Privacy Policy

This Privacy Policy explains what personal information Onlyoss collects, why, who we share it with, and what rights you have. It applies to https://onlyoss.com and the services available through it.

Onlyoss is responsible for the personal information described in this policy. The operator of Onlyoss, who is the data controller, is named with a postal address in section 1 of our Terms and Conditions. For any privacy question, contact support@onlyoss.com.

1. What we collect

Information you give us

• Account details — username, name, email address, password (stored only as a cryptographic hash, never in readable form), and anything you choose to add to your profile such as a bio, avatar, or cover image.
• Content you upload — posts, videos, images, messages and comments.
• Academy information — if you apply for an academy place, the school's name, location, the martial arts it teaches, roster size, and the contact details you give us.
• Correspondence — messages you send us through the contact form or by email.
• Questions you ask Ask Onlyoss, the assistant on our pages for schools: we keep what you write to it and what it answers, with e-mail addresses and phone numbers masked and without your IP address or name, to learn what schools want to know; ask support@onlyoss.com to delete them.

Information we collect automatically

• Usage data — pages viewed, content accessed, and actions taken on the Platform.
• Technical data — IP address, browser type and version, device type, operating system, and referring pages, recorded in our server logs.
• Cookies — see section 5.

Information we do not collect

We never see or store your full card number. Card details are entered directly with Polar, our merchant of record, and never reach our servers. From Polar we receive a transaction reference, what was bought, the amount, the buyer's name, e-mail address and billing country, and whether the payment or subscription is active.

2. Why we use it, and our legal basis

3. Who we share it with

We do not sell your personal information. We share it only with the service providers needed to run the Platform, and only as far as each needs:

• Google, for the maps on school pages. A school's page can show a Google map, and the Google rating, of the place the school chose; your browser loads that map from Google. Google's own Maps terms and privacy policy apply to it. We keep only the identifier of the place, never Google's ratings or reviews.
• Polar Software, Inc. ("Polar"), in the United States, our merchant of record for card payments. Polar sells the subscription, processes your payment, calculates tax and handles your card data under its own privacy policy. It tells us your name, e-mail address, billing country, what you bought and whether your payment or subscription is active, so the right plan or membership is switched on. A purchase we invoice directly does not involve Polar.
• Our hosting provider, which operates the servers and databases the Platform runs on.
• Our content delivery and storage provider, which stores and serves uploaded images and video.
• Cloudflare Turnstile, used on our registration, contact and other public forms to block automated abuse. Cloudflare receives your IP address and browser signals for that check, subject to Cloudflare's privacy policy.
• Our email infrastructure, used to deliver service messages.
• Professional advisers and authorities, where we are legally required to disclose, or need to establish or defend legal claims.

If the business is sold or merged, your information may transfer to the acquirer, who would remain bound by this policy or give you notice of any change.

4. International transfers

We operate from Egypt and our providers operate in several countries, including in the European Union and the United States. Your information may therefore be processed outside your own country, where data protection law may differ. Where we transfer personal data out of the EEA or UK, we rely on appropriate safeguards such as standard contractual clauses.

5. Cookies

We use cookies that are necessary for the Platform to work:

• a session cookie that keeps you logged in;
• a security token cookie that protects forms against cross-site request forgery;
• cookies set by Google reCAPTCHA to distinguish humans from bots.

You can block cookies in your browser, but the Platform will not function properly without the first two.

Analytics cookies (Google Analytics). We use Google Analytics to count visits and pages viewed, and to see which of our ads and forms lead to sign-ups and purchases. It sets the cookies _ga and _ga_*. We never send it your name, e-mail address or phone number. If you are in the EU/EEA, the UK or Switzerland, it runs only after you accept analytics cookies. Everywhere else it is on by default; to switch it off, choose "Reject non-essential" in the cookie box, or open Cookie preferences at the bottom of any page and turn off Analytics cookies. It then stays off.

Marketing cookies (Meta Pixel). The Meta Pixel measures which of our Facebook and Instagram ads brought you here and what you did next. It runs only if you accept marketing cookies, wherever you are, and sets the cookies _fbp and _fbc.

6. How long we keep it

• Account data — while your account is open, and for a reasonable period afterwards to handle disputes.
• Subscription and billing records — as long as tax and accounting law requires, typically several years, even after account closure.
• Content — until you delete it, subject to backups.
• Server logs — a limited period for security and troubleshooting.
• Backups — our backups rotate on a short cycle, so deleted data may persist there briefly before being overwritten.

7. Your rights

Depending on where you live, you may have the right to:

• access the personal information we hold about you;
• correct information that is inaccurate;
• delete your information, subject to records we must keep by law;
• object to or restrict certain processing;
• receive your information in a portable format;
• withdraw consent where processing is based on it;
• complain to your local data protection authority.

You can update most of your information directly in your account settings. To delete your account, write to support@onlyoss.com from the e-mail address of the account, and we delete it within 30 days. For anything else, email support@onlyoss.com. We will respond within one month.

8. Security

We protect your information with HTTPS encryption in transit, hashed passwords, encrypted storage of sensitive configuration, access controls, and regular backups. No system is perfectly secure, and we cannot guarantee absolute security, but we will notify you and the relevant authority where required if a breach affects your personal data.

9. Children

The Platform is for adults. It is not directed at anyone under 18, and we do not knowingly collect information from children. If you believe a child has given us personal information, contact support@onlyoss.com and we will delete it.

10. Other users can see some of your information

Your username, profile details, and anything you post publicly are visible to other users, and potentially to anyone on the internet where a profile or post is public. Think of that as published rather than private. Direct messages are visible to the people in the conversation and, where necessary for moderation or legal compliance, to us.

11. Changes to this policy

We may update this policy. Where changes are material we will give reasonable notice by email or a notice on the Platform. The date at the top always shows the current version.

12. Contact

Questions, requests, or complaints about privacy: support@onlyoss.com.