Privacy policy
Last updated 16 July 2026
This describes what RollCall actually stores and who touches it. It is written to be read, not to be survived.
RollCall holds children's records, because kids train jiu jitsu. That part is treated with more care than the rest, and is covered in its own section below.
Who is responsible for what
Your gym decides what to collect about its members and why; it is the controller of that information. RollCall stores and processes it on your gym's instruction, as its processor. If you are a member and want your record changed or removed, ask your gym first, because they own that decision. If they cannot help, contact us and we will.
What we collect
Accounts
Name, email address, and a hashed password. If you sign in with Google we receive your name, email address, profile photo, and a Google account identifier. We never receive your Google password.
Gym records
- Membership details: role, staff title, join date, and status.
- Attendance: which class you checked in to, when, and how.
- Belts and stripes, promotion history, and technique progress.
- Dues, payments, receipts, and any payment handles your gym records for you.
- Waivers you sign, including guardian sign off for minors.
- Messages, community board posts and comments, and training log entries you write.
- Optional profile details: photo, nickname, address, mobile number, and social links.
Technical
Server logs, and Google Analytics on the public marketing site and documentation only. The member app is deliberately excluded from search engines and is not analytics tracked. If you turn on notifications, we store a push subscription for your device so we can send them.
What we do not do
- We do not sell your data, and we do not share it with advertisers.
- We do not read your gym's private messages. The in app assistant answers only from our public help articles and never sees your gym's data.
- We do not use your gym's data to train AI models.
- We do not store card numbers. Card and e wallet details go directly to the payment provider.
Who else processes it
RollCall runs on a small number of providers, each doing one job:
| Provider | What it does | What it sees |
|---|---|---|
| Namecheap | Hosting and databases | Everything stored, at rest |
| Brevo | Sends our email | Recipient name, email, message content |
| PayMongo | Member dues by card, GCash, Maya | Payer name, email, amount |
| PayPal | Your gym's RollCall subscription | Billing contact, amount |
| Sign in, and analytics on public pages only | Account identity; page visits on public pages | |
| Gemini and Groq | The in app help assistant | Only the question you type; never your gym's records |
Our servers are in the United States, so your information is stored outside the Philippines. Payments through GCash, Maya, GoTyme, or bank transfer are reconciled by reference code, so the transfer itself happens between you and your bank or wallet, not through us.
Children
Kids train, so RollCall holds records for minors: name, attendance, belt and stripe history, and any photo the gym uploads. Under the Philippine Data Privacy Act (RA 10173), that information is handled on these terms:
- A child's record is created by the gym, not by the child. Signup is not open to minors directly.
- A parent or guardian can be linked to a child's record, and can see attendance and grading and pay dues from their own login. A child does not need their own phone or account.
- Waivers for a minor require guardian sign off, which is recorded with the signature.
- Ask your gym to remove a child's record and they can. Ask us and we will help if they cannot.
How long we keep it
While your gym has an account, its records are kept so attendance history and belt progress stay intact, since a time in grade clock is worthless if it resets. If your gym's plan lapses, nothing is deleted; data over the free limits simply becomes read only until you upgrade. When a gym asks us to delete its account, we delete its data, keeping only what tax law requires us to keep about payments.
Your rights
Under the Data Privacy Act you may ask to see your information, correct it, object to how it is used, have it erased, or receive a copy of it. Ask your gym first, since they control their roster. If they cannot help, or the request is about RollCall itself, use the contact form on the Support tab in the app and we will respond.
Security
Traffic is encrypted in transit. Passwords are hashed, never stored in readable form. Each gym's data is isolated from every other gym's at the query level, so one gym cannot read another's roster. No system is perfectly secure, and we will not claim otherwise; if a breach affects you, we will tell you and the National Privacy Commission as the law requires.
Changes
If this policy changes in a way that matters, we will say so in the app rather than quietly editing this page and updating the date.
Contact
Use the contact form on the Support tab inside the app, or reply to any email RollCall sends you. A person reads it.