Privacy Policy

1. Overview

This Privacy Policy describes how Social Butterfly AI LLC ("Company," "we," "us," or "our"), a limited liability company organized under the laws of the Commonwealth of Pennsylvania, collects, uses, shares and retains information in connection with mmaGPT ("the Service"), available at mmagpt.app and as an installable web app.

This policy applies to three groups of people:

• Individual users. Adults who create their own account on a free or paid plan.
• Athletes on an academy seat. People who use mmaGPT through a gym, academy or organization that pays for their seat. This includes junior athletes aged 13 to 17, who may only use the Service this way and only with parent or guardian consent.
• Visitors. People who browse our public pages, open a shared report, pay through a parent payment link, book an academy consultation, join a waitlist or contact support without creating an account.

We use analytics and advertising measurement tools, in the browser and from our servers. Section 4, Cookies, Tracking and Advertising, explains exactly what runs and how to turn it off.

We do not sell personal data for money. Our advertising measurement with Meta and our Google Ads remarketing may still count as "sharing" for cross context behavioral advertising under California law. See Data Sharing and Subprocessors and Your Rights.

By creating an account or using the Service, you acknowledge that you have read and understood this Privacy Policy.

2. Information We Collect

2.1 Account information. Email address, authentication credentials, display name, preferred language, account type, and role assignments such as athlete, coach, gym owner, organization administrator, agency user or partner. When you join an academy, we also collect your birth year or date of birth to confirm your age.

2.2 Profile and training data. Discipline, skill level, years of experience, rank or belt where applicable, weight class, height and reach where you provide them, training goals, weekly training frequency, training history, streaks, and the focus areas you select for each session.

2.3 User generated content. Video files you upload or record in the app, links to videos hosted elsewhere (such as YouTube or Vimeo) that you submit for analysis, generated thumbnails and marked subject frames, session metadata, session notes and other text you enter.

2.4 AI derived data. Generated feedback and scores, session findings, athlete snapshots, adaptive curricula, weekly focus records, drill history, messages you exchange with the AI coach chat, audio generated when you have feedback read aloud, and a coaching memory stored with your account that the AI builds across sessions so later feedback can refer back to earlier work.

2.5 Opponent and training partner information. If you build an opponent profile, we store the name, stance, tendencies and notes you enter about that person. Footage you upload may also show training partners and coaches.

2.6 Academy and roster data. Gym or academy membership, assigned coach, group assignments, seat type, invite records, join requests, and coach notes about you. For a junior seat, the academy supplies the student's full name, the parent or guardian's full name, and the student's date of birth, and a parent or guardian consent form is generated and stored in restricted storage that only that academy's managers and our administrators can reach.

2.7 Shared reports and payment links. If you create a share link for a report, we store the link, its expiry and whether it has been revoked. If you create a parent payment link, we store the link, the plan chosen and its expiry, and the payment made through it.

2.8 Communications and support. Emails you send us, support requests (which can be submitted without an account), unlisted academy requests, waitlist entries, ambassador applications, consultation bookings, and, if you turn on notifications, the push notification subscription your browser gives us.

2.9 Payment and billing information. Payments are processed by Stripe, which collects and stores your card details under PCI DSS. Checkout collects your billing location so tax can be calculated. We store Stripe customer, subscription and payment method identifiers, plan tier, subscription status, credit balances and transaction details. If you buy through Whop, Whop processes the payment and sends us your email address and membership details so we can activate your account. We do not store full card numbers or bank account details.

2.10 Device, technical and usage data. Device type, operating system, browser, IP address, user agent, pages viewed, feature usage and funnel steps, error reports and performance traces, and rate limiting records.

2.11 Attribution, referral and campaign data. UTM source, medium and campaign values, signup source, advertising click identifiers, referral codes and links, referral click records including IP address and user agent, a hashed IP address and user agent recorded when a referral is locked to an account, and an attribution audit log.

2.12 Information about visitors who are not registered users. Waitlist entries, booking leads including a hashed attendee email and email domain from calendar bookings, ambassador applications, unlisted academy requests, support requests, and academy page visit records containing IP address, user agent, advertising cookie identifiers and the page URL.

3. How We Use Information

• Delivering analysis and feedback. Processing your video or video link and session details through AI models to produce technical feedback, scores, drills, chat replies and read aloud audio.
• Personalizing coaching. Keeping your coaching memory, snapshots, curricula and weekly focus so feedback builds on your history.
• Operating academy features. Running rosters, invites, seats, groups, age checks, consent records and coach visibility, so your coaches and academy administrators can review your sessions.
• Managing subscriptions, credits and seats. Billing, session allotments, add on balances, credit refunds for failed analyses, upgrades, downgrades, referral rewards and rewards points.
• Improving the Service and our AI systems. We score engagement signals on generated feedback, such as whether it was viewed, whether a training session was started from it, whether the same focus was run again and whether the user returned within 14 days. Feedback that scores highly may be distilled into coaching material, such as scripts, drills and cues, with names removed, and that material may be used when generating feedback for other users. The record keeps an internal reference to the source account and submission so it can be audited or withdrawn. You may opt out of this use by emailing support@mmagpt.app.
• Transactional messages. Account, security, billing and session emails, and push notifications if you turn them on.
• Marketing and lifecycle email. Product announcements, feature launches, digests and re engagement messages, each with an unsubscribe link.
• Advertising measurement and attribution. Measuring which campaigns, creators and partners produce signups and subscriptions.
• Fraud prevention, rate limiting and abuse detection. Including referral fraud checks and quota enforcement.
• Legal compliance. Tax, accounting and responding to lawful requests.

4. Cookies, Tracking and Advertising

4.1 Essential technologies. We use browser storage for your sign in session, your language and cookie choices, attribution values carried from the link you arrived on, and a service worker that makes the web app installable and work offline. These cannot be turned off while you use the Service.

4.2 Analytics. Google Analytics 4 (measurement ID G-CPNB2GG6S4) measures page views, feature usage and funnels and sets Google Analytics cookies. We also record product funnel steps in our own database, and our error monitoring provider, Sentry, records errors and a sample of page performance traces. If you allow advertising cookies, Google Analytics also shares visit data with Google Ads, and while you are signed in, a hashed (SHA-256) copy of your email address, so we can measure our Google ads and show mmaGPT ads to people who visited our site (remarketing). If you reject advertising cookies, Google Analytics runs with Google's ad signals turned off. You can also manage Google ads at adssettings.google.com.

4.3 Meta Pixel. The Meta Pixel (ID 1235756575336201) measures ad performance and uses Meta cookies, including _fbp and, when you arrive from a Meta ad, _fbc. Our own code also stores these two identifiers as first party cookies when you visit, so a later signup or purchase can be matched to the ad that led to it.

4.4 Server side events to Meta. Our servers send events to Meta through the Meta Conversions API, including registration, video submitted, analysis viewed, paywall and upgrade offers shown or clicked, checkout started, checkout completed, purchase and subscription with value and currency, and academy consultation leads. Identifying fields such as email address, first name, last name, phone number and your account ID are SHA-256 hashed before they are sent. We also send the Meta cookie identifiers, IP address and user agent so Meta can match the event. These server side events are not controlled by the cookie banner. To stop them for your account, email support@mmagpt.app and we will exclude it.

4.5 Creator attribution pixel. Our creator partner program uses an attribution pixel from Trybe, served from track.mmagpt.app, to credit creators for the visitors and signups their content brings in. It loads on our pages.

4.6 Academy visit logging. When anyone visits an academy page, we record the IP address, user agent, Meta cookie identifiers and page URL to attribute academy interest to campaigns. Visits that do not lead to a consultation booking are deleted after 30 days. Visits that do are kept with the booking record.

4.7 Embedded content. Some public pages embed content from other services, such as YouTube videos, a Google Calendar booking widget and a third party badge image. When those load, the provider receives your IP address and browser information under its own privacy policy.

4.8 Your choices. A cookie banner is shown on your first visit. If your browser's time zone and language indicate you are in the European Economic Area, the United Kingdom or Brazil, Google Analytics and the Meta Pixel are not loaded until you accept. Elsewhere they load by default and you can reject them at any time using the "Cookie settings" link in the site footer. You can also use your browser's cookie controls, the Google Analytics opt out browser add on, and your Meta ad preferences.

4.9 Global Privacy Control. If your browser sends a Global Privacy Control signal, we treat it as a rejection of advertising cookies: the Meta Pixel is not loaded and Google Analytics runs with ad signals turned off. To also opt out of the server side events described in 4.4, email support@mmagpt.app.

4.10 OpenAI Ads measurement. When advertising measurement is allowed, the OpenAI Measurement Pixel measures page views, completed signups, accepted video submissions and checkout starts. It may automatically detect and hash supported customer information for conversion matching. Our servers measure confirmed initial payments and the first paid payment after a trial, including amount, currency and available opaque OpenAI click and browser references. The server checks current account permission before sending a purchase. We do not include video files, filenames, training details or feedback in these event payloads. Rejecting advertising or enabling Global Privacy Control stops OpenAI browser events and updates server permission when you are signed in.

The cookie table is on the Cookies and Tracking page.

5. AI Processing

5.1 Automated analysis. Your video or video link, session details and relevant history are processed automatically by AI models run by third party AI infrastructure providers to produce feedback, chat replies and read aloud audio.

5.2 Model training. We use AI infrastructure on terms under which our providers do not use customer content to train their general purpose models, and we rely on their contractual commitments to that effect. We cannot guarantee a third party's conduct.

5.3 Limitations. AI outputs may be inaccurate, incomplete or unsuitable for your circumstances. They are not medical advice and are not a substitute for a qualified coach.

5.4 Human review. In the individual product, no human reviews your video as part of the standard analysis. In the academy product, listed coaches, the gym owner and organization administrators can open an athlete's video and full feedback. Our administrators may access submissions for support, abuse investigation and quality review.

6. Academy and Organization Accounts

6.1 Who can see your data. If you are on an academy seat, the following people can see your profile, sessions, videos, feedback, notes and progress: your assigned coach, other coaches listed as staff at your academy, the gym owner, and administrators of the parent organization if your academy belongs to one.

6.2 The academy decides who its coaches are. We do not control which staff an academy lists. Adding or removing a coach changes who can see athlete data, and that is the academy's decision and responsibility.

6.3 Our role. For roster and athlete data handled on an academy's behalf, we act as a service provider or processor and follow the academy's reasonable instructions. For our own platform operations, including security, billing, abuse prevention and improving the Service, we act as a controller.

6.4 Leaving an academy. When you leave an academy, or when the academy's contract ends, the academy's staff lose access to your account going forward. Your account, history and feedback remain yours, and your video retention reverts to the window of your own plan, which may be shorter than the academy window.

6.5 Public academy pages. Each academy has a public page showing its name, city, parent organization and a button to request to join. It does not list athletes.

7. Children and Junior Athletes

Individual accounts are for adults aged 18 and over. By creating one, you confirm you are 18 or older.

Athletes aged 13 to 17 may use mmaGPT only through an academy seat, and only after a parent or legal guardian has signed the consent form for that athlete. Uploads are blocked until that consent is on file. A minor who asks to join an academy is told they need an invitation from the academy. Children under 13 may not use the Service, and the academy invite and join flows reject an age under 13. If we learn an account belongs to a child under 13, we delete it.

What we collect about a junior athlete. Student full name, date of birth, parent or guardian full name, assigned coach and academy, training video and session details, and the AI feedback and progress data generated from them. The academy supplies the identity details when it issues the junior seat, and the athlete supplies the training content.

Who can see it. The athlete, the assigned and listed coaches, the gym owner, organization administrators, and our administrators for support and quality review. A parent or guardian can request a copy at any time.

Advertising. We do not show advertising inside the Service.

The academy's responsibility. The academy is responsible for obtaining parental or guardian consent before issuing a junior seat, for keeping the signed consent, and for producing it on request.

Withdrawing consent. A parent or guardian may withdraw consent at any time by contacting the academy or by emailing support@mmagpt.app. Withdrawal stops the athlete's uploads. On request we will also delete the athlete's account and content, as described in Data Retention.

8. Data Sharing and Subprocessors

We share information with the following service providers so they can run parts of the Service for us.

The current list is kept on the Subprocessors page.

Academies. If you are on an academy seat, your data is shared with that academy's staff as described in Academy and Organization Accounts.

People you share with. Anyone who has a report share link you created can see that report's feedback, your first name, any coach notes on it, and the video while it is still stored. You can revoke a link at any time. Someone who opens a parent payment link sees your first name and the plan.

Partners and creators. When you sign up or subscribe through a partner's or creator's referral link or code, that partner sees the conversion, its plan and value, and a partly hidden version of your email address. They do not see your training content.

Legal disclosure. We may disclose information where required by law, subpoena, court order or regulation, or where we believe disclosure is necessary to protect our rights or someone's safety.

Business transfer. If we are involved in a merger, acquisition, financing or sale of assets, information may transfer as part of that transaction, subject to this policy.

Sale and sharing. We do not sell personal data for money. Our advertising measurement with Meta may constitute "sharing" for cross context behavioral advertising under the California Consumer Privacy Act as amended by the CPRA. You can opt out through the cookie settings link in the site footer, a Global Privacy Control signal, and by emailing support@mmagpt.app, which also covers the server side events.

9. Data Retention

9.1 Uploaded video. Video retention depends on your plan.

If you have given us permission to feature a clip on social media, that clip is kept for up to 365 days beyond its normal window while the permission is active. Videos submitted as links stay hosted wherever you posted them; we only keep the link.

When a video is removed, the report keeps two still images from it: the session thumbnail and the frame at your main fix. The fix still is deleted when you delete that report, and both are deleted when you delete your account.

9.2 Account data. Kept while your account is active.

9.3 Account deletion. When you request deletion, your account enters a 30 day grace period. Signing back in during that window cancels the request. After it, the account and its stored files are permanently deleted.

9.4 Feedback and training history. Kept with your account so progress tracking works, and deleted with the account.

9.5 Academy visit records. Deleted after 30 days unless they led to a consultation booking.

9.6 Junior consent forms. Kept for the duration of the academy relationship plus any period required by law.

9.7 Shared and payment links. Report share links last until they expire or you revoke them. Parent payment links expire after 7 days.

9.8 Email suppression lists. Kept indefinitely so we keep honoring your unsubscribe.

9.9 Financial records. Kept as required by tax and accounting law.

9.10 Derived coaching material. Coaching material distilled from feedback, as described in How We Use Information, has names removed and may persist after the source content is deleted.

10. Data Security

We use technical and organizational safeguards to protect information against unauthorized access, alteration, disclosure or destruction. These include encryption in transit and at rest, database access policies so each account can only reach its own data, restricted storage with time limited signed links for video and consent forms, rate limiting on sensitive operations, audit logging of administrative actions, and least privilege access.

No method of transmission or storage is completely secure and we cannot guarantee absolute security. You are responsible for keeping your account credentials confidential.

If a breach affects your personal data, we will notify you and the relevant authorities as required by applicable law.

11. Your Rights

11.1 Everyone. You may request access to your personal data, correction of inaccurate data, deletion of your data, a portable copy, and closure of your account. Account deletion is available in your settings and is subject to the 30 day grace period. Email support@mmagpt.app for anything else. We respond within 30 days, or within 45 days where the law allows an extension and we tell you why.

11.2 California residents (CCPA as amended by the CPRA). In the last 12 months we have collected the following categories of personal information: identifiers, customer records, commercial information, internet and network activity, geolocation inferred from IP address, audio and visual information in the form of uploaded video, professional or athletic information, inferences drawn to personalize coaching, and, where an academy provides it for a junior seat, information about a person under 18. We have disclosed identifiers, commercial information and internet activity to the service providers listed in Data Sharing and Subprocessors for business purposes, and we have shared identifiers, commercial information and internet activity with Meta for cross context behavioral advertising. You have the right to know, delete, correct, opt out of sharing for cross context behavioral advertising, limit the use of sensitive personal information, and not be discriminated against for exercising these rights. Authorized agents may submit requests with written proof of authorization. Use the cookie settings link in the footer and email support@mmagpt.app to opt out of sharing.

11.3 Other US states. Residents of Virginia, Colorado, Connecticut, Utah, Texas and other states with comprehensive privacy laws have rights to access, correct, delete and obtain a copy of their personal data, and to opt out of targeted advertising, sale and certain profiling. Where the law provides it, you also have the right to appeal a denied request. To appeal, reply to our decision or email support@mmagpt.app with the word Appeal in the subject line. We respond to appeals within 45 days and will tell you how to contact your state attorney general if the appeal is denied.

11.4 European Economic Area and United Kingdom (GDPR). Our legal bases are: performance of a contract for account creation, analysis, billing and academy features; legitimate interests for security, fraud prevention, service and AI improvement, and basic product analytics; consent for marketing email, advertising cookies and advertising measurement; and legal obligation for tax and accounting. You have the rights of access, rectification, erasure, restriction, portability, objection, including objection to processing based on legitimate interests, and to withdraw consent at any time without affecting prior processing. You may lodge a complaint with your local supervisory authority. Transfers out of the EEA and UK rely on Standard Contractual Clauses or an equivalent safeguard where required.

11.5 Brazil (LGPD). You have the rights to confirmation of processing, access, correction, anonymization, blocking or deletion of unnecessary or excessive data, portability, information about sharing, information about the consequences of refusing consent, revocation of consent, and to petition the Autoridade Nacional de Proteção de Dados. Email support@mmagpt.app to exercise these rights.

12. International Data Transfers

The Service is operated from the United States and information is processed and stored there and in other countries where our subprocessors operate. Where required, we rely on Standard Contractual Clauses, the UK International Data Transfer Addendum, or equivalent safeguards. By using the Service from outside the United States, you understand that your information will be transferred to and processed in the United States, where data protection law may differ from the law of your country.

13. Push Notifications and SMS

Push notifications. If you allow notifications, your browser gives us a subscription that lets us send account and training notifications through your browser's push service. Turn them off at any time in your browser or device settings.

SMS. We do not currently send text messages. If we add SMS, it will require a separate opt in with the exact consent text shown to you, we will record that consent, and you will be able to reply STOP to opt out or HELP for help. Message and data rates may apply. We do not share phone numbers with third parties for their marketing.

14. Email Communications

Transactional email covers account verification, sign in links, billing receipts and failures, session results, invites, join requests and support replies. These cannot be turned off while your account is active because they are needed to operate it.

Marketing and lifecycle email covers product announcements, feature launches, pricing news, re engagement messages and digests. The weekly digest is on by default and can be turned off in your settings.

Every marketing and lifecycle email contains an unsubscribe link. Unsubscribing adds your address to a suppression list that we keep indefinitely so the preference holds even if you sign up again. You can also manage preferences at /unsubscribe.

15. Content Showing Other People

Training footage usually shows other people, such as sparring partners and coaches, and opponent profiles contain information about a named person. If you upload footage or enter information about someone else, you are responsible for having their consent, or the consent of their parent or guardian if they are a minor.

If you appear in footage someone else uploaded, or believe information about you was entered without your consent, email support@mmagpt.app with enough detail to identify the content. We will review the request and, where appropriate, remove the content and the analysis derived from it.

16. mmaGPT in Claude

What we collect. When you use mmaGPT from Claude, Claude gives you a link to sign in to your mmaGPT account and upload a clip. We receive the discipline and short focus note you give Claude, and the clip you upload through that link.

How we use it. Only to produce your analysis, the same way as an upload made directly on mmaGPT. It uses your normal session balance.

Storage and retention. Clips follow your plan's normal retention. Upload links expire after 24 hours if unused. Claude can read the result for 24 hours after it finishes; after that it only receives a link to view it on mmaGPT.

Sharing. Your analysis result is returned to your Claude conversation, which Anthropic handles under its own terms. We do not send your name or email to Claude.

17. Changes to This Policy

We may update this Privacy Policy. For material changes we will give notice by email to the address on your account or in the Service at least 14 days before the change takes effect, and we will update the effective date at the top of this page. Continued use of the Service after a change takes effect means you accept the updated policy.

18. Contact

For privacy questions, requests or complaints, including access, deletion, opt out and appeals:

If we deny a request, we will tell you why and how to appeal. Appeals are answered within 45 days. If your appeal is denied you may contact your state attorney general, your supervisory authority in the EEA or UK, or the Autoridade Nacional de Proteção de Dados in Brazil.