Privacy Policy

This Privacy Policy explains how Scala (formerly Crag Social; “we,” “us”) collects, uses, and shares personal information when you use our website, apps, gym dashboard, climber site, and the public 3D viewer at climbscala.com and its gym subdomains (the “Service”). Questions? Contact us at [email protected].

Information we collect

• Account information. When you create an account we collect your email address. Authentication and passwords are handled by our provider (Supabase); we never receive or store your password. If you sign in with Apple or Google instead, see “Services that load in your browser or app” below.
• Climber profile & activity. If you have a climber account: your username and, if you add them, a display name, bio, profile picture, and home gym; the climbs you log (each send, the tries you log, whether a send was a flash, and how a problem’s grade felt to you), the problems you mark as projects, the problems you like and save, the climbers you follow and who follow you, your circles, your blocks, and your privacy settings; and, on spray walls, the problems you create and the grades and ratings you give. If you claim a first ascent, the link to the Instagram video you give for it, which is shown with the ascent when your sessions are public; and if a gym’s staff reject a claim, the warning they give you, which that gym’s staff can see. We also keep reports you send us about content.
• Gym & organization details. Information you enter to set up a gym — organization name, gym name, subdomain, contact email, and website — and the news a gym’s staff post, which is public and shown as the gym’s. We keep which staff account wrote each post, and never show it.
• Waitlist information. If you join our waitlist we collect your email and, optionally, a gym name.
• Uploaded content. The videos you upload and the frames and 3D models we derive from them, plus problem metadata you add — including setter names and links (e.g. Instagram) that you choose to publish.
• Share-link pictures. When you share a view of a wall, the app makes a picture of that view and stores it with the link, so the message you send shows it as the link’s preview. Anyone with that link can see the picture. It is stored with the gym and wall it shows, never with your account or name, and is deleted after 30 days.
• Activity records. When you use the Service signed in, we note each day you used it and where (a browser, the iPhone app, the Home Screen app, or the gym dashboard), but not what you looked at or when in the day. We use these records to count how many people use Scala. They’re kept for 13 months and deleted with your account.
• Usage analytics. Counts of how often each gym’s walls are opened and, on our main website, page views. No account, IP address or device id is stored with them, and no cookies are used.
• Payment information. If you subscribe, payments are processed by Stripe. We receive limited billing details (such as plan, status, and the last four digits of a card) but never full card numbers.
• Technical, performance & error data. To keep the Service reliable and fast we collect error and crash reports, and performance measurements such as how long screens and 3D walls take to load, with technical details of the device and app (such as device model, operating-system version and app version). This may include IP address and, for a signed-in user, their account id, never their email address. We use Sentry for this.
• Notifications. If you turn on notifications for a phone or browser, we keep a token for it, linked to your account, with its name (such as “Chrome on Mac”), its time zone and when it was last used, and your notification settings. We keep the notifications we show you in the app for a year.

How we use information

• To provide, operate, and improve the Service and reconstruct 3D models from your videos.
• To create and secure your account and communicate with you about the Service.
• To send the notifications you choose, which you can change in Settings → Notifications or on your device.
• If you set a home gym, pin a gym or turn on its alerts, we show you its new problems and news, and notify you if you choose. Gyms see only how many people get them.
• To process subscriptions and payments.
• To understand usage, diagnose problems, and prevent abuse.
• To comply with legal obligations and enforce our Terms.

People in uploaded videos

Videos are uploaded to model a gym’s walls, and sometimes catch people climbing or walking past. When people masking is on for a model, we automatically look for people in the frames taken from its videos and keep them out of the model’s surface, so they aren’t painted onto the wall. It is on by default for a model made from videos filmed at different times, and a gym can turn it on or off for any model.

This detection finds only where a person appears in a frame, never who they are. We do not use facial recognition, and we do not create or keep face geometry, faceprints, or any other biometric identifiers. The areas found are used only while the model is built and are not stored, and the uploaded video itself is kept unchanged. Detection runs on our reconstruction provider (Modal).

If you can be seen in a gym’s 3D model and want to be removed, contact the gym or [email protected].

Publicly displayed content

Reconstructed 3D models, section names, problem details, setter names, and any links you add are shown publicly on your gym’s viewer (e.g. yourgym.climbscala.com) to anyone with the link. Do not publish information about a person that they have not agreed to make public.

For climbers: your username, display name and profile picture are always visible, so people can find you and ask to follow you. You choose, in Settings → Privacy, who sees the rest: your profile (your bio and follower counts) is public or private, and a private profile is seen only by followers you approve; your sessions and sends, your activity summary, your follower and following lists, your home gym, and which circles you’re in are each shown to the people you choose, never more widely than your profile. Your tries, flashes and projects follow the same settings: their counts go with your activity summary, which problems you’re projecting with your sessions, and the tries and flashes in a session you post with that post. How a problem’s grade felt to you is never shown with your name: a problem’s flash count and grade verdict are counts, shown only once five climbers are behind them. A first ascent you claim, and the videos you contribute to a gym, show your name (and the ascent its Instagram video) only when your sessions are public. Gym staff see what they need to run their gym, such as first-ascent claims and the problems you suggest. Problems you publish on a spray wall are public, with your username, to anyone viewing that gym. If you delete your account, you choose whether those problems are deleted with it or stay available without your name.

Comps and challenges. When you join a gym’s comp or challenge, your name card (display name, username and picture), your category and your results in that event appear on its public results board, including on the gym’s screen and in its result and podium images. Joining a challenge lets it count your sends of its problems even if your other settings hide them: others see only your count, an hour behind if it runs longer than a day, and the gym’s staff can see which problems counted. Your other privacy settings stay as they are. If you delete your account, you’re removed from events that aren’t final, and final results keep your score as “A climber”.

Judged comps, teams and finals. A gym can name judges for a comp: Scala accounts it chooses, who see each entrant’s name card and see and record their attempts, zones and tops in that comp. A judge doesn’t see anyone they’ve blocked or who has blocked them. Judges aren’t shown to climbers. If you join a team, its name and its members’ name cards show on the results board. If you place high enough, the gym may ask you to its final; you’re added only if you join it yourself. If you delete your account, you stop judging; scores you recorded stay, without your name.

Leagues. A gym can run a league: a season of comps, its rounds. Joining a league enters you in each of its rounds as the gym publishes them, so your name card and scores show on each round’s board and, added up, on the league’s standings, the gym’s screen included, as for any comp you join. You can withdraw from a round or from the league at any time; a round whose results are final keeps yours unless you withdraw from that round too.

Setter credit. If you’re on a gym’s staff, climbers see the name you choose in Settings → Account → Setter credit (your first name, or your username if you have no display name, until you choose one) on the problems you set, with a link to your climber profile only if you switch it on. Photos staff add to a problem are public until staff take them off or delete the problem. When staff invite someone, we keep the invited email address to send the invite and to check that the account accepting it is theirs. The gym’s owners and admins also see counts about the problems credited to you, such as how many you set and their sends and likes, and you see your own in Insights.

How we share information — sub-processors

We do not sell your personal information. We share it with service providers that process it on our behalf, and only what each needs to provide its service to us. Every third party we share personal information with gives it the same or equal protection as this policy does:

• Supabase — authentication and database.
• Cloudflare — hosting, content delivery, and object storage (R2) for videos, frames, and models.
• Fly.io — backend application hosting.
• Modal — compute for frame extraction and 3D reconstruction.
• Resend — transactional email.
• Sentry — error, crash and performance monitoring.
• Amazon Web Services (Rekognition, and S3 for encrypted backups) — an automatic check of each profile picture for explicit, violent or hateful content before it appears. It reports what a picture shows, never who is in it: no facial recognition and no biometric identifiers. A picture that fails the check is never stored, and Amazon neither keeps the pictures it checks nor uses them to train its systems.
• komoot (Photon) — place search on the Gyms tab. When you search for a gym, our server also looks up your search text as a place (a town, a neighbourhood, a postcode) with komoot’s Photon service, which uses OpenStreetMap data. It receives only the search text, the rough area the map is showing (from the list, the area our gyms are in) and the language to show place names in, from our server — never your IP address, your account, or anything else about you.
• OpenStreetMap Foundation (Nominatim) — when gym staff look up their gym’s address, our server sends the typed address to Nominatim. No climber data is sent.
• Your browser’s push service, and Apple’s — a notification to a browser travels through that browser’s own push service (Google’s for Chrome, Mozilla’s for Firefox, Apple’s for Safari and Scala on an iPhone’s Home Screen, Microsoft’s for Edge on Windows), encrypted so the service can’t read it. In the Scala app for iPhone, a notification travels through Apple Push Notification service, which carries what it says (the words your lock screen shows) to your phone.
• Stripe — payment processing (once billing is enabled).
• Plausible Analytics — privacy-friendly, cookieless usage analytics (once enabled).

Gym statistics. A gym’s staff see statistics about their own gym, such as how often its walls are viewed, how many climbs are logged there and by how many climbers. They are counts and never name you. A count of people, or of things you do privately such as saving a problem, is shown only when it is five or more. Counts of sends and likes, on a problem or across the gym, are shown as they are. Gym statistics never show what you did unless your privacy settings already show it to everyone. Staff can also get them in a monthly email or download them as a spreadsheet, with the same counts held back.

We may also disclose information to comply with law or to protect our rights, users, or the public.

Services that load in your browser or app

Some parts of the Service come from other companies’ servers, which then receive your IP address and technical details of your browser or device, under their own privacy policies:

• Meta (Instagram) — when a problem shows an Instagram video, your browser or the app loads Instagram’s embed script and the video from Instagram, which may set its own cookies. Nothing loads from Instagram on a problem without a video.
• Google — opening a 3D wall loads the decoder that unpacks its model from Google’s servers (www.gstatic.com). If you sign in with Google, Google tells our sign-in provider your email address and your Google profile’s name and picture; we use only the email address.
• Apple — if you sign in with Apple, Apple tells our sign-in provider your email address, or a private relay address if you choose to hide yours, and the name you share. We use only the email address. Deleting your account in the iPhone app also revokes Scala’s access to your Apple sign-in.

Links to other services

Tapping Directions on a gym’s map card opens Apple Maps or Google Maps; their own privacy policies apply there.

Data retention

We keep personal information for as long as your account is active and as needed to provide the Service. You can delete your account at any time, in Settings → Account. That is immediate: your profile and picture, your logged sends and tries, projects, first-ascent claims and warnings, likes, ratings and saved problems, your follows, circles and blocks, the reports you filed, your video submissions still awaiting review, your activity records, your notifications and notification settings, and your sign-in account are deleted at once. If you were the only member of a gym’s organization, it closes and its gyms go offline. Copies left in backups, logs, and a closed gym’s files are deleted or anonymized within 90 days, except where a longer period is required by law. Daily counts made for gym statistics and our own usage numbers hold nothing that identifies you, and are kept after you delete your account. Share-link pictures are deleted 30 days after they are made. Activity records are deleted after 13 months. Notifications in your inbox are kept for a year, then deleted. A phone or browser’s notification token is deleted when you sign out there, turn its notifications off or remove it in Settings, delete your account, or don’t open Scala on it for 120 days.

Your rights & choices

Depending on where you live, you may have the right to access, correct, delete, or receive a copy of your personal information, and to opt out of certain processing. California residents have rights under the CCPA/CPRA — including the right to know what personal information we collect, to request access to or deletion of it, to correct it, and not to be discriminated against for exercising these rights. We do not sell or share your personal information as those terms are defined under the CCPA/CPRA. You can delete your account yourself, in Settings → Account → Delete account. To exercise any of the other rights, contact [email protected].

Cookies

We use cookies and similar technologies as described in our Cookie Policy.

Security

We use reasonable technical and organizational measures to protect personal information. No method of transmission or storage is completely secure, so we cannot guarantee absolute security.

Children

Climber accounts are for people 13 and older; gym and organization accounts are for adults. The Service is not directed to children under 13, and we do not knowingly collect personal information from them. If you believe a child under 13 has given us personal information, contact [email protected] and we will delete it.

Changes

We may update this policy from time to time. Material changes will be posted here with a new “last updated” date.

Contact

Scala. Email: [email protected].