Privacy

RateClimbs keeps as little about you as it can. This page lists everything it stores and why. Last updated 24 October 2026.

Your device

The first time you open the app, your browser gets a cookie with a random device id. It identifies this browser so each phone gets one vote per climb. It holds nothing else. If you sign in, that device and the ratings it already made are linked to your account.

What we store

• Ratings. Stars, grade vote (soft, correct or hard) and tags for each climb you rate.
• Logbook ticks, reset votes and “Still up?” answers. Your device (and your account, if you’re signed in), the climb, your answer and the time.
• Climbs and photos you add. The climb’s colour, grade and wall, and the photo of the wall you take. Photos must not show people: nobody in the background agreed to be published. Before a photo is stored, an automatic check looks at it, and a photo that shows a person or doesn’t show a climbing wall is refused and never saved. If the check can’t run, the photo is kept hidden until the site owner has looked at it. Anyone can report a published photo that shows a person, and it is hidden straight away.
• Your account, if you make one. Your email address and/or your Google account id, an optional display name, and your preferred grade scales. Rating never needs an account; adding gyms and walls does.
• Gym admins and setters. When the site owner or one of a gym’s admins adds someone to a gym as an admin or a setter, we store that person’s email address and role with the gym to give them access when they sign in with it. It is never shown publicly; only the site owner and that gym’s admins see it. It is deleted from the gym when they are removed, but a record of who was added, changed or removed, and by whom, stays in the edit history, which only the site owner sees. If you ask us to delete your data, we also remove your email address from that history. When you are added to a gym as an admin or a setter, we email that address an invite saying which gym and how to sign in; it never says who added you.
• Edit history. Each change to a gym, wall or climb records which account or device made it, so bad edits can be undone. Other people only see whether it was made by a member, one of the gym’s admins or setters, the owner, or someone anonymous.
• Notifications, if you turn them on. Your browser’s push subscription and the notifications we send you inside the app.
• App error reports. When the app crashes in your browser, it sends us the error message, the app file and line it happened in, the app version and the kind of screen (like “a gym page”, not which gym). Before it is sent and again when it arrives, web addresses, email addresses, ids and long numbers are removed from the message, and it is cut to 200 characters. Reports are counted per day without your device, account or IP address, and only the site owner sees them.
• Rate limits for error reports. To stop one phone from flooding us with error reports, your device id is kept next to an hourly count for about 2 hours.
• Page views. Page views are counted with Cloudflare Web Analytics, which sets no cookies and does not track you across sites.

Friends

Friends is for climbers 16 and older. It needs an account with a display name, and it asks for your birth year once. Nothing is shared with a friend until you turn it on for that friend.

• What we store. Your friendships, and for each friend the two switches (“Share my progress” and “Include my climb list”), your open invites (we keep only a scrambled code of the invite link, not the link itself), your birth year, the people you blocked, the reports you made, and your time zone, which is used to work out days and weeks for friends.
• Who sees what. A friend you share with sees your display name, a summary of the last 90 days (a grade pyramid and sessions per week) and, if you also include your climb list, the climbs with the day you logged them. They never see the time of day, your email, your birth year, your ratings or your other friends. Without sharing, your logbook stays private. Turning sharing off or removing a friend is silent: the other person is not told.
• The 16+ rule. We only compare your birth year with the current year, and we never ask for ID. Any friend can report someone who seems under 16 with “Report: may be under 16”. Nothing happens by itself: the site owner reads the reports, and the admin page never shows who reported. The owner may turn Friends off for the account, which deletes its friendships and invites for good (they don’t come back if Friends is turned on again), or reset the birth year, which only asks the age question again. We never tell you who reported you. If Friends is turned off for your account, you see that it was after a report and how to appeal. To appeal, email admin@rateclimbs.com.
• An under-16 answer on a phone. If the birth year you give makes you under 16, it is also kept against this phone’s anonymous device id, so a new account on the same phone can’t simply answer again. Deleting your account does not remove it; only the site owner’s reset does, so email us if you want it removed.
• Notifications. If you turned notifications on, you hear when someone accepts your invite or shares their progress with you.
• Check-ins. A check-in is sent only when you tap “I’m here”, and only to the friends you pick. It shows the gym and whether you are there or on your way, with a rough arrival time if you gave one; there is no live location and nothing you type. A check-in ends on its own: three hours after you arrive (or after you said you’d arrive), at the end of your day if you chose “later today”, or as soon as you tap “I left”. Within an hour of it ending, the notifications it sent and any answers are deleted. A record that it happened (who sent it, which gym, when) is kept for about a day after it was sent, only to enforce the daily limit of four; nobody can see it. Your friends can answer “On my way” or “Can’t today”, and only you, the sender, see who answered. Each friend can mute your check-ins, and you can turn check-in alerts off for everyone; that applies to check-ins sent after you switch it, and one already sent stays until it ends. Muting is invisible: you are not told, and a friend who muted you sees nothing. The “told” count on your card includes friends who muted you, so it never shows who did.
• Your schedule. You can share your usual climbing days (the day, the gym and a rough time) with the friends you choose. They see the next seven days only, on their Friends screen, on your friend page and on the gym’s page. Skipping a day, pausing your schedule or leaving a friend out shows them nothing, and no reason; a friend who had tapped “I’ll come” on a day that goes is only told you won’t be there. Your friends can tap “I’ll come” on a day; who did is seen only by you, and you get a notification. Skips, “I’ll come” taps and their notifications are deleted within an hour after the day ends, and nothing about past days is kept.
• Board climbs. You can post a training-board climb (the board, angle, grade, a photo and the holds you mark). Only friends you share your progress with see it, and only you see who tapped I’ll try it or I sent it too. Photos have location data removed and are checked for people; friends can report a photo. You can delete a board climb any time.
• Deleting your account. When your account is deleted (see “Questions or deletion” below), that deletes your account’s friendships, invites, blocks, reports and birth year. The phone’s under-16 answer is removed on request too.

Your location

The app asks for your location only when you look for gyms near you or tap “I’m at the gym”. Looking for gyms uses it to sort them by distance and never stores it. Gym search and place search use it, rounded to about 10 km, to prefer gyms and places near you, and only if you shared it in the last few minutes. When you add a gym, it is used to check that you’re at the gym, and we keep only whether that check passed. For a gym picked from Google Maps, if you are at the gym, your location rounded to about 1 km is also used once to look up the gym’s town on OpenStreetMap; we keep the town, not your location. “Add town from my location” on a gym page does the same.

A new gym’s public map position is where you put the pin (rounded to about 11 metres), unless OpenStreetMap already has a position for the gym. A gym picked from Google Maps starts with Google’s name, website and position, which you can change before saving; we keep Google’s place id, the name and website as saved, and Google’s position for at most 30 days (refreshed from Google, or deleted until someone pins the gym again). We don’t keep Google’s address. Your own location becomes the pin only if you tap “I’m at the gym”. Who added a gym is never shown publicly.

How long we keep it

• When a gym takes a climb down, it is marked as stripped. Its photo and the individual ratings are deleted 30 days later. The totals (average stars and grade vote counts) stay, so gyms can see how their setting went.
• Sign-in codes expire after 10 minutes, and their records (which hold your email address) are deleted within about a day.
• Sign-in sessions last 30 days and are deleted within a day of expiring.
• App error reports are deleted after 30 days, and the hourly counts that hold your device id after about 2 hours.
• Everything else listed under “What we store” stays until you ask us to delete it.

Who else handles your data

• Cloudflare hosts the app, the database and the photos, and runs the bot check (Turnstile) when you add a gym, a climb or sign in. The bot check and our rate limits see your IP address; we don’t store it. When you answer that a climb is gone, we keep a scrambled, unreadable code made from your IP address for that day only, so one person can’t remove climbs alone; it’s deleted the next day. Cloudflare’s Workers AI also runs the automatic photo check: it sees each photo you upload only while checking it, keeps no copy and does not use it to train AI models (Cloudflare’s data usage page).
• Resend sends sign-in emails, so it receives your email address.
• Google, only if you choose to sign in with Google.
• Apple, Google or Mozilla push services, only if you turn on notifications. Your browser’s maker delivers them, so it sees that a notification was sent to your device. Our notifications carry no content: the app fetches the text from us when one arrives.
• OpenStreetMap (its Nominatim and Overpass services) is used to search for places, to list climbing gyms near you and to check gym locations. Your search text, the gym’s location (to look up its town), your location rounded to about 1 km (only to find the town of a Google Maps gym you are at), or a point about 5 km wide around you is sent from our server; who you are is not. When the main Overpass server is busy, the same request goes to private.coffee’s Overpass server, which keeps only part of our server’s address and the request details for up to 48 hours (see its privacy notes on that page).
• Google Maps (Places API) is used to find a gym by name when RateClimbs doesn’t have it near you yet. Our server sends Google your search text and, if you shared your location, a point rounded to about 10 km; who you are is not sent. Google’s use of this data is covered by the Google Privacy Policy, and Google Maps content by the Google Maps Additional Terms of Service.
• A gym’s own website: when a gym is added with its website, our server fetches the site’s small icon once, to show next to the link. The site sees a request from our server, not from you.
• OpenStreetMap map tiles are loaded by your browser when you add a gym and see the map, so the OpenStreetMap tile servers see your IP address and which map area you looked at.

What we don’t do

No ads. We don’t sell your data or share it with anyone beyond the services above.

Questions or deletion

Email admin@rateclimbs.com to ask what we hold about you or to have it deleted.

About RateClimbs