Privacy
What personal data we process when you use Gripello, why, who can see it, how long we keep it and what you can control.
Controller
Krämerstraße 8 63450 Hanau Deutschland
Who is responsible
Gripello is a web app that climbing gyms use for their routes. The gym or club named above is the controller for its own gym pages (routes, reviews, route problem reports, competitions, staff tools). The operator of Gripello is the controller for the pages that are not tied to a gym: your account, logbook, friends, climber profiles and achievements. All data is stored and processed on our own servers in the European Union. If you have questions about your data, contact the controller named above.
Server logs
When you open the app, our server processes technical data such as your IP address, date and time, the requested address and your browser's user agent to deliver the page and protect the service against abuse and attacks. Lawful basis: our legitimate interests in running a secure service (Art. 6(1)(f) GDPR). Request logs are deleted automatically after 7 days.
Your account
If the operator allows sign-up, you can register with an e-mail address and password; we send a verification e-mail to confirm the address. If you don't confirm the address within 7 days, the account is deleted. A gym admin can also invite you as a staff member by entering your e-mail address and, optionally, your first and last name. We then send you an invitation link that is valid for 7 days and keep the invitation until you accept it, it expires or the gym withdraws it. Nothing is created without you: to accept, you sign in with that e-mail address or create an account with your own password, and only then do you become a member. We store your e-mail address, username, first and last name, password (only as a secure hash), language, notification preferences, privacy settings, the walls you follow and, if you add them, an avatar and a profile banner. If you work for a gym, your staff rights come from your membership in that gym and its role. We use this data to provide your account and the features you use (Art. 6(1)(b) GDPR). Your e-mail address is not shown to other climbers or to gym staff; the platform administrators can see it, and if you report content, the gym's moderators and the gym's contact address receive your name and e-mail address (see Content reports). Your account data is kept until you delete your account.
Your privacy settings
Under Settings → Privacy you decide who can follow you (approve each request, which is the default, anyone, or nobody), whether you appear on gym leaderboards, whether your name is shown on your reviews and whether your sends are shared with your followers. Changes take effect immediately; leaderboards follow with a short delay (see Leaderboards).
Logbook
When you log a send we store the route, the day, the type (flash, top or attempt), the number of attempts, the route's grade at that moment, the time the entry was saved and, if you add one, a note. We use this to keep your personal training log and to show your statistics and achievements (Art. 6(1)(b) GDPR). Your notes are only ever visible to you. Whether your sends are visible to others is explained under Friends, Climber profiles and Leaderboards. If you are offline, new entries are kept in your browser's storage until they can be sent. Your logbook is deleted when you delete your account; if a gym deletes a route, your entry keeps the route name and grade.
Friends and followers
You can follow other climbers and they can follow you, according to your follow setting. We store who follows whom and whether a request is pending or accepted. Your followers see your sends (route, grade, type, number of attempts, day and the time the entry was saved, never your notes) in their friends feed and the gym feed, updated live, unless you turn off Share my sends with followers. This setting does not affect leaderboards. You can decline requests and remove followers at any time. Lawful basis: providing the social features you choose to use (Art. 6(1)(b) GDPR). Follow data is deleted when you delete your account.
Climber profiles and search
Signed-in users can open your climber profile with your name, avatar, banner (if you have none, one is created on the viewer's device from your avatar's colours) and follower and following counts. If your follow setting is Nobody, only climbers connected with you through an accepted follow and climbers you have sent a follow request to can open it. Your statistics, recent sends and a comparison with the viewer's own sent routes are shown only to your accepted followers, your achievements (except grade-based ones) to everyone who can open your profile. If you turn off Share my sends with followers, your sends, statistics, comparison and achievements are hidden on your profile from everyone else; gym leaderboards have their own setting. Climber search shows the name, avatar and banner of users whose follow setting is not Nobody. Guests cannot see profiles or search. Lawful basis: Art. 6(1)(b) GDPR. Set your follow setting to Nobody to remove yourself from search.
Leaderboards
Each gym can show leaderboards for a season or the last 60 days. They are calculated from logbook data (your best 10 sends in that period) and show your shortened name (first name and the initial of your last name), an internal user ID, your avatar, rank, points, number of sends and flashes and your hardest grade. Leaderboards are public, including to visitors who are not signed in, and do not depend on Share my sends with followers. Lawful basis: our legitimate interests and those of the gym and its climbers in a motivating community feature (Art. 6(1)(f) GDPR). You can object at any time by turning off Show me on gym leaderboards in your privacy settings; you then disappear from current leaderboards within about a minute and from finished seasons within a few hours. Leaderboards are calculated on request, cached only briefly and not stored permanently.
Reviews
Signed-in users can review routes with stars, a felt grade and a comment. Each review is linked to your account. Signed-in users see your name and avatar next to your review unless you turn off Show my name on my reviews; visitors who are not signed in never see author names. The ratings and comments are shown publicly with the route and help the gym and other climbers. Lawful basis: providing the review feature (Art. 6(1)(b) GDPR) and, for showing your name, the legitimate interest in a trustworthy review community (Art. 6(1)(f) GDPR), which you can object to with the setting above. Gym moderators can remove reviews and anyone can report them. If you delete your account, your reviews remain without any link to you.
Beta videos
You can add a beta video to a route, either as a link to TikTok, Instagram or YouTube Shorts or as an upload of up to 30 MB. Videos and links are visible to everyone; your name and avatar as the person who added it are shown to signed-in users only. Make sure you have the right to share the video and that other people in it agree. Links are never embedded, so no data reaches the platform unless you tap the link; the platform's own privacy policy then applies. Lawful basis: Art. 6(1)(b) GDPR. You or the gym's moderators can delete a video at any time, it can be reported, and it is deleted when you delete your account.
Achievements
Our server automatically awards achievements based on your own activity: sends, climbing sessions, reviews, beta videos, accepted follows, confirmed route problem reports, competition entries and season ranks. We store each tier you reach with the date. Achievements based on grades are visible only to you; others see your remaining achievements only where your profile is visible to them and you share your sends with followers. This is not used to make any decision about you. Lawful basis: Art. 6(1)(b) GDPR. Achievements are deleted when you delete your account.
Competitions
If you take part in a competition run by a gym, the gym stores your name or display name, birth year, category, start number and results and, for participants under 16, the confirmation that a parent or guardian consents, to run the competition and publish results (Art. 6(1)(b) GDPR). Results lists with names are public on the gym's pages; when you register you can choose Hide me from public results. Entries are deleted when the gym deletes the competition or you delete your account.
Route problem reports
If you report a problem with a route, we store the problem type, your optional description and photo and, if you are signed in, a link to your account, so the gym's staff can fix the route and let you know (Art. 6(1)(f) GDPR, our interest in safe routes). Other climbers only see that a problem is open, not who reported it. Please do not include people in photos. Reports are deleted together with the route; if you delete your account, they remain without any link to you.
Content reports
If you report illegal or inappropriate content, we process your name, e-mail address, the reason and your explanation to handle the report and inform you of the decision (Art. 6(1)(c) GDPR in conjunction with Art. 16 of the EU Digital Services Act). The gym's moderators and the gym's contact address receive your name and e-mail address with the report. The person whose content you report is not told who you are, unless the law requires it. Reports are deleted three years after the decision; deleting your account does not delete them earlier.
Notifications
The bell in the app shows notifications such as follow requests, new routes on walls you follow, updates on your reports and new achievements. We store each notification with your account (Art. 6(1)(b) GDPR). In your notification settings you can switch off each topic for push notifications; the bell always shows all notifications. Read notifications are deleted automatically after 30 days, all others after 90 days, and all of them when you delete your account.
Push notifications
Push notifications are off until you turn them on for a device and allow them in your browser. Lawful basis: your consent (Art. 6(1)(a) GDPR and the national rules on device access), which you can withdraw at any time by removing the device in your notification settings or revoking the browser permission. We store the push address and keys your browser gives us and a device label (browser and operating system, for example Firefox · Android) with your account. Notifications are sent through your browser vendor's push service (for example Google, Apple or Mozilla), which may be located outside the EU and only receives the push address and the encrypted message. When you sign out or another person signs in on that device, the browser's subscription is cancelled. We delete the stored address when you remove the device in your notification settings, when the push service reports it as expired, or when you delete your account.
Download your data
In your account settings, Download your data creates a ZIP file with all data linked to your account, including your profile, avatar, banner, logbook, reviews, beta videos, follows, achievements, notifications, memberships, tasks and competition entries. This lets you use your rights of access and data portability yourself. To protect the service, it can be used a few times per hour. The ZIP file is prepared in the background and kept on our server for 7 days; you get a download link by e-mail and as a notification, and requesting a new export replaces the old one.
Deleting your account
You can delete your account yourself in your account settings. This deletes your account, logbook, follows, beta videos, achievements, notifications, push subscriptions, memberships and competition entries. Your reviews and route problem reports remain without any link to you, so they cannot be traced back to you. Content reports you made keep your name and e-mail address until they are deleted three years after the decision. Server logs and audit log entries are deleted on their normal schedule.
Audit log
To keep the service secure and changes traceable, we log every change made through the app by anyone (for example logbook entries, follows, reviews, beta videos, route problem and content reports, competition entries and staff changes) as well as sign-ins, failed sign-in attempts (the entered address only as a short hash), password resets and e-mail address changes, each with the e-mail address of the account, the action, the affected record and the IP address (Art. 6(1)(f) GDPR). Gym staff with access to the audit log see the entries for their gym, the platform administrators see all entries, and you can see your own. Entries keep your username or e-mail address even after you delete your account, and are deleted automatically after 90 days.
Spam protection
Some forms, such as registration, use a proof-of-work check hosted on our own server: your browser solves a small computing task. No data is sent to third parties and no tracking cookies are set. Lawful basis: our legitimate interests in protecting the service from spam and automated abuse (Art. 6(1)(f) GDPR).
Maps
Maps on gym pages are only loaded after you select Show map. Your browser then requests map data, fonts and symbols from OpenFreeMap (openfreemap.org), which receives your IP address and browser details (Art. 6(1)(a) GDPR, your consent). We remember the choice on your device; clear the site data to withdraw it. Staff who look up a gym address or move the map pin in the settings send that address or the pin coordinates to OpenStreetMap Nominatim.
No tracking, no third parties
We do not use analytics, advertising, social media plugins or tracking, and the app loads no fonts, scripts or other resources from third-party servers. We do not sell your data or use it for profiling or automated decisions with legal or similarly significant effects. The only external services involved are the push service of your browser vendor, if you turn on push notifications, and video platforms you choose to open yourself from a beta video link (see the sections above). Maps are only loaded from OpenFreeMap after you choose to show them (see Maps).
Cookies and local storage
We only store information on your device, or read it from there, where this is strictly necessary to provide the service you asked for, for example keeping you signed in, remembering the selected gym and your theme, and keeping logbook entries you made offline until you are back online. Because this storage is strictly necessary, no consent is required (Art. 5(3) ePrivacy Directive as implemented nationally, in Germany § 25(2) TDDDG). We set no tracking cookies. The complete list:
| Name | Type | Purpose | Duration |
|---|---|---|---|
gripello_auth | Cookie | Keeps you signed in | Until sign-out |
gripello_auth_session | Cookie | Keeps you signed in | Until sign-out |
theme-mode | Cookie | Remembers light or dark mode | 1 year |
sidebar-open | Cookie | Remembers whether the side navigation is expanded | 1 year |
gym | Cookie | Remembers the gym you last opened | 1 year |
gripello.moderation-seen | Local storage | Remembers when you last opened the moderation inbox, to mark new cases | Until deleted in the browser |
gripello.platform-users-compact | Local storage | Remembers whether the platform user table uses compact rows | Until deleted in the browser |
gripello-recent-gyms | Local storage | Lists the gyms you visited recently on the start page | Until deleted in the browser |
gripello.export-columns | Local storage | Remembers selected export columns | Until deleted in the browser |
gripello.export-tag-template | Local storage | Remembers the chosen tag layout | Until deleted in the browser |
inventory-scanned-route-ids | Local storage | Keeps the progress of an inventory scan | Until deleted in the browser |
gripello:competition-scores | Local storage | Keeps competition scores you entered without signal until they are sent | Until deleted in the browser |
gripello-push-declined | Local storage | Remembers that you removed push notifications on this device | Until deleted in the browser |
gripello-push-user | Local storage | Remembers who receives push notifications on this device, so another sign-in stops them | Until deleted in the browser |
map-route-type | Local storage | Remembers whether the map shows boulders or routes | Until deleted in the browser |
gripello-map-consent | Local storage | Remembers that you chose to load maps | Until deleted in the browser |
gripello-ticks | Browser database (IndexedDB) | Keeps your logbook and unsent ascents available offline | Until deleted in the browser |
gripello-* | Cache (service worker) | Keeps the app shell, public pages, gym data and images available offline | Until the next app update |
Your rights
Under the GDPR (and the UK GDPR if you are in the UK) you have the following rights. Contact the controller named above to use them; we reply within one month.
- Right of access (Art. 15 GDPR)
- Right to rectification (Art. 16 GDPR)
- Right to erasure (Art. 17 GDPR)
- Right to restriction of processing (Art. 18 GDPR)
- Right to data portability (Art. 20 GDPR)
- Right to object at any time, on grounds relating to your situation, to processing based on legitimate interests (Art. 21 GDPR)
- Right to withdraw consent at any time, without affecting processing before the withdrawal (Art. 7(3) GDPR)
You also have the right to complain to a data protection supervisory authority, in particular in the EU country where you live or work or where the alleged infringement took place (Art. 77 GDPR). In the UK you can complain to the Information Commissioner's Office (ico.org.uk); in Ireland to the Data Protection Commission (dataprotection.ie).