Privacy Policy

Who is responsible

The controller of your data is AECOder. For any privacy matter — including reaching our data protection officer — write to contato@meutatame.com.br.

What Meu Tatame is (and what it is not)

Meu Tatame is free and has no ads. It shows the information each gym publishes and takes you to the gym through external links: WhatsApp, phone, Instagram, website. We do not mediate conversations, enrolments or payments between you and the gym. What happens after you click a link stays between you and the gym; we do not track it.

Data we collect

If you only browse, without an account. We ask for nothing. Our hosting provider records technical data about each visit (such as IP address and browser type) to keep the site up and secure.

If you accept the cookie notice, we use PostHog (servers in the European Union) to understand how the site is used: pages visited, searches, clicks. Nothing is sent before you accept. You can withdraw consent at any time: clear your browser cookies (the notice appears again) or write to contato@meutatame.com.br.

If you create an account.

• Name, email and password. The password is stored scrambled; not even we can read it. If you sign in with Google, we receive your name, email and profile picture from Google.
• Date of birth. We ask for it once, to make sure you are at least 13. It cannot be changed later and is never shown to other people. We do not store an "under age" label; when we need to know, we calculate it from the date.
• Sessions and devices. When you sign in, we record IP address, browser and date, so you can see where you are signed in and end sessions in Settings.
• Two-step verification, if you use it (for now, only curators and the administrator): the authenticator app's secret, the backup codes and, for each passkey, a public key, the name you gave it and the date. The secret and the codes are shown only to you, once, when they are created; after that they are protected and never appear on any screen, not even to the administrator. Your fingerprint, face or screen lock never leave your device; we receive none of it.
• If you are a curator: the invitation you received (who invited you and when), the date you accepted it and each version of the confidentiality commitment you accepted, with the date of each acceptance.
• What you record in your personal area, Meu Tatame: favourite gyms, your training timetable, your attendance and your ranks. Only you see this.

If you manage a gym. The gym's information — name, address, disciplines, class times, instructors, plans, contacts, photos — is business data, published by you or taken from public sources, and is visible to everyone. Instructors' details and photos, and photos showing other people, are published by the gym, under its responsibility. When you save an instructor, you declare that they authorised publication; we record the date and the account that made the declaration.

If your gym was listed by our curators. Meu Tatame curators list some gyms from public sources: the gym's website, its public Instagram and federation and event listings — never Google. We bring in only the name, address, disciplines, Instagram and WhatsApp, never instructors or photos, and we keep the link to the source. If the gym is yours, you can claim it and correct the data, or ask for a correction or removal at contato@meutatame.com.br.

If you are an instructor or appear in a photo. You do not need an account. We show what the gym published — name, ranks, short bio, Instagram and photo — so people know who teaches there. To correct or remove your data or a photo you appear in, talk to the gym, file a report (Denúncia) on the photo or the instructor, or write to contato@meutatame.com.br. Requests about images of people under 18 come first: we take the photo down as soon as we receive the request. Other requests are handled within 2 business days.

If you file a report (Denúncia). About a gym: we keep the category, your description and, if you give it, your email; if you are signed in, the report is linked to your account. About a photo or an instructor: we keep your name, your email, your relation to the content, the reason and any details you write, and we send a code to your email to confirm it. As soon as you confirm, the content comes down. Only Meu Tatame curators and its administrator see this data. The gym is never told who filed the report, unless a court orders it.

Protection against bots and abuse. On the photo or instructor report form, and on the gym report form when you are not signed in, we use Cloudflare Turnstile to tell people from bots: it looks at technical browser signals and your IP address. We also count how many submissions — such as reports, claims, new gyms, invitations and photos — come from each network, and how many photo or instructor reports come from each email. These counters are kept at Upstash, in the United States; they hold only a scrambled code derived from the IP or email, never the IP or email itself, and disappear within 2 days.

What we use the data for

• Keeping your account working and talking to you about it: email confirmation, sign-in link, password reset, deletion confirmation. These emails come from no-reply@meutatame.com.br.
• Displaying the information, instructors and photos each gym publishes.
• Receiving and reviewing reports, taking reported content down and telling the gym, without saying who reported it.
• Protecting the site against bots and abuse and, when needed, blocking an account. For this, when searching accounts, a curator sees only the name and email.
• Providing support, keeping the site secure and handling requests about data. For this, the Meu Tatame administrator — the person at AECOder responsible for the platform — can see an account's data. On screen, they never see the password, the codes, the date of birth or the IP address: only whether the person is over or under 18. When you ask for a copy of your data, they generate the same file you download in Settings, to deliver it to you. Every look and every action is logged.
• Enforcing the minimum-age rule.
• Understanding how the site is used and improving it — only with your consent.
• Finding and fixing technical errors.
• Meeting legal obligations.

We do not sell your data. We do not use your data for advertising. We do not profile anyone's behaviour — least of all people under 18.

Legal bases: performance of a contract (your account), consent (usage analytics), legitimate interest (security, protection against abuse, error fixing, reviewing reports and displaying what gyms publish, including instructors' data and gym data taken from public sources), the regular exercise of rights (keeping records of authorisations and reports to answer complaints) and compliance with a legal obligation.

Who we share with

We do not share your data with advertisers or with gyms. We use a few services to run the site; each receives only what it needs:

• Vercel: hosting for the site and the app.
• Neon: database, in the São Paulo region.
• Cloudflare: DNS, forwarding of the contato@ email, storing and delivering photos (stored in the United States and delivered through a worldwide network) and Turnstile, the bot check on the report forms.
• Resend: sending Meu Tatame's emails, such as account emails, report codes and notices, and notices to gym managers.
• Upstash (United States): anti-abuse counters, holding a scrambled code of the IP or email, never the IP or email itself.
• Google: only if you choose to sign in with Google.
• PostHog (European Union): usage analytics, only after you accept.
• Sentry (European Union): error monitoring. When something breaks, it may capture the technical context of the failure, such as the page, the browser and the error message.

Some of these services are outside Brazil, mainly in the United States and the European Union. We transfer only what is needed to run the site, and each provider is bound by contract to data-protection obligations compatible with the LGPD. You can ask for details of these safeguards at contato@meutatame.com.br.

How long we keep it

• Account data: as long as the account exists. When you delete it, we erase your personal data permanently. What you published on a gym — information, instructors and photos — stays on its page, without your name; if you want something taken down, remove it first or write to us. Only these stay: the record of the instructor authorisations your account declared (email and date), for up to 3 years, to answer any complaint; the photo or instructor reports you filed, for the period below; the text of the reports you filed about a gym, unlinked from you and without your email; and, if you were a curator, your acceptances of the confidentiality commitment, for the period below.
• Photos: while they are published. A removed photo is erased from storage right away; temporary cached copies disappear within a few hours.
• Reports about a gym: up to 3 years after they are resolved, or until the gym is deleted, whichever comes first. The email you give is only used to tell you the report was resolved: we erase it when the report is resolved, or after 90 days if it is still open.
• Photo or instructor reports: without confirmation by the code, we erase the report within 2 days (right away if the email with the code cannot be sent). After confirmation, the content stays down and is deleted within 1 to 2 days, unless the curators restore it. The confirmed report — name, email, relation, reason, details, decision and dates — is kept for 3 years after the decision, only to answer complaints, even if the photo, the instructor or the gym no longer exists.
• Removal requests sent to contato@: the email and the record of how we handled it, for 3 years.
• Anti-abuse counters: up to 2 days.
• Account blocks: the reason, while the block lasts. The record that the account was blocked or unblocked stays in the curators' log; if the account is deleted, it is no longer linked to it.
• Log of curator and administrator actions — what was done, when and on which account or gym, including blocks, exports and account look-ups: for 3 years; if the account is deleted before then, the log is no longer linked to it and the name and email are removed from it.
• Two-step verification: while the method is active; we erase it when you remove it, when it is reset at your request or when you delete the account.
• Curator invitations: an invitation that was not accepted is erased 90 days after it expires or is cancelled. The acceptance of each version of the confidentiality commitment — email, version and date — is kept while you are a curator and for 3 years after you leave the Curadoria, even if the account is deleted, to prove the commitment made.
• Gyms listed by curators: the data and the source link, as long as the gym exists.
• Sessions: they expire on their own or when you end them.
• Technical and analytics records: for each provider's default period.
• Accounts of people under 13: deleted as soon as the age is given.

Your rights

At any time, you can:

• See and correct your data in Settings.
• Export your data in Settings, including the reports you filed. Anything not in the file, such as curators' internal notes about you, you can ask for at contato@meutatame.com.br.
• Delete your account in Settings. We ask for an email confirmation; after it, deletion is permanent.
• Withdraw consent for usage analytics.
• Ask for information, object to a use or complain: contato@meutatame.com.br. We reply within 15 days, the LGPD deadline.
• If your account is blocked, or you filed a report without an account, ask for access, correction, export or deletion of your data at contato@meutatame.com.br, from the same email. The same deadline and rights apply.

You can also complain to Brazil's National Data Protection Authority (ANPD).

Minors

Meu Tatame does not accept accounts from people under 13. If one is created, it is deleted immediately. Between 13 and 17, the account works normally, but the profile is never public and stays out of any behavioural analysis or advertising.

Gym photos may show students under 18, for example in Kids and Juvenile classes. The gym may publish them only with the parents' or guardians' permission and always in the child's or teenager's best interest. Parents and guardians can ask for removal at any time at contato@meutatame.com.br; we take the photo down as soon as we receive the request.

Wrong information about a gym

If you find wrong, abusive or fraudulent data on a gym, use the report (Denúncia) on its page. A Meu Tatame curator reviews it. If the problem is a photo or an instructor, use the report on that photo or instructor: it takes the content down as soon as you confirm it.

Changes to this policy

When we change something relevant, we update the date at the top and, if you have an account, we let you know by email.