Privacy Policy

1. Who We Are

letsboulder is operated by Patrick William Hadow trading as letsboulder, an individual / sole trader based in the United Kingdom.

If you have privacy questions or want to exercise your rights, contact hello@letsboulder.com.

2. Scope

This Privacy Policy applies to letsboulder.com, our web app, account services, map features, route submissions, community features, transactional emails, and related support interactions.

3. Personal Data We Collect

3.1 Data You Provide Directly

• Account data such as email address, sign-in method, username, and avatar.
• Profile data such as first name, last name, bio, gender, height, reach, grade preferences, units, theme preference, and contribution credit handles.
• Climbing data such as ascents, grades, votes, verifications, corrections, route submissions, comments, community posts, RSVPs, reports, and flags.
• Uploaded content such as photos, route images, and related text.

3.2 Location and Image Metadata

• GPS coordinates extracted from image metadata where present.
• Crag and route coordinates that you submit, edit, or verify.
• Default map location preferences saved in your account.

Location information is core to how letsboulder works. If you upload an image with location metadata, that metadata may be used to help place climbing content on the map before metadata is stripped from the stored file.

3.3 Data Collected Automatically

• IP address, browser type, operating system, referral information, timestamps, and request logs.
• Session identifiers, cookies, CSRF/security tokens, local storage values, and limited offline cache data.
• Limited product analytics and performance data.

4. How We Use Personal Data

• To create and secure accounts.
• To run maps, route discovery, logbooks, rankings, and community features.
• To process, display, moderate, and store uploaded climbing content.
• To detect abuse, spam, fraud, unsafe uploads, and policy violations.
• To send transactional emails such as sign-in, welcome, and account deletion confirmations.
• To improve product reliability, performance, and usability.
• To comply with legal obligations and resolve disputes.

5. Lawful Bases (GDPR / UK GDPR)

We rely on the following lawful bases where applicable:

• Contract: to provide the letsboulder services you request, including account access, climbing logs, route submissions, and community features.
• Legitimate interests: to keep letsboulder secure, moderate unsafe or abusive content, maintain route quality, prevent fraud, improve reliability, and maintain important operational audit trails.
• Consent: where consent is required by law for specific processing activities.
• Legal obligation: where we must retain or disclose data to comply with law, regulation, or legal claims.

6. Public Information

letsboulder includes public and community-facing features. Depending on your settings and actions, other users or the public may see your username, avatar, public profile details, route submissions, climbing content, comments, community posts, and map-related climbing data.

7. Sharing and Third Parties

We use third-party providers to operate letsboulder, including:

• Supabase for authentication, database services, and storage.
• Vercel for hosting and infrastructure.
• Vercel Analytics for limited analytics.
• Resend for transactional email delivery.
• AWS Rekognition for image moderation and safety checks.

We may also disclose information where required by law, to respond to legal process, or to protect rights, safety, and the integrity of the service.

8. Cookies, Local Storage, and Similar Technologies

We use cookies and similar technologies for authentication, session continuity, security, storing preferences, and limited analytics. We also use local storage and offline/browser storage for app state, CSRF handling, and product features.

For more detail, see our Cookie Policy. You can also control many cookies through your browser settings.

9. International Transfers

Your data may be processed in the United Kingdom, European Economic Area, United States, or other countries where our providers operate. Where required, we rely on appropriate safeguards for international transfers.

10. Data Retention

We keep personal data only for as long as reasonably necessary for the purposes described in this policy. Account and profile data are generally kept while your account is active. Uploaded files, submissions, and community content may be deleted, anonymized, or retained depending on the feature and the deletion option you select.

We may retain limited records of completed deletions, security events, moderation decisions, or legal requests where reasonably necessary for compliance, fraud prevention, or dispute handling.

11. Your Privacy Rights

Depending on your location, you may have rights to access, correct, delete, restrict, object to certain processing, withdraw consent, and request a portable copy of your personal data.

• Right to be forgotten: you can request deletion of your account and associated personal data, subject to lawful exceptions.
• Data portability: you can request a copy of your personal data in a structured, commonly used, machine-readable format by emailing us.
• Correction: you can update some profile details in settings and contact us to correct other data.

To exercise your rights, email hello@letsboulder.com. We may need to verify your identity before completing some requests.

12. Account Deletion

letsboulder provides an account deletion flow. When you delete your account, we may delete your profile, avatar, account access, and related user records. For route uploads, you may be offered a choice to delete the uploads or keep some content on letsboulder without personal attribution.

We may keep limited deletion audit records and other information that must be retained for security, fraud prevention, legal compliance, or dispute resolution.

13. California Privacy Rights

If you are a California resident, you may have rights to know, access, correct, delete, and receive information about the categories of personal information we collect, the sources of that information, the purposes for collection, and the categories of recipients.

We do not sell personal information for money. To submit a California privacy request, email hello@letsboulder.com with the subject line "California Privacy Request".

14. Children's Privacy

letsboulder is not directed to children under 13, and we do not knowingly collect personal information from children under 13. If you believe a child has provided personal data to us in violation of this policy, contact us and we will investigate and, where appropriate, delete the data.

15. Security

We use reasonable technical and organizational safeguards to protect personal data. No system is completely secure, and we cannot guarantee absolute security.

16. Changes to This Policy

We may update this Privacy Policy from time to time. If changes are material, we may post notice in the app or request renewed acceptance before continued use of certain features.