Crag Buddies
Back

Privacy Policy

Last update: 16 de maio de 2026

1. Introduction

Crag Buddies respects your privacy and is committed to protecting your personal data. This privacy policy explains how we collect, use, store, and protect your information when you use our platform.

By using Crag Buddies, you consent to the practices described in this policy.

2. Data We Collect

2.1 Registration Data

  • First and last name
  • Email address
  • Password (stored encrypted)
  • Profile photo (optional)

2.2 Profile Data

  • Location
  • Preferred climbing styles
  • Experience level
  • Biography and personal description
  • Climbing availability

2.3 Usage Data

  • Sessions and trips created or joined
  • Messages exchanged with other users
  • Favorite spots and contributions
  • Posts and comments published
  • Buddy connections

2.4 Payment Data

  • Premium subscription information
  • Transaction history
  • Credit card data is processed directly by Stripe and is never stored on our servers

2.5 Technical Data

  • IP address
  • Browser type, device model, and operating system version
  • Location data (only when authorized by the user)
  • Cookies and session identifiers
  • Advertising identifiers (IDFA on iOS, AAID on Android) — only collected if you grant App Tracking Transparency permission on iOS, or do not opt out on Android
  • Push notification tokens (FCM on Android, APNs on iOS) — used to deliver notifications about your activity
  • Permissions for camera, photo library, and device location (only when granted) for photo uploads, pickup point selection, and map features

3. How We Use Data

We use your personal data to:

  • Create and manage your user account
  • Facilitate connection with other climbers
  • Enable creation and participation in sessions and trips
  • Process Premium subscription payments
  • Send relevant notifications about your activity
  • Improve and personalize the platform experience
  • Ensure security and prevent fraud
  • Comply with legal obligations
  • Communicate important service updates

4. Advertising

Crag Buddies displays banner advertising in the mobile app (iOS and Android), provided by Google AdMob (Google Mobile Ads SDK). The web version of the platform does not display advertising. Premium subscribers do not see ads on any platform.

  • By default, AdMob serves non-personalized ads to all users.
  • EU / EEA / UK users see the Google User Messaging Platform (UMP) consent form at first launch, where they may opt in to personalized ads under GDPR.
  • iOS users are additionally asked for App Tracking Transparency (ATT) permission before any tracking. If you decline, ads remain non-personalized.
  • AdMob collects: anonymized advertising identifier (IDFA on iOS, AAID on Android), IP address, approximate IP-based location, device model and OS version.
  • Advertising is never shown on chat screens or on any create / edit form (sessions, trips, spots, profile) to keep the user focused.

To manage your advertising preferences: Google Ad Settings | Your Online Choices

You can adjust your consent preferences at any time by resetting app data or contacting us.

5. Payment Processing

Premium subscription payments are processed by Stripe, a PCI-DSS certified payment processor. Stripe.

  • Your credit card data is transmitted directly to Stripe
  • We never store complete card numbers on our servers
  • Stripe may store payment information according to their privacy policy
  • We only receive payment confirmations and transaction identifiers

6. Data Sharing

Your data is shared with other users according to platform features:

  • Public profile: Name, photo, location, and styles are visible to other users
  • Sessions and trips: Participants can see information about other members
  • Messages: Only visible between conversation participants
  • Buddies: Your buddy list may be visible to other users

We do not sell your personal data to third parties.

We may share data with:

  • Stripe — Premium subscription payment processing
  • RevenueCat — in-app purchase (IAP) processing on iOS and Android
  • Google AdMob — banner advertising in the mobile app
  • Google Firebase — push notification delivery (Cloud Messaging) on Android and basic analytics
  • Ably — real-time chat message delivery
  • Apple — Sign in with Apple authentication and APNs push delivery on iOS
  • Google OAuth — Sign in with Google authentication
  • Backblaze B2 — secure photo and image storage
  • Vercel, Cloudflare — application hosting and CDN
  • OpenStreetMap / Nominatim — geocoding for location search
  • Email providers — transactional communications
  • Competent authorities — when legally required

7. Cookies and Tracking Technologies

7.1 Essential Cookies

  • Session cookies: To maintain your authentication
  • Preference cookies: To save your settings (language, theme)

7.2 Advertising Cookies

  • Advertising identifiers (IDFA on iOS, AAID on Android) used by Google AdMob to serve and measure ads
  • GDPR consent state (UMP) for EU / EEA / UK users
  • App Tracking Transparency permission state on iOS

7.3 Analytics Cookies

  • We may use cookies to understand how users interact with the platform

You can manage your cookie preferences through your browser settings. Note that disabling certain cookies may affect platform functionality.

8. Storage and Security

Your data is stored on secure servers protected by appropriate technical and organizational measures, including:

  • Encryption of sensitive data
  • Secure connections (HTTPS)
  • Restricted access to personal data
  • Regular backups
  • Security monitoring

Data is retained as long as your account is active or as necessary to comply with legal obligations.

9. Your Rights

9.1 GDPR Rights (European Union)

Under the General Data Protection Regulation (GDPR), you have the following rights:

  • Access: You can request a copy of your personal data
  • Rectification: You can correct incorrect or outdated data
  • Erasure: You can request deletion of your data ("right to be forgotten")
  • Portability: You can receive your data in a structured format
  • Objection: You can object to processing of your data in certain circumstances
  • Restriction: You can request restriction of processing of your data
  • Withdraw consent: You can withdraw your consent at any time

9.2 CCPA Rights (California, USA)

If you reside in California, under the California Consumer Privacy Act (CCPA), you have additional rights:

  • Right to know what personal data we collect
  • Right to delete your personal data
  • Right to opt-out of selling your data (we do not sell data)
  • Right not to be discriminated against for exercising your rights

9.3 LGPD Rights (Brazil)

If you reside in Brazil, under the Lei Geral de Proteção de Dados (LGPD), you have rights similar to GDPR.

To exercise these rights, contact us at cragbuddies@gmail.com.

10. International Transfers

Your data may be transferred and processed in countries outside your country of residence, including countries where our service providers are located (such as the United States).

When we transfer data outside the European Economic Area (EEA), we ensure adequate protections exist, such as:

  • Standard contractual clauses approved by the European Commission
  • Adequacy decisions by the European Commission
  • Approved certifications or codes of conduct

11. Minors

Crag Buddies is not intended for minors under 16 years of age. We do not intentionally collect data from minors. If we become aware that we have collected data from a minor, we will proceed with its immediate deletion.

12. Changes to This Policy

We may update this policy periodically. Any significant changes will be communicated through the platform or by email. We recommend that you review this policy regularly.

The date of the last update is indicated at the top of this page.

13. Contact

For privacy questions or to exercise your rights, contact us:

Data Protection Authorities

You have the right to file a complaint with the competent data protection authority: