legal basisExplicit consent (Art. 9(2)(a) GDPR).

Readiness

Sleep, energy, soreness, pain spots

Health
What exactlyPer day: sleep, energy, soreness (0–100), the score made from them and the body spots you tap.
What forReadiness score, trend and a plan that gets lighter on tired days.
WhereSupabase, Frankfurt (EU).
Who sees itOnly you.
How longUntil you delete your account. Or right away if you withdraw your consent.
Legal basisExplicit consent.

Weight & scale

Your weigh-ins

Health
What exactlyDate and weight of every weigh-in.
What forWeight trend, nutrition plan and fight weight.
WhereSupabase, Frankfurt (EU).
Who sees itOnly you.
How longUntil you delete the weigh-in or your account. Or right away if you withdraw your consent.
Legal basisExplicit consent.

Nutrition

Meals, macros, fight planning

Health
What exactlyLogged meals with amount, calories, protein, carbs, fat and micronutrients; your nutrition settings incl. fight date, weight class and weigh-in.
What forDaily balance, nutrition plan and fight mode.
WhereSupabase, Frankfurt (EU).
Who sees itOnly you.
How longUntil you delete the entry or your account. Or right away if you withdraw your consent.
Legal basisExplicit consent.

Training & diary

Plan, sessions, notes

Health
What exactlyYour training plan, logged sessions (sets, reps, weights, mat sessions with intensity and length) and diary notes with mood.
What forPlan, progress, automatic progression and diary.
WhereSupabase, Frankfurt (EU).
Who sees itOnly you.
How longUntil you delete the entry or your account. Or right away if you withdraw your consent.
Legal basisContract; where health-related: explicit consent.

Coach chats

Your chats with JIRI

AI
What exactlyYour questions and JIRI’s answers, titles and whether you pinned a chat. Voice messages are only turned into text – we don’t store the recording.
What forSo you find chats again and JIRI keeps the thread.
WhereSupabase, Frankfurt (EU). Briefly at OpenAI for each answer (see “AI”).
Who sees itOnly you. The admin dashboard shows no chat content.
How longUntil you delete the chat or your account.
Legal basisContract; for health-related content explicit consent.

JIRI’s memory

Short notes JIRI keeps

AI
What exactlyA few bullet points JIRI derives from your chats (e.g. “boxes 3× a week”).
What forSo you don’t have to repeat yourself.
WhereSupabase, Frankfurt (EU).
Who sees itOnly you – viewable and deletable under Settings → JIRI’s memory.
How longUntil you tap “Delete memory” or delete your account.
Legal basisContract; explicit consent.

AI usage & cost

Counters, no content

AI
What exactlyPer AI call: feature (e.g. coach), model, number of tokens, cost and time; plus daily counters for coach and nutrition requests. No content.
What forFair limits, trial and our cost control.
WhereSupabase, Frankfurt (EU).
Who sees itUs (as totals and per call, without content).
How longSingle calls 24 months, daily counters 90 days – then deleted automatically.
Legal basisLegitimate interest (Art. 6(1)(f) GDPR): stable, affordable service.

Safety log

Only when a filter fires or you report

AI
What exactlyIf our safety filter flags a message as a crisis, sexual content or a threat, or if you report an answer: type of event, category and that one message.
What forTo prevent abuse, trigger crisis help correctly and review reported answers.
WhereSupabase, Frankfurt (EU).
Who sees itUs, for review only.
How long12 months, then deleted automatically – or earlier with your account or your withdrawal.
Legal basisLegitimate interest; for crisis signals also vital interests (Art. 6(1)(d) GDPR).

JIRI League

Visible to others

Public
What exactlyFight name (@name), display name, sport, total and weekly XP, streak, visibility; challenge results (exercise, reps, date, counted by camera) and 1-vs-1 duels; friendships, blocks and reports.
What forLeaderboards, friends, challenges and duels.
WhereSupabase, Frankfurt (EU).
Who sees itFight name, display name, sport, XP, streak and challenge results are visible to other fighters – friends only or everyone, your choice, never to people you blocked. Only the two of you see a duel. Only we see reports. In the admin area we see challenge results to check and delete suspicious ones.
How longUntil you delete your account. Resolved reports 12 months after resolution.
Legal basisContract.

Consents

When you agreed to what

Account
What exactlyFor every consent and withdrawal: type (terms accepted, health data consented or withdrawn), version of the text and time.
What forSo we can show that consent was given (Art. 7(1) GDPR) – and you always see what applies.
WhereSupabase, Frankfurt (EU).
Who sees itYou – under Settings → Privacy & data. Us only in case of a dispute.
How longUntil you delete your account. Entries are never changed.
Legal basisLegal obligation (Art. 6(1)(c) with Art. 7(1) GDPR).

JIRI Pro

Whether and until when Pro is active

Account
What exactlyThe date until which Pro is active. We never see payment details (card, Apple ID) – payment runs entirely through Apple.
What forUnlocking Pro features.
WhereSupabase, Frankfurt (EU); payment at Apple.
Who sees itOnly you and us.
How longUntil you delete your account; Apple keeps billing records under its own obligations.
Legal basisContract; legal obligations (Art. 6(1)(c) GDPR).

Only on your iPhone

Never leaves your device

Device only
What exactlyLeague profile picture, sound and app settings, reminders (scheduled on the device, no push server), the camera rep counter (Apple Vision runs on the iPhone, nothing is stored or uploaded), values from Apple Health (sleep, resting pulse, HRV – only if you connect it; all that is saved is the daily form you confirm yourself) and a local copy of your data for offline use.
What forFeatures that need no server.
WhereOnly on your iPhone.
Who sees itNo one but you.
How longUntil you delete the app.
Legal basisNo server – no transfer.

AI: what OpenAI gets – and what it doesn’t

JIRI’s coach, meal estimates, memory and speech recognition use models by OpenAI (OpenAI Ireland Ltd. / OpenAI, L.L.C., USA). Requests never go straight from your iPhone to OpenAI, always through our server in Frankfurt.

FeatureWhat goes to OpenAI
CoachYour question, the chat so far, JIRI’s notes about you and short lines from the app: age, gender, height, weight and goal, sports, training times, injuries, readiness, plan and today’s nutrition – without your name.
Safety checkYour message to OpenAI’s moderation model before JIRI answers.
Speech → textThe recording, only to turn it into text. We don’t store it.
NutritionWhat you ate, as text or recording – to estimate calories and nutrients.
MemoryNew messages of a chat and the existing notes, to update the notes.
Not included: your name or fight name, email, Apple or Google account, your account ID in plain text, photos, location. Instead of your ID OpenAI only gets an irreversible SHA-256 hash (for abuse detection).
  • We call OpenAI with “store: false”: answers are not kept at OpenAI for later retrieval.
  • Under OpenAI’s API terms, data is not used to train their models and kept at most 30 days for abuse monitoring, then deleted.
  • A data processing agreement with OpenAI is signed before the app launches.

You’re talking to an AI. JIRI is an AI system – not a person and not a doctor; the app says so under every chat (Art. 50 EU AI Act). Answers can be wrong; for pain, injuries or eating disorders the decision belongs to a doctor.

You decide what you write. Only share what your training needs. If you type names, addresses or diagnoses, they go to OpenAI with the question.

Processors

ServiceWhat forWhere
Supabase Inc.Database, sign-in, server functionsFrankfurt data centre (AWS eu-central-1)
OpenAIAI answers, speech, moderationUSA (see below)
Apple Distribution International Ltd.Sign in with Apple, App Store, paymentIreland / USA
Google Ireland Ltd.Sign in with GoogleIreland / USA
Cloudflare, Inc.Serving this website, forwarding support emailsUSA, global network (data centre near you)

Transfers to the USA

OpenAI, Cloudflare and the parent companies of Supabase, Apple and Google are in the USA. Transfers rely on the EU Commission’s Standard Contractual Clauses and – where the provider is certified – the EU-US Data Privacy Framework (Art. 45, 46 GDPR).

Weight, injuries, readiness, sleep, soreness and nutrition are health data (Art. 9 GDPR). JIRI processes them only with your explicit consent (Art. 9(2)(a) GDPR).

A tick of its own

When you sign in you set one tick yourself, only for health data and the AI – it is never pre-ticked. It says that JIRI uses your health data and sends it, with your messages (spoken ones too), to OpenAI’s AI (USA), and that you can withdraw any time. Nothing goes to OpenAI before this yes. You accept the terms of use (contract) separately, by going on after the note naming them; each is logged on its own.

Proof

Every consent and withdrawal is stored with type, text version and time in a log nobody can change. You see it under Settings → Privacy & data. If the texts change in substance, JIRI asks again.

Withdrawal – one tap

Under Settings → Privacy & data → Withdraw consent. JIRI then immediately deletes, on the server and on your iPhone: readiness and pain spots, all weigh-ins, weight and target weight, all meals and your nutrition plan, training plan and diary, the calibration, all coach chats, JIRI’s memory and safety logs. Account, fight name, league and consent log stay. What happened before stays lawful (Art. 7(3) GDPR).

iPhone permissions

PermissionWhat forWhat happens to the data
MicrophoneSpeaking to the coach and logging mealsOnly while you record; turned into text at OpenAI; not stored.
CameraCounting reps (league challenges)Stays entirely on the iPhone, nothing stored or uploaded.
Apple HealthReading sleep, resting pulse and HRV to suggest your daily form; on request, writing trainings as workoutsOptional, in Settings. The values are read on the iPhone only and uploaded nowhere, never passed to OpenAI and never used for advertising. JIRI does not read your weight.
PhotosChoosing a profile pictureKept only on your iPhone.
NotificationsTimer, remindersScheduled on the device, no push server.

Apple Health

Only if you connect it in JIRI under Settings → Apple Health and iOS allows access. You switch each part on or off separately:

  • Reading: sleep, resting pulse and heart rate variability (HRV), so JIRI can suggest your daily form. The values are read on your iPhone only; only the daily form you confirm yourself reaches our server.
  • Writing: on request, JIRI adds every finished training to Apple Health as a workout – with its type (e.g. boxing, martial arts or strength training), start and end. JIRI writes no calories, heart rate or training contents.
  • Never: JIRI does not read your weight or any other Health data. Data from Apple Health never goes to OpenAI or any other third party and is never used for advertising.

The legal basis is your explicit consent (Art. 9(2)(a) with Art. 6(1)(a) GDPR), given through the iOS prompt. You can withdraw it any time: in JIRI under Settings → Apple Health → Disconnect Apple Health, or in iOS under Settings → Apps → Health → Data Access & Devices → JIRI COMBAT. Workouts JIRI has already added stay in Apple Health until you delete them there.

What we never do

  • No ads, no advertising IDs, no app tracking.
  • No third-party analytics or crash tools.
  • No selling or sharing of your data for advertising.
  • No profiling with legal effect, no automated decisions about you (Art. 22 GDPR).
  • No use of your data to train anyone’s AI models.

Retention

DataHow long
Safety logs12 months
Single AI calls (model, tokens, cost – no content)24 months
Daily coach and nutrition counters90 days
Resolved league reports12 months after resolution
Everything elseuntil you delete it, withdraw or delete your account
At OpenAIat most 30 days for abuse monitoring

A job deletes expired data automatically every night.

Download your data

Settings → Privacy & data → Download my data gives you, right away, a file with everything stored for your account on our servers – in open JSON (Art. 15 and 20 GDPR).

Deletion

In the app: Settings → Delete account. Your account and all data on our servers are deleted immediately – every table is tied to your account and goes with it. Without the app: email support@jiricombat.app – here’s how.

Your rights

RightHow
Access & copy (Art. 15, 20)App: Settings → Privacy & data → Download my data
Rectification (Art. 16)App: change profile, weight and calibration yourself
Erasure (Art. 17)App: single entries, chats, memory – or Settings → Delete account
Withdrawal of consent (Art. 7(3))App: Settings → Privacy & data → Withdraw consent
Restriction (Art. 18), objection (Art. 21)Email support@jiricombat.app

By email we answer within one month at the latest (Art. 12(3) GDPR). Free of charge. You can also complain to a supervisory authority, e.g. the one responsible for us: Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen, Kavalleriestraße 2–4, 40213 Düsseldorf.

Age

JIRI is for 16 and over; app and database check it. For fighters under 18 the coach follows stricter rules.

Security

  • Encrypted connections throughout (TLS).
  • Row Level Security: each account reads and writes only its own rows.
  • Sign-in through Apple and Google – there are no passwords.
  • Your session sits in the iPhone’s encrypted Keychain, bound to this device.
  • One person has admin access; the dashboard shows numbers, no chat content, weights or meals.
  • If a breach still happens, we report it to the authority within 72 hours and tell you directly where there is a high risk (Art. 33, 34 GDPR).

This website

No cookies, no analytics, nothing loaded from third parties – the fonts are on our own server. The host processes your IP address, date, time and page in server logs as technically necessary (legitimate interest, Art. 6(1)(f) GDPR). The site is hosted by Cloudflare, Inc., 101 Townsend St, San Francisco, CA 94107, USA (Cloudflare Pages). Logs are kept only briefly, as long as running the site and protecting it from attacks requires; Cloudflare sets the exact period. The data processing agreement is part of Cloudflare’s terms.

Emailing us: if you write to support@jiricombat.app, we process your address, name and message to answer you (Art. 6(1)(b) or (f) GDPR). Cloudflare receives the mail and forwards it to our mailbox at Yahoo (Yahoo EMEA Limited, Dublin, Ireland). We delete it once your request is settled, unless we must keep it by law.

Changes

If what JIRI does with data changes, we update this policy and tell you in the app before it applies. For new purposes involving health data we ask again.