Privacy policy
This policy explains what personal data Cragfolk uses, why, who it's shared with, and your rights. It describes the app as it is today; when we add new features, we update it before they launch.
1. Who is responsible for your data
Alejandro Rodríguez Moreno, NIF 45366183V, Calle La Cueva 9, El Pagador, 35420 Moya (Las Palmas), Spain. Email: [email protected].
2. In short
- We only collect what Cragfolk needs to work. No adverts, no tracking, and we never sell your data.
- Your profile is only visible to signed-in climbers, and your home location is rounded to about 15 km.
- Your phone's location stays on your phone.
- You can delete your account and all your data from the app at any time.
3. What we collect and why
| Data | Why | Legal basis (GDPR) |
|---|---|---|
| Email address | To create your account and send you sign-in codes | Providing the service you signed up for (art. 6.1.b) |
| Profile: name, home area, bio, climbing styles, grades, year you started, availability | To show your climber profile and match you with partners | Providing the service (art. 6.1.b) |
| Home location, rounded to about 15 km | To show other climbers roughly how far away you are in Partners | Providing the service (art. 6.1.b) |
| Whether you're looking for partners | To show you in Partners, only when you turn it on | Providing the service (art. 6.1.b) |
| Technical data: IP address, device and app version, sign-in times | To keep accounts secure and fix problems | Our legitimate interest in a secure, working app (art. 6.1.f) |
| Emails you send us | To answer you | Our legitimate interest in replying (art. 6.1.f) |
We don't ask for or store your date of birth. We ask you to confirm you're 16 or older when you sign in, and 18 or older before joining Partners.
4. Your phone's location
If you allow it, the app uses your phone's location to centre the map on you and show distances to crags. This happens on your phone only: we don't send it to our servers or store it. You can turn it off at any time in your phone's settings.
5. Who can see your profile
- Only climbers who are signed in. People without an account can't see profiles.
- Your home location is stored rounded to about 15 km, so nobody can tell where you live.
- You appear in Partners only if you turn on "Looking for partners" and are 18 or older.
- Your email address is never shown to other climbers.
6. Services we use
We use these companies to run Cragfolk. They only use your data to provide their service to us.
| Service | What it does | What it receives | Where |
|---|---|---|---|
| Supabase | Database and sign-in | All the data in section 3 | Servers in Ireland (EU); Supabase Inc. is a US company |
| Brevo | Sends sign-in emails | Your email address and the code | France (EU) |
| Photon (komoot) | Place search when you set your home area | What you type in the search and your IP address | Germany (EU) |
| OpenFreeMap | Map images | Your IP address and the map area you're looking at | EU |
| Apple App Store and Google Play | Download and update the app | Covered by their own privacy policies | Worldwide |
Emails you send to [email protected] pass through Cloudflare's email forwarding before they reach us.
When data leaves the EU (for example to Supabase Inc. in the US), it's protected by the EU's standard contractual clauses or the EU-US Data Privacy Framework.
7. How long we keep it
| Data | How long |
|---|---|
| Account and profile | Until you delete your account |
| Sign-in codes | They expire after one hour |
| Technical data and logs | Up to 30 days |
| Emails you send us | Up to one year after we answer |
| Backups | Up to 30 days after deletion |
8. What the app stores on your device
The app keeps your sign-in session and your language choice on your device (in the browser's storage on the web version). These are needed for the app to work, so they don't need your consent. We don't use advertising or analytics cookies, and this website doesn't use cookies at all.
9. Age
Cragfolk is for people aged 16 or older, and Partners for adults aged 18 or older. If we find out that someone under 16 has an account, we delete it.
10. Your rights
You can:
- See the data we have about you and get a copy of it.
- Correct it: most of it you can edit yourself on your profile.
- Delete it: use "Delete account" in Settings, or write to us. See Delete your account.
- Take it with you in a common file format.
- Object to how we use it, or ask us to limit its use.
Write to [email protected]. We'll answer within one month. If you think we haven't handled your data properly, you can complain to the Spanish data protection authority (AEPD, aepd.es).
11. How we protect it
All connections are encrypted. Database rules let each climber change only their own data. We don't use passwords: you sign in with a one-time code sent to your email.
12. Changes
If we change this policy in an important way, we'll tell you in the app or by email before it applies.
Last updated: 5 October 2026.