Privacy Policy

Last updated: November 9, 2026

Overview

VerticalClimb ("we," "us," or "our") operates the VerticalClimb mobile app and web app. This Privacy Policy explains what information we collect, how we use it, and your rights regarding your data.

Information We Collect

Account & Profile

• Email address (for sign-in). If you use Sign in with Apple and choose "Hide My Email," we receive an Apple relay address instead of your real one
• Your first and last name (required for every account, including to manage subscriptions and billing). If you sign in with Apple or Google and share your name, we take it from there; otherwise we ask for it
• Username (you choose it and can change it any time)
• Profile information (age, climbing experience, home gym, goals)
• Profile photo (optional)
• Bio (optional)

What Other People Can See

• Your username and first name are shown on your public profile and wherever your activity appears (feed, climbers list, leaderboards)
• Your last name is shown publicly only if you allow it. You can turn this on or off at any time in your profile settings. When it is off, your last name is visible only to you and to us for account and billing purposes
• Your profile (bio, location, home gym, goals, hardest grades) and the climbs you log, including their notes and any AI feedback on them, are visible to other signed-in VerticalClimb users
• Free Solo makes your account private. Your climbs (including their notes and any AI feedback) and your posts are then visible only to you and to people with an accepted friend request between you, whichever of you sent it. Following you does not give access. Your name, photo and bio stay visible so people can find you and send a friend request. Free Solo also keeps you off the leaderboards and stops your climbs being posted to the feed automatically
• Gym check-ins (which gym you are at, and when) are visible only to you and your accepted friends, whether or not you use Free Solo. Everyone else sees only how many climbers are checked in at a gym, not who
• If you take part in a competition run on VerticalClimb, the organiser's results, including competitors' names, may be published

Competition Start Lists

• If a gym uploads a start list with your email, we use it only to link your entry when you join the competition with that confirmed email; only that gym's staff can see it (we can too, to run the service), it is never used for marketing, and it is deleted 30 days after results are published

Climbing Data & Content

• Climbs you log (grade, type, attempts, date, notes)
• Photos and videos you upload
• Your goals and progress tracking
• Leaderboard stats

Photos and videos you upload are shown only to signed-in VerticalClimb users. We won't share them on VerticalClimb's social media accounts, where the public can see them, unless you've said yes to that specific post. If you later ask us to, we'll take it down from our accounts.

Photos and videos are served through a Cloudflare Worker that checks a short-lived signed link on each request. It logs only whether the link was valid and the kind of file requested. It does not log the file name, the link's signature, or your IP address.

AI Coach Conversations

• Messages you send to our AI Coach are sent to Anthropic (Claude API) for processing
• Anthropic may retain logs for safety and improvement purposes (see their privacy policy)
• We save your AI Coach conversation history to your account so you can see it again. Only you can read it, and it is deleted with your account

Usage Analytics & Diagnostics

• We use PostHog to understand how the app is used: which screens and features are used, and events such as signing up or logging a climb. These analytics are linked to your account, including your name, username and email, so we can support you and fix problems for specific accounts
• In the mobile app, PostHog may record sessions (how screens were used) to help us find bugs. Text you type into fields and images are masked in these recordings
• We use Sentry to collect crash reports and error diagnostics, linked to your account ID
• Our websites use Vercel Web Analytics, which is cookieless and does not identify you
• We do not sell your data or use it for advertising

What We Do NOT Collect

• GPS location
• Advertising identifiers (IDFA, Android Advertising ID)
• Data for ad targeting
• Biometric data (fingerprint, face ID)

Our analytics provider may estimate your approximate country and city from your IP address.

How We Use Your Data

• Authentication & account management — to let you sign in and manage your profile
• Subscriptions & billing — to link purchases to the right person and account
• Service delivery — to store and display your climbs, stats, and community profile
• AI Coaching — to provide personalized climbing advice via Claude
• Leaderboards & community — to show public rankings and connect climbers
• Competitions — to run competitions for gyms, including linking a gym's start-list entry to your account when you join with the same confirmed email
• Notifications — to send push notifications you have allowed
• Product improvement & support — to understand usage, fix bugs, and add features

Data Retention & Deletion

You have the right to delete your account at any time. Deleting your account:

• Immediately and permanently removes your profile, name, climbs, AI Coach history, and other personal data from our database. This cannot be undone
• Removes your uploaded photos and videos from your profile and the app, and our system then erases the underlying files from our file storage, usually within about 20 minutes

If a gym uploads a start list with your email, that email is deleted 30 days after the competition's results are published or 90 days after the competition starts (or is created, if it has no start date), whichever comes first. Deleting your account does not remove it sooner; it is deleted on this schedule.

Encrypted backups of our database are kept for 30 days for disaster recovery, so deleted data may remain in a backup for up to 30 days before it is gone for good. Competition results published by an organiser are not removed by deleting your account; contact us if you want your name removed from them.

To delete your account, open the app, go to Profile → Settings → Delete account.

Third-Party Services

• Supabase — backend database and authentication. Supabase Privacy Policy
• Apple and Google — if you choose Sign in with Apple or Google. Apple Privacy Policy · Google Privacy Policy
• Anthropic (Claude API) — AI Coach messages. Anthropic Privacy Policy
• PostHog — product analytics and session recording. PostHog Privacy Policy
• Sentry — crash and error reporting. Sentry Privacy Policy
• RevenueCat — subscription management. RevenueCat Privacy Policy
• Cloudflare (R2) — storage for photos, videos, and encrypted backups. Cloudflare Privacy Policy
• Vercel — hosting for our websites and web app. Vercel Privacy Policy
• Expo (EAS) — app builds, updates, and push notification delivery. Expo Privacy Policy

Data Security

We protect your data using industry-standard encryption (HTTPS/TLS) and row-level security policies on our database. However, no system is 100% secure. If you suspect a breach, contact us immediately.

Children's Privacy

VerticalClimb is not intended for users under 13. If we become aware a child has created an account, we will delete it immediately.

Your Rights

You have the right to:

• Access — request a copy of your personal data
• Correct — update inaccurate information
• Delete — remove your account and data
• Opt-out — of non-essential communications

To exercise these rights, contact us at admin@fullverticalclimb.com.

Changes to This Policy

We may update this policy from time to time. We will notify you of material changes via in-app notification or email. Continued use of the app constitutes acceptance of the updated policy.

Contact Us