Privacy Policy
1. Who we are
OniBlade is made by David Guimarães Cunha Maekawa, an individual developer in Brazil who publishes as Onigiri Works ("we"). Under Brazil's General Data Protection Law (LGPD, Law 13.709/2018) we are the controller of the personal data in this policy: we decide why it is used and how.
We are a small-scale controller (ANPD Resolution CD/ANPD 2/2022). We have no separate data-protection officer. The email above is the channel for requests, questions, and complaints, and David answers it.
This policy covers what we collect, why, the legal basis, how long we keep it, who else receives it, and your rights. The Terms of Use are a separate document: terms.html
2. Summary
- You need an account (Apple, Google, or email) so your trick record can be backed up.
- Usage stats are off unless you say yes. You are asked once after you sign in. Saying no has no effect on the app.
- Crash reports carry no name, email, or account id. They are on by default, and you can turn them off in Profile.
- There are no ads, no ad tracking, no selling of data, no public profiles, no chat, and no way for users to see or contact each other.
- You can delete your account in the app. It takes effect immediately.
3. Data we collect
We collect only what this section lists. We do not collect advertising IDs, location, contacts, health data, or data for cross-app tracking. A profile photo is an avatar. We do not use it to recognize anyone's face. We do not process sensitive data as the LGPD defines it (art. 5, II).
3.1 Account and profile
| Data | Why | LGPD basis |
|---|---|---|
| Open the account, sign in, send account and password-reset messages | Contract (art. 7, V) | |
| Account id | Tie your records to your account | Contract (art. 7, V) |
| Display name | Show on your profile. It starts as "Skater" until you, Apple, or Google set one. You can edit it. | Contract (art. 7, V) |
| Profile photo (optional) | Show as your avatar, to you only in the app | Contract (art. 7, V). You choose to add it and can remove it at any time. |
| Password | We never see or store it. Email sign-in keeps it, protected, at Supabase Auth. | Contract (art. 7, V) |
If you use Sign in with Apple or Sign in with Google, that company checks your identity under its own privacy policy. We receive an account identifier and, if you allow it, your name and email. Apple may give us a private relay address instead of your real email.
3.2 Your skating record
| Data | Why | LGPD basis |
|---|---|---|
| Trick progress | Show and back up the tricks you marked | Contract (art. 7, V) |
| BLADE game sessions | Your history and scores | Contract (art. 7, V) |
A copy of your profile, progress, and game history is also kept on your phone so the app works offline. It syncs when you are online. Signing out does not erase that copy. Clear data, deleting your account, or signing in with a different account on the same phone does.
3.3 Usage stats (only if you agree)
After you sign in, the app asks once whether you want to share usage stats. If you say no, nothing is recorded. If you say yes, we record events in our database: screens you open, tricks you view, progress changes, BLADE games, how you signed in, and whether a backup worked. Events are tied to your account id. We use them only to learn which parts of the app people use, and to improve it. They are never used for ads and never sold.
- Legal basis: your consent (LGPD art. 7, I). Because the data is stored in the United States, the consent screen says so before you choose (art. 33, VIII).
- Proof: when you say yes, we record the date and the version of the text you agreed to.
- Withdrawing: turn off Profile → Account → Usage stats at any time. That stops new events and deletes every event already stored for your account. Withdrawing is as easy as agreeing and has no effect on how the app works.
- If we change what usage stats cover, we will ask again.
3.4 Crash reports
When the app crashes or hits an error, it sends a report to Sentry so we can fix it. A report contains the error and where in the code it happened, the device model, operating system, app version, and the screens visited just before the error.
What a report never contains: your name, email, account id, photo, the content of your record, screenshots, screen recordings, or network requests. The app removes identifiers before sending and masks anything that looks like an email address or account id inside an error message. We have asked Sentry not to store IP addresses.
- Legal basis: legitimate interest (LGPD art. 7, IX, and art. 10). Our interest is finding and fixing crashes, which we cannot see on your phone any other way. Because a report identifies neither you nor your account, the impact on you is minimal. We documented this assessment and will share it with the ANPD on request.
- Your choice: turn off Profile → Account → Crash reports. Nothing more is sent from that phone.
3.5 In-app feedback
When you send feedback from the app (Profile → Send Feedback), we store your message, your account id, the app version, and the device platform in our database. The message is sent from the app; we do not open your mail client. We use this only to answer you and to improve the app.
- Legal basis: providing the service you asked for (art. 7, V).
- Stored by Supabase (United States). Deleted when you delete your account, or earlier if we no longer need it (see section 6).
3.6 Emails you send us
If you email us (for example a data request), we receive your email address, your message, and anything you include. We use this only to answer you and to improve the app.
- Legal basis: providing the service you asked for (art. 7, V). For data requests, complying with the LGPD (art. 7, II).
- Our email is Gmail (Google), so these messages are stored by Google.
4. Who receives data, and transfers out of Brazil
| Who | Role | What | Where |
|---|---|---|---|
| Supabase, Inc. | Operator (processes data for us) | Account, profile, photo, progress, game history, in-app feedback, usage events (if you agreed), sign-in secrets, account emails | United States |
| Functional Software, Inc. (Sentry) | Operator | Crash reports | European Union (Germany) |
| Google LLC (Gmail) | Email provider | Emails you send us and our replies | Google's infrastructure, including the United States |
| Apple Inc. or Google LLC | Their own sign-in service, if you choose it | The identity check | Their infrastructure |
Legal grounds for transfers (LGPD art. 33):
- Account, profile, photo, record, in-app feedback, account emails, and your emails to us (United States): the transfer is needed to provide the service you asked for (art. 33, IX, with art. 7, V) and, for data requests, to comply with the law (art. 7, II).
- Usage events (United States): your specific consent, given after being told the data goes to the United States (art. 33, VIII).
- Crash reports (European Union): the ANPD recognized the European Union as offering adequate protection (art. 33, I; ANPD Resolution CD/ANPD 32/2026).
Each operator processes data under its own data-processing terms with us, and only to provide its service.
Security. All traffic is encrypted (HTTPS). The database only lets each account read its own rows. The app can add usage events and feedback but cannot read them; it can delete usage events only through the "turn off" action. Your profile photo is stored at an address that is hard to guess and is never listed or shown to other users. Anyone who already had that exact address could open it, though, so do not use a photo you would not want seen. We protect our own admin access with strong passwords and two-factor authentication.
5. Sharing
We do not sell, rent, or trade your personal data, and we do not share it for advertising.
We share data only with the providers in section 4. We also disclose it to a public authority when Brazilian law requires it, when it is needed to exercise our rights in legal proceedings, or when it is needed to protect someone's life or physical safety.
6. How long we keep it
| Data | How long |
|---|---|
| Account, email, display name, photo | While the account exists |
| Trick progress and BLADE history | While the account exists, or until you clear data |
| Usage events | Up to 12 months, then deleted automatically. Deleted right away if you turn usage stats off or delete your account. |
| Crash reports | 30 days at Sentry, then deleted automatically |
| In-app feedback | Up to 24 months after we receive it, or until you delete your account |
| Copy on your phone | Until you clear data, delete the account, or sign in with a different account on that phone |
| Emails you send us | Up to 24 months after the conversation ends. Data requests and our answers: 5 years, as proof that we met them. |
After deletion, copies in our providers' internal backups expire on the providers' own short schedule. We never use them to restore data you deleted.
7. Children and teenagers
OniBlade is a trick tracker for aggressive inline skating. It has no ads, no purchases, no chat, no public profiles, and no way for users to find, see, or contact each other.
- Minimum age: 13. Under Brazilian law a child is under 12 (Statute of the Child and Adolescent, art. 2). We set a higher minimum age, and the sign-in screen asks you to confirm it. In the European Union the minimum is the age of digital consent in your country (up to 16). We do not knowingly keep accounts for anyone younger. If you believe we have one, email us and we will delete it.
- Teenagers (13 to 17): privacy-protective settings are the default. Usage stats are off unless the teen turns them on, and nothing is ever used for profiling or advertising (ECA Digital, Law 15.211/2025). We treat all users this way, whatever their age.
For parents and guardians
- What your teen can share: a display name and an optional photo, which only they see in the app, plus their trick record and any feedback they send us. Nothing is visible to other users.
- Risks to know about: aggressive skating is physically risky. The app gives technique tips, but it does not supervise practice or replace a coach or protective gear. The app has streaks and weekly challenges. They do not send notifications, and there are no rewards to buy.
- Your tools: you can use your phone's parental controls (Apple Screen Time or Google Family Link) to approve downloads and limit screen time. You can ask us at the email above to access, correct, or delete your teen's data, or to close the account. We may ask you to confirm you are the parent or guardian.
- Reporting a problem: email us about any content or behavior in the app that concerns you. We reply within 15 days (ECA Digital, art. 28).
8. Your rights
In the app:
- Delete account: Profile → Delete account. This removes the account and everything tied to it, including usage events, in-app feedback, the photo, and the copy on your phone. It is immediate and cannot be undone. If you signed in with Apple, it also removes OniBlade from your Apple ID.
- Clear data: Profile → Account → Clear data. This deletes your trick progress and BLADE history. The account, name, and photo stay.
- Usage stats: Profile → Account → Usage stats. Turning it off deletes the events already stored.
- Crash reports: Profile → Account → Crash reports.
- Name and photo: edit your profile to change them or remove the photo.
By email: write to onigiriworksbr@gmail.com with the subject Data Request – OniBlade. Under the LGPD (art. 18) you can ask for:
- confirmation that we process data about you, and access to it
- correction of incomplete, inaccurate, or out-of-date data
- anonymization, blocking, or deletion of data that is unnecessary, excessive, or unlawfully processed
- a portable copy of the data you gave us
- deletion of data processed on the basis of your consent
- the names of the entities we share data with (listed in section 4)
- information about the option of not consenting, and its consequences (there are none for usage stats)
- withdrawal of consent
- an objection to processing based on legitimate interest (crash reports)
- a review of a decision made only by automated processing (we make no such decisions)
We may ask you to confirm the request comes from the account's email address. We confirm receipt within 15 days and answer fully within 30 days, the deadlines for a small-scale controller (ANPD Resolution CD/ANPD 2/2022). If we cannot do what you ask, we will explain why. Using your rights is free.
You can also complain to the Autoridade Nacional de Proteção de Dados (ANPD) at www.gov.br/anpd, or, as a consumer, to your local Procon or consumidor.gov.br.
9. Security incidents
If a security incident could cause you relevant risk or harm, we will tell you and the ANPD within six business days of learning that personal data was affected (LGPD art. 48; ANPD Resolution CD/ANPD 15/2024, with the small-scale controller extension). We will say what happened, what data was involved, what we did about it, and what you can do.
10. Changes
We will update the date at the top whenever this policy changes. If a change adds a purpose, a new type of data, a new country, or a new legal basis, we will tell you in the app before it applies. If the change relies on consent, we will ask again. Keeping the app installed never counts as consent.
11. Contact
Controller: David Guimarães Cunha Maekawa (Onigiri Works), Brazil
Email: onigiriworksbr@gmail.com
Subject for data requests: Data Request – OniBlade
This policy applies to the OniBlade apps for iOS and Android.