Privacy

What we collect

• Your account: email address and a password. Passwords are hashed by our authentication provider; we never see or store the plain text.
• Your profile: display name, and optionally a photo, the disciplines you climb, your grade system and current grades, your home gym or crag, and — because they change what the app shows you — gender, birth year, the year you started climbing, height and wingspan. All of it is optional and editable.
• What you log: sessions and ascents (date, indoor or outdoor, the place, duration, how it felt, your focus, notes, any injuries you record, boulder tallies, named climbs and grades), strength workouts and their sets, training plans, phases, trips, pyramids and assessments.
• Body measurements, if you switch them on: weight, sleep, steps, resting heart rate, heart-rate variability, blood pressure, waist, hydration, calories, and one-to-five ratings for soreness, stress and motivation. Everything is off until you turn it on, and each one is separate.
• Cycle tracking, if you switch it on: the days you record, an optional flow level, and any symptoms you tag. Off by default, kept in its own place, and deletable on its own.
• Your settings: units, colour theme, timer preferences, and which metrics you switched on.
• Ordinary technical records: our hosting and database providers keep standard server logs, including IP address, to run and secure the service. Our analytics provider does not — see below. Signing in sets cookies that keep you signed in.

Health and body data

Body measurements and cycle tracking are the most personal things here, so they get their own rules:

• Everything is off by default. The daily check-in only ever asks for the metrics you switched on.
• Nothing about your cycle changes what the app tells you to do. There is no training advice based on it, and there never will be without saying so here first. The evidence does not support it.
• Apple Health is read-only, and only if you connect it. If you do, the app reads only the metrics you have switched on, only while the app is open, and writes nothing back to Health, ever. You can change what Health shares, or revoke it entirely, in the Health app at any time. Connecting is per-device.
• Health and cycle data are excluded from our internal support tools — see below.
• You can delete them separately, without deleting your account, in Preferences.

Location

When you are picking a gym or crag, the app can offer places near you. If you allow it, your device's location is read at that moment only, used to sort the list, and then discarded — we never store it, and there is no background or continuous location tracking. Declining costs you nothing; you can still find any place by typing its name. Nothing else in the app works out where you are, including our analytics provider.

Analytics

We use PostHog to understand whether the app is being used and whether it is working. It is deliberately narrow:

• Events are a fixed list we wrote by hand — things like "a session was logged" or "this screen was opened" — and the code refuses to build if an event carries a property that is not on the list.
• The content of what you write never leaves: no notes, no place names, no climb names, no cycle or body values.
• No automatic capture and no session recording. We do not record your screen, your clicks, or your typing.
• You are identified by your account's internal ID, never your email address. Signing out disconnects it.
• Your IP address is discarded, not stored. PostHog receives it the way any server does, then drops it at the door — so no location is derived from it and none is kept. Both were switched on 1 September 2026; the enrichment that used to derive an approximate location is off, and the addresses it worked from are no longer retained at all.

Who can see your data

Day to day, only you. We keep an internal support tool that the founder uses to fix problems and curate the shared list of climbing locations, and it is deliberately fenced:

• Things that affect how the app draws — your units, theme, grade system — are visible, because they are the reproduction steps for a bug.
• Anything you wrote (notes, session details) takes a deliberate action and records that it was read, in a log we keep.
• Body measurements and cycle data are not reachable by that tool at all. This is enforced by an automated check that fails our build if anyone tries.

What we don't do

• No advertising, and we never sell or rent your data.
• No third-party sign-in providers, so nothing is shared back to a social account.
• No writing anything back to Apple Health.
• No background location tracking.
• No selling or sharing of anything with data brokers.

Who processes it

We use a small number of providers purely to run the service, and they process data only on our instructions:

• Supabase: database, authentication and file storage (hosted in the United States).
• Vercel: web hosting.
• PostHog: product analytics and error reporting (United States).
• Expo: building the mobile app and delivering its updates.
• Apple: distributing the beta through TestFlight.
• Resend: transactional email only, such as confirming your address or resetting your password. No marketing email.

Your data is yours

Your logs belong to you. In Preferences you can export everything as CSV or JSON at any time, and delete your body measurements or your cycle data on their own. To correct anything else, or to delete your account and everything in it, email privacy@climbkaizen.com and a human — currently the founder — will do it. We keep what you log until you ask us to delete it.

Beta software

Climb Kaizen is in active development and distributed to a small number of testers. We run a separate testing environment with disposable data; your real account and logs live only in the production environment.

Children

Climb Kaizen is not directed at children, and our Terms of Service require you to be at least 16 to hold an account — signup asks for a birth month and year and refuses anyone younger. We do not knowingly collect information from anyone under 16. If you believe a child has given us information, email privacy@climbkaizen.com and we will delete it.

Changes and contact

If this policy changes materially we will update the date above and tell testers directly. Questions, requests, or concerns: privacy@climbkaizen.com.