Last updated: October 16, 2026.
BoulderBuilder keeps your private climbing log on your device. If you choose to use Friends, our Cloudflare-hosted service stores the profile, relationships and content you explicitly submit. Apple and RevenueCat process Pro subscriptions, and RevenueCat receives limited paywall-view information. Meta and TikTok provide advertising measurement under the controls described below.
Your complete climbing log, private notes, goals, sessions and pyramids remain on your device. A Friends post is a separate copy of the climb details you choose to share: grade, color, discipline, style, attempts and date, together with your caption and selected photos. A gym name is included only if you turn on that option. Private notes and Apple Health records are excluded. Editing or deleting a local climb does not edit or delete an existing Friends post; remove the post separately in Friends. We do not send your climbing records or Friends content to RevenueCat, Meta or TikTok.
The App also keeps a local ledger of usage counts, such as first logging, climbing-session milestones, paywall views, and purchase or restore outcomes. This ledger is not uploaded. Separately, the App reports limited native paywall impressions to RevenueCat as described below. Settings > Support > Usage Counts lets you preview and optionally share a local summary using the system share sheet. That summary contains only event totals, a history-cohort label, and a test/build label; it excludes climbing details, account identifiers, dates, notes, and photos. Delete Account & Data clears these local counts.
When the usage collector is configured, BoulderBuilder sends limited app-usage events to our separate Cloudflare-hosted service to help us understand onboarding, first-use milestones, Pro offers, and purchase or restore outcomes. Events contain a random installation identifier, a random event identifier for retry handling, an event and screen name, an existing/empty-history label, app version and build, a development/release label, and the UTC day. They contain no climb records, grades, gym names, notes, photos, Health data, selected onboarding answers, Apple or RevenueCat account identifiers, advertising identifiers, or raw error messages. We do not join these events to an account or use them for advertising. They are not forwarded to RevenueCat, Meta, TikTok, or Friends.
You can turn off Share app usage in Settings > Support > Usage Counts. This clears unsent events and the local usage identifier. Delete Account & Data also clears them. Already received events cannot be looked up by your Apple account and are scheduled for removal after 90 days. Reports contain aggregate counts of installations and events, not a list of people or verified revenue. The collector does not write payloads to application logs. Cloudflare processes network information to receive requests and apply rate limits; ordinary platform metadata is subject to its hosting settings and terms. Automatic collection is disabled in builds without a configured endpoint.
Friends is optional and requires Sign in with Apple. The Friends service stores your Apple account identifier, a separate social account identifier, your display name and chosen username, friendships, requests, blocks and invitations. It uses your Apple identifier to check Pro access with RevenueCat, without sending your posts or photos to RevenueCat. Cloudflare hosts the service, D1 database and private R2 photo storage. We do not import your device address book.
Profiles and submitted posts, comments and challenges require safety review before they become available to other people. Authorized operators can inspect the submitted profile text, climb details, captions, photos, comments, challenges and reports for that purpose. An approved username and display name can be found by signed-in users through username search and invitations. Accepting a friend request gives that friend access to approved posts, photos and interactions, subject to blocking. An invitation or QR code alone does not make someone a friend.
Private challenges send a selected friend a route description, grade, color and discipline after review. Gym name is optional. The participants can see the challenge status and self-reported completion. If you associate completion with a logged send, the service also receives that local record's identifier and climb time; it does not receive the rest of your private log, notes, photos or Health data as proof. A completed challenge is a person's own claim, not independent verification of a climb.
When you choose to include a gym name in a post or challenge, that venue name may identify the particular building where you climb. Friends does not request your device's GPS location or upload the saved gym address or coordinates. Leave Include gym name off to omit the venue from that submission.
Removing or blocking a friend stops access through the service and prevents further active challenge interaction for that relationship. It cannot recall information someone already saw, saved or captured outside the app. Reports are sent privately to BoulderBuilder for safety review and include the reporter, reported account or content, reason, time and review state.
The Friends service verifies Apple identity tokens and exchanges one-time authorization codes. It stores an encrypted Apple refresh credential for account validation and revocation, and stores hashes of session and invitation tokens. Identity tokens may contain an email address, which is processed during verification but is not retained as a Friends account field. Raw authorization codes and access tokens are not persisted by the service. Apple credentials are never shown to friends.
Profiles, relationships, posts, comments, challenges and their review records are retained while needed to provide Friends, until the relevant content is removed or the account is deleted. Pending and rejected submissions remain private and are not automatically purged on a fixed deadline. Uploaded photos not attached to a post become eligible for cleanup after 24 hours. Sessions expire after 30 days, sign-in challenges after five minutes and invitations after seven days. Expired records and abandoned uploads are removed by scheduled maintenance.
Reports are kept for safety review. Deleting a Friends account removes reports made by or about that account, including reports concerning its posts or comments. A limited pseudonymous Apple-account hash and associated suspension record may remain after deletion to enforce a reviewed suspension and prevent ban evasion. You can contact support.boulderbuilder@gmail.com to appeal a suspension or ask about retention. Photo erasure and Apple-authorization revocation may require retries after a service failure; restricted cleanup and revocation records remain until that work succeeds. Cloudflare may retain ordinary platform metadata and backups under its hosting settings and terms. The service does not log submitted photos, report text, identity proofs or credentials in application logs.
Our separate subscription-account deletion service runs on Cloudflare Workers. During an account-deletion request it processes your signed Apple proof and the network information needed to receive and protect the request. It verifies the Apple identity, exchanges the one-time code, uses the resulting token to revoke Apple authorization, and asks RevenueCat to delete the record identified by the verified Apple account. Tokens are held only while handling that request. This separate deletion service does not create an account database, keep Apple refresh tokens, or store server sign-in sessions or deletion-request history. The Friends service has its own account and encrypted-credential storage described above. The Worker does not write request bodies, identity proofs or credentials to application logs. Cloudflare may process and retain ordinary platform request metadata under its hosting terms and the configured account settings. Your climbing history, photos and Health data are not sent to this service.
A connection failure can leave the result uncertain because the service has no persistent status history. The App keeps your local climbing data and a local pending marker, and lets you confirm with Apple again for a new attempt. A successful response can be saved on your device to finish local removal without repeating the remote request. A device confirmation reference does not identify a server-tracked case. If you choose the explicit local-only fallback, remote deletion remains unconfirmed.
The service can validate and acknowledge signed Apple account-change notifications. It has no stored user sessions or tokens to update and does not initiate RevenueCat deletion from a notification. It does not retain notification payloads or email fields. The App checks Apple credential state separately; a confirmed revocation can sign you out while keeping your local climbing history.
Apple processes purchases of BoulderBuilder Pro. RevenueCat receives subscription and transaction information, purchase history, and an app user identifier to validate purchases, provide and restore Pro access, and report subscription performance. The App does not receive your card details or billing address.
RevenueCat also receives device and attribution information such as the vendor identifier, IP address, tracking-consent status, and Meta anonymous identifier. The advertising identifier is available only when iOS tracking permission allows it. These identifiers do not contain your climbing history.
When subscription plans become visible on the App's native Pro paywall, the App reports an impression to the same RevenueCat service used for subscriptions. This helps measure whether people encounter the subscription screen. The event includes an SDK-generated event identifier, the existing RevenueCat customer identifier and SDK app-session identifier, a timestamp, the fixed paywall identifier boulderbuilder_pro_native_v1, and the displayed offering's context. RevenueCat may include placement or targeting context already associated with that offering. An SDK app session describes use of the App; it is not a climbing session.
This impression does not include climbs, climbing-session milestones, climbing history, gym names, grades, notes, photos, Health data, your name or email. The App does not attach those details as customer attributes or forward this impression to Meta or TikTok. This subscription-screen measurement is separate from optional advertising tracking and uses the existing RevenueCat integration; it adds no new data service. More information is available in RevenueCat's custom paywall impression documentation and RevenueCat's Privacy Policy.
We use Meta (Facebook) to measure whether ads lead to BoulderBuilder Pro. The Meta SDK handles installation and app-activation signals under the controls described below. Our RevenueCat Meta Conversions API integration is configured to forward subscription events only when RevenueCat records authorized tracking consent. Those events may include purchase information and identifiers used to match events to ads. The App provides tracking-consent status to RevenueCat. Meta's SDK may also process technical SDK information and crash diagnostics to operate and improve its services. We do not send Meta custom events about climbs, sends, grades, gyms, sessions, styles, or pyramids.
We also use TikTok to measure app launches from ads. If you allow tracking, TikTok receives app-launch events, app and device information, SDK-generated and device identifiers, IP address, tracking-consent status, and SDK performance, crash and technical error diagnostics. Under the TikTok Business Products (Data) Terms, this information may be used for measurement and analytics; marketing BoulderBuilder and targeting our ads; improving, optimizing and personalizing advertising, including through data combined with information from other sources; personalizing other content shown by TikTok; and operating, securing and improving TikTok's products and services. These partner uses include data linked to a person or device and cross-app advertising tracking. The TikTok integration does not send your name, email, Apple sign-in identifier, purchase events, climbing records, Health data, photos, or screen contents. TikTok measurement starts only after you grant tracking permission. TikTok's Jurisdiction Specific Terms may apply based on the relevant region and service configuration.
The App asks for tracking permission after the first-run experience. You can decline and continue using the App, purchase Pro, or restore purchases. You can change your choice in iOS Settings > Privacy & Security > Tracking. RevenueCat's Meta forwarding requires its recorded authorized consent status. TikTok event uploads pause when tracking permission is revoked; an already initialized SDK may still make configuration requests. Meta's SDK may still process limited app or device information under its platform privacy controls.
More information is available in the RevenueCat Privacy Policy, Meta Privacy Policy, TikTok Privacy Policy, and Apple Privacy Policy.
We use support emails and usage summaries you choose to send us only to handle your support request. We delete our copies of those emails and summaries within 30 days after the issue is resolved.
Open Settings > Manage Account. Apple accounts use Delete Account & Data; guests use Remove Guest Data for removal from this device. Apple accounts use a fresh Sign in with Apple confirmation for the same account. The App distinguishes Friends removal, local removal, Apple authorization revocation, and a RevenueCat deletion request. Guest removal sends no new remote deletion request and does not automatically remove older anonymous subscription records. Signing in with Apple does not guarantee that an old guest record is associated with the Apple account. A guest subscription reference is only a lookup hint, not proof of ownership. The App will:
TikTok's local measurement identifier and queued SDK data are not cleared by account deletion. TikTok uploads remain controlled by your tracking permission. Deleting the App removes TikTok's identifier and queued events from the App's local storage.
Some information is not deleted by this action:
If you can no longer open the App, email support.boulderbuilder@gmail.com to request deletion of your Friends account or RevenueCat record, appeal a suspension, or follow up on an existing request. We aim to respond to manual requests within 30 days. Remote removal requires verified ownership; a reference or approximate purchase date alone is not proof. Include your Friends username or request reference if available and relevant Apple order information so we can assess the request. We will explain if the available information cannot establish ownership rather than deleting an unverified record. Do not send passwords, sign-in tokens or private keys.
Questions about this policy or privacy requests can be sent to support.boulderbuilder@gmail.com.