← Back

Privacy Policy

Last updated: July 2, 2026

This Privacy Policy describes how Climb – Grow Together ("Climb", "we", "our") collects, uses, stores, and protects user information, in compliance with the Brazilian General Data Protection Law (LGPD — Law No. 13,709/2018).

By creating an account, you confirm that you have read and accepted this Policy.

1. Data We Collect

1.1 Account Data

Username
Email address
Password (stored in encrypted format — bcrypt hash; never in plain text)
Timezone (provided by the device or selected by the user)
Profile photo (optional; stored on the Cloudinary platform)

1.2 Activity Data

History of completed activities (dates, points, streaks)
Activities selected by the user for tracking
Subscription information (active plan, status, payment history — processed by RevenueCat)

1.3 Device & Notification Data

Push notification token (for sending alerts via Expo Push Service → FCM/APNs)
Operating system and platform (iOS / Android)

1.4 Advertising Data

Climb shows ads served by Google AdMob (banners, interstitials, and rewarded ads) to support the free plan.
To serve ads, AdMob accesses the device advertising identifier (Advertising ID on Android / IDFA on iOS) and technical device information.
Personalized ads (based on your advertising identifier) are shown only with consent. In the European Economic Area and the United Kingdom, consent is collected through Google's User Messaging Platform (UMP) before any personalization; without consent, we serve only non-personalized ads.
You can change or withdraw this consent at any time under Settings → Ad privacy options (where available in your region).

1.5 Social Login Data (OAuth)

If you choose to sign in with Google or Apple, we only receive the identity token issued by them. We do not have access to your password on those platforms.

2. How We Use Your Data

Purpose	Legal Basis (LGPD)
Creating and managing your account	Contract performance (Art. 7, V)
Calculating points, streaks, and rankings	Contract performance
Sending push notifications	Consent (Art. 7, I)
Processing subscriptions and payments	Contract performance
Showing personalized ads	Consent (Art. 7, I)
Showing non-personalized ads	Legitimate interest (Art. 7, IX)
Monitoring app errors and stability	Legitimate interest (Art. 7, IX)
Complying with legal obligations	Legal obligation (Art. 7, II)

3. Data Sharing

Your data is shared only with service providers necessary for the app to function:

Partner	Purpose	Data Shared
Cloudinary	Profile photo storage	Profile image
RevenueCat	Subscription management	User ID, subscription status
Expo / Expo Push Service	Push notification delivery	Notification token
Google (Firebase/FCM)	Android push notifications + OAuth	FCM token, OAuth identity token
Apple (APNs)	iOS push notifications + OAuth	APNs token, OAuth identity token
Railway	Server hosting	Data processed in infrastructure
Sentry	Error monitoring	Anonymous error logs, user ID
Google AdMob	Ad serving	Advertising identifier (Advertising ID / IDFA), device information

We do not sell or rent your personal data. Sharing with Google AdMob for advertising purposes is limited to the advertising identifier and technical device data, and respects your consent choice — personalized ads only with opt-in; otherwise, non-personalized ads only.

4. Data Retention

Data Type	Retention Period
Account data and activities	While the account is active
Session tokens	7 days (automatically renewed)
Notification tokens	While the account is active
Error logs (Sentry)	90 days
Data after account deletion	Removed immediately

5. Your Rights (LGPD Art. 18)

Access: request confirmation that we process your data and obtain a copy
Correction: correct incomplete, inaccurate, or outdated data
Deletion: delete your data — available in the app under Settings → Edit Profile → Delete account
Portability: request your data in a structured format
Revocation of consent: revoke consent for push notifications through device settings, and consent for personalized ads under Settings → Ad privacy options (where available in your region)
Information on sharing: know which third parties your data is shared with (section 3)

To exercise any right, contact us: privacy@weareclimbapp.com

6. Security

Passwords stored with bcrypt hash
HTTPS communication (TLS)
Short-lived JWT tokens (15 minutes) with rotating refresh tokens
HTTP security headers (HSTS, X-Content-Type-Options, X-Frame-Options)
Rate limiting on sensitive endpoints
Automatic database backups

7. Children's Privacy

Climb is not directed at children under 13 years of age. If you believe a child has provided data to the app, please contact us so we can remove it.

8. Changes to This Policy

We may update this Policy periodically. Significant changes will be communicated via in-app notification or email.

9. Contact

Climb – Grow Together
Email: privacy@weareclimbapp.com
Website: weareclimbapp.com