Privacy Policy

Last updated: September 30, 2026

This Privacy Policy explains how Mateusz Kuba ClimbingDad ("we", "us") collects and uses information when you use the ClimbingDad mobile application and related coach tools (the "App").

If you do not agree with this policy, please do not use the App.

1. Who is responsible for your data

Data Controller: Mateusz Kuba ClimbingDad

Address: ul. Bernardyńska 16b/116, 02-904 Warszawa, Poland

NIP: 7621941760

Contact: climbingdad@mateuszkuba.com, tel. 509 595 095

We have not appointed a Data Protection Officer. For all privacy matters, contact us at the email above.

2. Information we collect

We collect only the information needed to provide ClimbingDad’s training features.

2.1 Account information

When you create an account, we process:

• Email address
• Display name (from signup or your profile)

Authentication is handled by Supabase authentication services.

2.2 Profile and preferences

Depending on what you set in the App, we may process:

• Grade scales (boulder and route)
• Language (Polish or English) and unit system (metric or imperial)
• Week-start preference
• Optional birth date, climbing-since date, peak grade, and body weight
• Plan preferences (training days, session length, equipment, focus) used by the plan generator

2.3 Training data you create

Depending on how you use the App, we process:

• Sessions — planned and completed workouts (climbing, hangboard, campus, gym, cardio, mobility), dates, duration, accent, notes, and status (including shortened or skipped items)
• Session items and efforts — sets, reps, holds, rest, load, edge size, grades, outcomes (sends), and related logging fields
• Warm-up routines linked to sessions
• Training plan and weekly rhythm — planned sessions and rhythm settings
• Load / readiness inputs derived from your logged efforts (used to show readiness by training system)
• Custom exercises and routines you create or save
• Climbing history and session summaries generated from your logs

2.4 Coach collaboration (opt-in)

If you link with a climbing coach:

• Your coach can view training data needed to coach you (sessions, plan, history, readiness-related training data)
• Your coach can send plans and coaching notes that appear in the App
• You control the relationship and can revoke access

2.5 Paid coaching (opt-in)

If you buy paid coaching from a coach through ClimbingDad, we also process:

• Subscription records — which coach, price, currency, status, current period end, and whether you cancelled
• Payment records — amount paid, our commission, date, and payment identifiers from our payment provider. We never see or store your card number.
• Your consent to start coaching early — the exact wording you accepted, its version, language, and time (required as evidence under Polish consumer law)
• Referral code — if you entered one at purchase

The legal basis is performance of the contract (Art. 6(1)(b) GDPR) and our legal obligations under tax and consumer law (Art. 6(1)(c) GDPR).

2.6 Coaches who sell through ClimbingDad

If you are a coach selling coaching through ClimbingDad, we additionally process your payout account status from our payment provider and the data required by EU platform reporting rules (DAC7, implemented in the Polish Tax Ordinance): full name, address, tax identification number (NIP), VAT status and number, and date of birth. We are required to report this data to the Polish tax authority (Art. 6(1)(c) GDPR).

3. What we do NOT collect

• We do not collect location or GPS data
• We do not collect advertising identifiers (the Android Advertising ID or Apple’s IDFA)
• We do not sell your data to third parties
• We do not use generative AI on your training data

4. How we use your information

• Provide core app functionality — today’s session, live logging, plan, history, offline sync
• Show readiness and load insights — rule-based calculations from your logged efforts (not generative AI)
• Support coach collaboration when you opt in
• Manage your account — authentication, password reset, account deletion
• Process paid coaching when you buy it — payments, cancellations, refunds, and records required by law
• Understand how the App is used — which screens are opened, sign-ups and sign-ins, and whether people start and log training, to find what does not work (see 5.3 and 5.4)
• Measure our advertising — whether people who install the App from our Google Ads go on to sign up and train (see 5.4)

5. Third-party services

5.1 Supabase

We use Supabase for authentication, database storage, and backend functions. Your data is stored in a PostgreSQL database hosted by Supabase. Supabase processes data on our behalf as a data processor. API traffic may use api.climbingdad.app.

5.2 Expo

The App is built with Expo (React Native). Expo may deliver over-the-air updates to the App.

5.3 PostHog (product analytics in the App)

The App sends usage events to PostHog (PostHog Inc., data hosted in the EU), linked to your account identifier:

• which screens you open, sign-up, sign-in and sign-out
• that you started or completed a session — with where it came from (your routine, your weekly rhythm, or a free session), whether you logged it live or afterwards, and how many sets or climbs it contains
• that you logged a set or a climb — with its type only (for example “hangboard” or “climb”)
• basic device and app version information

We use it to see which parts of the App work and which do not. We do not send the contents of your training — grades, loads, reps, notes — or your email address. The legal basis is our legitimate interest in maintaining and improving the App (Art. 6(1)(f) GDPR); you can object by contacting us.

5.4 Google Analytics for Firebase (app usage and ad measurement)

The App sends the same events as in 5.3 to Google Analytics for Firebase, provided by Google Ireland Limited. Google additionally records an app-instance identifier, device model, operating system and app version, and an approximate location (country and city) derived from your IP address. The events are linked to your account identifier.

We use it for usage reports and to measure whether our Google Ads campaigns bring people who actually use the App: Google Ads receives counts of installs, sign-ups and logged training attributed to its ads. We do not collect advertising identifiers (the Android Advertising ID or Apple’s IDFA), and we do not use this data to personalise ads or build remarketing lists. Development builds of the App send nothing.

Google may process this data outside the European Economic Area under the EU–US Data Privacy Framework and standard contractual clauses. The legal basis is our legitimate interest in understanding how the App is used and whether our advertising works (Art. 6(1)(f) GDPR); you can object by contacting us.

5.5 Stripe (payments for paid coaching)

Payments for paid coaching are processed by Stripe Payments Europe, Ltd. Stripe collects your card details directly and processes them under its own privacy policy; we receive only payment status, amounts, and identifiers. Coaches who sell through ClimbingDad verify their identity and payout details directly with Stripe.

5.6 Coach panel (coach.climbingdad.app)

The coach panel and the pages for buying and managing paid coaching use only strictly necessary cookies: your sign-in session and your language choice. They do not use analytics or advertising cookies.

5.7 Website analytics (climbingdad.app)

This section applies only to visitors of the climbingdad.app website, not to the App.

• Vercel Web Analytics — cookieless, aggregated statistics (page views, referrer, country, device type). It does not use cookies or identify individual visitors.
• Google Analytics 4 (Google Ireland Limited) — loaded only if you click “Accept” in the cookie banner. It sets _ga cookies to measure visits, traffic sources, and clicks on app store links. Google Signals and advertising features are not enabled. The legal basis is your consent (Art. 6(1)(a) GDPR).

You can change your choice at any time using the “Cookie settings” link in the website footer.

Each service has its own privacy policy. We do not sell your training data.

6. Data retention

We keep your information for as long as your account is active. When you delete your account, associated personal and training data is permanently removed from our servers, subject to any short technical backups required for reliable operation.

Exceptions required by law:

• When a climber deletes their account, the coach’s records of the paid subscription and payments, and the climber’s consent to start coaching early, stay — no longer linked to the deleted account. Tax law requires the coach’s sales to be documented, and the consent is evidence under consumer law.
• An account of a coach who has sold coaching through ClimbingDad, or has provided DAC7 data, is not deleted on request while tax law requires those records to be kept (Art. 17(3)(b) GDPR). If you ask, we will tell you exactly what we keep and why.

You can request deletion of your account by contacting us at climbingdad@mateuszkuba.com. See our Account Deletion page for details.

7. Security

We use reasonable technical and organizational measures to protect your information. Data is transmitted over HTTPS/TLS. Row-level security policies are designed so you can only access your own data (and a linked coach only what the coaching relationship allows). No method of transmission or storage is 100% secure.

8. Your rights

Depending on where you live (including under the GDPR if you are in the EEA/UK), you may have rights to:

• Access your information — visible within the App
• Correct inaccurate information — editable in your profile and session history
• Delete your information — via in-app account deletion or our deletion request page
• Restrict or object to certain processing
• Data portability where applicable
• Lodge a complaint with a supervisory authority (in Poland: President of the Personal Data Protection Office, ul. Stawki 2, 00-193 Warszawa)

To exercise these rights, contact climbingdad@mateuszkuba.com.

9. Children's privacy

The App is not intended for children under 13. We do not knowingly collect personal information from children under 13.

10. Changes to this policy

We may update this policy from time to time. We will update the "Last updated" date when changes are made.

11. Contact

Questions or requests: climbingdad@mateuszkuba.com

Mateusz Kuba ClimbingDad · ul. Bernardyńska 16b/116, 02-904 Warszawa · NIP 7621941760