Parent app privacy policy

Who we are

BeltManager is run by John Powell Ltd, a company registered in England and Wales (company number 05408918), 124 City Road, London EC1V 2NX. Contact: info@beltmanager.com.

Your child's martial arts school (the “school”) uses BeltManager to run its classes. The school is the controller of its records about you and your children: it decided to add you, and it decides what it keeps. BeltManager processes those records on the school's behalf. For the app's own sign-in, device and crash-report data, BeltManager is the controller.

What the app uses

Information you give us

• Your email address, to send you a 6-digit sign-in code and find the children linked to you. You can only sign in if your school has already added you as a parent or guardian.
• Your school's code, to know which school you're signing in to.
• Your answers about classes: “Coming” or “Can't make it”. If your child can't make it you choose a reason (unwell or injured, away, a school or family event, or other) and can add a short note of up to 100 characters. “Unwell or injured” can tell the school something about your child's health, so please don't put medical details in the note.

Information the app shows you from your school's records

• Your children's first and last names, their current belt or grade, upcoming classes (day, time, venue) and the dates the school is closed.

Information collected automatically

• Notification token: if you turn notifications on, your phone gives the app a push token. We store it, with your phone's platform (iOS or Android), so we can send you class requests. It's deleted when you sign out, or when your phone tells us it no longer works (for example after you delete the app).
• App name, version and phone platform (for example “BeltManagerParent/1.0.0 (ios)”), stored with your signed-in device so it can be listed and signed out later.
• Crash and error reports: if the app crashes or hits an error, it sends a technical report (what went wrong, the app version, the phone model and operating system). Reports never include your email, your children's names, your answers or your sign-in tokens.
• IP address, used only to limit repeated sign-in attempts and protect the service. The counters expire within minutes and are not added to your records.

What we don't collect: your location, contacts, photos, camera, microphone, files, payment details, advertising identifiers or usage analytics. The app has no ads and does no tracking. We don't sell data.

Notifications

Notifications are off until you turn them on. A few days before a class, we send one asking whether your child is coming, for example “Is Sam coming to Kids Karate?”, so it shows your child's first name and the class. You can answer from the notification. We only send class requests. You can turn them off at any time in your phone's Settings.

Why we use it (lawful basis)

• To let you sign in and stay signed in, show your children's classes, send class requests and pass your answers to the school: the legitimate interests of the school and BeltManager in running classes safely and knowing who to expect, and, where the school has a contract with you, performance of that contract.
• To keep the service secure, prevent abuse and fix crashes: legitimate interests.
• “Unwell or injured” may be health information. Giving it is optional, and it's used only so the school knows why a child is absent.

Children

The app is for parents and guardians, not children. Children don't use it or sign in. It shows children's data that their school already holds, and only to the adults the school has linked to those children.

Who sees it

• Your child's school: staff see your answers and reasons in BeltManager.
• Service providers that run BeltManager for us, under contract and only on our instructions:
  • Vercel: hosting, London region.
  • Neon: database, London region.
  • Upstash: short-lived rate-limit counters.
  • Sentry: crash and error reports, EU (Germany) region.
  • Resend: sending the sign-in and class-request emails. Resend is in the United States, so your email address is transferred there, protected by the UK International Data Transfer Addendum to the EU Standard Contractual Clauses.
  • Expo, Apple and Google: delivering notifications to your phone. The notification text and your push token pass through their services, which may process them outside the UK under the same kind of safeguard.
• No one else, unless the law requires it.

How long we keep it

• Sign-in codes expire after 10 minutes and are deleted once used or replaced.
• Wrong-code counters: 24 hours.
• Signed-in devices: until you sign out, or 90 days after you last used the app (180 days at most), after which you sign in again. Notification tokens: until you sign out or the token stops working.
• Crash reports: up to 90 days.
• Class answers and reasons are kept by the school as part of its attendance records for as long as your child is a member. When a school erases a child's record, the reasons and the link to the parent who answered are removed.
• Your email address and your children's records are kept by the school. Ask the school to change or remove them.

Signing out of the app revokes that device's sign-in straight away. The sign-in token on your phone is kept in its secure storage (iOS Keychain or Android Keystore) and deleted when you sign out.

Security

Everything the app sends uses HTTPS. Sign-in codes and sign-in tokens are stored only as one-way hashes. Access is checked again on every request, so when a school removes a guardian their app access ends immediately.

Your rights (UK GDPR)

You can ask for access to, correction or deletion of your data, or object to or restrict how it's used. For records your school holds (you, your children, your answers), contact the school, or email info@beltmanager.com and we'll pass it on and help. To stop using the app, sign out and delete it. You can complain to the Information Commissioner's Office (ico.org.uk, 0303 123 1113).

Changes

We'll update this page when the app changes what it collects, and change the date at the top.