EMAC Privacy Policy
Extreme Martial Arts Centers · Effective October 20, 2026 (policy version 2026-10-20) · Updated October 23, 2026: added the section for staff who add videos, and a support section. Updated October 27, 2026: corrected the description of what YouTube's video player and Google Sign-In collect; how EMAC itself handles your information hasn't changed.
Who we are
The EMAC app is the members' video library of Extreme Martial Arts Centers, which operates it. Privacy questions: teamextreme04@gmail.com.
What the app does
Members sign in with the email address on their gym membership and watch the school's class videos. The app has no in-app purchases and no social features, and EMAC itself shows no ads. Videos play in YouTube's player, and YouTube may show its own ads on them (see "YouTube and Google"). Before you can watch, the app asks you to agree to this Privacy Policy and the YouTube Terms of Service.
Information we use
| What | Where it comes from and why |
|---|---|
| Your membership's contact email, membership ID, active or inactive status, and whether you're enrolled in the gym's video plan | From the gym's membership system (Gymdesk), added by our staff or sent automatically when your membership changes. Used to recognise you as a member and decide which videos you can watch. |
| Your email address and password | From you, when you set up the app, to sign you in. The password is stored only as a one-way hash; we can't read it. |
| One-time sign-in and reset codes | Created by us and emailed to you to confirm the email address is yours. Stored only in hashed form; they expire after 10 minutes. |
| A sign-in session | Created when you sign in, to keep you signed in. Kept on your phone in its secure storage (the iOS Keychain), and on our server only in hashed form. It ends after 30 days of inactivity, and always after 90 days. |
| Your agreement to this policy | Recorded on your phone, in its secure storage, so the app knows you've agreed to the current version. |
| A record of account events (for example "password set") with the time | Kept on our server for security and support. |
For members, EMAC doesn't collect your name, phone number, date of birth, location, contacts, photos or videos, and doesn't use your device's advertising identifier. Staff who use the upload feature are the exception for videos: the video a staff member picks, with its title, description and free marker, is sent from their phone to YouTube (see "If you are a member of our staff"). EMAC adds no analytics or advertising software of its own. Two Google components inside the app collect information themselves, as described below: YouTube's video player, used by everyone, and Google Sign-In, which only staff use, to connect the school's YouTube channel.
Our server's logs record only the kind of request, the address path and the result, not your email, codes or passwords. Your device's IP address is used briefly in memory to stop repeated requests; it isn't written to our logs.
YouTube and Google
The videos are YouTube videos, played in YouTube's embedded player. EMAC uses YouTube API Services. When you play a video, YouTube receives the request and may collect information as described in the Google Privacy Policy. By using the app's video features, you agree to the YouTube Terms of Service.
YouTube's player. Videos play in YouTube's embedded player, in its privacy-enhanced mode. When the player loads, it sends YouTube basic information so it can show the video, check whether it can play and any restrictions, and prevent fraud and abuse. When you play a video, it sends more, such as information about your playback. YouTube can place or read cookies and similar identifiers stored by the app on your device, and Google may associate what it collects with those identifiers. Google says it may use information it receives from sites and apps that embed YouTube videos, such as the IP address and cookies, to deliver and improve its services, protect against fraud and abuse, and measure the effectiveness of advertising. Google says that views in this mode aren't used to personalize your YouTube experience or the ads you see elsewhere, and that any ads shown on these videos aren't personalized. YouTube may show ads on the videos. Google's handling of this information is described in the Google Privacy Policy.
To keep the app's video list in step with the school's YouTube channel, our server uses the YouTube API Services with a restricted, read-only key to read our own three class playlists (video titles, order and visibility) and to check videos our staff have added or edited. This happens on our server only, and none of your personal information is sent to it. Video preview images are fetched by our server, not your phone. Members are never asked to sign in with a Google account. Staff who add videos connect the school's YouTube channel through Google, as described below.
Other services that see some information
- Gymdesk (membership software) holds the gym's membership records; we receive only the fields listed above.
- Google (Gmail): sign-in and reset codes are sent from the school's Gmail account, so Google handles those emails.
- Hosting: our server is rented from Hetzner and located in the United States (Hillsboro, Oregon).
We don't sell your information. Apart from the Google components described in this policy, which collect information directly under Google's own policy, we don't share it with anyone else for their own purposes.
If you are a member of our staff
Staff of the school also see Manage videos in the app. With it, staff can add a class video to the school's YouTube channel and change the title, description and "free" marker of the school's existing videos. Members never see these controls, and our server checks that the account belongs to staff on every request.
- Connecting YouTube. To do this, a staff member connects the school's YouTube channel through Google's own sign-in screen, on their phone, which asks them to let the app manage YouTube videos. This is not how anyone signs in to the app. Google's sign-in token stays on that staff member's phone, in its secure storage (the iOS Keychain). Our server never receives or stores it. Staff can remove the app's access at any time in their Google Account settings.
- Google Sign-In. Google Sign-In, the component staff use to connect the school's YouTube channel, is made by Google. It is included in the app for everyone, but only the staff-only Manage videos screen uses it; members never reach it. Signing in shares the Google account's basic profile (name and email) with the app on the staff member's phone. The app then checks that the account manages the school's channel and stops if it doesn't. Signing in happens on Google's own sign-in page, shown by the app. Google declares that this component may collect the staff member's name, email address, phone number, approximate location, account and device identifiers, usage data and other data, for sign-in and for Google's analytics, and says it records the sign-in permission with the account's identifier and may use the IP address to estimate general location to prevent fraud. That collection follows Google's policy for the component. The app doesn't send the Google profile to our server.
- Uploading and editing. The chosen video file, with the title, description and free marker the staff member enters, goes directly from the phone to Google's YouTube service, into the school's channel as an unlisted video in the matching class playlist. Edits also go from the phone directly to YouTube. Our server never receives the video file. Staff pick the video with the phone's own Photos or Files picker, which gives the app only the video they chose. The app doesn't browse the photo library.
- What our server keeps. For each upload: the title, class category, whether it's free, the file's name, type and size, a fingerprint of the file (a SHA-256 checksum, used to make sure the right file was uploaded), the resulting YouTube video ID, the upload's progress and status, and which staff account added it and when. For each edit: the video's YouTube ID, the title, description and free marker before and after, and which staff account made the change and when. These records and our account-event log are kept to show what changed and who changed it.
- YouTube API Services. Uploads and edits use the YouTube API Services, so the YouTube Terms of Service and the Google Privacy Policy apply. Uploaded videos are published under the school's channel, and Google's policies govern what YouTube does with them.
Children
App accounts belong to the email address on the gym membership. For students under 13, a parent or guardian signs in with the email on the child's membership; children under 13 should not have their own app accounts. The app doesn't ask for or check anyone's age.
Keeping and deleting information
We keep your app account while it exists. Expired sign-in codes and sessions stop working.
Delete your account in the app: Account → Delete account (you'll confirm with your password). This removes your app account and everything the app created for it: your login, your sign-ins on all devices, pending codes, the link to your gym record, staff video grants, your app history and queued app emails. The gym's own membership records, which come from Gymdesk and are held for every member, are kept, so while you're a member you can sign up again later with your membership email. After deletion we don't send you automatic app emails unless you sign up again. Backup copies of our database may still contain deleted data for up to about 15 days, until the daily cleanup removes them.
Server backups: we make backup copies of our database on the same server, before system updates. A daily cleanup deletes each backup copy once it is more than 14 days old. Until then a copy may still contain your deleted app data, so deleted data can remain in backups for up to about 15 days. This cleanup does not apply to the gym's Gymdesk records or to emails we've sent.
Emails we've sent: copies of sign-in and reset emails stay in the school's Gmail account until we delete them; they aren't deleted automatically.
If you are staff: if your account has uploader access, staff remove it first; then you can delete the account in the app as above. Records of the videos you added or edited (described in the staff section) are kept after your account is deleted, because they document changes to the school's YouTube channel, but they no longer lead back to your email address. Videos you uploaded stay on the school's YouTube channel.
You can also ask us to delete your app account by emailing teamextreme04@gmail.com.
Support
For help with the EMAC app (signing in, your membership's video access, or deleting your account), email teamextreme04@gmail.com or ask our staff at Extreme Martial Arts Centers. You can delete your EMAC account in the app at any time: Account → Delete account.
Changes and contact
If the way we handle members' information changes, we'll update this page and the app will ask you to agree to the new version. Questions: teamextreme04@gmail.com.