Privacy Policy

Version 1.4 — 14 October 2026 · previous: v1.2, 29 September 2026

Cordada is a climbing app for iPhone, iPad, Apple Watch and Android: a collaborative guide to crags and routes, a logbook of your ascents, condition forecasts, social features and Progress, where you log your training (sessions, timers, tests and indicative suggestions for each week). This policy explains, plainly, what data we handle, what for, and what control you have over it. It covers the iPhone, iPad and Android app, the Apple Watch app and also the cordada.eu website: your health is in section 3, and the website, which handles much less, is at the end, in section 13.

The 30-second summary

No adverts and no trackers. The app carries no tracking SDK at all. The website uses a single audience measurement with no cookies and no profiling, explained in section 13. We do not sell your data or hand it over to anyone.
You choose what is visible. Ascents and photos have three levels: private, friends or public. Sharing your position with friends is optional and is switched on friend by friend.
Your health stays on your devices unless you say yes. What Cordada reads from Apple Health is used on your iPhone and your Apple Watch. Your training only goes up to your account if you tick “Save to my account”, and your health data (the effort you give each session, your injuries, the weight in two tests, your sex and a summary of your heart rate) only if you also tick “Also save health data”, which is for over-18s only. Your heart-rate curve, how you are feeling each day, your sleep, your HRV and your resting heart rate never leave your devices.
Your health data is not a business. It is not used for advertising, it is not sold, it is not handed to third parties and it is not used to train models or to compile statistics: only to show you your training and your fitness.
Full control from inside the app: you can export all your data (JSON), disconnect Apple Health and delete your account along with everything in it, without having to ask us by email.

1. Data controller

The controller of your data is Pawel Wojciech Kadziolka Bystrzycki, a private individual, developer of Cordada, an app made in Spain. Address: C/ Alemania, 4, 28907 Getafe (Madrid), Spain.

Contact for anything to do with privacy: hola@cordada.eu

2. What data we handle and what for

Category	Data	What for	Legal basis (GDPR)
Account	Email and password (stored hashed, never in the clear), or a “Sign in with Apple” identifier (if you choose to hide your email, Apple gives us a relay address), or a “Sign in with Google” identifier.	Creating your account, signing you in and keeping it safe.	Performance of the contract (art. 6.1.b)
Public profile	Username, display name, bio, profile picture and, if you add them, links to social networks (Instagram, YouTube, TikTok, Strava, 8a.nu, theCrag, personal website).	Your identity within the community. Visible to other users.	Performance of the contract (art. 6.1.b)
Date of birth	Your date of birth, which we ask for when you sign in.	Checking that you are at least 14 and applying the protections for under-18s (sections 3.9 and 9). It is private: it is not shown to anyone. Progress does not ask your age: it takes it from here.	Performance of the contract (art. 6.1.b) and the legal obligation to check the minimum age of consent (art. 6.1.c GDPR and art. 7 of LO 3/2018)
Logbook	Your ascents: route, date, style, grade, attempts, notes, rating; optionally the location where you logged the ascent and, if you log it from gym mode, the climbing gym. Also the ones you log from your Apple Watch (outdoors, with the crag, sector and route you pick from the list).	Your climbing history, your grade pyramid and — depending on the privacy you choose — the activity feed and each crag’s season calendar. An ascent logged at the gym or from the watch follows the privacy you choose for that ascent. An ascent never carries your heart rate.	Performance of the contract (art. 6.1.b)
Your training in your account (Progress, optional)	Only if you tick “Save to my account”: your sessions (type, day, start time, duration, exercises, sets, reps, loads, notes, climbing gym or crag, the grade and time of each attempt and, if the session comes from an Apple Health workout or from your Apple Watch, that workout’s identifier), your tests without your body weight, your answers in “Fine-tune the suggestions” without your sex (years climbing, disciplines, goal, the days and time you have, rock days, equipment and other sports), your suggested week without kilos or diagnosis figures, and which suggested sessions you skipped or moved. None of this is health data: each session’s effort (RPE) goes with the second box (next row), and your answer to “How are you feeling today?” never leaves your phone.	So you don’t lose it when you change phone and you see the same on all your devices. Only you can see it. Without this box, everything stays on your phone (section 3).	Consent (art. 6.1.a): the “Save to my account” box, in Progress settings. Untick it and it is deleted from your account.
Your Progress health data (optional, over-18s only)	Only if you also tick “Also save health data”: the effort you give each session (RPE, from 1 to 10), your injuries (which one, side and finger, since when, whether your physio lets you climb, pain from 0 to 10 and notes), your body weight in the two tests that need it, your sex if you give it (to compare you with the benchmark for your grade and to adjust the rests and reps of some exercises) and the heart-rate summary of the sessions linked to a workout from your watch: the session’s average and maximum heart rate; for each attempt, the time on the wall, the average, the maximum and how many readings there were; with Pro, your recovery between attempts (your heart rate at the end of each attempt and 60 seconds later); and the type of sensor. With this box, your suggested week goes up in full (with the kilos and your diagnosis) and your sessions with the percentage of your maximum. Never the full heart-rate curve.	Having them on your other phone too: with them, the phone works out your loads, your benchmark and your recovery. Only you can see them.	Explicit consent for health data (art. 9.2.a GDPR): the “Also save health data” box. Untick it and they are deleted from your account
Your Progress permissions	Every time you tick or untick a Progress box: which one, yes or no, the version of the text you saw, the language of that text, the platform, the app version and the date. And, if you save to your account, that you read the “Cordada is not a coach” notice.	Being able to prove that you gave us your permission and when you withdrew it.	Legal obligation (art. 6.1.c and art. 7.1 GDPR)
Subscriptions	No payment data. Purchases and renewals are handled by Apple (App Store) and Google (Google Play): Cordada does not receive your card or payment details, and does not store your purchases on its servers. The app checks on your phone, with the store, whether your subscription is active. Only if we give you a tier ourselves (for example, as a gift or for testing the app) do we note it in your account, with its end date.	Giving you what your subscription includes.	Performance of the contract (art. 6.1.b)
Location	Your device’s position, only while the app is in use (“while using the app”), on your phone and on your Apple Watch.	(a) Centring the map, showing you nearby sectors and, in gym mode, working out which climbing gym you are at — this position is processed on your device and is not stored on our servers. (b) “My crew”, if you switch it on: your last position is stored so it can be shown only to the friends you pick, one by one; it only updates with the app open and you can switch it off whenever you like. (c) Busyness, on by default and switchable off in Settings → “My crew”: when you are less than 1.5 km from a climbing crag, we store your account identifier, that crag and the time of your last signal, to count how many people are there; not your position. No user can read that row: the busyness map only shows how many people are at each crag, and only when there are at least 2 at the same time, so it can never give away someone climbing on their own. You stop being counted after 90 minutes without a signal, the row is deleted within 2 hours at most and, if you switch the option off, it is deleted straight away. (d) On the Apple Watch: working out which climbing gym you are at, showing you the crags and sectors nearby and following an approach trail. It is processed on the watch and does not leave it. To bring the nearby crags to the watch, the iPhone uses the last position it already knows, rounded, and does not send it anywhere either. Recording an approach is a different thing: see “Approach breadcrumb trails”.	Consent (art. 6.1.a), except busyness (c): legitimate interest (art. 6.1.f) in knowing how many people are at each crag. It stores the bare minimum, nobody can read your row and it is deleted within 2 hours; to object, just switch it off (section 8).
Photos	The images you upload: photos of routes and sectors, topos, your avatar and the photos you send in chats. If you capture a topo with augmented reality, also the 3D map of the wall that the iPhone generates (points and anchors, no photos), which is stored with the topo.	Showing them according to the privacy level you choose when you upload them (private / friends / public).	Performance of the contract (art. 6.1.b)
Social	Friendships and requests, meetups on the board that you create or sign up to, messages in meetup chats, in Cordada Match and with your friends, kudos, tags in photos (between friends only; you can remove a tag someone has put on you). If you switch on Cordada Match (over-18s only), your Match profile, which people who also have it switched on can see: your photo (without one you don’t appear in anyone’s deck), your name, your bio, what you are looking for, the days you usually climb, your region, up to three crags (the ones you pick in “I usually climb at…” or, if you don’t pick any, the ones from your public ascents), your grade and figures taken from your public ascents, any endorsements you have and, if you add it, your town, with its centre rounded to ~1 km, which their app uses to work out roughly how far away you are. Your exact position never leaves your phone.	Making the social features work.	Performance of the contract (art. 6.1.b)
Notifications	Your device’s push notification token (Apple’s APNs on iPhone; Google’s Firebase Cloud Messaging on Android) and the text of each notification we send you (for example, who is writing to you and the start of the message).	Letting you know about friend requests, messages and relevant activity. Only if you grant the notifications permission. The text of each notification passes through our server, which prepares it and keeps it in the sending queue (30 days, section 7), and it reaches you through Apple or Google. We do not store your language: on iPhone, the notification travels with the key of its text and it is your phone that writes it in your app’s language.	Consent (art. 6.1.a)
Contributions to the catalogue	Crags, sectors, routes and corrections you propose; your votes on other people’s proposals; and the live conditions and wall notes you leave on a sector or a route.	Keeping and improving the collaborative guide.	Performance of the contract (art. 6.1.b)
Approach breadcrumb trails	The GPS track of the walk-in you record up to the foot of the route, with your phone or your Apple Watch: the points along the way, the distance, the duration, the crag, the sector and the date.	Building the approach map between all of us. The first time you record a trail, on your phone or on your watch, the app asks whether you want to share your trails, with two buttons and neither one preselected: “Share my trails” or “Just for me”. You can change this whenever you like in Settings › Privacy and on each trail, when you save it or later. It is shared in full, from where you started recording, which is why we recommend starting at the car park or on the path. Shared trails are seen by the community without your name and are merged with other people’s to draw that sector’s path; behind the scenes they stay linked to your account, so you can stop sharing them or delete them whenever you like. Only you can see the ones you don’t share. A trail recorded on the watch goes to your iPhone and is uploaded the same way; in Apple Health it is also kept as a hiking workout with its route (section 3.3). If you delete your account, the trails you shared stay for the community, with no author; the rest are deleted.	Consent (art. 6.1.a), which you give actively: nothing is preselected. You withdraw it in the settings or by making the trail private.
Car parks	The car parks you add or move at a crag: the spot, the crag, an optional note (“room for 6 cars”) and the date.	So everyone knows where to drive and where to leave the car. The community sees them without your name; internally they stay linked to your account so you can change the note or delete them. The app also marks a car park on its own where shared trails start, with nobody’s data. If you delete your account, the ones you added stay for the community, with no author.	Performance of the contract (art. 6.1.b)
Car park reports and comments	What you say about a car park: whether you can sleep in a van there, the restrictions you confirm (paid, limited spaces…) and the date; and the comments you write, with their date.	So whoever arrives knows what to expect. Van sleeping and restrictions are shown only as counts (“3 people confirm”), never with your name. Comments are shown with your name and the date; you can edit or delete them whenever you like, and anyone can report them. Under-18s cannot report or comment. If you delete your account, they are deleted with it.	Performance of the contract (art. 6.1.b)
Belay trust	The endorsements you give or receive: who endorses whom and the tags describing how that person belays.	So your profile shows that someone vouches for the way you belay. They are positive only, there is no score and no ranking, and only your friends or someone you have met up with can endorse you.	Consent (art. 6.1.a) — you can withdraw an endorsement you have given
Route bolters	If you apply for the bolter role for a crag: the crag, whatever you provide as accreditation and your role note. Plus the sector condition reports you send, with their category, severity and comment.	Showing who bolts each crag and flagging the real state of the fixed gear. An administrator reviews the application.	Consent (art. 6.1.a) for the application; legitimate interest (art. 6.1.f) in the safety of people climbing, for the reports
Climbing gyms	The gym you sign up to and the date, and the messages you write in its room.	So the others who have signed up can see you are going and you can all write to each other. Visible to anyone signed up to that gym.	Consent (art. 6.1.a) — you sign up and sign out yourself
Badges and progress	The badges you unlock and the count of sectors and regions you have climbed.	Showing your progress on your profile. They are worked out from your logbook.	Performance of the contract (art. 6.1.b)
Moderation	Reports of content or users that you send; your list of blocked users.	Reviewing inappropriate content and keeping the community safe. Only administrators can see the reports queue.	Legitimate interest (art. 6.1.f): safety of the service
Crash reports	When the iPhone app suddenly closes or freezes, iOS generates a technical report: the type of failure, the app and system versions, the device model and the trace of the code where it happened. The app uploads it to our database with your account identifier. It contains nothing you have written, nor your location, nor any health data.	Finding and fixing the app’s bugs, and telling one device with many crashes apart from many devices with one. They are deleted after 90 days (section 7).	Legitimate interest (art. 6.1.f): keeping the app working. You can object (section 8).
App usage	A few steps inside the iPhone app, with your account identifier and the time: that you open the app, which tab you go to, that you open the form to log an ascent (and whether you came from the catalogue), that you pick the crag (and how) and that you save the ascent (and of what kind). No positions, nothing you write and no health data.	Knowing at which step people get stuck when logging their first ascent and which tabs get used, to improve the app. Not shown to anyone, and deleted after 12 months (section 7).	Legitimate interest (art. 6.1.f): improving the app. Objecting is easy: switch off “Send usage statistics”, in Settings › Privacy (it is on by default), and the app stops sending them (section 8).

3. Your health, Apple Health and the Apple Watch

This section explains what Cordada does with your health and fitness data: the data in Progress (the tab where you log your training), what it reads from or writes to Apple Health, and the data in the Apple Watch app. Anything involving Apple Health and the Apple Watch is for over-18s only (under-18s, in 3.9).

3.1 The essentials

By default, everything stays on your phone. What you log in Progress (sessions, tests, injuries, your answers and your suggested week) is kept only on your phone until you tick “Save to my account”. The suggestions, the 48-hour rule, the charts and your recovery are all worked out on your own phone.
What we read from Apple Health is used on your devices. The only things that go up to your account are what you save as your own (a session and its effort, the weight in a test, your sex) and a summary of your heart rate, with the boxes in section 2.
Only for your health and fitness. No advertising, no selling, no handing over to third parties, no models and no statistics (3.7).

3.2 What we read from Apple Health

Only if you connect Apple Health in “Your watch” (in Progress settings), and only what you allow on the Health permissions sheet, which you can change at any time. We do not read in the background: we read when you open the app or Progress.

Data	What for	Is it stored? Does it go up?
Your workouts (type, start, end and which app they come from), including other apps’ workouts	Suggesting you log the workouts from your watch (they are never logged on their own), linking your watch’s “Climbing” workout to your gym session by its time, showing them in your calendar and, with Pro, taking your other sport (CrossFit, running…) into account in the suggestions.	Read on the spot and not stored. If you log one, it becomes a session of yours: its time, duration, type and the workout’s identifier go up with “Save to my account”; its effort, only with “Also save health data”.
The effort of your workouts (the one you enter on your watch and, if you don’t, the one Apple estimates)	Suggesting the effort (RPE) when you log a workout from your watch, and counting your weekly load.	Not stored. If you accept it when you log the session, it becomes your RPE, which only goes up with “Also save health data”.
Your heart rate during your workouts	Showing you the session’s average, maximum and chart and the heart rate of each attempt, “per your watch”; with Premium, your heart rate by grade; with Pro, your recovery between attempts. No zones and no judgements of effort: when you climb, heart rate does not measure effort.	The curve is never stored and never leaves your phone. The summary is stored on your phone and only goes up with “Also save health data”.
The active energy of your workouts	Showing what your watch measured, “per your watch · approximate”. Cordada does not calculate calories, set goals or talk about food.	Neither stored nor uploaded: it is read again each time.
Your weight	Filling in the weight of the two tests that need it, which is used to work out the kilos of your hangs. Never weight goals or weight trends.	Only stored if you save the test, and only goes up with “Also save health data”.
Your sex	Filling in the sex in “Fine-tune the suggestions”, which picks the benchmark for your tests.	Only stored if you save your answers, and only goes up with “Also save health data”.
Your heart rate variability (HRV), your resting heart rate and your sleep (time asleep only)	With Pro, “How you’re feeling”: comparing your last two nights with what is normal for you (your last six weeks) and, if you seem tired, suggesting you go easy on today’s demanding session or move it to another day. It only suggests: you decide.	In memory only: never stored in any file, not included in “Export”, never uploaded.

We read nothing else from Apple Health: not your height, no body fat, lean body mass, VO2 max, steps, menstrual cycle or clinical records.

3.3 What we write to Apple Health

From the iPhone: every session you log in Progress, as a climbing workout or a workout of its sport, with its time, its duration and your effort (RPE). That way your climbing counts alongside the rest of your workouts.
From the Apple Watch: the workout of the session you run on the watch (climbing, a timer or today’s suggested session) and, if you record an approach, a hiking workout with its GPS route. While it lasts, the watch measures your heart rate and your active energy, which stay in Health with that workout, as with any Apple Watch workout.
Nothing else. We do not write weight, height, calories or anything you have not done, and never made-up data. The only thing Cordada deletes from Health is its own copy of a session when it links it to the workout your watch recorded, so it is not duplicated: it never touches other apps’ data.
With Pro, if you don’t have Cordada on your watch, you can send today’s suggested session to the Apple Watch Workout app. It goes from your iPhone to your watch without passing through our servers.

3.4 What stays on your devices and what goes up to your account

Always on your devices, whatever you tick	Goes up with “Save to my account” (14 or older)	Also goes up with “Also save health data” (18 or older)
Your heart-rate curve and its chart; the watch’s live heart rate; active energy; your HRV, your resting heart rate and your sleep; the effort Apple estimates; your answers to “How are you feeling today?” and about finger pain; how much your heart rate dropped in each rest of the watch timer; what the watch’s sensors measure and the falls you don’t confirm; the watch’s location, except the approach you record.	Your sessions, including those from the watch: their type, day, time, duration, exercises, loads and notes, with the grade and time of each attempt (and, if your account measures them, the metres and the falls you confirm), without their effort; your tests, without your weight; your answers, without your sex; your suggested week, without kilos or diagnosis figures; the suggested sessions you skip or move.	The effort (RPE) of your sessions; your injuries; the weight in your two weighted tests; your sex; your heart-rate summary (session average and maximum, heart rate of each attempt and recovery between attempts); your full suggested week and the percentage of your maximum in your sessions.

A session you log from an Apple Health workout is yours from that moment: its time, duration and type go up with the first box, as if you had typed them in, and its effort only with the second. The rule is this: when you train, for how long, which exercises you do and which grades you climb are sports data; the effort you feel and how you are feeling each day say how your body is doing, so we treat them as health data: the effort only goes up with the second box, and how you are feeling never leaves your phone.

3.5 The Apple Watch app

It works with your iPhone. The watch app does not connect to the internet on its own: it only talks to the app on your iPhone, over Apple’s connection between your two devices, without going through our servers. Whatever needs to go up to your account is uploaded by the iPhone, under the same rules as everything else.
Your ascents go to the Logbook on your iPhone (section 2, “Logbook”), and the session goes to Progress.
Your live heart rate is shown on the watch and on the iPhone while you climb, and is not stored in any Cordada file: it stays in Health with the workout (3.3).
With Pro, recovery between sets and between exercises. In the timer and in the suggested session, the watch notes how much your heart rate drops in each rest so it can show you your trend and, in endurance exercises, tell you when you reach the heart rate you usually start the next set at. In finger and strength work the rest is always timed. It is stored only on the watch (400 days at most) and on your iPhone, and never goes up, whatever you tick.
The watch’s location (“while using the app” permission) is used to work out which climbing gym you are at, show you nearby crags and sectors, follow a trail and, when you ask for it, record your approach even with your wrist down. Only the recorded approach leaves the watch: it goes to your iPhone and is uploaded as a trail (section 2). Nothing else leaves the watch.
The map, topos and Friction Score on the watch are prepared by your iPhone, from the catalogue and from Apple Weather (with the sectors’ coordinates, not yours), and sent to the watch.
Motion and altimeter. With Pro, the watch’s altimeter, accelerometer and pedometer measure, on routes, the metres you climb on each attempt and detect your falls with their g-force; the watch asks you for that permission the first time. It’s an approximate measurement (the detector is still being calibrated). What it measures stays on your phone, in each attempt’s details; only the metres and the falls you confirm go up to your account, inside the session. Without Pro they aren’t used and the permission isn’t requested.
What the watch stores: the session in progress, what is waiting to go to the iPhone, the crags, sectors and topos the iPhone sends it, the latest Friction Score and, with Pro, your rests. Deleting your account on the iPhone does not delete it from the watch: it is deleted when you uninstall the watch app.
Over-18s only. The watch app writes to Health and reads your heart rate: an under-18 account does not have it.

3.6 Indicative suggestions

The suggestions for each week (Pro), the 48-hour rule, “How you’re feeling” and the benchmarks for your tests are worked out by a program on your phone, using fixed rules and your data. They are indicative: they are not personalised training or medical advice, they have no legal effects, and you decide (section 4 and Terms of Service, section 2).

3.7 What we never do with your health data

We only use it for your health and fitness: showing you your training, your charts and your suggestions inside Cordada. Nothing else.
We do not use it for advertising, marketing or profiling, and we do not sell it, rent it or give it to anyone: not to advertisers, data brokers, insurers or employers. It is never used to make decisions about insurance, credit or employment.
We do not share it with third parties. If you tick the boxes, it is stored in our database (Supabase, section 5.2), which only stores it on our behalf, and nobody but you can see it. We would only disclose it if the law required us to.
We do not use it to train or improve models, for statistics or for research, not even anonymised or aggregated. If we ever wanted to, we would ask your permission separately, beforehand, and this policy would say so.
We do not store it in iCloud. On iPhone, the Progress files containing health data are excluded from iCloud and computer backups.
We never write false data to Apple Health, or anything you have not done (3.3).
Data from Apple Health follows Apple’s HealthKit rules.

3.8 Android

On Android, Progress will come later; this policy will be updated then.

3.9 Under-18s

From 14 to 17, Progress has limits and no health features at all: connecting Apple Health, the Apple Watch app and the “Also save health data” box are not offered; weight, sex and injuries are not asked for, and our server rejects any health data from an under-18 account. Their sessions and tests can be saved to their account with the first box, without health data: not even each session’s effort, which stays on their phone.

3.10 How long it is kept, how it is deleted and how you take it with you

On your phone, until you delete it, delete your account or uninstall the app. Signing out does not delete it: it is kept for your account, and another account signing in on the same phone cannot see it. If another account signs in, the app asks you before deleting anything that is only on the phone.
In your account, for as long as “Save to my account” is ticked. Untick it and it is deleted from your account there and then, health data included; untick only “Also save health data” and your sessions’ effort, your injuries, heart-rate summaries, test weights and sex are deleted. What is on your phone stays. Heart-rate summaries are deleted automatically after 24 months (section 7).
In Apple Health, what Cordada wrote stays there, under your control and Apple’s: you delete it from the Health app. With “Disconnect Apple Health”, in “Your watch”, Cordada stops reading and writing; to remove the permission completely, on your iPhone go to Settings → Privacy & Security → Health → Cordada, or do it from the Health app.
To take it with you: “Export my training”, in Progress settings, saves a JSON file with all of Progress on your phone, including what is not in your account and the health data; it works offline and without ticking anything. “Export my data” (Profile) includes it too, along with the Progress data in your account (section 8). What Cordada only reads from Health on the spot (your heart-rate curve, energy, sleep, HRV and resting heart rate) is not included, because we don’t store it: it is in the Health app, which has its own export. Recovery between sets on the watch (how much your heart rate dropped in each rest) stays on the watch and on your iPhone, and is not included in either export.
When you delete your account, all your Progress is deleted from our database and, on the phone, that account’s Progress folder (section 7).

4. What we do NOT do

In the app we use no third-party analytics or tracking SDK. All we measure, in our own database, is a few app usage steps and the crash reports iOS generates (section 2). On the website we only use Cloudflare Web Analytics, with no cookies and no persistent identifiers: see section 13.
We do not show adverts or share data with advertisers.
We do not sell or rent your data. To anyone, ever.
We do not use your health data, or anything that comes from Apple Health, for anything other than your health and fitness inside Cordada (section 3.7).
We do not take automated decisions with legal effects on you (art. 22 GDPR). The app’s scores and recommendations (friction conditions, the Progress suggestions and their loads, “How you’re feeling”) are indicative and have no legal effects. They are worked out on your phone with your data: they are suggestions, and you decide.

5. Who your data is shared with

5.1 With other users — according to your settings

Cordada is a social app: some of your data is shown to other users exactly according to the privacy you choose:

Your public profile (username, name, avatar, bio, links) is visible to other users.
Ascents and photos: private (only you), friends, or public — you choose for each item. Ascents you log from your Apple Watch too, and without your heart rate.
Your position: only if you switch on “My crew”, and only for the friends you tick.
Your Cordada Match profile, if you switch it on: only for people who also have it switched on (section 2, “Social”).
Approach trails: only the ones you choose to share, merged into the shared path and without your name; in full.
Car parks you add: visible to the community, without your name.
Comments on car parks: visible to the community, with your name. What you say about van sleeping and restrictions: counts only, without your name.
Closure and restriction reports you send: only the reviewers see them; if approved, they are published in the details without your name.
Meetups on the board: visible to the community, with the home town you give.
Chat messages: only the participants of that chat.
Progress is not shown to anyone: not your sessions, tests, suggestions or health data.

5.2 With infrastructure providers (processors)

We do not share your data with anyone else, except the providers strictly needed for the app to work:

Provider	What it does	Where
Supabase	Database and authentication (all the data in section 2, including whatever you save from Progress to your account and the crash reports).	Servers in London, United Kingdom (AWS region eu-west-2). The United Kingdom has an adequacy decision from the European Commission.
Cloudflare	Storage and delivery of the images you upload (R2), through our own proxy with authenticated uploads.	Global network. Cloudflare is certified under the EU-U.S. Data Privacy Framework and applies standard contractual clauses.
Apple	“Sign in with Apple”, push notifications (APNs), weather data (Apple Weather) and the maps in the iPhone app and on the Apple Watch (Apple Maps): to draw them, Apple receives the area you are looking at.	Apple participates in the EU-U.S. Data Privacy Framework.
Google	Only in the Android app: “Sign in with Google”, push notifications (Firebase Cloud Messaging) and the map (Google Maps). To draw the map, Google receives the area you are looking at and technical data from the device, such as the IP address.	Google participates in the EU-U.S. Data Privacy Framework.

Apple Health is not a recipient of your data: it is a store on your own phone that you control. Whatever Cordada writes to it stays under your control and Apple’s, under Apple’s terms. Between your Apple Watch and your iPhone, data travels over Apple’s connection between your devices, not through our servers. Purchases are charged and handled by Apple or Google: Cordada does not receive your payment details, and the app checks on your phone whether your subscription is active.

For the weather forecast and the Friction Score (including the watch’s, which your iPhone requests), the app sends Apple Weather the coordinates of the climbing sector being looked at — not your personal position. The same goes for the terrain (IGN) and geology (IGME) lookups: they are sector coordinates, not yours.

We would only disclose data to the authorities if a legal obligation required us to.

6. International transfers

Your data is stored mainly in the United Kingdom (Supabase), which has an adequacy decision from the European Commission. Images are served through Cloudflare’s global network and some Apple and Google services may process data in the United States; in both cases the transfers rely on the EU-U.S. Data Privacy Framework and on the standard contractual clauses approved by the European Commission, which form part of the data processing agreement we have signed with each provider. You can ask us for a copy of those safeguards by writing to hola@cordada.eu and we will send it to you.

7. How long we keep your data

For as long as your account exists. When you delete it (Profile → Delete account), your profile, ascents, photos, messages, meetups, friendships, position, preferences, notification tokens, reports and blocks, crash reports, usage events, your busyness presence and all your Progress are removed from the database, along with the record of your permissions. On the phone, the app also deletes that account’s Progress.
Your training in your account is kept for as long as “Save to my account” is ticked. Untick it and it is deleted from your account there and then, health data included. Untick only “Also save health data” and your sessions’ effort, your injuries, heart-rate summaries, test weights and sex are deleted from your account. Either way, what is on your phone stays.
Heart-rate summaries are deleted automatically after 24 months.
When you delete something in Progress, your account keeps a deletion marker with no content (only its identifier and dates) so your other phones find out. It disappears completely after 180 days.
The record of your Progress permissions is kept for as long as your account exists.
What only lives on your devices (section 3.10) is deleted when you uninstall the app or delete your account; what is on the Apple Watch, when you uninstall its app, and your Pro rest data after 400 days at most.
The text of each notification we send you is kept in the sending queue and deleted after 30 days.
Crash reports are deleted after 90 days.
App usage events are deleted after 12 months.
Your busyness presence is deleted within 2 hours at most of your last signal, and straight away if you switch the option off.
The providers’ backups may keep data for up to 30 days longer before it disappears for good.
Of your position in “My crew” we only keep the last known one; it stops being shared as soon as you switch it off.
Contributions to the shared catalogue (crags, sectors, routes and corrections already merged into the guide) stay on as factual guide data, unlinked from your identity.
The approach trails you shared stay on the shared map when you delete your account, with no author; private ones are deleted with it.
The car parks you added stay at the crag when you delete your account, with no author.
Your car park reports and comments are deleted when you delete your account.
Your pending closure reports are deleted when you delete your account; published ones stay in the details, with no author.
Technical logs (access logs with IP address at Supabase and Cloudflare) are kept for as long as each provider applies by default for security and diagnostics, never more than 30 days, unless a particular log has to be kept longer to investigate a security incident or to respond to a legal request.

8. Your rights

You have the right of access, rectification, erasure, portability, restriction and objection. The two most common ones are built into the app:

Export my data (Profile): generates a JSON file with all the personal data we store about you on our servers, including the Progress data in your account, plus, separately, the Progress data on that phone. Covers access and portability. Usage events and crash reports are not in the file: if you want them, ask us and we will send them to you.
Export my training (Progress settings): saves a JSON file with all of Progress on your phone, including what is not in your account and the health data, except recovery between sets on the watch (section 3.10). Works offline and without ticking anything.
Delete account (Profile): deletes your account and your content immediately and irreversibly, your Progress included. Covers erasure.

For all the other rights, or if something is not working, write to hola@cordada.eu. We reply within one month at the most (art. 12.3 GDPR).

If you no longer have the app installed, you can request the deletion of your account at cordada.eu/delete-account.

If you think we have not handled your data properly, you can complain to the Agencia Española de Protección de Datos, the Spanish data protection authority (aepd.es). (If you live in another EU country, you can also complain to the supervisory authority of your own country, or of the place where the problem happened — art. 77 GDPR.)

Withdrawing your consent

Several of the things described in this policy rely on your consent: the location behind “My crew”, the Apple Watch’s location, the notifications, the approach breadcrumb trails, the endorsements, the climbing gym you sign up to, the two Progress boxes (“Save to my account” and “Also save health data”, which you untick in Progress settings, with a connection, and which delete the copy in your account straight away) and access to Apple Health (“Disconnect Apple Health”, in “Your watch”, or in your iPhone’s settings). You can withdraw it whenever you like, without explaining yourself, from the same settings where you switched it on, or by writing to us. Withdrawing it is as easy as giving it. Whatever we had processed before you withdraw it remains lawful, but from that moment on we stop processing it.

Right to object

You can object, on grounds relating to your particular situation, to the processing we carry out on the basis of legitimate interest: the moderation and safety of the service, the crash reports, the app usage events, busyness and the audience measurement on the website. If you object, we will stop unless we have compelling grounds that override yours or we need it to defend legal claims. Write to us at hola@cordada.eu. For usage events you don’t need to write to us: switch off “Send usage statistics”, in Settings › Privacy; and for busyness, switch it off in Settings → “My crew”, and your row is deleted straight away.

9. Minimum age

Cordada requires you to be at least 14, the digital age of consent in Spain (art. 7 of LO 3/2018, the Spanish data protection act). We do not knowingly create accounts for under-14s; if we spot one, we will delete it. If you are a parent or guardian and believe a child under 14 has created an account, write to us.

From 14 to 17, Cordada works with protections: no social features, no Apple Watch app, and Progress with limits and no health features at all (section 3.9). That is why we ask for your date of birth (section 2).

10. Security

All communications are encrypted (TLS).
The database applies row-level security (RLS): every query is checked on the server against your identity, not just in the app. Your private data cannot be queried by other users, not even through direct access to the API.
Passwords are handled by Supabase’s authentication system with secure hashing; we never see them in clear text.
Our server rejects injuries and heart-rate summaries from anyone who has not given the health permission or is under 18, and empties any weight or sex that arrives without that permission.
On iPhone, the Progress files containing health data are excluded from iCloud and computer backups.
The Apple Watch app does not connect to the internet: it only talks to your iPhone.
Image uploads require an authenticated session. Images are served from non-listable URLs; their visibility inside the app respects the privacy you choose.

11. Changes to this policy

If we change this policy substantially (new processing, new providers), we will announce it inside the app before the change takes effect and we will update the version date on this page. The version in force will always be published at this URL.

12. Contact

Pawel Wojciech Kadziolka Bystrzycki — hola@cordada.eu

If you write to us through any other channel, your request is handled just the same and the clock starts the moment we receive it.

13. The cordada.eu website

The sections above are about the app. This one is about this website, which handles far less data and deserves an explanation of its own.

There are no cookies. None.

cordada.eu does not install cookies, does not use your browser’s local storage, and does not use persistent identifiers of any kind. There is nothing to store on your machine and nothing to delete afterwards. That is why you will not see a cookie banner: asking your permission for something we do not do would be theatre.

What we handle when you visit the website

What	What for	Who receives it	Legal basis (GDPR)
Audience measurement — page viewed, page you came from, browser type, country and IP address.	Knowing how many people come in and which pages are any use. These are aggregate figures: we do not build profiles, we do not follow you between sessions or across websites, and we cannot recognise you on a later visit.	Cloudflare Web Analytics, as processor.	Legitimate interest (art. 6.1.f): understanding how our own site is used. You can object (section 8).
Hosting — the IP address and the technical data of each request end up in the server logs.	Serving the page, protecting it from attacks and diagnosing faults. This includes the automatic network error reports the browser sends.	Cloudflare, as processor.	Legitimate interest (art. 6.1.f): security and operation.

And that is that: there are no forms, we do not collect email addresses, there are no adverts, there are no social buttons tracking you. The links to Instagram and the App Store are ordinary links and do nothing until you tap them. The catalogue figures you see on the home page are written into the page, they are not queried live.

The climbing gym directory

The listings at cordada.eu/rocodromos gather the name and the address of climbing facilities from public OpenStreetMap data and contributions from the community, not supplied by each gym. In some cases a small gym may be one person’s own business, and then that data is their personal data: we publish it on the basis of legitimate interest (art. 6.1.f) in keeping a useful directory of where you can climb. If it is your gym and you want to correct the listing or have us take it down, write to us at hola@cordada.eu and we will do it.

Transfers

Cloudflare is a US company with a global network: it is certified under the EU-U.S. Data Privacy Framework and we have standard contractual clauses signed with it. You can ask us for a copy as explained in section 6.