Kozaru
Software for running martial-arts schools: students, attendance, gradings, fees and family messages, with each school's data walled off from every other.
About
Kozaru runs the day-to-day of a dojo: the roll, attendance, gradings and belts, fees and payment plans, and messages to students and families by email and text.
Each school is its own tenant. The database itself enforces the wall between schools (row-level security, forced on every table), so a mistake in a query returns nothing rather than someone else's students.
What it does
- Roll, attendance and grading records.
- Fees collected straight into each school's own Stripe account.
- Email and SMS messages to students and parents.
- Each school on its own web address.
Security statement
- Database-enforced separation between schools (PostgreSQL row-level security, forced).
- Passwords hashed with scrypt; two-step sign-in (authenticator app); Google sign-in only for accounts that have linked it.
- Student journal entries are encrypted under a key that belongs to each student.
- Support access needs a written reason, is logged, and shows masked data unless more is needed.
- A+ on Mozilla Observatory and SSL Labs; Content Security Policy with reporting; rate-limited sign-in.
- Its own server, separate from other clients' sites; daily backups with a watchdog; written incident response plan.
Shared platform measures (servers, backups, updates, monitoring) are on the Security page. Found a problem? security@emgee.dev.
Privacy statement
What it keeps
- School staff accounts.
- Students' and families' details as each school records them, which can include emergency and health notes.
- Payment records (not card numbers).
Why
To run each school's classes, gradings, fees and communications.
Where it is kept
On our servers in Melbourne; files in encrypted object storage. Nightly encrypted backups (see Security); daily copies kept 2 weeks, weekly 2 months, monthly 1 year.
Who else sees it
| Service | What for | Where |
|---|---|---|
| Stripe | Kozaru subscriptions, and fees paid to schools through Stripe Connect. | Australia / USA |
| Resend | Sends email on the school's behalf. | USA / Japan |
| SMS provider | Sends texts the school asks for. | Australia |
| Anthropic (Claude) | A daily summary for staff; only first names and counts are sent. Sent through the API, which Anthropic does not train on. | USA |
| Optional Google sign-in. | USA | |
| Cloudflare | Delivers the site and blocks attacks; sees IP addresses and request details. | Global |
How long, and deleting it
A closed school account is kept 30 days, then deleted. A deleted student can be destroyed after 30 days. Access logs are kept.
Each school is responsible for its students' information; Kozaru acts for the school. Kozaru's own privacy notice and data processing terms are the binding version. Ask what we hold about you, correct it or have it deleted at privacy@emgee.dev; we answer within 30 days. The general Privacy page covers your rights under the Australian Privacy Principles.
Contact
Kozaru support: support@kozaru.net. Privacy: privacy@kozaru.net. Security reports: security@emgee.dev.