Privacy Policy
Last updated: August 4, 2026
The short version. We collect what the app needs to work: your email address so you can sign in, the climbs and ascents you log, and — only if you allow it — your location to place a board on the map. We do not sell your data, we do not run ads, and we do not share anything with data brokers or advertisers.
Information we collect
Information you give us
- Your account. An email address, which is how you sign in — we email you a one-time code rather than storing a password. Also a username, and anything else you choose to add to your profile: a display name, a profile picture, an Instagram handle, and optionally your gender, country, height and ape index.
- Your climbing. The climbs you set, the ascents and attempt sessions you log (including the angle, the date, the number of attempts, your suggested grade and star rating, and any comment you write), the circuits you build, the climbs you like, and the climbs you block or report.
- Your boards. The boards you add or save, including a name, serial number and — if you add a home board — the location you choose to give it.
- Links you add. If you link an Instagram post as beta for a climb, we store the link and its thumbnail.
Information collected automatically
- Crash reports. If the app crashes we receive a diagnostic report containing the error, the stack trace, and basic device and app-version information. These reports are configured not to carry personally identifying information.
- Technical logs. Our hosting provider records ordinary server logs, including IP addresses, as part of operating the service.
We do not use advertising identifiers, we do not track you across other apps or websites, and the app contains no advertising or marketing analytics software.
Location
Location is optional and only ever used while you are using the app. Granting it lets the map centre on climbing gyms near you, and lets a home board you add drop a pin at its location. We do not track your location in the background and we do not build a location history — the app asks only for “while in use” access. You can revoke it at any time in your device settings; the map still works, it just won't start near you.
Bluetooth
The app connects to your board's LED controller over Bluetooth to light up the holds of the selected climb. This is a one-way connection: the app sends the LED pattern and nothing else. No personal data is transmitted over Bluetooth, and the app does not read anything from the board beyond the device name it advertises while you are choosing which board to connect to.
What other people can see
SprayBoard is a social app, so some of what you do is public by design: your username and profile, the climbs you set, your logged ascents, comments you write, your circuits, and your position on a board's leaderboard. Turning on Private Account in Settings hides your logbook and activity from other climbers in the app.
Two things are always private to you and are never shown to anyone else: the climbs you have blocked, and any climb you have reported — a report is visible only to you and to our moderators, so a setter never learns who flagged their climb.
Who we share information with
We do not sell your personal information. We share it only with the service providers that run the app, and only as far as they need it:
- Supabase — hosts the database, authentication and uploaded profile pictures. Data is stored on servers in the United States.
- Resend — delivers the sign-in emails containing your one-time code.
- Sentry — receives crash reports.
- Vercel — hosts this website.
- Expo — builds and distributes the app, and delivers over-the-air updates to it.
- Apple — distributes the app through the App Store and TestFlight, under Apple's own privacy policy.
If you choose to connect an existing board account to import your logbook, we send your credentials to that board's own service to authenticate and retrieve your history. Those credentials are encrypted before they are stored, and that request happens only when you initiate it. Beta video links point to Instagram; opening one takes you to Instagram, whose privacy policy then applies.
We may also disclose information where we are legally required to, or where it is necessary to protect the rights and safety of our users.
Keeping and deleting your information
We keep your information for as long as your account exists. You can delete your account at any time from the app: Profile → Settings → Delete Account. Deletion is immediate and permanent — it removes your account and all of your climbs, ascents, attempts and circuits, and it cannot be undone. Residual copies may persist in encrypted backups for a limited period before those backups expire.
Deleting your account does not retract a published climb that other climbers have already logged ascents on, because doing so would erase their history too.
Children
SprayBoard is not directed at children under 13, and we do not knowingly collect personal information from anyone under 13. If you believe a child under 13 has given us personal information, contact us and we will delete it.
Your choices and rights
You can view and change your profile information, make your account private, revoke location or Bluetooth permission in your device settings, and delete your account — all from within the app. Depending on where you live you may also have the right to request a copy of your information or ask us to correct it; contact us and we will help.
Changes to this policy
If we change this policy we will update the date at the top of this page. Continuing to use SprayBoard after a change means you accept the updated policy.
Contact
Questions about this policy, or about your information? Email itaiaxelrad@gmail.com or use the contact page.