Privacy Policy

Climbify ("we", "our", "us") operates the website climbify.gg and related services (collectively, the "Service"). This Privacy Policy explains what personal information we collect, how we use it, and what rights you have in relation to it. By using the Service, you agree to the collection and use of information as described in this policy.

We collect only the information necessary to provide the Service:

• Account data: email address and username, provided when you register.
• Marketing consent: if you tick the optional box asking whether we may send you marketing email, we record your answer, the date, the exact wording you were shown and the IP address it came from. We record a "no" and a later withdrawal the same way. We keep this because the law requires us to be able to show what you agreed to, and because it is how we know not to email you.
• Order data: rank details, service selections, and order history, necessary to fulfill your boost order.
• Game account credentials: if you select the Piloted boosting mode, you provide your game login credentials so your assigned booster can complete the order. These are stored only for the duration of the order in a dedicated, access-restricted field and are automatically deleted when the order is completed, refunded, or cancelled.
• Payment data: handled entirely by Stripe, Inc. We do not receive, process, or store card numbers or full payment details. We receive only a payment confirmation and your email.
• Usage data: standard server logs (IP address, browser type, pages visited) for security and diagnostic purposes.

We use the information we collect to:

• Create and manage your account.
• Process and fulfill boost orders.
• Send service emails (order confirmations, status updates, coaching and account notices). These are part of providing the Service, our lawful basis for them is the contract between us, and they are not something you can opt out of while you hold an account.
• Send marketing email, but only if you have asked us to. Our lawful basis is your consent (GDPR Art. 6(1)(a)). We ask for it as a separate, optional, unticked box when you create your account, and nothing about signing up, buying or using the Service depends on your answer. You can turn it on or off at any time under Email preferences in your account settings, and every marketing email carries a one-click unsubscribe link. Withdrawing does not affect anything we sent before you withdrew, and it never affects the service emails above.
• Detect and prevent fraud or abuse.
• Comply with applicable legal obligations.

We do not sell, rent, or share your personal data with third parties for advertising or marketing purposes.

Your data is stored on Supabase (supabase.com), which operates servers in the United States and European Union. We apply industry-standard security measures including encrypted connections (HTTPS/TLS), hashed passwords, and access controls limited to authorised personnel. However, no system is completely secure, and we cannot guarantee absolute security.

International transfers. Where your personal data is transferred outside the European Economic Area (for example, to Supabase or Stripe infrastructure in the United States), that transfer is governed by the European Commission's Standard Contractual Clauses (SCCs) and, where applicable, the EU–U.S. Data Privacy Framework, which provide appropriate safeguards under Chapter V of the GDPR.

Data breaches. In the event of a personal-data breach that is likely to result in a risk to your rights, we will notify the competent supervisory authority within 72 hours of becoming aware of it, and will inform affected users without undue delay where the breach is likely to result in a high risk to them, as required by GDPR Art. 33–34.

Climbify is not liable for data breaches that result from circumstances beyond our reasonable control, including breaches of third-party infrastructure we rely on.

All payments are processed by Stripe, Inc., a PCI-DSS Level 1 certified payment processor. Card data is handled entirely by Stripe: Climbify never sees, receives, stores, or processes your card number, CVC, or billing details. We receive only a payment confirmation and your email address. When you complete a purchase, you are also subject to Stripe's Privacy Policy (stripe.com/privacy).

Note: "end-to-end encryption" references elsewhere on this site refer exclusively to your connection to our servers over HTTPS/TLS, not to game account credentials, which you voluntarily share with your assigned booster at your own risk.

Authentication is handled exclusively through secure, httpOnly session cookies: these cannot be read by page scripts and are the only cookies essential to the Service. We do not store authentication tokens in your browser's localStorage. No advertising or tracking cookies are used. We use localStorage only for non-essential interface preferences (for example, remembering that you have dismissed a notice). You may disable cookies in your browser settings, but this will prevent login from functioning.

We count how the Service is used, and we do it without cookies. We record page views and a small number of named steps, for example that a checkout was opened, that card details were submitted, or that an order was completed. These records contain no name, no email address, no account number and no free text of any kind, and there is no field in which such a thing could be stored. Visits are grouped together using a short one-way code that our servers calculate from your IP address and browser type. That code changes every day, so nothing is placed on your device, your browser is never given an identifier, and a visit today cannot be connected to a visit tomorrow. Each record also notes whether the visit came from a phone, a tablet or a computer, and which country it came from, worked out from your browser type and from the country our host already identifies for every request. We keep only those two facts, never the IP address itself, your city or your device model. We cannot work backwards from these records to identify you. They are deleted automatically after 90 days.

We also use Vercel Analytics and Vercel Speed Insights, which measure page views and real page loading times. Both are cookieless, both are limited to aggregate figures, and neither builds a profile of you or follows you to other websites.

The Service relies on the following sub-processors who process personal data on our behalf under appropriate data processing agreements (DPAs) in accordance with GDPR Art. 28:

• Supabase, Inc.: database hosting and user authentication. DPA available at supabase.com/privacy.
• Stripe, Inc.: payment processing. Stripe is an independent data controller for card data. DPA and privacy policy at stripe.com/privacy.
• Resend, Inc.: transactional email delivery. DPA available at resend.com/privacy.
• Vercel Inc.: website hosting, and the cookieless analytics and page-speed measurement described in section 6. As our host, Vercel processes the IP address of every request in order to serve the site. DPA and privacy policy at vercel.com/legal/privacy-policy.
• Google LLC: if you choose to sign in with Google, Google authenticates you and shares your email address and basic profile information with us. This occurs only when you use the "Sign in with Google" option. Google's handling of your data is governed by its privacy policy at policies.google.com/privacy.

Discord is an independent platform that you may choose to use to contact our support team. Discord is not our data processor; any information you share via Discord is governed by Discord's own privacy policy at discord.com/privacy.

We are not responsible for the privacy practices of these independent third parties.

Depending on your jurisdiction, you may have the right to:

• Access the personal data we hold about you.
• Receive a copy of your data in a portable, machine-readable format (data portability).
• Request correction of inaccurate data.
• Request deletion of your account and associated data (right to erasure).
• Object to or restrict certain processing activities.

You can exercise the access, portability, and erasure rights directly and immediately from your Account Settings page: use Download my data to export a copy of your information, and Delete account to erase your account. For any other request, or if you are unable to access your account, contact us at privacy@climbify.gg or via our Discord server, and we will respond within 30 days.

If you are a California resident, the California Consumer Privacy Act (as amended by the CPRA) gives you specific rights regarding your personal information.

Categories we collect: identifiers (email address, username, IP address), commercial information (order and purchase history), and internet activity (standard server logs). We collect these directly from you and from your use of the Service, for the purposes described in Section 3.

We do not sell or share your personal information as those terms are defined under the CCPA/CPRA, including for cross-context behavioral advertising. Because we do not sell or share, no "Do Not Sell or Share My Personal Information" action is required; however, you may still contact us to confirm this.

You have the right to know what personal information we collect, to access and delete it, to correct inaccurate information, and to not be discriminated against for exercising these rights. Exercise these rights from your Account Settings page or by contacting privacy@climbify.gg.

We retain account and order data for as long as your account is active or as required to resolve disputes and fulfil legal obligations. Game account credentials provided for Piloted orders are deleted automatically when the order is completed, refunded, or cancelled. The usage records described in section 6 are deleted 90 days after they are created.

When you delete your account, the deletion happens immediately rather than being queued. The following are erased outright: your coaching bookings and anything you wrote in them, your progress scores and training plan, your replay uploads and the replay files themselves, your coaching conversations, any reports you filed and the screenshots attached to them, your notifications, your avatar and any images you sent in chat, your saved card fingerprints, your payout and Stripe customer records, your referral code, and your two-factor backup codes.

Two things are kept, and we would rather say so plainly than imply otherwise. Messages you sent to a booster or in a dispute stay in place with your words replaced by “[deleted]”, because the other person in that conversation has their own copy of a paid order and is entitled to it. Financial records (orders, payments, refunds, wallet entries, payouts and commission) are kept for up to 7 years because tax law requires it, which GDPR Article 17(3) expressly allows. Your profile is anonymised in the same moment, so those records no longer identify you: what remains reads as a transaction, not as you.

The Service is not directed at persons under the age of 18. We do not knowingly collect personal information from minors. If you believe a minor has provided us with personal information, please contact us immediately.

To the maximum extent permitted by applicable law, Climbify's liability for any privacy-related claim is limited to the amount paid by you for the specific order in question during the 12 months preceding the claim. We are not liable for indirect, consequential, or incidental damages arising from our processing of your data.

We may update this Privacy Policy from time to time. When we do, we will update the effective date at the top of this page. Your continued use of the Service after any changes constitutes your acceptance of the revised policy. We encourage you to review this page periodically.

The data controller responsible for your personal data is:

Swift Studios s. r. o.
Palkovičova 226/1
821 08 Bratislava – mestská časť Ružinov
Slovak Republic
IČO: 56 315 864

For all data protection requests (including access, correction, deletion, and objection), contact our data protection point of contact at privacy@climbify.gg. We will respond within 30 days as required by GDPR Art. 12.

You also have the right to lodge a complaint with the supervisory authority in your EEA member state. The Slovak supervisory authority is the Office for Personal Data Protection of the Slovak Republic.

For general privacy questions, contact us at privacy@climbify.gg or via our Discord server at discord.gg/RUa28jvMTH.