We store account and profile information, climb data and activity, direct messages, notifications, feedback, gym requests, support-payment records, and uploaded photos needed to operate the app.

• Email and account details for sign-in and moderation
• Profile details like username, display name, bio, and home gym
• Climb interactions such as attempts, sends, comments, votes, and reports
• Messages, notifications, feedback, gym requests, and support-payment records
• Photos you upload for climbs, gym materials, or photo logging

If you choose Google sign-in, Google provides your email address and basic profile information, such as your name and profile image. Supabase stores these details to authenticate and maintain your Climb Stump account. We request identity information only, without access to your Gmail, Drive, or contacts.

Public profile and community contributions may be visible to other climbers. Private notes are excluded from community activity and public profile displays.

• Your public profile identity and visible climbing activity
• Community-facing comments, climb data, and shared ratings or votes
• Feedback and gym-request submissions are for the team, not for public display

Stripe processes payment details. Climb Stump stores the payment status, amount, and identifiers Stripe returns; it does not store full card details.

When you send feedback or request a gym, we use that information to improve the app, understand demand, and follow up if we need more detail.

We use product analytics to understand which flows work, find bugs, and debug behavior. Session replay is disabled. Analytics events should not include raw emails, comments, invite codes, image links, filenames, or free-text form contents.

When you use the tag scanner, the photo is processed by a configured third-party AI provider to read the visible tag fields. Climb Stump keeps short-lived private scan metadata for reliability and matching, normally for 14 days. Raw scan images and raw AI-provider responses are not retained by Climb Stump unless diagnostic capture is explicitly enabled; the selected AI provider handles requests under its own service terms.