eCrag
Privacy Policy
Effective 20 October 2026
This policy explains what personal data the people who run eCrag ("we", "us") collect through the eCrag application and website, why we collect it, who we share it with, and what rights you have over it.
eCrag is an independent project. It is not a company or any other registered organisation. We decide how this data is used and are responsible for it as its controller. You can reach us at info@e-crag.com.
1. What we collect
| Category | What it includes | Where it comes from |
|---|---|---|
| Account | Email address, password (stored only as a cryptographic hash), nickname | You, at registration |
| Sign-in with Google or Apple | Your Google or Apple account identifier, and the name and email address the provider shares with us. For Apple, also a token we use to unlink eCrag from your Apple ID when you delete your account | Google or Apple, if you choose to sign in with them |
| Profile | First and last name, country, Instagram handle, profile photo — all optional | You, if you choose to add them |
| Climbing records | Routes climbed, dates, attempts, ascent style, whether completed, personal grades, sessions grouped into activities and projects | You, as you log climbs |
| Photographs | Images you attach to activities, trips and projects | You. Photos keep the metadata your phone stores in them, which can include where and when they were taken. Anyone who can open a photo can read it. |
| Social | Who you follow and who follows you, likes, comments, mentions, and the notifications they produce | You and other users, as you use the Service |
| Reports | Reports you file about publications, comments or profiles — what you reported, the reason and any details you write — and reports other users file about you or your content, with what we decided about them | You and other users, when they report something |
| Blocks | The people you have blocked, and the people who have blocked you | You and other users, when they block someone |
| Contributed climbing data | Crags, sectors, routes, spots and topos you add or edit, and the photos of crags and walls you upload | You. This becomes part of a shared database — see section 5 |
| Technical | IP address, device and browser identifiers, request timestamps, authentication tokens; if you allow notifications, your phone's push notification token, platform (iOS or Android) and language | Automatically, when your device contacts our servers |
We do not track your location. The Service records the location of crags and routes, not of you. When you look for climbers to follow nearby, the app sends us a point — your phone's location or the centre of the map — which we use only to answer that request and do not store with your account. It may remain for a short time in our server's technical logs.
We do not ask for, and you should not submit, special categories of data — health, biometrics, political or religious views, sexual orientation. If you put such information into a free-text field or a photograph, you do so on your own initiative.
2. Why we use it, and on what legal basis
| Purpose | Data used | Legal basis |
|---|---|---|
| Providing the Service — your account, your logbook, your feed, and keeping the people you block out of it | Account, profile, climbing records, photographs, social, blocks | Performance of our contract with you |
| Signing you in with Google or Apple, and unlinking eCrag from your Apple ID when you delete your account | Sign-in with Google or Apple | Performance of our contract with you |
| Sending push notifications about likes, comments, mentions and new followers | Technical, social | Performance of our contract with you |
| Keeping the Service secure, preventing abuse, and reviewing and acting on reports | Technical, account, reports, and the content reported | Our legitimate interest in protecting the Service and its users |
| Maintaining the shared crag and route database | Contributed climbing data | Our legitimate interest in providing a usable climbing database |
| Responding to your messages and support requests | Account, and whatever you tell us | Performance of our contract, and our legitimate interest in supporting users |
| Complying with law and defending legal claims | Whatever is relevant | Legal obligation, and our legitimate interest in establishing or defending claims |
3. Advertising
The Service may show advertising in the feed. It is worth being precise about what that does and does not involve:
- advertisements are the same for everyone — they are not selected using your profile, your climbing history or your behaviour;
- we do not build advertising profiles, and we do not run behavioural or interest-based targeting;
- we do not currently record impressions or clicks, and no advertiser receives your personal data from us;
- there are no third-party advertising networks, trackers or advertising cookies in the Service.
If this ever changes — for example if we begin measuring impressions — we will update this policy and tell you before the change takes effect.
4. Analytics and tracking
We do not use third-party analytics, advertising SDKs, social plug-ins or cross-site tracking. Our servers keep ordinary technical logs, which we use to operate and secure the Service.
5. What other users can see
eCrag has social features, and some of what you create is visible to others by design:
- your nickname, profile photo, optional name, country and Instagram handle are visible to other signed-in users;
- so are your completed climbs, your activities and your climbing statistics, on your profile;
- your published activities, trips, projects and their photographs also appear in the feeds of people who follow you;
- your likes and comments are visible on the publications they belong to;
- your follower and following counts are visible on your profile;
- if you have logged climbs near a place another user is looking at, the Service may suggest you to them as someone to follow.
None of this is shown to people you have blocked. People who have blocked you can still open your profile, so that they can lift the block. Who you block is never shown to anyone.
Your email address and password are never shown to other users.
Contributed climbing data is different. Crags, sectors, routes and topos become part of a shared database that all users rely on. That data stays in the Service even if you delete your account, because it describes the rock rather than you.
6. Who we share it with
We do not sell personal data, and we do not share it for anyone else's marketing.
We share it only with:
- GoDaddy, our hosting provider, which stores and serves the data on our behalf from a server in the European Union;
- Microsoft, which carries our email through Microsoft 365 — the messages that confirm your address and reset your password, and our correspondence with you;
- Google, which delivers push notifications through Firebase Cloud Messaging, receiving your phone's push token and the text of each notification, and which handles Sign in with Google if you use it;
- Apple, which delivers push notifications to iPhones, and handles Sign in with Apple if you use it;
- Discord, where we are alerted to each new report: it receives the nicknames of the person reporting and of the person reported, what was reported, the reason, and the details written with it;
- authorities, where we are legally required to disclose, or where disclosure is necessary to establish or defend legal claims or to protect someone's vital interests;
- a successor — a company or other organisation we set up to run eCrag, or someone who takes the project over — in which case we will tell you before your data becomes subject to a different policy.
These providers receive only what their part of the Service needs. Each of them protects it under its own data protection terms, which give it at least the protection this policy describes.
7. Where your data is processed
Our server is in the European Union. Google, Apple, Microsoft and Discord may process the data they receive from us in the United States and in other countries outside the European Union. Where the law requires it, they rely on recognised safeguards for such transfers, such as the EU–US Data Privacy Framework or the European Commission's standard contractual clauses.
8. How long we keep it
| Data | Retention |
|---|---|
| Account, profile, climbing records, photographs, social activity | For as long as your account exists |
| Everything above, after you delete your account or ask us to | Deleted at once if you delete your account in the app, or within 30 days of a request by email, including from backups as they rotate |
| Reports | For as long as the accounts of both the person who reported and the person reported exist; deleting either account deletes them |
| Blocks | Until the block is lifted, or either account is deleted |
| Contributed crags, routes and topos | Retained — part of the shared database and no longer attributable to you alone |
| Technical logs | Kept for a limited period for security and troubleshooting, then discarded |
| Records needed for legal claims or obligations | For as long as the relevant limitation period requires |
9. Your rights
Subject to the conditions in applicable data protection law, you have the right to:
- access the personal data we hold about you, and receive a copy;
- rectify data that is inaccurate or incomplete — most of it you can correct yourself in your profile;
- erase your data — see Delete Your Account;
- restrict or object to our processing, in particular processing based on our legitimate interests;
- portability — receive the data you gave us in a structured, machine-readable format;
- withdraw consent at any time, where we rely on consent, without affecting processing carried out before you withdrew it;
- complain to your data protection authority. If you are in Ukraine, that is the Ukrainian Parliament Commissioner for Human Rights; in the EEA, it is the supervisory authority of your country of residence.
Write to info@e-crag.com to exercise any of these. We respond within one month, and will tell you if we need longer because a request is complex. We may need to verify your identity first.
10. Security
Passwords are stored only as cryptographic hashes and are never recoverable in plain text. Traffic between your device and our servers is encrypted in transit. Access to production data is limited to people who need it to operate the Service.
No system is perfectly secure. If a breach occurs that is likely to result in a high risk to your rights and freedoms, we will notify you and the relevant supervisory authority as the law requires.
11. Children
The Service is not intended for children under 16. We do not knowingly collect data from them. If you believe a child has given us personal data, write to info@e-crag.com and we will delete it.
12. Cookies and similar technologies
The mobile application does not use cookies; it authenticates with a token stored on your device. The website sets two strictly necessary cookies on every visit — a session cookie and a security token that protects forms — which expire after two hours. They keep administrators signed in and are not used to track anyone. We set no advertising, analytics or cross-site tracking cookies, so no consent banner is required.
13. Changes to this policy
We may update this policy. When changes are material we will give reasonable notice before they take effect. The date at the top of this page always shows the current version.
14. Contact
Write to info@e-crag.com.