Privacy Policy
TopOut is a community app for indoor bouldering. This policy explains what we collect when you use the app, why, who helps us run it, and how to have your data removed. TopOut has no ads and no analytics trackers, and we do not sell your data.
TopOut is run by Andrei Micuda, Romania ("we", "us"). We are the controller of your personal data. Contact: [email protected].
What we collect
When you browse without an account
You can browse gyms, Routes, Profiles and Beta videos without signing in. We store nothing about you. Our hosting providers keep standard request logs (IP address, time, request) for security and troubleshooting.
Your account
- From Google Sign-In: your email address, your name and your Google profile picture. We do not receive your Google password or access to anything else in your Google account.
- From Sign in with Apple (iPhone): your email address, or a private relay address if you choose to hide it, and your name if you share it. We do not receive your Apple ID password.
- What you set: your Username, profile photo and home gym.
What you log and post
- Routes you add: the photo, grade, wall and date.
- Ascents: the Route, style (flash, send or attempt), date and any notes.
- Sessions: start and end times, title and an optional photo.
- Beta videos, comments, fist bumps, Route ratings, and the climbers you follow.
- Reports you file about content or climbers, and any account deletion request.
This content is public. Your Username, profile photo, Routes, Ascents, Sessions, Beta videos and comments can be seen by anyone using TopOut, signed in or not. Your email address is never shown to other climbers.
Location
If you allow it, the app reads your device's approximate location while you use it, to sort gyms and climbers by distance. Your location is sent with that request and is not stored. You can turn location off in your phone's settings; the app keeps working, unsorted.
Notifications
If you allow notifications, we store a push token for your device so we can tell you about follows, comments, fist bumps and reminders for an open Session. Notifications are delivered through Expo's push service and Apple or Google.
App and device
For each install we record a random install identifier created by the app, your platform (iOS or Android), OS version, app version and build, and the app update it runs. We use this to know which versions are still in use so we don't break them. It is linked to your account and is not used for advertising.
Why we use it
- To provide TopOut (performance of our agreement with you): your account, logging, stats, the feed, follows and notifications.
- To keep TopOut safe and working (our legitimate interests): reviewing reports, removing content that breaks the Terms, preventing abuse, fixing bugs and supporting older app versions.
- With your permission (consent): location and notifications. You can withdraw it at any time in your phone's settings.
Who processes it
We use these providers to run TopOut. They process data only on our instructions.
- Supabase: database, sign-in, video storage and server functions. Hosted in the EU (Ireland).
- Cloudflare: photo storage and delivery (R2, images), the topout.me website and email forwarding.
- Google: Google Sign-In, and Google Places for gym names, addresses and opening hours. Gym searches go through our server; Google does not receive your account details.
- Expo (650 Industries): delivers push notifications and app updates.
- Apple and Google: Sign in with Apple, app distribution and push notification delivery.
Some of these providers are based in the United States. Where data leaves the EU, transfers rely on the EU–US Data Privacy Framework or the European Commission's Standard Contractual Clauses.
How long we keep it
We keep your data while your account exists. When you delete your account, we delete it within 7 days, except where the law requires us to keep something. Deleted data may remain in encrypted backups for up to 7 days before it is overwritten.
Deleting your account
In the app, open your Profile, then Account › Delete account. You can also email [email protected] from the address you sign in with. Your account is deleted within 7 days. This removes:
- your Profile (Username, name and photo);
- your Ascents, Sessions and their photos;
- your Beta videos, comments and fist bumps;
- your follows, push tokens and install records.
Routes you added stay at their gyms, because other climbers log Ascents on them; they are no longer linked to you.
Your rights
You can ask us to access, correct, delete or export your personal data, or to restrict or object to how we use it. Email [email protected] and we will reply within one month. If you are in the EU or UK, you can also complain to the data protection authority where you live or work, or to ours: the Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP).
Children
TopOut is not meant for anyone under 16. We do not knowingly collect data from children under 16; if you believe a child has an account, tell us and we will delete it.
Changes
If we change this policy in a way that matters, we will update the date above and tell you in the app before the change applies.