Crux Club Privacy Policy

Last updated: 11 November 2026

Who we are

Crux Club is run by Jack Cooper, an individual developer based in the UK, who is the data controller for your personal data. Contact: support@cruxclubclimbing.app. You must be 16 or over to use Crux Club.

What we collect

Your sign-in details (email, or Apple/Google account identifier), username, optional display name and avatar, the gyms you follow, your climbing logs and sessions, the posts, media, comments, likes and follows you create, and the messages and message photos you send to friends, and any gym membership codes (gym keys) you save. If you own a gym on Crux Club, we also keep any facility suggestions you send us, with your account id, until we've dealt with them. We also store your route ratings and grade votes, friend invite codes, and, if you sign in with Apple, a token that lets us revoke Apple sign-in when you delete your account. If you're gym staff, we store your role, the routes you set and any gym maps you upload.

We also keep:

• Gym memberships you add, so we can show the gyms you climb at. They appear as "Climbs at" on your profile to anyone who can see your profile, and we use them to suggest climbers who climb at the same gyms.
• Body details, if you add them (height, weight, wingspan and build). They're optional. Only you can see them. We use your reach (wingspan, or height if there's no wingspan) to order other climbers' beta so the closest fit comes first. Other users never see your numbers.
• "Was this beta helpful?" votes, to rank beta. Votes aren't shown with your name.
• Suggestions you send from the app, with your account id. Only the developer reads them.

Why we use it (lawful basis)

• To provide the app (contract): your account, logging, posts, comments, messages, friends, gym follows and memberships, gym keys, body details and votes.
• With your consent: background location ("Show friends when I'm at the gym" and "Remind me of my gym key when I arrive") and push notifications. You can withdraw consent at any time by turning the switch off, or in your device settings.
• Our legitimate interests: keeping the app safe (blocked words, reports, moderation and evidence snapshots), stopping abuse such as sign-in spam, and keeping anonymised gym statistics.
• Legal obligations: keeping report evidence where the law requires it.

You need an email address, or an Apple or Google account, to sign up; everything else is optional. We don't make decisions about you by automated means that have legal or similarly significant effects. Ranking beta and suggesting climbers only changes the order things appear in.

Who processes your data

• Supabase hosts our database, file storage and sign-in, in the EU (Frankfurt).
• Resend delivers the email that carries your sign-in code.
• Expo builds the app and delivers app updates.
• Expo delivers push notifications on iOS. Push is off on Android for now.
• Apple or Google, if you choose them to sign in, confirm who you are and share your name and email with us (Google also shares your profile photo, and Apple lets you hide your email behind a relay address). We use the name and photo to pre-fill your display name and avatar, which you can change.

We don't sell your data, and we don't use it for advertising.

International transfers

Resend, Expo, Apple and Google are based in the US and may process data there. Where a provider is certified under the UK Extension to the EU-US Data Privacy Framework we rely on that; otherwise we rely on the standard contractual clauses with the UK Addendum.

Push notifications

If you allow notifications we store a device push token so we can send them. Tokens are deleted when you sign out or delete your account. A message notification shows the sender's username and the start of the message (or "sent a photo"). You can turn these off with the Messages switch in notification settings.

Location and friends

• Start session reads your location on your phone to find the gym you're at. That reading isn't sent to us.
• Bump to add a friend sends us one location reading so we can match your phone with the one you bumped. It's deleted within two minutes.
• Show friends when I'm at the gym is off unless you turn it on. When it's on, your phone checks in the background whether you're at one of the gyms you've added as a member. It sends us only which gym you arrived at, and that you left. It never sends your location. Only your friends see which gym you're at; followers and the public never do. Turning it off stops the checks and clears it straight away.
• While you have a logging session going, your friends see which gym you're at.
• Friends can see your private profile, the same as an approved follower.
• Remind me of my gym key when I arrive is off unless you turn it on. When it's on, your phone checks in the background whether you've arrived at a gym you've saved a key for, and shows you a notification. Nothing is sent to us when you arrive.

Gym keys

If you save a gym membership code, we store it encrypted, linked to your account and that gym. Only you can see it. Friends, followers and gym owners never do. Deleting the key, or your account, removes it.

User content and moderation

Your username, display name, avatar, follower count, top grade and the wall type you climb most are visible to every signed-in user, even if your profile is private. Your posts, sends and comments, and the gyms you climb at, are visible according to your profile privacy setting: everyone signed in if it's public, or only approved followers and friends if it's private. Content is checked against a blocked-words list. Reports you file are kept for moderation; the reporter link is removed if your account is deleted.

Messages. You can message your friends, with text and photos. We store messages and their photos so the two of you can read them. Only the two people in a chat can read it. Unsending a message deletes it for both people. Deleting a chat removes it from your side only; your friend keeps their copy. If someone reports a message, we keep it, including its photo, and the developer reads it for moderation. A reported message, and its photo, is kept even if it is unsent or an account in the chat is deleted, while the report is reviewed, and for no more than 90 days after it leaves the chat.

Evidence snapshots

When a report about a post, comment, message or user is open and the account is deleted, we keep a private snapshot of the reported text (and, for a message, its photo), the author's username and the time it was posted. Snapshots are erased 90 days after the deletion and are used only for moderation and legal obligations.

How long we keep it

• Your account data: until you delete it, or delete your account.
• Sign-in codes: 10 minutes.
• Bump locations: two minutes.
• Report evidence: 90 days, as above.
• Reports you file: for as long as we need them for moderation; your name is removed if you delete your account.
• Suggestions: until we've dealt with them, or you delete your account. Facility suggestions are kept without your name after that.
• Gym presence: until you leave the gym or turn the switch off; friends stop seeing it after 4 hours.
• Our hosting providers keep short-lived technical logs (such as IP addresses) for security.

Account deletion and what is kept anonymised

Deleting your account removes your profile, posts and their media, comments, messages and their photos, likes, "Was this beta helpful?" votes, follows, friends, friend invites, gym memberships, gym presence, gym keys, body details, suggestions, gym staff roles, blocks, notifications, preferences, push tokens and sign-in (including any stored Apple sign-in token, which we revoke). Logbook ascents and sessions are kept with your identity removed and notes cleared, so gym statistics stay correct. Reports you filed, facility suggestions you sent and gym maps you uploaded stay, without your name.

Delete your account in the app from Settings. If you can't use the app, see https://cruxclubclimbing.app/delete-account.

Cookies

The app and the website don't use cookies or tracking.

Children

Crux Club isn't for anyone under 16. If we learn that an account belongs to someone under 16, we delete it.

If you're 16 or 17, the law treats you as a child, so we keep your settings private by default: your profile is private, location features are off until you turn them on, and nobody can message you unless you're friends.

Your rights

You can ask for a copy of your data, ask us to correct or delete it, ask us to limit or stop using it, object to how we use it, and ask for it in a portable format. Email support@cruxclubclimbing.app. We'll reply within one month.

If you're unhappy with how we handle your data, you can complain to the Information Commissioner's Office (ico.org.uk).

Changes

If we change this policy we'll update the date above, and for important changes we'll tell you in the app.