Privacy Policy
Effective September 2, 2026 · Last updated September 2, 2026
The short version: we hold your email address, a display name and your belt. There is no advertising network, no analytics package and no tracking of you across other sites. Ask and we will delete it.
1. Who is responsible
PYTech LLC, a Florida limited liability company of 818 Palm Grove Ct, South Daytona, FL 32119 decides what is collected here and why. Reach us at hello@wherewerolling.com.
2. What we collect
When you make an account
- Email address — it is how you sign in, and how we reach you.
- Display name — shown on your reports and reviews.
- Belt, if you give it — shown alongside what you write, because a white belt and a black belt saying "the level was high" are different statements.
- Home gym, optionally.
We do not ask for your date of birth, address, phone number or real full name.
When you use the site
- Visit reports — the gym, the date, whether the open mat ran, what you paid, roughly how many people were there, gi or no-gi, how you were treated, and any note you write.
- Reviews — your rating and text, tied to the visit report behind it.
- Gym submissions, ownership claims and the evidence you send with a claim.
- Images you upload as a gym manager. We strip embedded metadata, including GPS coordinates, before storing them.
- Instructor listings, if you make one — your teaching name, belt and degree, city, rates, travel radius, specialities, languages, and any links you add to your own booking page, Instagram, Smoothcomp or IBJJF record.
- Enquiries you send an instructor — your name, email, what you are after, when you are free, and whether it is for a student under 18.
Automatically
- Web server logs. Our web server records the IP address, time, page and browser for each request, and keeps them for 14 days. They are used to keep the site up and to deal with abuse.
- Rate limiting. Your IP address is held briefly in memory to count requests. It is not written to the database.
- Location, only if you ask. Tapping "use my location" asks your browser for coordinates and sends them with that one search. They are not stored.
What we deliberately do not collect
- No advertising cookies, no third-party analytics, no pixels, no cross-site tracking. There is nothing on this site that follows you to another one.
- No card numbers. Payments go through Stripe and card details never reach us.
- No passwords, because there are none.
- Sponsored placements are counted in totals only — a per-campaign, per-day tally of views and clicks. Nothing identifies who did the clicking.
3. Why we hold it, and on what basis
| What | Why | Basis |
|---|---|---|
| Email, display name, belt | To sign you in and attribute what you post | Performing our agreement with you |
| Reports and reviews | They are the product — the confirmation badge is built from them | Performing our agreement; our legitimate interest in a useful, honest directory |
| Claim evidence | To check someone claiming a gym actually runs it | Legitimate interest in preventing hostile claims |
| Instructor listing and payment records | To run and bill a paid listing | Performing our agreement; legal obligation for tax records |
| Enquiries | To pass your message to the instructor | Your request |
| Server logs, rate limits | Security and keeping the site up | Legitimate interest in a site that works |
4. What other people can see
Public: your display name, your belt, your visit report answers and notes, your reviews, and any instructor listing you publish, including the contact details you put in it.
Not public: your email address, your enquiries (they go to that instructor only), your claim evidence, and anything you send us by email.
Reviews and reports are indexed by search engines, which we cannot undo after the fact. Write with that in mind.
5. Who else sees it
We do not sell your data. There is no advertising network here to sell it to. It goes to these companies only because the site cannot work without them:
| Who | What they get | Why |
|---|---|---|
| Stripe | Your email and payment details, entered on their page | Taking payment for listings |
| Resend | Your email address and the message | Sending sign-in links and notifications |
| US Census Bureau geocoder | A gym's street address — never yours | Putting academies on the map |
| Google Places | A place identifier when you open a listing that has one | Fetching a live rating. Nothing about you is sent, and nothing comes back that we store |
We will also hand something over if the law genuinely requires it, or to establish or defend a legal claim — for instance where a gym alleges a review is defamatory and a court orders us to identify who wrote it.
Our servers are in the United States.
6. Cookies and what is stored in your browser
We set no cookies. When you sign in, a session token is kept in your browser's local storage so a refresh does not sign you out. It lasts 30 days, it is not sent to anyone but us, and signing out removes it. Clearing your browser data removes it too.
Because there are no advertising or analytics cookies, there is no consent banner. That is not an oversight.
7. How long we keep it
| What | How long |
|---|---|
| Account details | Until you close the account |
| Sign-in links | 20 minutes to use; deleted a day after expiry |
| Session token | 30 days |
| Visit reports and reviews | Indefinitely — they are the record the site is built on. Detached from your name if you close your account |
| Images you remove | Marked removed at once, purged from disk afterwards, so an accidental deletion can be undone |
| Web server logs | 14 days |
| Payment and billing records | As long as tax law requires, typically seven years |
| Backups | Copies may persist for a short period after deletion |
8. Your rights
Wherever you live, you can ask us to:
- Show you what we hold about you.
- Correct anything wrong.
- Delete your account and personal details.
- Export your data in a portable format.
- Object to a use of it, or ask us to restrict it.
Email hello@wherewerolling.com. We answer within 30 days. We will not charge you, refuse you service, or treat you differently for asking.
On deletion: your account, email and display name go. Visit reports and reviews are disconnected from you rather than deleted, because removing them would rewrite a confirmation record other people are relying on to decide whether to drive somewhere. If you want them gone as well, say so and we will look at it.
California residents: we do not sell or share personal information as those terms are used in the CCPA, and we have no financial incentive programmes. The rights above are the ones the CCPA gives you.
In the UK or EU: the bases we rely on are in section 3, and you can complain to your supervisory authority.
9. Children
This site is not for anyone under 18 and we do not knowingly collect anything from a child. If you believe a child has made an account, email us and we will delete it.
Private lessons listed here are adults-only, so we neither ask for nor hold any information about a child in connection with them.
10. Security
The site is served over HTTPS. There are no passwords to breach. Sign-in links are stored only as a hash, expire in twenty minutes and work once. Uploads are stripped of metadata. Access to the database is limited to what each part of the site needs.
None of that is a guarantee. If we ever have a breach affecting your data, we will tell you and the relevant authority without undue delay.
11. Changes
If this policy changes materially, we will post a notice on the site and email account holders before it takes effect. The date at the top always reflects the current version.
12. Contact
hello@wherewerolling.com, or 818 Palm Grove Ct, South Daytona, FL 32119.