Privacy Policy

Effective date: Oct 6, 2026
Last updated: Oct 11, 2026
Operator: Galen Jauss, an individual operating Konjo
Contact: support@getkonjo.com

This policy describes how Konjo handles information across getkonjo.com, the Konjo student and instructor app, and Konjo Studio, the dashboard schools use to manage their operations.

The short version: We use information to run Konjo, support schools and their members, and fix problems. We do not sell personal information or use it for targeted advertising. Schools direct the use of their school records. Accounts, messages, media, optional location, payments and diagnostics involve different kinds of information and different retention rules. Contact Galen for help accessing, correcting or deleting information.

Table of Contents

1. Who handles your information
2. Accounts and app activity
3. School and family records
4. Children and guardians
5. Messages, media and visibility
6. Payments and purchases
7. Public pages and the website
8. Assistant and Agent
9. Diagnostics and notifications
10. Providers and other disclosures
11. Retention, deletion and leaving
12. Your choices and rights
13. Security and international use
14. Changes and contact

1. Who handles your information

Galen Jauss operates Konjo personally. Konjo is not currently a separate incorporated company. We handle account administration, our website inquiries, support and diagnostics. When a school uses Studio, it directs how its member and business records are used, which staff have access, and the records it needs to keep. We provide the service that holds and processes those records.

Contact your school about its attendance, tuition, waivers, family relationships or staff notes. Contact us about your Konjo account or our own practices. If you are unsure, write to us and we will help route your request. Our legal responsibilities and the school’s depend on the information and applicable law; a school cannot use this policy to remove your rights.

This policy does not cover a school’s activities outside Konjo, a website it links to, or services you use directly under their own policies.

2. Accounts and app activity

We collect your name, email address, date of birth, login details handled by our authentication provider, and your acceptance of legal documents. Your profile may include a photo, bio, school, rank, training goals and preferences. Schools can verify ranks and roles. We also store account creation and sign-in information, device notification tokens when enabled, and records needed to prevent abuse or investigate reports.

You can sign in using the available email, Google or Apple options. Those providers supply account information such as an email and name; Apple’s private relay email can be used. Our authentication provider handles passwords. Konjo does not need your Google or Apple password.

When you use the app, we store what you create and the related activity: training logs and reflections, photos and videos, posts and comments, reactions, follows, direct messages, coaching requests and feedback, class bookings, attendance, events, curriculum progress, flashcard progress and achievements. Calendar subscriptions use a private link; anyone with that link may be able to read the schedule it contains. Keep it private and replace it if exposed.

Optional location. If you permit foreground location access, Konjo can use coordinates from your device to find nearby schools. Those coordinates are sent to our service for the search. If you choose to save your home area during onboarding, the saved coordinates are rounded to a coarser location. Device coordinates can be more accurate than the saved area. You can decline or revoke location permission in device or browser settings; contact us to remove a saved area. We do not use background location tracking.

We do not read your device address book or your entire photo library. We receive the media you choose to upload. Address searches for an event or school may send the text you type to our address-lookup provider.

3. School and family records

A school may enter or import information about a person who has no Konjo login. Depending on the features it uses, this includes:

• Member and family contact details, mailing addresses, dates of birth, emergency contacts, authorized pickup arrangements, guardian links, notes, tags and documents.
• Memberships, attendance, bookings, schedules, rank history, testing, certificates, progress, class plans, homework and instructor feedback.
• Waivers, signatures, signing dates and related verification records.
• Incident reports, injury details, safety instructions and accommodation notes. These can contain sensitive health information. Staff should record only what they are authorized to collect and need for their work.
• Charges, invoices, payments, refunds, credits, authorizations and purchases.
• Staff roles, availability, work hours, pay rates and payroll preparation records. Konjo’s payroll tools are not a place to enter Social Security numbers or bank credentials.
• Leads and trial requests, contact preferences, messages, and a history of changes and approvals.

For an assisted migration, we receive the school’s export, prepare it for review, and ask the owner to approve the setup. Imported records and working files are personal information too. Do not send passwords, full card numbers or unnecessary sensitive information in an import.

We use school records to provide these features, support the school, investigate problems, and enforce access and communication preferences. Reports may flag attendance patterns or suggest follow-up. Such indicators and AI summaries can be incomplete; they are not medical findings or a substitute for a person’s judgment.

4. Children and guardians

Konjo logins are intended for people 13 and older. We ask for date of birth during signup, and the signup and account-completion flows reject ages below 13. Younger students can have profiles managed by an authorized adult. A managed profile does not provide a student login; staff or guardians enter information on the child’s behalf. Turning a managed profile into a login requires the age and account-claim checks.

A guardian or school must have authority to enter and manage a child’s information. Schools should obtain any permissions required for their records, communications, waivers and media. A school account or an adult’s checkbox is not a blanket substitute for legally required parental consent.

People under the age of majority should use Konjo with a parent or guardian’s permission. If you believe someone under 13 has created a login, or that information about a child was collected without appropriate authority, contact us. We will investigate, restrict inappropriate access, and address deletion or other required steps. Legitimate adult-managed school records are different from a child signing up independently.

Guardians can ask to review or correct a child’s information and request deletion. We may need to verify the relationship and coordinate with the school, especially where custody, safety or record-retention obligations are involved.

5. Messages, media and visibility

Your profile and content are shown according to the feature and its audience settings. Profile information can be visible to other signed-in people. Community posts may be visible broadly within the signed-in app or to a selected group. Training visibility defaults to private and can permit access by instructors at your school. Coaching requests and feedback use their own audience rules. School records are available to authorized staff and, where the feature allows it, the member or guardian.

Direct messages store participants, message text, timestamps and read information. Recipients can read and retain what you send. Blocking and reporting tools support moderation. Authorized moderators may review reported messages and relevant context. Deleted message bodies are retained separately for up to 30 days for moderation, then scheduled for removal. Do not treat messages as end-to-end encrypted or assume deleting one removes a recipient’s screenshot or copy.

Photos and videos are stored and delivered by our media providers. Some photo and playback links can be opened by anyone who has the link, even when the post that supplied it has a restricted audience. Do not rely on a hard-to-guess link as a privacy control. School documents and waivers use restricted storage. Removing a post or account and removing the associated media files are separate operations; see Section 11.

Content can describe injuries or other sensitive matters. Share only what is appropriate for the selected audience. Schools should limit access to safety and health information to people who need it. Authorized AI features may process permitted records as described in Section 8.

Schools send email and, where enabled, text messages through Konjo. We keep delivery records, recipients, content and contact preferences so schools can manage communications. Marketing messages provide unsubscribe controls; text messaging requires consent and honors STOP and suppression records. Necessary service messages, such as a receipt or security notice, may still be sent. Contact the school about its choices or us if an unsubscribe is not working.

6. Payments and purchases

Payment forms send card details to Stripe. Konjo stores payment references and limited details such as card brand, last four digits and expiry, plus amounts, payment status, receipts and refunds. Full card numbers are not stored in Konjo’s database.

Your school’s tuition, memberships and other sales are separate from a school’s subscription to Konjo. The school sets its prices and handles its member billing questions. Stripe may request additional information from the school to establish and operate its payment account. Its own terms and privacy policy apply to that processing.

If a merchandise fulfillment feature is enabled, the order and shipping contact details are sent to the fulfillment provider. We do not describe an available integration as proof that it is enabled for every school.

7. Public pages and the website

Our public website does not add advertising cookies or marketing analytics. Hosting providers still receive ordinary request information such as IP address, browser information, requested page and time. Signed-in app and Studio services use session storage or cookies needed to run accounts. Studio also uses page-performance measurement.

When you request a demo or contact us, we receive the information you submit, such as your name, school, email, student-count range and current software. We use it to reply and manage the inquiry. Historical email signups may also remain in our records; ask us to remove yours.

A school’s public trial or event form may collect a name, email, phone, age range and interest details. Payment and waiver links may work through a private token rather than a login. A school’s check-in tablet can search its roster and record attendance. Treat private links and school devices carefully. Public forms also use abuse-prevention information, which can include a hashed IP address or rate limits tied to an email.

8. Assistant and Agent

Konjo Assistant helps authorized staff aged 18 or older review permitted records and prepare documentation. Staff must accept its supplemental terms. It can send conversation content and the school records it is permitted to read to an AI provider through Vercel AI Gateway. This can include recorded safety or accommodation instructions. Staff must review and confirm its proposed documentation changes. It is not for diagnosis, emergencies, payroll or autonomous payment decisions.

Konjo Agent is a separate operations feature governed by separate terms. It is currently disabled for general use. Where made available, it starts in simulation and requires separate authorization before live operation. Permissions, school settings, approval requirements and limits determine what it may do. Simulation can still involve AI processing and stored records; it does not mean no information is processed.

Agent may process permitted school records, inquiries, messages, policies, remembered facts, drafts and operational context. It records runs, actions, approvals, usage and routing information. Its possible live actions differ from Assistant’s documentation workflow; a claim that every Assistant change needs confirmation does not describe every Agent mode.

AI routing and retention. We request a provider route with zero data retention first and require routing that disallows prompt training. If a zero-retention route is unavailable, a no-training route may be used; Assistant displays a fallback notice. That route may retain information under the provider’s applicable terms. These controls do not delete conversations or records stored by Konjo. Our configured model defaults include Google Gemini for Assistant and Agent, and Anthropic Claude for Agent; actual routing can depend on configuration and availability.

AI output can be wrong. Schools must review outputs and the information they allow these tools to use. We do not use private user content to train our own general-purpose AI models. Section 11 explains Konjo’s retention separately from providers’ handling.

9. Diagnostics and notifications

Where product analytics is enabled in the app, PostHog receives selected events such as account creation, joining a school, check-in and training logging. Events for eligible signed-in adults use the Konjo account ID; we exclude minors, accounts whose age is unknown, managed profiles, test/demo accounts and Konjo staff. We do not send names, email addresses, message or training-note content, input values, recordings or full links. Analytics writes no cookies or device storage and does not enable automatic interaction capture, session replay or advertising tracking. Events also contain the app platform and event time. We request no geographic lookup and configure the project to discard client IP data; the provider still receives ordinary network requests. This is separate from Sentry diagnostics below.

Where Sentry diagnostics are enabled in production app builds, events can include your account ID, device and network information, IP address, request details, error messages, stack traces, navigation and interaction breadcrumbs, diagnostic logs, and feedback you submit. Feedback may include your message, optional email and a screenshot.

Mobile session replay is configured to sample 10% of ordinary sessions and sessions with errors at a 100% rate. Replay uses the provider’s default masking for supported text, images and other views. We filter common credential headers before sending error events and breadcrumbs. These protections do not guarantee that all error messages, URLs, logs or feedback are free of personal information. For example, diagnostics may contain a media link. Sentry performance tracing is disabled in the current configuration.

Studio uses Vercel Speed Insights for page-performance information. Upload failures also produce diagnostic records. We use diagnostics to investigate and improve reliability, not to target advertising. Contact us about diagnostic data associated with your account; we do not currently offer a user-specific diagnostics opt-out control.

If you enable push notifications, we store a device push token and send notification content through delivery providers. You can adjust available notification preferences and device permissions. Notification text can appear on a lock screen. Turning off delivery does not necessarily erase the stored token immediately.

10. Providers and other disclosures

We use providers to deliver the service. The information they receive depends on the feature you or your school uses.

Scroll sideways to see every column.

Providers may use their own infrastructure providers. Their notices describe their practices; a provider’s website alone does not establish a particular retention period or contract for Konjo.

We may disclose information to comply with applicable law, respond to valid legal process, protect people and the service, or investigate fraud or abuse. We may involve advisers and support providers subject to appropriate confidentiality. If the operation transfers to another entity, information may transfer with it; applicable notice and legal requirements still apply.

A school can enable integrations or exports that send records to a system it chooses. Ask the school about those recipients. We do not sell personal information or share it for cross-context behavioral advertising, and we do not use advertising identifiers for ad targeting.

11. Retention, deletion and leaving

We keep information for the purposes described here, taking account of the account or school’s activity, requests, security, disputes, and legal recordkeeping requirements. Different records have different lifecycles.

Scroll sideways to see every column.

Deleting your account. Account & settings includes Delete account. The current deletion process can remove linked app content and some school records, while other linked business records can prevent it from completing. It does not reliably separate a login from every school record. If you have school records to preserve, contact us and your school before using it so we can coordinate the request. If deletion fails, email us; you do not have to keep retrying. Account deletion does not cancel a school membership or a Konjo subscription.

Some records may need to remain for lawful school recordkeeping, accounting, disputes, fraud prevention or security. We will assess the request and explain relevant limits; this is not a blanket right to retain everything. Photos, video and other stored files need separate removal from their providers. A file link may continue to work until that cleanup occurs. Copies other people downloaded or independently shared are outside our control. We do not promise immediate deletion from every system or a fixed provider backup deadline.

When a school leaves. Available Studio screens provide CSV exports during service. Galen also provides assisted export support without an additional export fee during service and for 30 days after it ends. Contact us to arrange the records and media you need; this is a human-assisted process, not a promise that every record has a one-click export or that a canceled account retains dashboard access. Payment credentials and third-party secrets are not portable. We review remaining records and removal with the school after export; there is no automatic purge of every school record on day 30.

12. Your choices and rights

You can edit available profile settings, choose audiences, manage notifications, decline optional location access, and use message or marketing controls. Contact us to request access, an export, correction or deletion, or to object to or restrict a use of your information. We may need to verify your identity or authority without requesting more information than necessary. A school’s request cannot override another person’s rights.

Your rights depend on where you live and the applicable law. California and other state laws may provide rights to know, access, correct, delete, receive a portable copy, appeal a decision, and opt out of certain uses. We do not sell information or share it for cross-context behavioral advertising, so there is no such sale or sharing to switch off. We do not discriminate against you for making a privacy request. We will explain any lawful exception or inability to complete a request and how to follow up. Contact us without creating a new account. We aim to respond within 30 days and will meet applicable legal deadlines or explain a permitted extension.

Information we process includes identifiers and contact details; customer, family and commercial records; financial transaction details; internet and device activity; location when permitted; photos, video, audio and messages; training and employment information; and sensitive content such as credentials, health notes or private communications. Providers receive relevant categories for the purposes in Section 10. Some reports produce activity indicators or summaries about members. We do not use those to make medical diagnoses.

Where EU or UK law applies, the basis for our own processing may be providing a requested service, our legitimate interests in security and support, consent for optional processing where required, or legal obligations. Schools determine the applicable basis for records they direct us to process. Consent can be withdrawn without affecting earlier lawful processing. Special-category information may require additional conditions. You may complain to your applicable data-protection authority. We do not claim that accepting this policy supplies every permission required by law.

13. Security and international use

We use encrypted connections, access controls and provider security features to protect information. Access depends on the school, role and feature. No system is guaranteed secure, and public media links have the limits described above. Keep your password and private links secure; contact us promptly about suspected unauthorized access.

If a personal-data breach occurs, we will investigate and notify affected schools, people or authorities as applicable law requires. Different laws have different notice triggers and deadlines.

Our core database is hosted in the United States. Providers may process or deliver information through systems in other countries. International-transfer obligations depend on the people, providers and contracts involved; contact us for information relevant to your school before sending records that require particular contractual or residency safeguards. We do not promise that all processing stays in one country or that every international agreement has already been completed.

14. Changes and contact

When we materially change this policy, we will publish an updated date and give notice appropriate to the change, such as email or an in-product notice. Where additional consent is required, we will seek it before that new processing. A privacy notice is an explanation of our practices, not a waiver of your rights. Previous versions are available on request.

Operator: Galen Jauss, an individual operating Konjo
Email: support@getkonjo.com

Contact us for a privacy request, a question, or an accessible copy of this policy.