Privacy Policy

Service operator

ClimbCut operator: The Irum

Representative: Choe Geon-yeong

Business registration number: 448-79-00533

Business address: Room S77, 3rd floor, 28 Hyoryeong-ro 31-gil, Seocho-gu, Seoul, Republic of Korea (Bangbae-dong)

Customer support and privacy inquiries: support@climbcut.team

Privacy contact: Choe Geon-yeong

1. Scope and purposes

ClimbCut provides climbing video capture, storage, editing and export, account-based community, public video posts, activity records and optional cloud backup and restore. Capture and local editing do not require login.

Camera preview and original videos; lists, albums, thumbnails and playback information for device videos you allow access to; working copies for editing and their audio; file hashes for duplicate detection; working-copy creation times; recording dates, duration, size, resolution and file references; your discipline, grade, tape color and hold color selections; covers, trim ranges, ratios and watermark text; edited copies and export job status. Motion sensor readings for the level guide and pre-recording blur analysis are processed temporarily on the device only and are not sent to a server.

Videos and text may contain information that identifies you or people around you. Review the contents before recording or sharing.

Device album browsing, editing and body-position analysis run primarily on the device. Capture or editing alone does not upload originals. When you back up or publish, selected video, audio, covers and associated captions, gym or grade information are sent to servers. Advertising versions use Google AdMob.

2. Automatic diagnostics, analytics and SDK processing

In versions containing the automatic-collection update, Firebase Crashlytics diagnostics and Google Analytics usage collection are enabled automatically after the app starts to improve stability and features. There is no separate collection-choice screen or settings switch. Disabled collection settings saved by earlier versions are no longer used; collection is enabled at app startup. Viewing this document or granting camera permission is not stored as a separate collection-consent record.

When crash diagnostics are enabled, Firebase Crashlytics sends error types and stacks, crash and unresponsive-app diagnostics, app version, operating system and device information, and installation identifiers to Google to improve stability. Dart errors sent directly by the app exclude error bodies and local paths. Native crashes are collected using the SDK’s diagnostic methods. If both options are enabled, feature usage events may be included as diagnostic clues around an error.

When usage statistics are enabled, Google Analytics processes app instance identifiers; app, device, operating system and language information; automatic events such as launches, sessions and engagement time; start/result events and failure codes for recording, editing, person selection, Follow tracking, export, file saving, sharing and batch actions; processing times, video lengths, requested resolution, frame rate, ratio, mute, watermark and Follow settings; tracking completion ratios, missing-section counts and item counts. Approximate location derived from IP addresses may be processed, but location permission or precise location is not requested. App-added events exclude video IDs, filenames, user text and personal account IDs. Firebase Analytics advertising identifier collection, ad personalization and ad data consent settings are disabled. Separate AdMob SDK processing is described in Section 13.

The app does not delete crash reports or local analytics data to switch collection settings. Requests to restrict processing or delete data can be sent to support@climbcut.team. For SDK data not linked to an account, identifying the requester from installation-level data may be limited; we explain the available scope and outcome. Installation identifier and network processing required for SDK operation, and ML Kit diagnostics below, may be separate.

Android Follow tracking uses Google ML Kit. Input videos and analysis results are processed on the device, but ML Kit may send device and app information, installation identifiers, API configuration, usage, performance and error diagnostics to Google. See https://developers.google.com/ml-kit/terms and https://developers.google.com/ml-kit/android-data-disclosure . iOS Follow analysis uses Apple Vision.

Firebase Remote Config and Firebase Installations check app versions and deliver recommended or required update policies. This operational function is independent of diagnostics and analytics; Google processes information such as app/SDK versions, operating system, country code, language, time zone and installation identifiers. Policies, check times, dismissal times and the previous launch build are stored on the device. Videos and edits are not sent for update checks. Only when analytics is enabled, update prompt displays, button selections, deferrals, waiting for work to finish, actual build increases, link failures, policy codes, current/target builds and update types are sent as analytics.

3. Permissions

Camera: used for preview and video recording. You can revoke permission in system settings. Denial limits recording, but camera permission is not required to access previously saved videos in the library.

New recordings include sound and request microphone permission when preparing the camera. Recording is blocked if microphone access is denied or restricted; the existing app library remains available. The app does not request location, contacts or ad-tracking permission. The device folder requests media read access to list videos by album and play them directly: video read permission on Android and photo library access on iOS, querying videos only. Supported systems allow full or selected-item access, which you can change or revoke in settings. Denying gallery access does not prevent recording or use of the app folder. Listing or playing a video does not register it in the app library. Editing, sharing, exporting or recording gym/grade metadata prepares a working copy and links the device video to an app record. If you explicitly choose a move or deletion, the app may remove or trash the device-library video after saving and verifying a copy. Connected photo services may sync the change to other devices or cloud storage. A recovery copy is kept in the app before deletion; restoring from app trash places it in the app folder. Moving to the device folder saves the video in the system media library. Android 9 and earlier also request external storage write permission for this. File saving and sharing use operating system interfaces you choose.

4. Storage and retention

Originals and working copies are kept on the device; edits are saved separately. Videos in app trash become eligible for permanent cleanup from the displayed date, 30 days after moving to trash. Actual cleanup can be later depending on device state. Cloud copies and public posts are managed separately from device trash.

On Android, clearing app storage or uninstalling removes app data. On iOS, deleting the app removes local app data, while offloading may retain data. Separately saved or shared copies are not removed by uninstalling.

Firebase Crashlytics retains crash stacks and associated installation identifiers for 90 days before Google begins deletion. Google Analytics user- and event-level data follows the linked property’s retention settings; aggregate reports have separate retention behavior. See https://firebase.google.com/support/privacy and https://support.google.com/analytics/answer/7667196 for retention and deletion details.

See Section 13 for advertising and consent data processing and retention.

Account, cloud and public content are retained as needed to provide the feature and process deletion or account-closure requests. Object storage and database cleanup is not instantaneous removal of every copy. Store transactions, legally required records and necessary abuse/dispute records may be handled separately for their applicable purpose and retention scope. Manage local and externally shared copies separately.

5. Device backups and external storage

Videos, covers and restore metadata selected for backup are stored under the authenticated account. Completed cloud backups may remain after uninstalling or losing a device. Recovery of unfinished backups or drafts held only on the device is not guaranteed.

Personal cloud backups are separate from public posts. Authorized operators may process account, purchase and usage metadata as necessary for support, payment verification, errors and abuse response. Cloud storage is not described as end-to-end encrypted.

6. Third parties, processors and international transfers

Google and Cloudflare process authentication, hosting, storage and delivery; the chosen identity provider authenticates users; Google Play/Apple processes purchases. Providers may process data on infrastructure outside your country. Private cloud videos are not sold or automatically sent for advertising or AI training. Send processing, retention or rights inquiries to support@climbcut.team.

When you save or share a file, the selected edited video may be transferred to your chosen app or storage provider. That service’s policies govern server storage, international processing and publication scope; check before sending. New ClimbCut recordings include microphone audio. Silent originals from older versions remain unchanged. Audio in recorded or imported videos can be kept or muted in export settings.

AdMob collection, sharing, international processing and privacy choices follow Section 13. Not providing videos or climbing records for advertising is separate from the SDK’s processing of advertising-related data.

7. Access, correction, deletion and choices

View videos in the library and change edit text and settings in the editor. Changed edit settings do not overwrite original recording records. Files saved externally must be edited or deleted at their own locations.

Use supported profile, cloud and post controls to edit, delete or close your account, or request access, correction, deletion or processing restriction at support@climbcut.team. We verify identity only as needed for the request. Signing out or uninstalling alone does not remove all server accounts, posts or subscriptions.

8. Security and automatic collection

The app uses operating system private storage and permissions. This does not provide a separate app lock or end-to-end encryption. Access to an unlocked device and exported files depends on your device and sharing settings.

The app removes the Android advertising ID permission and does not request iOS ATT tracking permission. App- or developer-scoped identifiers that the advertising SDK may process are described in Section 13. It does not use facial recognition to identify users or automatically upload videos for AI training. Crashlytics/Analytics and Android ML Kit processing follow Section 2. Independent processing by operating systems and app stores follows their providers’ policies.

9. Policy changes

This policy reflects the development version’s implementation. If data processing changes, such as accounts, diagnostics or cloud storage, the policy will be updated with the version, effective date and key changes. Separately required legal consent will be obtained before processing.

10. Support email

When you contact support, we process your sender email, display name, message, attachments you choose and correspondence information to respond and resolve issues. Device videos and libraries are not attached automatically. Do not send passwords, identity documents or unnecessary sensitive information.

Support emails are retained for one year after resolution, then deleted. Where law requires retention, they are kept separately only for that purpose and period. Expired electronic records are deleted and paper copies, if any, are shredded. Request email deletion or exercise rights at support@climbcut.team.

Zoho Mail is used to send, receive and store email. Inquiry emails and attachments may be processed in the currently used US data center. When you send an email it is transferred electronically for responding and retention. See https://www.zoho.com/privacy.html . You can record and edit without sending support email.

11. Service age

ClimbCut is for ages 14 and above. We do not target children under 14 for personal information collection. If we learn that such information was sent to support, we will delete it after necessary checks. Guardians can contact support@climbcut.team.

12. Website visits

The official website provides feature and usage information. The operator has not added advertising or behavioral analytics tools, registration, or inquiry collection forms. OpenAI Sites and network providers hosting the site may process communication information such as IP addresses, browser information and request times for delivery and security. This is separate from on-device video processing in the app.

13. Library advertising and privacy choices

App versions with advertising may display one Google LLC AdMob native ad after eight videos in the app library. No ads appear on the camera screen. Recording, the library and editing remain available if an ad cannot load or the required privacy choices do not permit an ad request.

For advertising, measurement and fraud prevention, the Google Mobile Ads SDK may collect and share with advertising partners your IP address and approximate location derived from it, app/device/operating system information, app- or developer-scoped device identifiers, ad impressions, taps and ad video views, and app/SDK performance and diagnostic information. Data is encrypted in transit using TLS. We do not include recorded videos, audio, covers, body-position analysis results, gym names, grades, notes, filenames or watermark text in ad requests.

ClimbCut requests non-personalized ads. This does not mean that no personal data is processed: contextual advertising, frequency capping, measurement and fraud prevention may still require data. The Android advertising ID permission is removed and iOS ATT permission is not requested. App- or developer-scoped identifiers and network information may still be processed.

Before requesting ads, Google User Messaging Platform (UMP) checks the applicable region and privacy-choice status. It displays a notice or choice form when required. When Google requires a privacy-options entry point, you can reopen those choices through Ad privacy options in the library. Manage consent-dependent choices in that form. Requesting non-personalized ads does not replace required consent.

Advertising and consent information may be sent over a network to Google and advertising partners and processed internationally, including in the United States. Google LLC processes it for advertising, analytics, security and fraud prevention. Retention varies by data type, purpose, legal obligations and Google policies. We do not promise a single deletion deadline or immediate deletion of all server data when the app is removed. See https://policies.google.com/technologies/partner-sites and https://policies.google.com/technologies/retention .

Contact support@climbcut.team for privacy questions or access, deletion and processing-suspension requests. Linking a requester to installation-specific SDK data that is not associated with an account may be limited; we explain available actions and relevant Google procedures. External websites or apps opened by selecting an ad handle data under their own policies.

Optional app news notifications

With notification permission, FCM/APNs and account-linked device registration may deliver comments, likes, follows, processing results and service news. Device tokens, language, preferences, target account/post identifiers and notification text are processed. Original video files are not sent in push messages. Manage categories and permissions in app/device settings; network conditions may delay changes.

Optional calendar connections

Versions with calendar connections request OS calendar access or Google calendar viewing authorization only when you choose to connect. Capture, the library and personal workouts remain available without connecting.

Selected calendar IDs/names and event IDs, titles, start/end times and all-day flags are used for display and duplicate detection. Google also provides iCalUID. Selected calendar IDs stay on the device; event content is processed in memory for display. Continuous background synchronization is not provided.

Google authorization and Calendar API requests go directly from your device to Google. OAuth tokens are handled by the Google Sign-In SDK and device, not stored on ClimbCut servers. Calendar names and event content are not sent to ClimbCut servers, ads or analytics events. Original events are never modified or deleted.

Disconnecting a provider removes its selection and displayed events. Revoke Google account authorization or OS permission in the respective account/device settings. Original events and ClimbCut workout records are preserved.

16. Accounts, cloud, public posts and subscriptions

Features requiring an account use the sign-in methods offered in the app. Provider account identifiers, email when supplied, nickname and profile photo support identification, profiles and access control. Do not misuse accounts or infringe others’ rights.

Cloudflare R2 stores cloud and public media; Google Firebase/Google Cloud provide authentication, databases, APIs and notifications. Account identifiers, file identifiers, sizes, hashes, states and processing times support access control and delivery. Private backups restrict access to the owning account; public posts can be viewed and played by other users.

Community posts, photos, comments, Climb videos, captions, gyms, grades, hashtags, author profiles and public reactions are visible to other users. We process posted content as needed to display, transmit and play it without taking ownership. Deleting a post may not recall copies shared or saved by others. Users can report or block inappropriate content or accounts; operators may act to investigate reports and protect the service.

Account-specific workouts, schedules and linked-video information are stored locally. If you choose account sync or backup, dates, gyms, disciplines, grades, notes and other necessary record data may be sent to the server. Original external calendar events remain separate and follow their connection notice.

Subscription verification processes purchase tokens, transaction/order identifiers, product, price, currency, environment, subscription/renewal/cancellation times and state, and payment-device model/app information. Our server does not collect card numbers or store passwords. Google Play or Apple processes payments.

Version history

Previous published documents remain available in Korean.