KataMarrant is a personal-scale, open-source judo trainer. The app runs locally
on your device; this server (katamarrant.weill-duflos.fr) only
exists so you can sync the same training history across two or more devices.
There is no advertising, no analytics, and no third-party data sharing.
no ads · no trackers
What we collect
If — and only if — you sign in to enable cross-device sync, the server stores:
- Your email address. Used solely to send magic-link sign-in emails and account-deletion confirmation emails.
- Per-technique stats. The slug of each judo technique you've practised plus correct/wrong counts and the last time it was shown.
- Quiz log. An append-only history of answered questions: technique slug, whether you got it right, mode, timestamp, and response time in ms.
- App settings. Your scheduler and UI preferences.
- Gamification state. Streak / level / XP blob produced by the app.
- Daily progress. Per device, per local day: questions answered, correct count, goal-met flag, XP earned.
We never collect: your name, location, contacts, IP-derived profile,
device fingerprint, or any data outside the KataMarrant app.
How sign-in works
KataMarrant uses passwordless email sign-in (magic link + paste-fallback short
code). When you request a sign-in, the server sends one short-lived email with
a link that expires after 15 minutes. The link is one-shot: clicking it (or
pasting the code) consumes the attempt. No password is ever stored.
Where the data lives
- One self-hosted SQLite file on a server I (Antoine Weill--Duflos) operate, in France/EU.
- HTTPS only, behind a reverse proxy with TLS termination.
- Backups are encrypted snapshots of the same SQLite file; no third-party processor sees your raw data.
- Outgoing email is relayed through an SMTP provider for sign-in / deletion emails. The provider only sees the recipient address and the message itself.
Retention
- Your sync data is kept until you delete your account — see below.
- Pending sign-in attempts auto-expire 24 hours after their TTL lapses.
- The mailer activity log keeps the last 30 days of send/throttle/error rows for abuse-monitoring; older rows are auto-deleted.
- Rate-limit counters are pruned 24 hours after their last hit.
Your rights
You can ask for a copy of your data, correction of any field, or full deletion
at any time. The fastest path for deletion is the self-service form:
👉 Delete my KataMarrant account
For everything else (export, correction, questions): email
support_katamarrant [at] weill-duflos [dot] fr.
Replies usually arrive within a few days.
Security
- JWTs are HMAC-signed with a server-side secret; sign-in short codes are stored as HMAC-SHA256 hashes, never in plaintext.
- The sign-in endpoint is rate-limited per IP and per email to prevent it being abused as an SMTP relay.
- If a device is lost, signing out from another signed-in device, or letting the JWT expire (default 30 days), revokes its access.
Changes to this policy
Material changes will be flagged in the app's release notes and at the top of
this page. The current version of this document is the authoritative one.
