Privacy Policy
Effective date: 30 September 2026 · Last updated: 2 November 2026
This policy explains what personal data CLYMB collects, why, on what legal basis, who it is shared with, where it is stored, how long it is kept, and how you can get it deleted. It is written to meet the EU General Data Protection Regulation (GDPR) and the UK GDPR.
1. Who we are
CLYMB is an adaptive climbing-conditioning app. The data controller for the processing described here is:
Flexfit Softwareentwicklung, Inhaber: Américo Andrés Munoz Buschmann
Stresemannstr. 72, 10963 Berlin, Germany
Email: [email protected]
We are established in Germany. We have not appointed a Data Protection Officer, because we are not required to under GDPR Art. 37 and § 38 of the German Federal Data Protection Act (BDSG): send anything you would send to a DPO to [email protected] and it reaches the person responsible.
2. What this policy covers
- The website clymb-app.com (this site).
- The CLYMB app: the web app at
clymb-290526-claude.web.appand the iOS and Android apps of the same name.
Where the rules differ between the site and the app, we say so.
3. What we collect
3.1 If you only visit this website
You do not need an account to browse this site, and nothing tracks you here unless you accept analytics in the cookie banner.
| Data | Where it comes from |
|---|---|
| IP address, browser and device type, requested URL, referrer, timestamp | Automatically logged by our hosting provider (Firebase App Hosting on Google Cloud) when a page is served |
| Your name, email address and message | Only if you send the contact form |
| Your email address, and a reason if you write one | Only if you submit the form on our account-deletion page |
| IP address, request details (URL, headers, timestamp) and, on the contact and account-deletion forms, browser and device signals | Processed by Cloudflare, which delivers this website, filters attacks before requests reach our host, and on those two forms runs Turnstile, the check that tells people from bots |
| Pages you view, how you arrived, approximate location (country/region), browser and device information, and a pseudonymous identifier stored in the _ga and _ga_<id> cookies | Google Analytics, loaded through Google Tag Manager, only if you accept in the cookie banner |
We run no advertising trackers, no pixels and no fingerprinting on this site. The only analytics is Google Analytics, loaded through Google Tag Manager, and it runs only if you accept in the cookie banner: until you choose, and if you reject, it sets no cookies and sends nothing to Google. Rejecting is as easy as accepting, and you can change your choice at any time with "Cookie settings" in the footer. We use it only to understand how the site is used so we can improve CLYMB, never for advertising, marketing or profiling, and we do not share it with advertisers. Apart from that, we set no cookies other than the strictly necessary ones described in our Cookie Policy.
3.2 If you create an account in the CLYMB app
Account data — your email address, the display name you provide, a unique account identifier, and, if you sign in with Google, the profile picture Google returns. Password-based accounts also produce an email-verification status. We never see or store your password: authentication is handled by Firebase Authentication.
If you use Sign in with Apple and choose to hide your email, Apple gives us a private relay address instead of your real one. We use it exactly like any other address, and we never try to resolve it back to you.
Training profile you enter during onboarding — your training goal and its details (such as a competition or season date, your discipline, or the weaknesses you want to work on), climbing ability level, climbing experience, self-assessed body strength, gender (including "Prefer not to say") and date of birth, both optional (if you leave out your date of birth, you confirm instead that you are at least 16), injury areas, how many days a week you want to train, which days, your start date and your training preferences.
Training data the app generates as you use it — your progression levels for each movement ladder, your skills plan and schedule, your completed sessions, and what you log in each session: sets, repetitions, weight lifted, hold times in seconds, and session duration. Finger training adds your equipment, tested finger strength and finger sessions.
Technical data — device type, app version, your time zone, IP address and server logs of the API requests your app makes.
Usage analytics, only if you accept — if you accept analytics in the app, we measure how it is used with Google Analytics for Firebase: which screens you open and which features you use (for example onboarding steps and training sessions started or completed), with a pseudonymous app-instance identifier, device type, operating system, app version and approximate location (country/region). It is off until you say yes. The app asks with its own optional box when you create your account, unticked and separate from the Terms (earlier app versions ask once in a pop-up); creating an account works the same either way. You can switch it on or off at any time in Profile. We keep your choice, and when you made it, with your account, so it applies on every device you sign in on and we can show that you agreed. It uses no advertising identifiers. We use it only to find problems and improve CLYMB, never for advertising, marketing or profiling, and we do not share it with advertisers.
Crash diagnostics, only if you accept — the same optional analytics choice also turns on Firebase Crashlytics, which tells us when the app crashes. A crash report contains the stack trace, a Crashlytics installation identifier and a Firebase installation ID, your device model, operating system version, available RAM and disk space, whether the device is jailbroken or rooted, the app's bundle identifier and version, the timestamp, the session identifier and whether the app was in the background. We also attach your account identifier, so that when you write to us about a crash we can find the report that belongs to you. It is off until you say yes, you can switch it off at any time in Profile, and Google deletes crash reports after 90 days. It uses no advertising identifiers, and we use it only to fix what is broken.
What we never collect: we do not request or receive your location, contacts, photos, camera, microphone, health-app data (Apple Health / Google Fit), advertising identifiers, or your payment card or bank details (if you ever buy a subscription, Apple or Google processes the payment and we never see those details). CLYMB shows no ads.
Subscription data — CLYMB is currently free. The app is built to support an optional paid subscription, and to do that it uses RevenueCat. In the iOS and Android apps, every time you sign in, the app registers your account identifier with RevenueCat so it can check whether your account has a subscription — whether or not you ever buy one. With it RevenueCat receives technical information such as your device type, operating system, app version, IP address and when you last opened the app. The web app does not use RevenueCat. If you buy a subscription, RevenueCat also receives the subscription status and purchase history the App Store or Google Play reports for you (which product, when it started, renews or expires, whether it was refunded) and the store identifiers of the transaction. We keep a copy of your current entitlement (for example "free" or "Pro") on your account so the app knows what to unlock.
4. Health-related data
Your injury areas, your answers about an injury if you choose the come-back-from-injury goal (when it happened, whether a doctor or physio has cleared you, your pain level) and your training logs can count as data concerning health under GDPR Art. 9. We treat it that way.
- We process it only to build and adapt your personal training plan, and to show your own progress back to you.
- Our legal basis is your explicit consent (Art. 9(2)(a)). You give it by ticking the consent box on the injury-areas step of onboarding, before you enter anything. Ticking it is optional: if you leave it unticked you can still use CLYMB, and we simply do not collect injury areas.
- You can withdraw that consent at any time, and it is as easy to withdraw as it was to give. In the app, open Profile → Injury focus → Clear: that deletes the injury areas and injury answers we hold and the record of your consent. Deleting your account (Profile → Delete account) erases everything. You can also email [email protected]. Withdrawing does not affect the lawfulness of processing carried out before you withdrew.
- We never use health-related data for advertising, marketing, profiling for third parties, or data mining, and we never sell or share it with data brokers.
If you use finger training, CLYMB asks about finger pain (0 to 10) before and after each finger session. Those pain check-ins are health data too. We store them only with a separate consent you give in Fingers → Settings, and turning it off deletes every stored score. Without that consent the check-in still works and nothing is stored.
5. Why we use your data, and our legal basis
| What we do | Why | Legal basis (GDPR Art. 6 / 9) |
|---|---|---|
| Create and run your account; sign you in; keep you signed in | You asked us to provide the app | Contract — Art. 6(1)(b) |
| Build your personalised conditioning and skills plan; adjust difficulty from your logs; show your progress | This is the service itself | Contract — Art. 6(1)(b), and for health-related data your explicit consent — Art. 9(2)(a) |
| Send account emails: email verification, password reset, and service notices | Necessary to give you a working, secure account | Contract — Art. 6(1)(b) |
| Keep the service secure: rate limiting, abuse prevention, error and security logs | Our legitimate interest in a service that is not abused or broken | Legitimate interests — Art. 6(1)(f) |
| Deliver this website through Cloudflare and keep it and its forms safe from attacks and bots (Cloudflare Turnstile) | Our legitimate interest in a website that stays available and forms that are not flooded with spam | Legitimate interests — Art. 6(1)(f) |
| Diagnose bugs and improve the app | Our legitimate interest in a product that works | Legitimate interests — Art. 6(1)(f) |
| Receive a report when the app crashes (Firebase Crashlytics), only if you accept | To find and fix the crashes that break the app, and to match a crash to a report you send us | Consent — Art. 6(1)(a). You can withdraw it at any time in Profile; withdrawal does not affect processing carried out before it |
| Answer your support emails and contact-form messages | To respond to you | Contract / legitimate interests — Art. 6(1)(b), (f) |
| In the iOS and Android apps, check whether your account has a subscription; if you buy one, link it to your account, unlock what you paid for, and restore it on a new device | To provide the app as offered, including its optional paid features | Contract — Art. 6(1)(b); for accounts that never buy, our legitimate interest in reliably knowing what each account is entitled to — Art. 6(1)(f) |
| Measure how the app and this website are used: Google Analytics for Firebase in the app and Google Analytics, through Google Tag Manager, on this website — only if you accept | To understand which features help and where people get stuck, so we can fix problems and improve CLYMB. Not for advertising, marketing or profiling | Consent — Art. 6(1)(a). You can withdraw it at any time, in the app in Profile and on this website with “Cookie settings” in the footer; withdrawal does not affect processing carried out before it |
| Handle data-subject and deletion requests, and keep a record that we handled them | We are legally obliged to | Legal obligation — Art. 6(1)(c) |
We do not send marketing email unless you have separately asked for it, and we do not use your training data to advertise to you anywhere.
6. Automated adjustment of your plan
CLYMB automatically changes your training plan based on what you log — for example, promoting you to the next level on a movement ladder after two consecutive sessions at the top of the prescribed range. This is automated processing, but it produces no legal or similarly significant effects for you within the meaning of GDPR Art. 22: it only changes which exercise the app suggests next, you can always override the suggested difficulty in the app, and you can email us to talk to a person about it.
CLYMB is a fitness product, not a medical device, and nothing in it is medical advice. It does not diagnose, treat or prevent any condition. If you are injured, pregnant, or have a medical condition, talk to a qualified professional before training.
8. Where your data is stored, and international transfers
We deliberately keep the app's data in the EU:
- Your account, training and workout data live in Cloud Firestore in Google's eur3 European multi-region (Belgium and the Netherlands).
- The API that processes it runs as a Cloud Function in europe-west1 (Belgium), and its server logs stay in that same region.
- This website is served by Firebase App Hosting from Google's europe-west4 (Netherlands) region.
Three transfers outside the EEA do happen and we will not pretend otherwise:
- Firebase Authentication account records (your email, account identifier and sign-in metadata) and, only if you accept analytics, usage analytics data from the app (Google Analytics for Firebase) and from this website (Google Analytics) are processed by Google on infrastructure that includes the United States. Crash reports (Firebase Crashlytics), also only if you accept, go further: Google offers Crashlytics with no European data-residency option and may process it anywhere it maintains facilities.
- Subscription data (your account identifier, purchase history and subscription status) and the related technical data are processed by RevenueCat, Inc. and its sub-processors in the United States. This relies on the Standard Contractual Clauses (GDPR Art. 46) in RevenueCat's data processing addendum.
- Requests to this website, including your IP address, and the Turnstile check on its forms are handled by Cloudflare, Inc. on its global network, which includes the United States. Cloudflare, Inc. is certified under the EU–US Data Privacy Framework (GDPR Art. 45), with the Standard Contractual Clauses (Art. 46) in its data processing addendum as a fallback.
The Google transfer relies on the European Commission's adequacy decision for the EU–US Data Privacy Framework (GDPR Art. 45), under which Google LLC is certified, with the Commission's Standard Contractual Clauses (Art. 46) as a fallback, together with encryption in transit and at rest. You can ask us for a copy of the relevant safeguards at [email protected].
9. How long we keep it
| Data | Retention |
|---|---|
| Account, profile, training plan and workout history | For as long as your account exists. Deleted immediately and permanently when you delete your account. |
| Subscription status and purchase history (ours and RevenueCat's) | For as long as your account exists. Deleted, including at RevenueCat, when you delete your account. Deleting your account does not cancel a store subscription: cancel it in the App Store or Google Play. |
| Deletion requests submitted through the website form | Kept for up to 12 months as proof that we handled the request, then deleted |
| Support email correspondence | Up to 24 months after the conversation ends |
| Messages sent through the contact form on this website | Treated like support email: up to 24 months after the conversation ends |
| Website server logs (Firebase App Hosting) and API/security logs (Google Cloud Logging) | Up to 30 days, then automatically deleted |
| Usage analytics, only if you accept (Google Analytics for Firebase in the app, Google Analytics on this website) | 14 months, then automatically deleted. Withdrawing consent stops new collection at once |
| Crash reports, only if you accept (Firebase Crashlytics) | 90 days at Google, which then starts removing them from live and backup systems. Withdrawing consent stops new reports at once |
| Residual copies in system backups | Overwritten within 30 days of deletion |
10. Deleting your account
In the app — immediate, permanent, no email needed. Open Profile → Delete account and confirm. This deletes, at once and for good:
- your authentication record (you can no longer sign in),
- your user profile,
- your training levels and plan,
- your skills schedule,
- your finger training plan and sessions,
- your onboarding answers,
- your entire workout and session history,
- your subscription record, including your subscriber record at RevenueCat.
It cannot be undone and we cannot restore a deleted account.
If you cannot sign in, submit the form on our account-deletion page or email [email protected] from the address on the account. We may need to verify that the account is yours before we act, and we confirm completion within 30 days — normally within a few days.
11. Your rights
If you are in the EEA or the UK, you have the right to:
- Access the personal data we hold about you, and get a copy of it.
- Rectify anything inaccurate or incomplete.
- Erase your data ("right to be forgotten") — see section 10.
- Restrict our processing in certain cases.
- Portability — receive the data you gave us in a structured, commonly used, machine-readable format, and have it sent to another controller where technically feasible.
- Object to processing based on our legitimate interests, on grounds relating to your particular situation.
- Withdraw consent at any time, where we rely on consent (including for health-related data), without affecting the lawfulness of processing carried out before the withdrawal.
- Not be subject to a decision based solely on automated processing that produces legal or similarly significant effects — see section 6.
To exercise any of these, email [email protected]. We answer within one month, extendable by two further months for complex requests (we will tell you if that happens). Exercising your rights is free; we only charge for manifestly unfounded or excessive requests, and we will say so first.
You also have the right to lodge a complaint with a supervisory authority — the Berliner Beauftragte für Datenschutz und Informationsfreiheit (BlnBDI), Alt-Moabit 59-61, 10555 Berlin, or the data protection authority of the EEA country where you live, work or where the alleged infringement took place. We would appreciate the chance to sort it out first.
Providing your account and training data is not a statutory requirement, but it is necessary to use CLYMB: without it we cannot create an account or build a plan for you.
13. How we protect your data
Everything travels over HTTPS/TLS and is encrypted at rest on Google Cloud. Access to the API is authenticated with short-lived Firebase ID tokens; every request that touches your data is checked against the identity in the token, so one account can never read or change another's. We enforce a Content Security Policy and HTTP security headers, rate-limit the API, keep email verification on password accounts, and restrict administrative access to a signed admin claim held by the smallest possible number of people. No system is perfectly secure, but if a breach ever affects your rights we will notify the competent supervisory authority within 72 hours and tell you directly where the law requires it.
14. Children
CLYMB is not directed at children. You must be at least 16 to create an account in the EEA and the UK — or 13, where the law of your country sets that lower age and a holder of parental responsibility consents. Elsewhere the minimum age is 13. If you believe a child has given us personal data, write to [email protected] and we will delete the account.
15. Changes to this policy
We update this policy when what we do changes. The effective date at the top always reflects the current version. If a change materially affects your rights, we will tell you by email or in the app before it takes effect.
16. Contact us
Flexfit Softwareentwicklung, Inhaber: Américo Andrés Munoz Buschmann
Stresemannstr. 72, 10963 Berlin, Germany
[email protected]