Privacy policy.

Who runs Cruxd

Cruxd is run by Tomas Nguyen, a private individual in Slovakia. Cruxd is not a company. That person decides what Cruxd does with your data, which makes them its controller under the EU General Data Protection Regulation (GDPR). In this policy, "we" means them.

Email: support@cruxdhq.com. Write there about anything on this page, including your rights.

What we store, and why

• Your account. Your email address and your password, which is stored only as a one-way hash. If you sign in with Apple, the email address Apple gives us (which may be a private relay address) and, the first time, your name. Why: to sign you in and to reach you about your account.
• Your profile. Name, username, home gym, and an avatar colour or photo. Why: so other climbers can find you and see who logged what.
• Your sessions. The gym, the date and time, how long, and each climb with its grade, result, burns, notes, how hard it felt, who you climbed with, and a song if you pick one. Why: this is the logbook, and the reason Cruxd exists.
• Photos and clips you attach to a climb, a gym post or your profile. The app removes location and camera details from them on your phone before upload.
• What you do with other people. Who and which gyms you follow, the kudos and comments you leave, and the people you block.
• If you run or work at a gym. Your role there, the boulders you set, and the posts you write for the gym.
• Staff invites. When a gym's owner adds staff, we keep the invite: its code, the gym, who made it, a name the owner may add for their own list, when it was made, used or cancelled, the account it is tied to once someone signs in with it, and which account accepted it. Why: so the link works once, for one person, and the owner can see who was added.
• Reports. If you report something: who reported, what, the reason, your note if you add one, and when. If you are reported, the same record names your content. Each report is also emailed to us, with the reported text quoted in it.
• Emails to support. What you write to us, and our answer.
• Keeping the service safe. To slow down mass sign-ups we keep a hashed form of your network address, never the address itself. It is deleted the first time anyone signs up after its hour is over. When you sign in, our sign-in provider records the network address and device of that sign-in, and keeps a log of sign-ins with their network addresses. Our hosting and sign-in provider keep short request logs, which include network addresses, for up to a week. When something breaks, an error report is sent to our error tracker: what failed, where in the code, the address of the request (which can include a username) and the browser or app version. Not your email, password or cookies.

On your phone, the app keeps your sign-in in the iOS Keychain, and a few preferences (theme, grade scale, the session in progress, whether you have seen the walkthrough) in its own storage. Those stay on the phone; a session reaches us when you save it.

Asking for your gym on the website

If you ask for a gym here, we keep what you send: the gym's name, its link and city, and whether you work there. If you do, we also keep your email address and your position there, and use that address for one thing: talking with you about getting the gym on Cruxd, which includes telling you when it is on. Requests sent before 25 October 2026 may also hold a note, and an address left by someone who does not work there, used only to tell them when the gym is on Cruxd. No account is needed, and no IP address is stored with the request. To stop the form being flooded, the rate limiter keeps a hashed form of your network address, never the address itself, and deletes it the first time the form is used after an hour.

Our legal grounds

To provide what you signed up for (GDPR Art. 6(1)(b)): your account, profile, sessions, media, social features and gym tools.

Our legitimate interests (Art. 6(1)(f)): keeping Cruxd safe and working — handling reports and blocks, slowing abuse, error reports, request logs and backups — keeping a post written for a gym with that gym after its author leaves, and the name an owner puts on a staff invite. You can object to these; see your rights below.

Your consent (Art. 6(1)(a)): the email address and position you choose to leave on a gym request. You can withdraw it at any time by writing to us.

Legal obligations (Art. 6(1)(c)): when the law requires us to keep or hand over something.

Who can see it

Anyone signed in to Cruxd can find you by name or username and see your profile and your sessions, with their climbs, photos, clips, kudos, comments and who you climbed with. There is no private account in this version. Your feed shows the people you follow, but that only decides what is shown to you, not what is hidden from others.

A gym's monthly board lists everyone who logged a session at that gym that month.

People who run a gym (its owner and staff) see who climbed each of their boulders, with the result and how hard it felt. If you follow a gym, its owners also see your name, how many sessions you have logged there, and whether it is your home gym. Their insights show grade counts only, never names. If you work at a gym, its owners see your name and your role on its People and roles list.

A staff invite is seen only by the gym's owners. Its code goes to whoever the owner sends it to, and anyone with the code sees which gym it is for.

Photos, clips and profile photos are stored at long, unguessable links. Anyone who has a link can open that file without signing in, so a link you share, or that someone copies, works for whoever gets it.

Blocking someone hides each of you from the other.

Your email address is never shown to other users.

We do not sell your data, show ads, or use analytics or tracking of any kind.

Who processes it for us, and where

These companies run parts of Cruxd for us, under data processing agreements. They may use the data only to provide their service to us.

• Supabase — the database, sign-in and file storage. Data stored in the EU (Ireland, eu-west-1). Supabase, Inc., USA.
• Vercel — runs the app's server and this website. Servers in the EU (Dublin, Ireland); its network may answer a request from a location near you. Vercel Inc., USA.
• Sentry — error reports. Data stored in the EU (Germany). Functional Software, Inc., USA.
• Resend — sends account emails (sign-in codes and password resets), and emails each report to us, with the reported text and the reporter's note. Resend, Inc., USA.

Some of these companies are in the USA. Where your data can be reached from outside the European Economic Area, the transfer is covered by the EU Standard Contractual Clauses, and by the EU–US Data Privacy Framework where the company is certified under it.

Apple is not our processor but acts for itself, under its own privacy policy: it distributes the app, and runs Sign in with Apple if you use it. When you search for a song, the app sends the search words straight from your phone to Apple's public music catalogue, and covers and previews load from Apple's servers. Apple sees your network address, not who you are on Cruxd.

How long we keep it

• Your account and everything in it: until you delete your account. Your username is then kept on its own, so nobody else can take it.
• Backups: the database is backed up daily and each backup is kept for 7 days, so deleted data is gone from them within a week. Before a risky change we also save a copy to our own computer, and delete it within 30 days.
• Error reports: at most 90 days. Request logs: up to a week.
• Sign-up hashed network addresses: an hour, then until the next sign-up deletes them.
• Sign-ins: the network address and device of a sign-in, until you sign out or delete your account. If you remove the app without signing out, it stays until you delete your account. The sign-in log: we delete entries older than 90 days every month.
• Reports, and their emails: while we handle them. Every month we delete those closed more than 12 months ago; until then they help us recognise repeated abuse. Deleting your account removes the reports you made; their emails are kept as above.
• Staff invites: the name on an invite goes when it is used or cancelled, or once its 7 days are over, the next time the gym's invites are opened. The rest stays as the record of who was added, until the gym is deleted or the owner who made it deletes their account. If you signed in with one or accepted one and then delete your account, it no longer says which account it was.
• Emails to support: up to 12 months after the conversation ends.
• Gym requests from the website: up to 12 months; every month we delete older ones. Your email address and position go sooner: in that monthly sweep once the gym is on Cruxd or we decide it will not be, or straight away if you ask.

Getting a copy, or deleting it

Prepare an export, in the app's System settings, gives you your profile, sessions, follows, kudos and comments in one file. For anything it leaves out, write to us and we will send it.

Delete account, in System settings, deletes your login, profile, sessions, climbs, photos and clips, the kudos and comments you left, your follows and blocks, and a demo gym you made. A post you wrote for a gym stays with that gym, with your name taken off it, because it belongs to the gym's page; its photos stay at their links. Your username is kept on its own, so nobody else can take it and inherit links to you. If you no longer have the app, write to us from your account's email address.

Your rights

You can ask us for a copy of your data, to correct it, to delete it, to limit what we do with it, or to have it in a portable form. You can object to anything we do on the basis of legitimate interests, and withdraw consent at any time. Write to support@cruxdhq.com; we answer within one month.

You can also complain to a data protection authority: in Slovakia, the Úrad na ochranu osobných údajov Slovenskej republiky, Hraničná 12, 820 07 Bratislava 27 (dataprotection.gov.sk), or the one where you live.

No decision about you is made by automated means alone. One rule runs on its own: reports from established accounts can hide content automatically until we review it.

Age

Cruxd is for people aged 16 and over. If we learn that an account belongs to someone younger, we delete it.

Cookies

This website sets no cookies. The older web version of Cruxd, at cruxdhq.com/app, uses one cookie that keeps an existing sign-in and one that remembers V or Font grades. Neither tracks you.

Changes

When this policy changes, the date at the top changes. If a change matters to how your data is used, we will say so in the app or by email before it takes effect.