Service operator
ClimbCut operator: 더 이룸 (The Irum)
Representative: 최건영 (Choe Geon-yeong)
Business registration number: 448-79-00533
Business address: Room S77, 3rd floor, 28 Hyoryeong-ro 31-gil, Seocho-gu, Seoul, Republic of Korea (Bangbae-dong)
Customer support and privacy inquiries: support@climbcut.team
Privacy contact: 최건영 (Choe Geon-yeong)
1. Scope and purposes
ClimbCut provides climbing video capture, storage, editing and export, account-based community, public video posts, activity records and optional cloud backup and restore. Capture and local editing do not require login.
Camera preview and original videos; lists, albums, thumbnails and playback information for device videos you allow access to; working copies for editing and their audio; file hashes for duplicate detection; working-copy creation times; recording dates, duration, size, resolution and file references; your discipline, grade, tape color and hold color selections; covers, trim ranges, ratios and watermark text; edited copies and export job status. Motion sensor readings for the level guide and pre-recording blur analysis are processed temporarily on the device only and are not sent to a server.
Videos and text may contain information that identifies you or people around you. Review the contents before recording or sharing.
Device album browsing, editing and body-position analysis run primarily on the device. Capture or editing alone does not upload originals. When you back up or publish, selected video, audio, covers and associated captions, gym or grade information are sent to servers. Advertising versions use Google AdMob.
Device-folder videos can be edited by reference; entering the editor does not itself copy the entire original into the app folder. Choosing to keep an app copy creates a separate copy. Edit settings, covers and analysis results are stored separately without overwriting the original. Revoked access, external deletion or waiting for a device photo service download may limit playback or editing.
Person tracking and climb-segment suggestions analyze body positions and movement in video frames on the device. Coordinates and suggested segments needed for editing may be stored in local edit settings. This is not facial identification or health diagnosis; videos/results are not automatically uploaded or used for AI training for this analysis. Separate Android ML Kit SDK diagnostics follow section 2.
2. Automatic diagnostics, analytics and SDK processing
In versions containing the regional consent feature in this draft, usage analytics starts disabled when Google UMP identifies a European consent region, including the EEA, United Kingdom or Switzerland. A separate choice screen enables Google Analytics only after permission. Allow, decline or withdraw in Settings > Usage analytics. Analytics is enabled automatically after a region outside this scope is confirmed. Device language is not used to infer region; collection remains paused if the region cannot be verified. Feature events before permission are not sent retrospectively. Firebase Crashlytics diagnostics is enabled automatically and separately for app stability. Declining or withdrawing does not prevent capture or editing. Earlier releases follow the collection settings included in that version. Viewing this document is not consent.
When crash diagnostics are enabled, Firebase Crashlytics sends error types and stacks, crash and unresponsive-app diagnostics, app version, operating system and device information, and installation identifiers to Google to improve stability. Dart errors sent directly by the app exclude error bodies and local paths. Native crashes are collected using the SDK’s diagnostic methods. If both options are enabled, feature usage events may be included as diagnostic clues around an error.
When usage statistics are enabled, Google Analytics processes app instance identifiers; app, device, operating system and language information; automatic events such as launches, sessions and engagement time; start/result events and failure codes for recording, editing, person selection, Follow tracking, export, file saving, sharing and batch actions; processing times, video lengths, requested resolution, frame rate, ratio, mute, watermark and Follow settings; tracking completion ratios, missing-section counts and item counts. Approximate location derived from IP addresses may be processed, but location permission or precise location is not requested. App-added events exclude video IDs, filenames, user text and personal account IDs. Firebase Analytics advertising identifier collection, ad personalization and ad data consent settings are disabled. Separate AdMob SDK processing is described in Section 13.
The app does not delete crash reports or local analytics data to switch collection settings. Requests to restrict processing or delete data can be sent to support@climbcut.team. For SDK data not linked to an account, identifying the requester from installation-level data may be limited; we explain the available scope and outcome. Installation identifier and network processing required for SDK operation, and ML Kit diagnostics below, may be separate.
Android Follow tracking uses Google ML Kit. Input videos and analysis results are processed on the device, but ML Kit may send device and app information, installation identifiers, API configuration, usage, performance and error diagnostics to Google. See https://developers.google.com/ml-kit/terms and https://developers.google.com/ml-kit/android-data-disclosure . iOS Follow analysis uses Apple Vision.
Firebase Remote Config and Firebase Installations check app versions and deliver recommended or required update policies. This operational function is independent of diagnostics and analytics; Google processes information such as app/SDK versions, operating system, country code, language, time zone and installation identifiers. Policies, check times, dismissal times and the previous launch build are stored on the device. Videos and edits are not sent for update checks. Only when analytics is enabled, update prompt displays, button selections, deferrals, waiting for work to finish, actual build increases, link failures, policy codes, current/target builds and update types are sent as analytics.
3. Permissions
Camera: used for preview and video recording. You can revoke permission in system settings. Denial limits recording, but camera permission is not required to access previously saved videos in the library.
New recordings include microphone audio. Denied or restricted microphone access blocks capture while keeping the existing library available. Location, contacts and ad-tracking permissions are not requested.
Device-folder browsing and playback use media access. Profile and community photos read only images you choose in the system picker, resize them and upload them without changing originals. Editing can use original references; explicit app-copy storage and recovery before deleting a device original prepare validated copies. Device moves or deletions follow your selection and OS confirmation and may affect connected photo services. Automatic export saving may require device-library write access; Android 9 and earlier request external-storage write permission. Additional file saving and sharing use OS destination selection. Notifications and calendars request their separate permissions when enabled.
4. Storage and retention
Originals and working copies are kept on the device; edits are saved separately. Videos in app trash become eligible for permanent cleanup from the displayed date, 30 days after moving to trash. Actual cleanup can be later depending on device state. Cloud copies and public posts are managed separately from device trash.
On Android, clearing app storage or uninstalling removes app data. On iOS, deleting the app removes local app data, while offloading may retain data. Separately saved or shared copies are not removed by uninstalling.
Firebase Crashlytics retains crash stacks and associated installation identifiers for 90 days before Google begins deletion. Google Analytics user- and event-level data follows the linked property’s retention settings; aggregate reports have separate retention behavior. See https://firebase.google.com/support/privacy and https://support.google.com/analytics/answer/7667196 for retention and deletion details.
See Section 13 for advertising and consent data processing and retention.
Account data, public posts, private backups and server copies of workout records are retained during use and cleaned up following deletion/account-closure requests. Public visibility changes and media deletion may occur sequentially. Deletion fences, payment/entitlement history, reports and notification jobs may remain separately; on request we explain the applicable basis and deletion scope by record type. Uninstalling, logout and subscription cancellation are not server-deletion requests. We do not claim all copies are instantly erased before deletion completes.
Where Korean e-commerce retention duties apply, necessary contract/withdrawal and payment/supply records are retained separately for five years, consumer complaint/dispute records for three years, and advertising records for six months. These duties do not justify retaining all video content for those periods. Ordinary support email follows section 10; transaction disputes follow the applicable statutory period.
5. Device backups and external storage
Videos, covers and restore metadata selected for backup are stored under the authenticated account. Completed cloud backups may remain after uninstalling or losing a device. Recovery of unfinished backups or drafts held only on the device is not guaranteed.
Personal cloud backups are separate from public posts. Authorized operators may process account, purchase and usage metadata as necessary for support, payment verification, errors and abuse response. Cloud storage is not described as end-to-end encrypted.
Workout records, plans, notes, gyms, disciplines, grades, completion counts by color and linked-video information are stored in account-specific local databases. Logout hides but does not delete the previous account records. Record backup files exclude video files, login tokens and device video IDs. Choosing account backup or sync sends records and merge information such as server revisions to Firebase. Cross-device synchronization is explicit; videos require separate backup. Community/Climb drafts and upload retry state may also be stored locally per account.
Export creates and validates a separate edited file, then automatically attempts to save copies to the app folder and device media library. Permissions, free space or operating-system conditions may prevent one save; check the result and retry guidance. A device-library copy may also sync through iCloud Photos, Google Photos or another connected photo service according to your settings.
6. Third parties, processors and international transfers
Google LLC Firebase/Google Cloud handles authentication, record/post databases, APIs, media validation, push, diagnostics and analytics. Cloudflare, Inc. R2 stores and delivers selected private backups and public Climb videos/covers. Community/profile images may be processed in Firebase databases. Video bytes go from the device to R2; a verifier may temporarily download them to check size, hash and playback metadata.
The API runtime region is Seoul; this does not mean all authentication, SDK, storage and delivery processing occurs only in Korea. Transfer countries, timing/method, recipient contacts, retention and the applicable basis for Google/Cloudflare processing must be finalized for publication against actual contracts and service settings. This draft does not assert unverified storage countries or periods. Provider information: https://firebase.google.com/support/privacy and https://www.cloudflare.com/privacypolicy/ .
Enabled Google, Apple, Kakao or NAVER sign-in providers independently authenticate and supply necessary account information to Firebase. Google Play/Apple process store payments and Zoho Mail processes support email. Passwords are entered with the provider; ClimbCut servers do not collect provider passwords or card numbers. Account and calendar providers have separate terms.
When you save or share a file, the selected edited video may be transferred to your chosen app or storage provider. That service’s policies govern server storage, international processing and publication scope; check before sending. New ClimbCut recordings include microphone audio. Silent originals from older versions remain unchanged. Audio in recorded or imported videos can be kept or muted in export settings.
AdMob collection, sharing, international processing and privacy choices follow Section 13. Not providing videos or climbing records for advertising is separate from the SDK’s processing of advertising-related data.
7. Access, correction, deletion and choices
View videos in the library and change edit text and settings in the editor. Changed edit settings do not overwrite original recording records. Files saved externally must be edited or deleted at their own locations.
Use supported profile, cloud and post controls to edit, delete or close your account, or request access, correction, deletion or processing restriction at support@climbcut.team. We verify identity only as needed for the request. Signing out or uninstalling alone does not remove all server accounts, posts or subscriptions.
8. Security and automatic collection
The app uses operating system private storage and permissions. This does not provide a separate app lock or end-to-end encryption. Access to an unlocked device and exported files depends on your device and sharing settings.
The app removes the Android advertising ID permission and does not request iOS ATT tracking permission. App- or developer-scoped identifiers that the advertising SDK may process are described in Section 13. It does not use facial recognition to identify users or automatically upload videos for AI training. Crashlytics/Analytics and Android ML Kit processing follow Section 2. Independent processing by operating systems and app stores follows their providers’ policies.
9. Policy changes
This draft was revised on 2026-10-30. The effective date, previous version and key changes will be announced at publication. Only processing relevant to the app version and available features applies. Changes requiring separate consent will obtain it before processing; viewing the document or continued use does not replace it.
10. Support email
When you contact support, we process your sender email, display name, message, attachments you choose and correspondence information to respond and resolve issues. Device videos and libraries are not attached automatically. Do not send passwords, identity documents or unnecessary sensitive information.
Support emails are retained for one year after resolution, then deleted. Where law requires retention, they are kept separately only for that purpose and period. Expired electronic records are deleted and paper copies, if any, are shredded. Request email deletion or exercise rights at support@climbcut.team.
Zoho Mail is used to send, receive and store email. Inquiry emails and attachments may be processed in the currently used US data center. When you send an email it is transferred electronically for responding and retention. See https://www.zoho.com/privacy.html . You can record and edit without sending support email.
11. Service age
ClimbCut is for ages 14 and above. We do not target children under 14 for personal information collection. If we learn that such information was sent to support, we will delete it after necessary checks. Guardians can contact support@climbcut.team.
12. Website visits
The official website provides feature and usage information. The operator has not added advertising or behavioral analytics tools, registration, or inquiry collection forms. OpenAI Sites and network providers hosting the site may process communication information such as IP addresses, browser information and request times for delivery and security. This is separate from on-device video processing in the app.
13. Library advertising and privacy choices
Ad-supported versions may show one AdMob native ad after eight videos in the app library and a separate native ad page between each group of six videos in the public climbing feed. Ads appear only at supported screen widths and never on the camera screen. Capture, library and editing remain available if ads fail to load or required privacy choices have not been completed.
For advertising, measurement and fraud prevention, the Google Mobile Ads SDK may collect and share with advertising partners your IP address and approximate location derived from it, app/device/operating system information, app- or developer-scoped device identifiers, ad impressions, taps and ad video views, and app/SDK performance and diagnostic information. Data is encrypted in transit using TLS. We do not include recorded videos, audio, covers, body-position analysis results, gym names, grades, notes, filenames or watermark text in ad requests.
ClimbCut requests non-personalized ads. This does not mean that no personal data is processed: contextual advertising, frequency capping, measurement and fraud prevention may still require data. The Android advertising ID permission is removed and iOS ATT permission is not requested. App- or developer-scoped identifiers and network information may still be processed.
Before requesting ads, Google User Messaging Platform (UMP) checks the applicable region and privacy-choice status. It displays a notice or choice form when required. When Google requires a privacy-options entry point, you can reopen those choices through Ad privacy options in the library. Manage consent-dependent choices in that form. Requesting non-personalized ads does not replace required consent.
Advertising and consent information may be sent over a network to Google and advertising partners and processed internationally, including in the United States. Google LLC processes it for advertising, analytics, security and fraud prevention. Retention varies by data type, purpose, legal obligations and Google policies. We do not promise a single deletion deadline or immediate deletion of all server data when the app is removed. See https://policies.google.com/technologies/partner-sites and https://policies.google.com/technologies/retention .
Contact support@climbcut.team for privacy questions or access, deletion and processing-suspension requests. Linking a requester to installation-specific SDK data that is not associated with an account may be limited; we explain available actions and relevant Google procedures. External websites or apps opened by selecting an ad handle data under their own policies.
14. Optional push and device notifications
Enabling notifications uses FCM/APNs delivery tokens. Personal notifications register the token, account ID, language, platform, app build, chosen kinds and update time on the server, and process recipients, kinds, target-post IDs and delivery/deduplication state. Comments, replies, likes, followers, payment and upload notices can be disabled by kind. Original videos and external-calendar content are not sent in push messages.
Workout reminders and some backup, restore and export results are scheduled or shown locally. Inbox text, read status and destinations are stored on the device. OS lock-screen settings can expose notification previews to others; adjust previews in device settings.
Disabling notifications, logout or account changes request deregistration and token cleanup. Offline conditions and messages already sent may delay the effect. Personal device registrations not updated for 90 days are excluded from delivery, which does not mean automatic deletion of those server records. News subscription is separate from consent to promotional events or offers.
15. Optional calendar connections
Where supported, choosing a provider and calendar requests device-calendar permission, Google Calendar read authorization or Kakao Talk Calendar authorization. App login and calendar connection are separate. Some providers may be unavailable depending on approval or permission status. Location and contacts permissions are not used.
Calendar/account IDs and names, event IDs, titles where available, start/end times, all-day status and recurrence/deduplication information are used to display events. Google and Kakao API requests go directly from the device to the provider. Google tokens are handled by the sign-in SDK and Kakao tokens by secure device storage, not ClimbCut servers. Although the Kakao permission name includes writing and deletion, the app only reads.
NAVER connection imports an .ics file you exported and choose with the system picker. A confirmed copy is stored in app-private storage and parsed locally for events, time zones and recurrence. This is neither NAVER account authentication nor automatic synchronization; import again to update. The original file is not modified.
Selections are stored locally and API events are handled in memory for display. Event content, calendar names, tokens and imported .ics files are not sent to ClimbCut servers, ads or analytics. Original events are not changed or deleted. External events are excluded from workout backup/sync and completed-workout statistics. There is no continuous background sync.
Disconnecting removes local selections and displayed events, the app-private NAVER file copy and Kakao tokens. Failed remote disconnection is reported. Google/Kakao account access and OS permissions can also be revoked in provider/device settings. Original events, the original .ics file and ClimbCut workout records are retained.
16. Accounts, cloud, public posts and subscriptions
Features requiring an account use the sign-in methods offered in the app. Provider account identifiers, email when supplied, nickname and profile photo support identification, profiles and access control. Do not misuse accounts or infringe others’ rights.
Cloudflare R2 stores cloud and public media; Google Firebase/Google Cloud provide authentication, databases, APIs and notifications. Account identifiers, file identifiers, sizes, hashes, states and processing times support access control and delivery. Private backups restrict access to the owning account; public posts can be viewed and played by other users.
Community posts, photos, comments, Climb videos, captions, gyms, grades, hashtags, author profiles and public reactions are visible to other users. We process posted content as needed to display, transmit and play it without taking ownership. Deleting a post may not recall copies shared or saved by others. Users can report or block inappropriate content or accounts; operators may act to investigate reports and protect the service.
Workout records, plans, notes, gyms, disciplines, grades, completion counts by color and linked-video information are stored in account-specific local databases. Logout hides but does not delete the previous account records. Record backup files exclude video files, login tokens and device video IDs. Choosing account backup or sync sends records and merge information such as server revisions to Firebase. Cross-device synchronization is explicit; videos require separate backup. Community/Climb drafts and upload retry state may also be stored locally per account.
Subscription verification processes purchase tokens, transaction/order identifiers, product, price, currency, environment, subscription/renewal/cancellation times and state, and payment-device model/app information. Our server does not collect card numbers or store passwords. Google Play or Apple processes payments.
Public-profile nicknames, bios and selected photos, follower/following relationships and counts, posts, videos, comments, replies and likes are linked to account IDs for display, search and notifications. Post/user/gym/tag search terms are sent to the search API. Report targets, reasons, status and blocked accounts are processed for safety and visibility controls, not displayed on public profiles. Public posts, profiles and share links can be viewed without login.
Public video and comment reports store the target, reason, reporter account identifier and submission time. Authorized operators review reports and dismiss them or hide the content from public access, recording the reviewer, reason and time. Hiding blocks public server lookup and playback access; it does not delete on-device originals. Previously issued playback links may remain usable until expiry. Review is not guaranteed to be automatic or immediate. Appeals and rights requests can be sent to support@climbcut.team.
17. Notices and update guidance
Firebase Remote Config supplies JSON notices, events and update policies filtered by app version, OS, language and time. Notice IDs, revisions, viewing/hide times, day/month/ongoing hide choices and caches are stored locally, not recorded as acceptance of terms or marketing consent.
18. Destruction and rights requests
When a purpose ends or a deletion request is confirmed, data without a legal retention duty is deleted without undue delay. Statutory records are separated from other uses and destroyed when the period ends. Electronic files, database entries and stored objects are deleted to prevent recovery/reproduction; paper records, if any, are shredded. Shared copies, device-library copies and photo-sync copies must be removed from those separate locations.
Send access, correction, deletion, suspension, consent-withdrawal or representative requests unavailable in-app to support@climbcut.team. After minimal identity/authority checks, we respond with the result or lawful restriction within the applicable period. We do not request passwords, entire videos or unnecessary identity documents. Refusing necessary processing may limit related account/server functions, separately from login-free local recording/editing.