1. Controller and contact
The controller is the publisher of Climbing Diary, distributed through an individual Google Play developer account. Privacy and data enquiries: climbingdiaryapp@gmail.com.
2. App modes
Trial Premium
Seven days of local and cloud features. It does not start an automatic charge.
Lifetime Local Pro
One-time purchase with local log, sessions, projects, import, export and analytics. It does not create a cloud account or use Firebase sync.
Premium
Monthly or yearly subscription with an account, Firebase sync, friends, groups, challenges, training invitations and Coach mode.
3. Data categories
- Account and profile: email, Firebase ID, optional name, profile name, phone number, visibility settings and profile photo.
- Climbing data: routes, boulders, projects, attempts, sessions, grades, styles, tags, dates, place, notes, GPS coordinates and sports test results.
- Social data: friendships, blocks, groups, invitations, challenges, challenge progress and planned training.
- Purchase data: product ID, entitlement status, purchase token and validity period. Climbing Diary does not receive full card details.
- Diagnostics: crash, app version, operating system, device model and installation information provided by Firebase Crashlytics.
Route and project photo or video attachments remain on the device and are not uploaded to Firebase. The app stores a reference to the original file. A profile photo is reduced automatically and, with active Premium access, may be uploaded to Firebase Storage and shown to friends according to privacy settings.
4. Purposes and legal grounds
- providing the app, sync and purchased plan — performance of a contract;
- account, friend, challenge and training features — requested service;
- location, contacts, camera, media and notifications — consent through the selected feature and Android permission;
- crash diagnostics, security and abuse prevention — legitimate interest in a stable and secure service;
- purchase records — contract and legal accounting obligations.
5. Android permissions
- Location: only when you choose to add current GPS coordinates.
- Contacts: the selected contact number is used to check for an account that allows phone search. The address book is not published.
- Camera and media: a profile photo and a locally referenced route or project photo or video. Route attachments are not copied to the cloud.
- Notifications: invitations, training, challenges and deadlines.
- Calendar: a selected event can be handed to the phone calendar after your action.
6. Providers and transfers
Data is not sold. Necessary processing may involve Google Firebase (Authentication, Cloud Firestore, Cloud Functions, Cloud Storage, Crashlytics and App Check), Google Play (distribution, billing and entitlement verification), and GitHub Pages (public website hosting).
Google services may process data outside the EEA under safeguards used by the provider.
7. Security
Climbing Diary uses encrypted connections in transit, Firebase authentication, user-scoped Firestore rules, Firebase App Check, plan-based access controls and Android app storage isolation. No system eliminates all risk. Lifetime Local Pro users should export backups because the publisher cannot restore data that existed only on a lost or cleared device.
8. Retention
- Local data and local media references stay on the device until deleted, app data is cleared or the app is uninstalled. Moving or deleting an original media file may make its attachment unavailable earlier.
- Cloud data and the profile photo are available during Trial Premium and active Premium.
- After Premium expires, cloud data may be retained for up to 12 months for renewal or export, then deleted or anonymised unless a longer period is legally required.
- Diagnostics follow Firebase retention settings; transaction records may be retained as required by law.
9. Your rights
Depending on your location, you may request access, correction, deletion, restriction, portability or object to processing, and withdraw consent. Contact climbingdiaryapp@gmail.com. Identity confirmation may be required. You may also complain to your local data protection authority.
10. Account and data deletion
In the app: Profile → Data and privacy → Delete account and cloud data. Without app access, use the account deletion page or email support. Requests are normally completed within 30 days. Data required for security, transactions or legal compliance may be retained for the necessary period.
11. Children
The app is not specifically directed at children. If a minor uses it through a sports team, a parent, guardian or organiser should provide appropriate consent and supervision under local law.
12. Policy changes
This policy may change as the app, providers or law develop. The revision date appears above; material changes may also be announced in the app.