Privacy Policy
Effective date: 2026-10-02
This policy explains what information the Klipr Climbing app and the website KliprClimbing.com ("the service") collect, how it is used, and the choices you have. The service is operated by Nick Armel, operating as Klipr Climbing ("we", "us").
If Klipr Climbing becomes a company, this policy and our terms will transfer to it and we will notify you.
Contact: [email protected]
The service is offered to people in the United States and in Europe (the European Union and European Economic Area, with the United Kingdom where noted).
1. The short version
- Your profile, your likes, your attempts and sends, and the routes and gyms in the app are readable by anyone, without signing in. Treat everything you add to the app as public.
- Photos you upload for routes are publicly readable (see section 5 on photo metadata).
- We show banner ads. They are personalised by default and use your device's advertising ID (see section 7).
- We do not currently use analytics, crash reporting or push notifications.
- For people in the EU/EEA and UK, the data controller is Nick Armel, operating as Klipr Climbing, and sections 4A to 4C, 9 and 11 explain our legal bases, retention and your GDPR rights.
2. Information we collect
2.1 Account and sign-in
You can create an account with any of the methods the app offers.
- Email and password. We receive your email address and a password. Passwords are handled by our authentication provider; we do not see or store your password in readable form.
- Google Sign-In. We receive your Google account email address and display name. Your display name pre-fills your profile and you can change it. We do not copy your Google profile photo into the app.
- Facebook Login. The Facebook Login SDK is included in the app and initialises when the app starts, but Facebook sign-in is not live today. When it is enabled it will request your email address and public profile from Meta. Meta processes data under its own policy.
- Sign in with Apple. Support is built into the app but is disabled today. When enabled it will request your name and email address (which may be Apple's private relay address) from Apple.
2.2 Profile
Your profile consists of a username, a display name, a home gym and an avatar image URL. The username is unique and is shown on every route you create.
2.3 Content and activity
- Routes you create, including the wall photo, hold positions and markings, name and grade information, and the gym they belong to.
- Attempts and sends: how many tries you have logged on a route and whether you sent it.
- Likes you give to routes.
- Gyms you add or correct. Gyms are shared reference data that any signed-in climber can add or edit, and they are not owned by any one person.
2.4 Photos
- Route wall photos you take or choose. The app resizes and re-encodes the photo before upload. Newer versions of the app are designed to remove location and camera metadata (EXIF/GPS) from photos before upload; photos uploaded with earlier versions may still contain it (see section 5). Uploaded photos are publicly readable.
- Avatar images you choose. Avatars are publicly readable.
The app asks for camera and photo-library access only to let you take or pick these images.
2.5 Location
The app can use your device location to list climbing gyms near you. This is optional.
- It is requested only when you tap the control to find nearby gyms, only while the app is in use, and only once per request. The app does not track your location in the background.
- It asks for approximate (medium accuracy) location.
- You can decline and enter a ZIP code instead.
- Your coordinates (or the ZIP code you type) are sent to Google's Places and Geocoding services to find nearby gyms. We do not store your coordinates ourselves. A gym you choose to add may be saved with that gym's own address and coordinates, which are the gym's location, not yours.
2.6 Advertising data
The ad SDK (Google AdMob) collects data from your device, including the advertising ID, to serve and measure ads. See section 7.
2.7 Device attestation
The app uses an app-integrity check (Firebase App Check, backed by Play Integrity on Android and App Attest or DeviceCheck on Apple devices) to confirm that requests come from a genuine copy of the app. This involves device and app integrity signals being sent to the provider.
2.8 What we do not currently use
We do not currently use analytics tools, crash-reporting tools or push notifications.
3. Public by default
Today, the following are readable by anyone who can reach our servers, with no sign-in required:
- every user profile (username, display name, home gym, avatar);
- every like;
- every climber's attempts and sends;
- public routes, including their photos;
- gyms.
Your private routes (if the app offers them) are readable only by you. Do not put information in your profile, route names or photos that you do not want the world to see.
4. How we use information
- To run the service: sign you in, show your profile and routes, count sends and likes, and show gyms.
- To find nearby gyms when you ask.
- To keep the service secure and prevent abuse.
- To show advertising.
- To respond to your requests and to enforce our Terms of Use.
4A. Who is responsible for your data (controller)
For the purposes of the EU General Data Protection Regulation (GDPR) and the UK GDPR, the data controller is:
Nick Armel, operating as Klipr Climbing Email: [email protected]
Our hosting, sign-in, ad and maps providers (section 8) act as processors or, for some of their own purposes (for example Google AdMob advertising), as independent controllers under their own policies.
We will publish our EU representative's details here if one is appointed (and our UK representative's, if one is appointed).
4B. Legal bases for each purpose (EU/EEA and UK)
If the GDPR applies to you, we rely on the following legal bases. This table is based on what the app collects today (section 2).
| Purpose | Data involved | Legal basis |
|---|---|---|
| Create and manage your account, sign you in | Email, password (handled by our authentication provider), Google account email and display name, username | Contract (Art. 6(1)(b)): needed to provide the service you signed up for |
| Show your profile, routes, attempts, sends, likes and photos to other users; maintain gyms | Profile, content, activity, route and avatar photos | Contract (Art. 6(1)(b)) for the core features; legitimate interests (Art. 6(1)(f)) in running a public community of climbers |
| Find climbing gyms near you | Approximate device location or ZIP code, sent to Google Places and Geocoding | Consent (Art. 6(1)(a)), given when you grant location permission and tap the nearby-gyms control; you can withdraw it in your device settings |
| Security, fraud and abuse prevention, app-integrity checks | Device and app integrity signals (Firebase App Check), account and usage records | Legitimate interests (Art. 6(1)(f)) in keeping the service and its users safe |
| Show banner ads and measure them | Advertising ID and device data collected by Google AdMob | The app does not currently collect consent for ads; see section 7 |
| Respond to your requests, enforce our Terms, handle reports of content | Contact details, account and content records | Legitimate interests (Art. 6(1)(f)); contract where it concerns your own account |
| Comply with law and respond to valid legal requests; keep records we are legally required to keep | Whatever the legal obligation requires | Legal obligation (Art. 6(1)(c)) |
We do not currently use analytics or crash reporting. If we add them, we will update this table first and, where required, ask for your consent.
The app does not currently show its own consent prompt for ads. Section 7 describes how ad personalisation works today and how you can control it through your device settings.
4C. Special categories and automated decisions
We do not intentionally collect special-category data (such as health or biometric data). Photos can incidentally show people; our Terms ask users not to upload photos of people without permission. We do not make decisions about you based solely on automated processing that have legal or similarly significant effects.
5. Photos and embedded metadata
Newer versions of the app are designed to remove location and camera metadata (EXIF/GPS) from photos before upload; photos uploaded with earlier versions may still contain it. You can email [email protected] to ask us to remove a photo that contains location metadata.
6. Location
See section 2.5. You can withdraw location permission at any time in your device settings and still use the ZIP code search.
7. Advertising
The app shows banner ads provided by Google AdMob. Ads are personalised by default and AdMob uses your device's advertising ID. Google may use this data under its own privacy policy.
You can limit this on your device regardless of what the app offers:
- Android: Settings > Google > Ads (or Privacy > Ads), then "Delete advertising ID" or opt out of ads personalisation.
- iOS: Settings > Privacy & Security > Apple Advertising, to turn off personalised ads.
Opting out does not remove ads; it makes them less personalised.
The app does not currently show its own consent prompt for ads: it has no Google consent-management (UMP) prompt, and on iOS no App Tracking Transparency prompt. Ad personalisation is therefore controlled through the device settings above.
8. Service providers and third parties
We share information with providers that process it for us or that provide features of the app.
- Our hosting and database provider stores accounts, profiles, routes, attempts, likes, gyms and uploaded images, and handles sign-in. Today this is Google Firebase (Authentication, Firestore, Cloud Storage, App Check).
- Google: Firebase (above); Places and Geocoding (nearby gym search); AdMob (ads); Google Sign-In.
- Meta: Facebook Login SDK, included in the app, not live today.
- Apple: Sign in with Apple, when enabled; App Attest and DeviceCheck for app integrity on Apple devices.
We do not sell your personal information.
9. Retention
We keep personal information only as long as needed for the purposes in section 4B.
| Category | How long we keep it |
|---|---|
| Account and sign-in data (email, sign-in credentials, linked provider details) | Until you delete your account |
| Profile (username, display name, home gym, avatar image) | Until you delete your account. Your username reservation and avatar are deleted at that point |
| Routes, route photos, attempts, sends and likes | Kept while your account exists. When we process your deletion, the routes and route photos you published, and your activity on routes (attempts, sends and likes), are kept but anonymised: they are no longer linked to you and are shown under a "Deleted climber" placeholder. You can delete individual routes you created in the app before asking us to delete your account |
| Gyms | Kept; shared reference data owned by no one |
| Location | Not stored by us. Coordinates or ZIP codes you enter are sent to Google to find gyms (section 2.5) |
| Device integrity and security records | Kept by our provider and us for as long as needed for security and abuse prevention |
| Emails you send us (requests, reports, deletion requests) | Kept as long as needed to handle your request and for a reasonable period afterwards to show we handled it. We keep these emails for up to 24 months |
| Backups and logs | Deleted data may remain in backups and logs for a limited time before it is overwritten (see Account Deletion) |
| Data held by third-party providers (for example ad providers) | Under their own policies |
When you delete your account, we delete or anonymise data as described on our Account Deletion page. Anonymised content no longer identifies you, so it is not personal data once the link to you is removed; if you would rather have specific routes removed entirely, tell us (see the Account Deletion page).
10. Deleting your account
See Account Deletion for how to request deletion and exactly what is removed or kept anonymised.
11. Your rights
11.1 Everyone
Much of your information can be edited in the app. You can ask us to access, correct or delete your personal information by emailing [email protected]. We do not sell your personal information.
11.2 If you are in the EU/EEA or UK
Under the GDPR (and UK GDPR) you have the right to:
- Access the personal data we hold about you and receive a copy.
- Rectification: have inaccurate or incomplete data corrected.
- Erasure: have your data deleted, in the circumstances the law provides (see Account Deletion for how deletion works, including content that remains anonymised).
- Restriction: ask us to pause the use of your data in certain cases.
- Portability: receive the data you provided in a structured, commonly used, machine-readable format, and have it transmitted to another provider where technically feasible.
- Object to processing based on our legitimate interests (section 4B).
- Withdraw consent at any time where we rely on consent (for example location), without affecting processing done before you withdrew. Location permission can be withdrawn in your device settings. The app does not currently ask for consent for ads; see section 7 for how to limit ad personalisation on your device.
- Complain to a supervisory authority: the data protection authority in the country where you live, work or where you think a breach occurred. In the UK this is the Information Commissioner's Office. We would appreciate the chance to address your concern first.
How to exercise them. Email [email protected] from the address registered to your account, say which right you want to use, and include your username. We may ask follow-up questions to confirm it is you, and we will not ask for your password. We aim to respond within one month, which the law allows us to extend in some cases. Exercising your rights is free unless a request is clearly unfounded or excessive.
Anonymised content that can no longer be linked to you is outside these rights, because it is no longer personal data.
11.3 If you are a US resident
Some US states give residents rights to know, access, correct and delete personal information, and to opt out of certain advertising uses. Email [email protected] to make a request. We do not sell personal information. The app shows ads through Google AdMob, which may use your device's advertising ID to personalise them; you can limit this through your device settings (section 7).
12. Children
The service is not directed to anyone under 16, and we do not knowingly collect personal information from them. If you believe a child under that age has an account, contact us at [email protected] and we will delete it.
13. International transfers
Klipr Climbing is based in the United States, and our providers process information in the United States and other countries, which may differ from the data protection laws where you live.
If you are in the EU/EEA or UK, your information is transferred to the United States and potentially other countries where our providers operate. Today the providers involved are Google (Firebase, Google Places and Geocoding, Google Sign-In and Google AdMob) and, for Apple devices, Apple.
Where the GDPR requires a safeguard for these transfers, we rely on one or more of the following, depending on the provider and the data: the provider's certification under the EU-US Data Privacy Framework (and the UK Extension), where the provider has certified; the European Commission's Standard Contractual Clauses (and the UK International Data Transfer Addendum) in the provider's data processing terms; or another mechanism the law allows. You can ask us for information about the safeguards by emailing [email protected].
14. Security
We use access rules and app-integrity checks to protect the service, but no system is perfectly secure. Because much of the content is public by design (section 3), do not treat the app as a place for private information.
15. Changes
We may update this policy. The effective date above will change, and for material changes we will give notice in the app or on the website.
16. Contact
Nick Armel, operating as Klipr Climbing (data controller) [email protected]