Privacy Policy

Last updated: October 7, 2026.

BoulderBuilder stores your climbing history on your device. Apple and RevenueCat process Pro subscriptions, and RevenueCat receives limited paywall-view information. Meta and TikTok provide optional advertising measurement under the controls described below.

Climbing Data

Your sends, grades, attempts, styles, gyms, notes, goals, sessions, and pyramids stay on this device. We do not operate a backend for climbing data or send your climbing history to RevenueCat, Meta, or TikTok.

The App also keeps a local ledger of usage counts, such as first logging, climbing-session milestones, paywall views, and purchase or restore outcomes. This ledger is not uploaded. Separately, the App reports limited native paywall impressions to RevenueCat as described below. Settings > Support > Usage Counts lets you preview and optionally share a local summary using the system share sheet. That summary contains only event totals, a history-cohort label, and a test/build label; it excludes climbing details, account identifiers, dates, notes, and photos. Delete Account & Data clears these local counts.

Account

• You can use the App as a Guest without signing in with Apple.
• If you choose Sign in with Apple, Apple handles authentication. The App stores your sign-in identifier and any shared name or email in the device-only iOS Keychain. Ordinary sign-in does not create a session on our deletion service. When you request account deletion, the App asks for fresh Apple confirmation and sends its signed identity token, one-time authorization code and a random request nonce to the deletion service. An identity token may contain your shared or private-relay email address; these claims are verified during that request and are not retained by the service. Your display name is not sent to the deletion service. The locally saved email can prefill the optional reply address when you request a feature.
• Your Apple-provided app user identifier is also sent to RevenueCat to associate your Pro subscription with your sign-in. Guests use a RevenueCat-generated anonymous identifier. Signing in does not upload or sync climbing history.
• We do not send your name or email address to Meta or TikTok, or set them as RevenueCat customer attributes.
• You can delete your account and data at any time from Settings; see Account and Data Deletion.

Account Deletion Service

Our deletion service runs on Cloudflare Workers. During an account-deletion request it processes your signed Apple proof and the network information needed to receive and protect the request. It verifies the Apple identity, exchanges the one-time code, uses the resulting token to revoke Apple authorization, and asks RevenueCat to delete the record identified by the verified Apple account. Tokens are held only while handling that request. We do not create an account database, keep Apple refresh tokens, or store server sign-in sessions or deletion-request history. The Worker does not write request bodies, identity proofs or credentials to application logs. Cloudflare may process and retain ordinary platform request metadata under its hosting terms and the configured account settings. Your climbing history, photos and Health data are not sent to this service.

A connection failure can leave the result uncertain because the service has no persistent status history. The App keeps your local climbing data and a local pending marker, and lets you confirm with Apple again for a new attempt. A successful response can be saved on your device to finish local removal without repeating the remote request. A device confirmation reference does not identify a server-tracked case. If you choose the explicit local-only fallback, remote deletion remains unconfirmed.

The service can validate and acknowledge signed Apple account-change notifications. It has no stored user sessions or tokens to update and does not initiate RevenueCat deletion from a notification. It does not retain notification payloads or email fields. The App checks Apple credential state separately; a confirmed revocation can sign you out while keeping your local climbing history.

Subscriptions

Apple processes purchases of BoulderBuilder Pro. RevenueCat receives subscription and transaction information, purchase history, and an app user identifier to validate purchases, provide and restore Pro access, and report subscription performance. The App does not receive your card details or billing address.

RevenueCat also receives device and attribution information such as the vendor identifier, IP address, tracking-consent status, and Meta anonymous identifier. The advertising identifier is available only when iOS tracking permission allows it. These identifiers do not contain your climbing history.

Paywall Measurement

When subscription plans become visible on the App's native Pro paywall, the App reports an impression to the same RevenueCat service used for subscriptions. This helps measure whether people encounter the subscription screen. The event includes an SDK-generated event identifier, the existing RevenueCat customer identifier and SDK app-session identifier, a timestamp, the fixed paywall identifier boulderbuilder_pro_native_v1, and the displayed offering's context. RevenueCat may include placement or targeting context already associated with that offering. An SDK app session describes use of the App; it is not a climbing session.

This impression does not include climbs, climbing-session milestones, climbing history, gym names, grades, notes, photos, Health data, your name or email. The App does not attach those details as customer attributes or forward this impression to Meta or TikTok. This subscription-screen measurement is separate from optional advertising tracking and uses the existing RevenueCat integration; it adds no new data service. More information is available in RevenueCat's custom paywall impression documentation and RevenueCat's Privacy Policy.

Optional Ad Measurement

We use Meta (Facebook) to measure whether ads lead to BoulderBuilder Pro. The Meta SDK handles installation and app-activation signals under the controls described below. Our RevenueCat Meta Conversions API integration is configured to forward subscription events only when RevenueCat records authorized tracking consent. Those events may include purchase information and identifiers used to match events to ads. The App provides tracking-consent status to RevenueCat. Meta's SDK may also process technical SDK information and crash diagnostics to operate and improve its services. We do not send Meta custom events about climbs, sends, grades, gyms, sessions, styles, or pyramids.

We also use TikTok to measure app launches from ads. If you allow tracking, TikTok receives app-launch events, app and device information, SDK-generated and device identifiers, IP address, tracking-consent status, and SDK performance, crash and technical error diagnostics. Under the TikTok Business Products (Data) Terms, this information may be used for measurement and analytics; marketing BoulderBuilder and targeting our ads; improving, optimizing and personalizing advertising, including through data combined with information from other sources; personalizing other content shown by TikTok; and operating, securing and improving TikTok's products and services. These partner uses include data linked to a person or device and cross-app advertising tracking. The TikTok integration does not send your name, email, Apple sign-in identifier, purchase events, climbing records, Health data, photos, or screen contents. TikTok measurement starts only after you grant tracking permission. TikTok's Jurisdiction Specific Terms may apply based on the relevant region and service configuration.

The App asks for tracking permission after the first-run experience. You can decline and continue using the App, purchase Pro, or restore purchases. You can change your choice in iOS Settings > Privacy & Security > Tracking. RevenueCat's Meta forwarding requires its recorded authorized consent status. TikTok event uploads pause when tracking permission is revoked; an already initialized SDK may still make configuration requests. Meta's SDK may still process limited app or device information under its platform privacy controls.

More information is available in the RevenueCat Privacy Policy, Meta Privacy Policy, TikTok Privacy Policy, and Apple Privacy Policy.

Optional Features

• Face ID / Touch ID: Used as a local app lock. The App never receives your biometric templates.
• Profile photo: A photo you select is stored on your device.
• Climb photos (Pro): You can attach one photo to a climb from your camera or photo library. Photos are downscaled and stored only in the App's storage on your device. They are never uploaded, synced, or shared. You can remove a photo without deleting the climb; deleting a climb or your account removes the climb photo. Archiving a gym keeps its climbing history and photos saved and can be reversed in Settings.
• Projects and beta (Pro): Project names, grades, notes, and optional beta photos stay on this device. Deleting the last logged attempt keeps the project and its beta notes/photos. Existing notes and photos remain readable after Pro lapses; creating or editing beta requires Pro. Deleting a beta note removes its photo.
• Share cards (Pro): You can turn a climb or a period of progress into a simple image card. The card is drawn on your device and handed to the iOS share sheet; you choose where it goes, and the App never posts it or sends it to us. Your gym's name is left off the card unless you turn on "Include gym name".
• Weekly target (Pro): The number of pyramid slots you aim to fill each week is a preference stored only on your device; progress toward it is computed from your local climbing log.
• Weekly check-in (Pro): If you turn on the weekly check-in, the App schedules one local notification on your device every Sunday at 6:00 PM. Notifications are scheduled by iOS on the device; there is no server or push notification service, and nothing about your climbing is sent anywhere. Turning the setting off or letting Pro lapse cancels the scheduled notification.
• Feature requests: Settings > Support > Request a Feature opens a draft email in your mail app addressed to us. The draft contains only the text you typed, an optional reply address you choose to include, the App version, and your iOS version. It does not include any climbing data, and nothing is sent unless you send the email yourself.
• Gym search: Text you enter for gym suggestions is sent to Apple Maps. This does not request your device's location or upload your saved gyms or climbing history.
• Apple Health (Pro): If you turn on Health sync, the App saves each climb you log as a climbing workout in Apple Health on your device and reads your most recent body weight from Health to estimate calories. Health data stays in Apple Health under your control; we never receive it and never send it to RevenueCat, Meta, TikTok, or anyone else. You can turn sync off in Settings or revoke access in the Health app at any time.

Support Correspondence

We use support emails and usage summaries you choose to send us only to handle your support request. We delete our copies of those emails and summaries within 30 days after the issue is resolved.

Account and Data Deletion

Open Settings > Manage Account. Apple accounts use Delete Account & Data; guests use Remove Guest Data for removal from this device. Apple accounts use a fresh Sign in with Apple confirmation for the same account. The App distinguishes local removal, Apple authorization revocation, and a RevenueCat deletion request. Guest removal sends no new remote deletion request and does not automatically remove older anonymous subscription records. Signing in with Apple does not guarantee that an old guest record is associated with the Apple account. A guest subscription reference is only a lookup hint, not proof of ownership. The App will:

• Request RevenueCat deletion for a verified Apple account. Our service derives the subscription identifier from verified Apple authentication, then sends RevenueCat's customer-deletion request. RevenueCat treats linked identifiers as one customer. A successful response confirms that RevenueCat queued the deletion for asynchronous processing; it does not confirm that all processing or physical deletion has finished. A not-found response is not treated as a successful deletion confirmation. If RevenueCat deletion was not requested, the App says so. Guest records whose ownership has not been verified are not automatically deleted merely by supplying an identifier.
• Revoke Apple authorization when confirmed by the service. The App saves local intent before contacting the service. If a response is interrupted, Apple revocation or RevenueCat deletion may already have occurred. The service has no persistent status lookup. The App keeps local data and requires fresh Apple confirmation for a new attempt rather than reusing the consumed authorization code or claiming nothing happened. If automatic revocation cannot be confirmed, the App explains how to stop using Sign in with Apple manually.
• Remove your locally stored BoulderBuilder account and climbing data after confirmation: your climbing log, climb photos, projects and beta notes/photos, goals, sessions, active and archived gyms, remembered logging grades, local usage counts, profile photo, weekly check-in preference and scheduled notification, weekly target preference, app-lock preference, and saved sign-in name and email. A local pending marker or successful result receipt may remain until you resolve local removal. If the service cannot confirm the required steps were accepted, local records are kept unless you separately choose the clearly described local-only removal option.
• The App attempts to log out the previous RevenueCat identity after local deletion when the subscription SDK is available. Detachment can fail or be deferred. If you continue using the App or restore purchases, RevenueCat can create an anonymous customer record and associate your active subscription with it. Deletion does not cancel or erase your Apple subscription.

TikTok's local measurement identifier and queued SDK data are not cleared by account deletion. TikTok uploads remain controlled by your tracking permission. Deleting the App removes TikTok's identifier and queued events from the App's local storage.

Some information is not deleted by this action:

• Your Apple subscription and App Store transactions. Billing is between you and Apple. Deleting your account does not cancel a subscription; manage or cancel it in Apple Account settings or at apps.apple.com/account/subscriptions. Restoring purchases later can associate your Apple receipt with a customer record again.
• Apple authorization that could not be revoked automatically. Legacy accounts or an unavailable account service may require the manual fallback. Open Settings > your name > Sign in with Apple > BoulderBuilder > Stop Using. Removing Apple authorization does not itself confirm RevenueCat erasure or cancel an App Store subscription.
• App-launch measurement events already delivered to TikTok (only if you allowed tracking) are governed by TikTok's privacy policy and controls.
• Information already delivered to Meta under the controls described above. This is governed by Meta's privacy policy and controls; see the Meta Privacy Center. This page also serves as the data-deletion instructions for the Meta integration.
• Aggregated statistics that are not tied to your identifier, and records a provider must keep to meet legal obligations.

If you can no longer open the App, email support.boulderbuilder@gmail.com to request deletion of your RevenueCat record or follow up on an existing request. We aim to respond to manual requests within 30 days. Remote removal requires verified ownership; a reference or approximate purchase date alone is not proof. Include the request reference if available and relevant Apple order information so we can assess the request. We will explain if the available information cannot establish ownership rather than deleting an unverified record. Do not send passwords, sign-in tokens or private keys.

Contact

Questions about this policy or privacy requests can be sent to support.boulderbuilder@gmail.com.