Privacy policy
Last updated 2 November 2026
Rolla is a jiu-jitsu learning app at rolla.academy, run by Thomas Arntsen, Norway ("we"). We collect as little as we can: enough to keep your account, your progress and, if you subscribe, your payments working. We don't sell your data or show ads.
What we collect
- Account details: your email address and, if you sign in with Google, the name and email Google shares with us. Passwords are stored only as a secure hash by our authentication provider; we never see them.
- Training progress: lessons completed, scores, XP, streak, daily goal, belt level, gi or no-gi preference, the name you choose to show, and your bookmarks.
- Subscription details if you buy Rolla Plus: plan, status and renewal date. Card details go straight to Stripe; we never see or store them.
- Technical data: standard server logs (IP address, browser, pages requested, time) kept by our hosting provider for security and to fix errors.
Before you sign in, your progress is kept only in your own browser (local storage). When you create an account, that progress is copied into your account so nothing is lost.
Why we use it
- To run your account and save your progress across devices (to provide the service you asked for).
- To send emails you need: confirming your address, resetting your password and receipts. No marketing emails without your consent.
- To take payment for Rolla Plus and to meet accounting rules (legal obligation).
- To keep Rolla secure and working (our legitimate interest).
Who processes it for us
- Supabase: accounts and the database, stored in the EU (Ireland).
- Vercel: hosting of the website.
- Resend: sending account emails.
- Stripe: payments for Rolla Plus.
- Google: only if you choose to sign in with Google.
Some of these companies are based in the United States. Where data leaves the EU/EEA, they rely on the EU-US Data Privacy Framework or the EU Standard Contractual Clauses.
How long we keep it
We keep your account and progress until you delete your account. Deleting your account removes your profile, progress and bookmarks straight away. Payment records are kept as long as accounting law requires (in Norway, five years). Server logs are deleted after 30 days.
Your rights
You can see, correct, export or delete your data, object to how we use it, and withdraw consent at any time. Delete your account yourself in Profile, or see how to delete your account. For anything else, email hello@rolla.academy and we will answer within 30 days. If you think we handle your data wrongly, you can complain to the Norwegian Data Protection Authority (Datatilsynet) or your local authority.
Cookies and local storage
We use only what Rolla needs to work: a sign-in cookie that keeps you logged in, and local storage for your progress and settings. No advertising or tracking cookies.
Children
Rolla is meant for people aged 13 and over. If you are under 16 in the EU/EEA, ask a parent or guardian before creating an account.
Changes
If we change this policy in a way that matters, we will tell you in the app or by email before it takes effect.
Contact
Thomas Arntsen, Norway. Email hello@rolla.academy.