Privacy statement

What we hold

An account, and whatever you choose to put on it. Some of this is needed for the app to work at all. Most of it is optional, and the optional parts are left empty until you fill them in.

• Your email address and a password, held by Google Firebase Authentication. We never see the password.
• Or, if you sign in with Google or Apple, no password at all. They give us your email address and the name on that account. The name is kept privately, like one you typed. Apple can give us a relay address instead of your real one, if you ask it to. Google also offers your profile picture, which we only copy onto your profile if you say yes when asked.
• Your first and last name, kept where only you can read them, and a nickname if you set one. Other climbers see the one of these you pick.
• Your climbs: the gym, the wall, the grade, the colours, how many attempts, whether you sent it, when, and anything you typed about it.
• Photos and video you attach to a climb.
• The reaction you leave on another climber's attempt. It is kept with that attempt and shown as a count. It goes when you take it back, when the attempt is deleted, or when your account is.
• Your profile picture, bio, home gyms and social handles, if you add them.
• Your date of birth, given once when you join. See below: almost all of it is thrown away.
• Optional measurements: sex, height, weight, ape index, the month you started climbing, sessions a week, and strength benchmarks.
• When you last changed your measurements, when the app last reminded you to, and how often you asked to be reminded. The dates, not the numbers, and they sit on your profile where other signed-in climbers could read them.
• Which badges the app has already told you about, so it does not tell you twice.
• A dated history of your strength benchmarks and your weight on the day, one entry for each day you change them. Only you can read it: not other climbers, not moderators.
• Who you follow and who follows you.
• Climbers you have blocked, with the report and reason behind each block. A block can be read by you and by the climber you blocked, so that each of your apps can hide the other. Their app never shows it to them.
• Reports you file, and reports filed about you.
• Which build and platform you filed a report from, so a bug can be traced to a version.
• A push token for each device you allow notifications on.
• Which version of this statement you have been shown, so the app knows when to tell you it has changed.

Your date of birth

Asked once, because the app is for climbers of 16 and over and we have to have asked. Almost all of it is then thrown away, which is the part worth knowing.

• The date is kept where only you can read it. Not other climbers, not gym staff, not moderators.
• What goes on your profile is the day and the month with no year attached, and a note that the check happened. Neither of those is an age, and nobody can work your age out from them.
• The day is there so the app can notice when you log a climb on your birthday, which is worth a badge.
• You cannot change it later, and neither can we without you asking. A date that can be edited is not a check.
• It goes when your account goes, like everything else.
• We do not ask for any document and we do not verify it against anything. It is your word, recorded, which is what the law asks of an app this size.

Photos and video

Attachments are the part of this worth reading twice, because a gym photo often has other people in it. Think about who is in frame before you upload, and take something down if somebody in it asks you to.

• A photo you attach is readable by anyone signed in to the app. There is no setting that makes an attachment private, because it is shown on a climb other climbers are looking at.
• Video is shrunk to 720p on your phone before it is uploaded. The original never leaves the device.
• We keep the file, its size, and any hold outlines marked on it. We do not read or store the location, camera or timestamp metadata your phone may attach.
• Your phone measures a few hundred corners and edges in each photo, and in a few frames of each video, and keeps those numbers on the climb. They are what lets the app spot that two pictures show the same wall. The numbers describe texture and shape, nothing about a person, and no picture can be rebuilt from them. Anyone signed in can read them, the same as the photo or video they came from.
• Photos may be used to train the hold detection the app uses to spot when two climbers logged the same climb. What is of interest is the wall and the holds, never the people. That work happens on a maintainer's machine, not a third party service.
• Delete an attempt and its photos and video are deleted from storage with it, including the copy used as a climb's cover image. The corner and edge measurements taken from its photos and video go at the same time.
• We never run face recognition, and we never try to identify anybody from a picture.

What we do not do

Stated as plainly as the rest, because the absences here are the reason the list above is as short as it is.

• No analytics: nothing counts which screens you open, how long you stay, or what you do next.
• No advertising, no advertising identifiers, and nothing that follows you between apps or sites.
• Crash reports are the one exception, they are described above, and you can turn them off.
• The one thing we count is how often a link you shared was opened. See "Sharing a climb" above. It is a number on the link, not a record of who opened it.
• No advertising, and no advertising identifiers.
• Nothing is sold, rented or shared with data brokers.
• No profiling and no automated decisions with legal effect.
• No contacts, no photo library beyond the files you pick, no microphone outside a video you record yourself.

When the app falls over

The app sends a crash report so the fault can be fixed. This is the only thing it reports about itself, and you can turn it off in app settings under Privacy.

• What goes: the error and where in the code it happened, your phone model, its operating system version, and which build of the app you were running.
• What does not: your name, your account, your email, anything you have logged, and any photo. A crash is a fault in our code rather than a fact about you.
• It goes to Firebase Crashlytics, run by Google, who process it for us and for nobody else. The same company already hosts everything else here.
• Turning it off stops reports being sent at all, rather than sending them with the details removed.
• Reports are kept for up to 90 days, which is Crashlytics' own limit, and are not linked to your account.

Sharing a climb

Tap Share on an attempt and you get a link to it. This is the only part of the app that counts anything, so it is written out in full.

• The link records that you made it, which climb it points at, and when. That is so the same climb shared twice is one link rather than two.
• Two counts sit on it: how many times it opened the app, and how many times it opened the web page for people who do not have the app. They are counts and nothing else.
• Nothing is stored about whoever opened it. No address, no device, no location, no cookie, and no way to tell one opener from another.
• Only you and a moderator can read your links. Which climbs somebody shares is not on their profile and is not in the feed.
• Sharing an anonymous attempt shares it anonymously. The message carries the same name the app shows, which is "Anonymous climber".
• Your links go when your account goes, and a link goes when the climb it points at is deleted.
• You can send your own video to your Instagram story, with a sticker you pick. Only when you tap it, and only that video: it goes to Instagram on your phone, under their terms, and what you post there is yours to remove there.

Location

Asked for once, when you want the gym list sorted by what is nearest, and never on launch. Say no and every part of the app still works.

• Coarse location only, which is accurate to a few hundred metres. That is enough to sort a list of buildings.
• It is used, then forgotten. No position is written to any document or kept after you close the app.
• Distances are worked out on your phone. No location leaves the device.

Posting anonymously

An anonymous post hides your name from other climbers. It does not hide it from us. Which account made it is kept in a separate record that only you and our moderators can read, which is what makes it possible to act on abuse, and it is why anonymity is safe to offer at all.

• An anonymous post carries no name, no profile picture and no account id. Its photos and video are stored without your account in the file name or the file details either.
• The record of which account made it is readable by you and by a moderator, and by nobody else. It goes when the post goes.
• Measurements you have chosen not to share are not written onto the post at all. They are kept in a private area of your profile that no other account can read.

Why we are allowed to hold it

Under UK and EU data protection law every use of personal data needs a lawful basis. Here there are three, and which one applies changes what you can ask us to do about it.

• Performing the contract you entered when you made an account: your email, your climbs, your follows. Without these there is no app.
• Your consent: optional measurements, your bio and picture, location, and push notifications. Withdraw it by clearing the field or turning the setting off, and it takes effect at once.
• Legitimate interests: keeping the app usable and safe. Moderation records, the report queue, and the private record of who made an anonymous post sit here. You can object, and we will weigh it.

Who else sees it

Other climbers see what you post. A small number of moderators see what gets reported. One company processes the data on our behalf, and that is the whole list.

• Other signed-in climbers: the name you chose to show, picture, bio, social links, climbs, and the measurements you chose to share. Your stats and the gyms you climb at follow their own settings, which can be everyone, followers only, or nobody.
• Gym staff and managers: the same, plus the ability to correct climbs at their own gym.
• Moderators: reports, and the account behind an anonymous post when one is reported.
• Google, as our processor, under their data processing terms. Firebase Authentication, Firestore, Cloud Storage, Cloud Messaging, Cloud Functions and Crashlytics. They hold the data; they do not get to use it.
• Google Maps draws the map in the gym picker. Opening that screen tells Google you loaded a map, which is unavoidable in any mapping SDK.
• Google or Apple, if you sign in with one of them. They learn that you signed in to this app, under their own privacy terms rather than ours. We send them nothing else.
• Nobody else.

Where it is kept

On Google Cloud, in the United States. That is an international transfer out of the UK and EEA, and it is covered by the standard contractual clauses in Google's data processing terms, which is the mechanism Article 46 provides for.

• Everything is encrypted in transit, and encrypted at rest by Google.
• Access is governed by rules the app cannot talk its way around. They are enforced by the server, not by the screen deciding what to draw.
• Your phone keeps a cache of pictures you have looked at and any upload still in the queue. Delete the app and that goes with it.

How long we keep it

While your account exists, and not after. The exceptions are moderation records, and they are listed rather than buried.

• Your account and everything on it: until you delete it.
• Reports you filed and reports about you: kept, with your name and account id removed when you delete your account. What was described and what was decided survives; the link to a person does not.
• Push tokens: until you turn notifications off, sign out, or delete the account.
• Server logs, which record that a request happened rather than what was in it: 30 days, on Google's own schedule.
• Copies inside Google's backups can outlive a deletion by a short period. Nothing in the app can reach them and they are overwritten on Google's cycle.

Your rights

You have all of these under the UK GDPR and the EU GDPR. Ask by email and we will answer within one month. There is no charge, and we will not ask why.

• Access: a copy of everything we hold about you.
• Rectification: anything wrong corrected. Most of it you can edit yourself in the app, which is faster.
• Erasure: your account and its data deleted. There is a button for this, and it runs immediately.
• Portability: your climbs and profile in a machine readable file you can take elsewhere.
• Restriction and objection: tell us to stop using something while a dispute is open, or object to a use we base on legitimate interests.
• Withdraw consent: at any time, for anything given by consent. It does not undo what was done before you withdrew it.
• Complain: to the ICO in the UK, or your own supervisory authority in the EEA. You do not have to come to us first, though we would rather you did.

Deleting your account

The control is in your profile. It asks for your password, or for one more sign-in if you joined with Google or Apple, and the name on your profile typed back. Then it erases everything below. It cannot be undone by you, by us, or by anybody. If you joined with Apple, the app's access to your Apple ID is withdrawn too.

• Every attempt you logged, with its photos and video.
• Your profile: name, bio, picture, measurements, social links, home gyms.
• Your date of birth, and the day on your profile.
• Every follow, in both directions, including the copies held under other climbers.
• Your beta requests, gym requests and notifications.
• Your answers to "is this the same climb?" and "is this still up?".
• Your registered devices, so no phone keeps receiving notifications for an account that is gone.
• Your sign-in.

What survives a deletion, and why

Three things, and each one is a deliberate decision rather than an oversight. Under Article 17(3) erasure gives way where records are needed to establish or defend a claim, which is what a moderation record is.

• Reports keep what was described and what was decided. Your name and account id are removed from them, whether you filed the report or it was about you. A queue that the person complained about can empty is not a queue.
• Climbs other people have also logged stay, with their attempts. Yours come off. A shared climb is their record too, and it is not yours to delete.
• The account that first logged a shared climb is recorded on it as an id with nothing attached, and so is the account that last said whether the climb is still on the wall. Once the account is gone they point at nothing and identify nobody.

Age

You must be 16 or older. The app asks for your date of birth before it collects anything else, and an account that does not clear that is not set up rather than set up and then closed.

• Nobody under 16 is asked for height, weight or anything else. The check comes first for that reason.
• An account that gives a date under 16 is not suspended and not deleted. It simply cannot go on, and the two ways out are both yours: correct a date typed wrong, or delete the account.
• We do not knowingly hold data about anybody younger. Tell us if you think we do.

If this changes

Any change to what we do with your data changes this page first. The app shows a notice when that happens, with the date at the top of this screen so you can tell what you have already read.

How it is protected

Access is decided by the server on every single read and write. An app that asks for something it should not have is refused, and a modified app is refused in exactly the same way.

• Your private measurements live where no other account has read access, and so does your date of birth.
• Attachments can only be written under your own account's area, with size and file type enforced by the server.
• Reports can be read by the person who filed them and by moderators. Nobody else, including the person reported.
• Nobody can edit somebody else's climb except a moderator or the staff of that gym, and a correction is recorded as one.