Privacy Policy
Last updated: 18 October 2026
This privacy policy governs the processing of the personal data of users of the Kumbra mobile application (hereinafter, "the App"), in accordance with Regulation (EU) 2016/679, the General Data Protection Regulation (GDPR), and Spanish Organic Law 3/2018 of 5 December on the Protection of Personal Data and Guarantee of Digital Rights (LOPDGDD). In the event of any discrepancy, the Spanish version shall prevail.
1. Data controller
The controller of the data is Álvaro Montero Carmena, domiciled in 28935 Madrid, Spain (hereinafter, "the Controller"). For any enquiry regarding data protection, users may write to axclimb@gmail.com.
2. Personal data processed and purposes
| Data category | Source | Purpose |
|---|---|---|
| Account data: email address, password (stored in encrypted form), first name, first surname and username. If the user signs in with Apple or Google, the account identifier and email (or Apple's relay email) provided by that provider, instead of the password. | Provided by the user when registering or when updating their personal details, or by Apple or Google when the user chooses to sign in with them. | Creating and managing the account, authentication, password recovery and displaying the profile. |
| Sports activity data: climbing gym or crag, date, duration, routes and boulders climbed (grade, result, attempts and style), session rating, notes and, where applicable, metres climbed. | Entered by the user in the App. | Keeping the user's history, calculating level, experience points, statistics and rankings, and publishing the activity to other users. |
| Photos and videos that the user adds to their sessions. | Selected or captured by the user in the App. | Displaying them with the session on the user's profile and, if the user so chooses, in other users' feeds. They are reduced in size on the device before being uploaded. |
| Social interaction data: users followed and followers, recognitions ("kudos"), comments on sessions and their likes, challenges between friends (created or joined), muted or blocked users, reports submitted and their reason, and favourite places. | Generated through use of the App. | Providing the social features, enforcing blocks and mutes, and reviewing reports to keep the community safe. |
| Private messages: conversations (one-to-one or group) with other users, their content, participants and date, and message requests accepted or declined. | Written by the user in the App. | Delivering messages to the participants of the conversation. Only the participants see them; an automatic filter for offensive content applies, and blocking stops messages from the blocked user. |
| Kumbra Pro subscription data: plan, status, start and renewal dates and the store's purchase identifier. No payment details are received. | The App Store or Google Play, when the user subscribes or restores a purchase. | Enabling Kumbra Pro features on the user's account and handling subscription issues. |
| Moderation data: reports received and, where applicable, account suspension and its duration. | Generated when reviewing reports. | Enforcing the community rules (terms of use) and preventing abuse. |
| Crash reports: when the App closes because of an error, the device model, the system and App versions, the time and the technical detail of the error, together with a random identifier of the installation. They don't include the account or the user's content. | Generated automatically by the App (Firebase Crashlytics). | Detecting and fixing errors in the App, on the basis of the legitimate interest in it working properly. |
| Places added by the user: name of the gym or crag, town, province, discipline and, optionally, its location. | Provided by the user when a place is not yet listed in the App. | Allowing sessions to be logged at that place and, after review, making it available to other users. |
| Notification data: the device's notification identifier, language, App version and notification preferences. | The user's device, with prior authorisation. | Sending notifications about social activity (kudos, new followers, comments and messages) and the reminders the user turns on. |
Waiting list
Anyone who joins the App's waiting list (www.axclimb.com/kumbra) provides their email address and the username they wish to reserve; if they arrive through another person's link, the username of the person who invited them is also recorded, as well as, if they choose to tell us, the climbing gym where they climb. This data is processed on the basis of consent (Art. 6(1)(a) GDPR) for the sole purpose of reserving that username, confirming the sign-up, announcing the App's launch and recognising founder status, and learning which climbing gyms have the most interest. It is kept until the person creates their account or, at most, six months after the launch, and can be deleted at any time on request. It is stored in the App's database (Supabase, European Union) to reserve the username and, when the person creates their account with the same email, to recognise them as a founder.
Data that stays on the device
The following data is processed exclusively on the user's device and is not transmitted to the Controller's servers:
- Location, used only when the user looks for nearby places, unless the user chooses to attach it to a place they add.
- Heart rate and calories read from Apple Health or Health Connect (see "Health data").
- Reminders and the Live Activity on the lock screen.
Health data
If the user so chooses, the App reads from Apple Health (iPhone) or Health Connect (Android) the data their watch records while they climb: heart rate, active energy (calories), metres climbed and climbing workouts (start and duration). Some of this is data concerning health, a special category of data (Art. 9 GDPR).
- Purpose: showing the user the heart rate, zones and calories of their sessions and suggesting they log a session when their watch records a climbing workout.
- Legal basis: the user's explicit consent (Art. 9(2)(a) GDPR), collected on a dedicated screen in the App, with a box the user must tick, before the operating system asks for read permissions. The system permissions do not replace this consent. Giving consent is voluntary: the App works the same without it, and it does not depend on the Pro subscription.
- Where it is processed: heart rate and calories are processed only on the user's device; they are not sent to the Controller's servers and other users do not see them. The workout's duration is saved with the session if the user logs the session with it. Metres climbed are only saved with the session if the user expressly turns on "Save the watch's metres" in Settings; in that case whoever can see the session sees them. Whatever is saved with the session is hosted by Supabase in the European Union (Frankfurt, Germany).
- Writing: the Kumbra app for Apple Watch saves the sessions the user does with the watch to Apple Health as climbing workouts. The App writes no other data to Apple Health or Health Connect.
- Excluded uses: this data is not used for advertising, analytics or usage metrics, is not sold and is not shared with third parties.
- Retention: whatever is saved with a session is kept for as long as the session or the account exists. Data processed on the device is not stored on the Controller's servers.
- Withdrawing consent: at any time, from Settings → Apple Health (iPhone) or Settings → Health Connect (Android). The App then stops reading this data and deletes from its servers the metres climbed saved with the user's sessions. Turning off "Save the watch's metres" deletes them as well. System permissions can also be revoked in the Health app or in Health Connect. Withdrawal does not affect the lawfulness of processing carried out beforehand.
Usage metrics
The App sends anonymous usage events to its database (for example "session saved" or "session shared"), with a random installation identifier and the App version, not linked to the account, the email or the sessions. They are used to understand which parts of the App are used in order to improve it. They are kept for a maximum of 24 months.
Device permissions
The App requests access to the camera, microphone, photos, location (only while in use), Apple Health or Health Connect (read) and notifications only when needed for the corresponding feature. Users may refuse or revoke these permissions at any time in their device settings (iOS or Android).
The Controller does not display advertising, does not sell or transfer data for commercial purposes, does not track users across third-party apps or websites and does not use third-party analytics tools. To detect errors it uses Firebase Crashlytics, only with the crash reports described above.
3. Information visible to other users
Kumbra is a social network. The user's first name, the initial of their first surname, username, avatar, level, followers and following, and sessions (including their notes) are visible to other users of the App on the profile, in the feed, on place pages and in the rankings. The email address is never shown to other users. Comments are shown with the session to whoever can see it. Private messages are only seen by the participants of the conversation. A session's photos and videos are shown to other users unless the user chooses to show them only on their own profile. If the user shares a session on other platforms, it is done at their own decision and through the third-party app they choose. Blocked users lose access to the profile and activity of the user who blocked them.
4. Legal basis for processing
- Performance of a contract (Art. 6(1)(b) GDPR): account, sports activity and social interaction data, necessary to provide the requested service.
- Consent (Art. 6(1)(a) GDPR): notifications and location. Consent may be withdrawn at any time, without affecting the lawfulness of processing carried out beforehand.
- Explicit consent (Art. 9(2)(a) GDPR): health data from Apple Health and Health Connect, as detailed in "Health data".
- Legitimate interest (Art. 6(1)(f) GDPR): handling reports, preventing abuse, keeping the service secure and anonymous usage metrics to improve it.
- Compliance with legal obligations (Art. 6(1)(c) GDPR), where applicable.
5. Recipients
Data is not disclosed to third parties, except to the following processors, with whom the corresponding agreement is in place:
- Supabase, Inc.: database hosting, account management and sending account emails. Data is hosted in the European Union (Frankfurt, Germany).
- Cloudflare, Inc.: storage and delivery of session photos and videos, which can only be accessed through signed, time-limited links.
- Resend, Inc.: sending account emails and internal report alerts.
- Apple Inc.: delivery of notifications on iPhone, Sign in with Apple and billing of the Kumbra Pro subscription on the App Store.
- Google LLC: delivery of notifications on Android (Firebase Cloud Messaging), Sign in with Google, billing of the Kumbra Pro subscription on Google Play and crash reports for the App (Firebase Crashlytics).
- Google LLC (Gmail) and Vercel Inc.: receiving waiting-list sign-ups and sending the confirmation email, and hosting the sign-up page, respectively.
Any international transfers outside the European Economic Area are carried out with the safeguards provided for in the GDPR, such as the European Commission's standard contractual clauses or the EU-U.S. Data Privacy Framework. Data may also be disclosed to the competent authorities where required by law.
6. Retention period
Data is kept for as long as the account remains active. When the user deletes their account from the App (Settings → Delete account), the account, profile, sessions (including the metres climbed saved with them), social activity, photos, videos and registered devices are deleted immediately. Videos are deleted automatically twelve months after being published, and only their preview image is kept. The provider's backups are overwritten within a maximum of 30 days. Data stored only on the device is deleted when the App is uninstalled.
7. User rights
Users may at any time exercise their rights of access, rectification, erasure, objection, restriction of processing and data portability. Account details can be corrected and sessions deleted directly in the App; erasure can be requested from Settings → Delete account.
To exercise these rights, users may send their request to axclimb@gmail.com from the email address associated with their account. Requests will be answered within one month at the latest. Users also have the right to lodge a complaint with the Spanish Data Protection Agency (www.aepd.es) or with the supervisory authority of their country of residence.
8. Minors
The App is intended for people aged 16 or over. If the Controller becomes aware that an account belongs to a child under 16, it will delete it.
9. Security
The Controller applies appropriate technical and organisational measures to protect the data: communications between the App and the servers are encrypted with HTTPS, passwords are stored in encrypted form and the database access rules prevent users from modifying other users' data.
10. Changes
The Controller may amend this policy to reflect changes in legislation or in the service. Significant changes will be notified to users through the App or by email before they take effect, and the date shown at the top will be updated.