Boulder Tracker Privacy Policy

Effective: 4 October 2026 · Version: 2.1 (minimum age 14 and always non-personalized ads; replaces v2.0 of 4 October 2026)

1. Summary

• Your videos, notes, gyms and stats are stored only on your phone. Boulder Tracker has no servers of its own, no accounts of its own and no analytics of its own.
• If you turn it on, you can back up your data to your own Google Drive (a Premium feature).
• The free version shows Google AdMob ads, always non-personalized (you are not profiled for advertising), and only if you allow it when Google asks (where the law requires it). Ads never see your videos, notes or gyms.
• Premium (no ads, cloud backup) is paid through Google Play and validated with RevenueCat.
• We do not sell your data for money. You can delete it whenever you want.
• Boulder Tracker is for people aged 14 or over. If you are 14-17, read section 11.

2. Who is responsible

The data controller is Cristian Felipe Castro Ponce, a natural person, trading as BClabs, based in Villarrica, Chile ("we"), who publishes the Boulder Tracker app on Google Play.

Privacy and rights contact: vulcanoedicionessa@gmail.com (subject "Privacy"). This same address is the channel for data protection queries in every country (including the LGPD "encarregado" in Brazil).

3. Data we process

3.1 Data that stays on your phone

Videos and thumbnails, grades, attempts, notes, gyms you add (name, address, coordinates, phone, website and social links), your profile (name, location, bio and avatar, if you fill them in), settings and achievements. They are in the app's private storage and we do not receive them. If you record other people or include their data, you are responsible for respecting their privacy and for what you share or export.

If you use "Export backup" or share a video, the file leaves your phone to wherever you send it; that choice is yours.

3.2 Phone permissions

• Camera and microphone: only to record videos (with audio) inside the app.
• System photo and video picker: to import videos or pick an image. The app has no access to your gallery, only to what you choose.
• Approximate location: only when you tap "detect location" while creating a gym. The app reads your approximate location once and converts it into country, region, city and address using the Android/Google system geocoding service, which may receive the coordinates. The coordinates are stored on your phone, in the gym's record, and go to your Drive if you turn on backup. We do not receive them. If you tap "View on map", Google Maps opens with that address or those coordinates.
• Notifications: local training reminders, if you turn them on. We do not use remote notifications.
• Internet and network state: for Drive, ads and Premium.
• Advertising ID (AD_ID permission): declared by the ads library; see section 3.5.

3.3 Gym catalog

The app includes a catalog of climbing gyms: Chile (our own catalog from public information) and other countries with OpenStreetMap data (© OpenStreetMap contributors, ODbL license). It is business data (name, city, address, website, Instagram and, for a commercial landline, phone). We do not include gym emails or mobile phone numbers in the Chile catalog. The data ships inside the app and nothing of yours is sent to obtain it. It may be incomplete or out of date. If you are a gym and want to correct or remove your data, write to us.

3.4 Google Drive backup (optional, Premium)

If you connect your Google account, the app receives your email address (only to show which account is connected) and can upload and download files in a "Boulder Tracker" folder in your Drive: your videos and a file with the app's data (profile, notes, gyms with their coordinates, and stats). It uses only the drive.file permission: the app can only see files it creates itself. The files stay in your Drive; we do not see or store them.

Google Limited Use. Boulder Tracker's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. Specifically: we use Drive data only to provide the backup and restore feature you see in the app; we do not transfer it to third parties (except to comply with law, for security, or with your consent); we do not use it for advertising; no humans read it (except with your explicit consent, for security, or by law); and we do not use it to develop, improve or train artificial intelligence or machine-learning models.

3.5 Advertising (free version)

We use Google AdMob. When ads are shown, Google may collect the advertising ID, your IP address, device data, approximate location derived from your IP, information about how you interact with ads, and diagnostic data, to show and measure ads and prevent fraud. Ads are always non-personalized: the app tells Google to treat every user as under the age of consent and to serve only non-personalized ads, so your interests or history are not used to pick them (they rely on context, such as the app's content, and on frequency caps). Google acts as an independent controller of that data (how Google uses data). We never send it your videos, notes, gyms or email. - Consent. In the European Economic Area, the UK and Switzerland, and where other laws require it (for example some US states), Google shows its consent form (UMP) before ads are requested. If there is no usable consent, the app does not request ads. You can change your choice at any time in Settings → Privacy and ads. - You can reset or delete the advertising ID in Android settings, or remove ads with Premium (with Premium the app does not start the ads SDK). - Non-personalized ads for everyone. Because the app admits users from age 14 and cannot verify age, we set all ads to non-personalized (we flag the app as "treat users as under the age of consent"), request only non-personalized ads and limit content to a PG rating. That is not the same as zero data: Google may still process the advertising ID, IP and device data to deliver and measure ads, cap frequency, prevent fraud and comply with the law, under its own responsibility. We build no advertising profiles. With Premium, the app does not start the ads SDK. - We do not flag the app as "child-directed" (it is not: the minimum age is 14).

3.6 Premium and purchases

Subscriptions are charged through Google Play: we do not receive your payment details. We use RevenueCat, Inc., a provider acting on our behalf, to validate your subscription. It receives an anonymous identifier generated for you (we do not link it to your email or Google account), purchase information (product, dates, status), basic device data and your IP address. We do not send it your email, name, videos or notes. More information: RevenueCat privacy policy. You cancel in Google Play → Payments & subscriptions; uninstalling the app does not cancel it.

3.7 What we do not do

We do not use our own analytics, do not profile you or make automated decisions with legal effects about you, do not knowingly process sensitive data, and do not use your data to train AI. The ads we show are non-personalized: there is no advertising profiling based on your data.

4. Why we use data and the legal basis

Brazil (LGPD): consent (art. 7, I), legal obligation (art. 7, II), contract (art. 7, V) and legitimate interest (art. 7, IX). Chile (Law 19.628 and Law 21.719): consent, contract, legal obligation and legitimate interest.

Withdrawing consent does not affect earlier processing. You are not required to give us data to use the app: if you do not consent to ads, none are shown; if you do not connect Drive, there is no cloud backup.

5. Who we share data with

• Google LLC / Google Ireland Ltd. (Google Play, AdMob, UMP, Drive, Maps and location services), as described above.
• RevenueCat, Inc. (subscription validation; on our behalf).
• The hosting provider of this web page (GitHub Pages), which may log your IP when you visit it.
• Authorities, when required by law, and professional advisers bound by confidentiality.

We do not sell personal data for money. Because we request only non-personalized ads, we do not "share" data for cross-context behavioral advertising; even so, ad delivery by Google may involve processing that Google carries out on its own account (section 10).

6. International transfers

We are in Chile. Google and RevenueCat may process data in the United States and other countries, which may not offer the same level of protection as yours. Where the law requires it we rely on appropriate safeguards: the EU-US Data Privacy Framework (and its UK and Swiss extensions) where the provider is certified, and the European Commission's standard contractual clauses (with the UK addendum where applicable) otherwise. For Brazil we apply art. 33 of the LGPD (contractual clauses and certifications) and for Chile the transfer rules of Law 21.719. You can ask for more information at the contact address.

7. How long we keep data

• Data on your phone: until you delete it or uninstall the app.
• Files in your Drive: until you delete them.
• AdMob/Google: per Google's retention policies; we do not store it.
• RevenueCat: while your anonymous ID is tied to purchases needed to validate your subscription and for the provider's legal obligations; you can ask for deletion by email.
• Messages you send us: up to 24 months after the last contact, or longer if the law requires.
• Log of rights requests: 3 years, to show compliance.

8. Your rights and how to use them

Depending on your country you have the right to access your data, rectify it, erase it, object, restrict or block processing, portability, withdraw consent at any time, not be subject to automated decisions that significantly affect you, and complain to the data protection authority of your country.

How to exercise them: email vulcanoedicionessa@gmail.com with the subject "Privacy: rights". We may ask for minimal information to verify your identity. We reply without undue delay and generally within 30 calendar days (or any shorter period set by law, for example 15 days in Brazil), extendable where the law allows. It is free, except for manifestly unfounded or excessive requests. Since almost all your data is only on your phone, you can exercise most rights directly in the app (edit, export, delete).

How to delete your data 1. In the app: delete videos, gyms and notes, and edit or empty your profile. 2. Drive: in the cloud backup section use "Remove from Drive" or disconnect the account, and delete the "Boulder Tracker" folder at drive.google.com. To revoke access: myaccount.google.com/permissions. 3. Phone: clear the app's data in Android settings or uninstall it. The app does not allow Android backups. 4. Ads: reset or delete the advertising ID in Android and change your choice in Settings → Privacy and ads. 5. Purchases: email us to request deletion of your anonymous ID and we will coordinate with RevenueCat; cancel the subscription in Google Play.

9. Users in the EU/EEA, the UK and Switzerland

• Controller: as stated in section 2.
• EU representative (Art. 27 GDPR): we have not yet appointed a representative in the EU. If you are in the EU/EEA you can exercise your rights and send us questions by writing directly to vulcanoedicionessa@gmail.com (we reply within the legal deadline), and you have the right to lodge a complaint with the data protection authority of your country. For now the app is not offered in the United Kingdom.
• Legal bases: those in section 4 (consent for ads, Drive and location; contract for Premium; legitimate interest for security and fraud).
• Ads consent: requested with Google's form (UMP), even though ads are always non-personalized. You can withdraw it in Settings → Privacy and ads. If you do not consent, ads are not requested; or you can subscribe to Premium.
• Teenagers: see section 11. The age at which a minor can consent by themselves to data processing in information society services varies between 13 and 16 depending on the EU country (GDPR art. 8) and is 13 in the UK. Because the app does not verify age, we do not rely on a minor's consent for any processing of our own that is not necessary for the service, and ads are non-personalized.
• Transfers: see section 6.
• Rights and deadlines: we reply within one month (extendable by two months in complex cases; 30 days in Switzerland).
• Breaches: if a breach poses a risk to you, we will notify the authority within 72 hours and you without undue delay where required.
• Complaints: to the authority of your country of residence, work or place of the alleged infringement (e.g. AEPD, CNIL, Garante, the ICO in the UK, FDPIC in Switzerland).

10. Brazil, Chile and California/US

Brazil (LGPD). You have the rights in art. 18: confirmation of processing, access, correction, anonymization or deletion, portability, information on sharing, and revocation of consent. "Encarregado" channel: the email in section 2. Authority: ANPD.

Chile (Law 19.628 and Law 21.719). You have rights of access, rectification, erasure, objection, blocking and portability. Law 21.719 takes effect on 1 December 2026 and creates the Personal Data Protection Agency, where you may complain. For minors, see section 11.

California and other US states (CCPA/CPRA and state laws), to the extent they apply to us: - Categories collected in the last 12 months: identifiers (advertising ID, anonymous purchase ID, IP); internet activity (ad interaction); approximate location; commercial information (subscription history); and, only if you connect Drive, your email. We do not knowingly collect sensitive personal information. - Sources: you, your device, Google Play and AdMob. Purposes: section 4. Disclosure: to service providers (RevenueCat, Google) and to Google as an advertising third party. - Sale and sharing: we do not sell your information for money. Because we request only non-personalized ads, we do not run cross-context behavioral advertising with your data. If your state gives you a right to opt out, you can exercise it in Settings → Privacy and ads (where Google offers the form), in Android settings, or with Premium. We do not sell or share data of under-16s. Mobile apps do not receive the browser "Global Privacy Control" signal; we honor the options above. - Rights: know, access, correct, delete, opt out of sale/sharing, portability and non-discrimination. Request by email (you may use an authorized agent). We reply within 45 days (extendable by another 45 with notice). You can appeal a refusal by replying to our email.

11. Minimum age (14) and teenagers' data

Minimum age. Boulder Tracker is for people aged 14 or over and is not directed at anyone under 14. We do not knowingly collect data from children under 14. The app does not verify age: your age is a statement you make. If you believe a child under 14 has given us data, write to us and we will delete it.

If you are 14-17. - You may use the free app. Almost all your data stays only on your phone and we do not receive it. - The ads you see are always non-personalized (section 3.5). We do not sell your data or use it for targeted advertising. - Premium: if you are under 18, you may buy it only with the authorization of your parent or legal guardian, or if an adult buys it with their own Google Play account, as Google Play's terms and consumer law require. Drive backup requires a Google account that meets Google's own age requirements. - We recommend talking to a parent or guardian before connecting Drive, using location, or recording other people.

Parents and guardians. Write to vulcanoedicionessa@gmail.com (subject "Privacy: minor") to ask about, correct or request deletion of a minor's data we hold (for example, their message to us or their anonymous RevenueCat purchase ID); we will coordinate deletion with RevenueCat. We may ask for minimal information to verify the relationship. Data on the minor's phone (videos, notes, profile) can be deleted from the app or Android settings (section 8); Drive files are managed by the minor's Google account.

What the laws say (summary). - Chile (Law 19.628, Law 21.719 and Law 21.430): children under 14 need their parents' or representatives' consent; teenagers 14-17 can generally consent themselves, except for certain sensitive data, and the child's best interests and progressive autonomy guide all processing. We do not knowingly process sensitive data. - EU/EEA: GDPR art. 8 lets each country set the age of consent between 13 and 16 for processing based on consent (for example, 14 in Spain and Italy, 15 in France and 16 in Germany). The app is for people aged 14 or older and all ads are non-personalized; if the age of consent in your country is higher than yours, you need the authorization of your parent or legal guardian: write to us and we will handle the request. United Kingdom: the Children's Code applies to services minors are likely to use; for now the app is not offered there. - Brazil: the LGPD (art. 14) and the ECA Digital (Law 15.211/2025) require protecting the best interests of children and teenagers; we use non-personalized ads and avoid collecting unnecessary data. - US: COPPA protects under-13s, who are outside the app; some state laws protect teenagers (for example, limiting targeted advertising), which is why we do not do targeted advertising.

12. Cookies and similar technologies

The app does not use cookies. The advertising and purchase identifiers work in a similar way and are explained in sections 3.5 and 3.6; the ads SDK's access to your device identifier depends on your consent where the law requires it. This web page uses no cookies and no analytics of its own.

13. Security

Your data is stored in the app's private storage (excluded from Android backups). Communications with Google, AdMob and RevenueCat use encrypted connections (HTTPS/TLS). Data on your phone depends on its security (screen lock, updates): the app does not encrypt it by itself. No system is infallible. If a breach affecting you occurs and the law requires it, we will notify you and the authority within the legal deadlines. To report a vulnerability: vulcanoedicionessa@gmail.com.

14. Changes to this policy

If we change it, we will publish the new version here with its effective date. If the change is important we will notify you in the app before it applies and, if the purpose of a consent-based processing changes, we will ask you again. Earlier versions: on request by email.

15. Contact

Cristian Felipe Castro Ponce (BClabs) · Villarrica, Chile · vulcanoedicionessa@gmail.com

The full identification details of the provider are available on request by writing to the contact email.