Privacy Policy
Crimpway · Climbing Plans (Android phone app, Wear OS watch app and crimpway.com) · Last updated: 6 November 2026
1. Who is responsible
The controller responsible for your personal data is:
Friedemann Ehlich
Calle Roberto Lewis
Edif. Crillon
Panama City, Republic of Panama
Email: panamasismo@gmail.com
In this policy, “we” and “us” mean the controller above; “the app” means the Crimpway phone app and the Crimpway watch app (package app.crimpway); “the service” means the app, the optional account and backup, and the website crimpway.com.
2. Summary
- Your training data is stored on your phone and watch. You can use the app fully without an account.
- An account (email or Google) is optional and only needed for the encrypted backup on crimpway.com.
- We send anonymous usage statistics tied to a random install ID, not to you. You can switch them off in the app’s settings.
- No ads, no selling of data, no third-party analytics or advertising SDKs, no profiling.
- Health Connect access is optional, permission-based and used only for bodyweight-relative targets, training load and recovery (section 9).
3. Data stored on your devices
The app stores on your phone (and, for the parts you use there, on your watch): your athlete profile (for example grade, bodyweight, birth year, climbing focus, training ambition), equipment, weekly time windows, sensor measurements and force curves, test results, routines, workouts, plans, session history, effort ratings and heart-rate values of your sessions, and app settings. This data does not leave your devices unless you create a backup (section 6), export a file yourself (CSV/ZIP export), or it is included in Android’s own backup (section 7).
Bluetooth sensors and heart-rate straps
The app connects over Bluetooth Low Energy to force sensors (Frez Dyno, Tindeq Progressor, Bluetooth crane/hanging scales) and, if you choose, to a heart-rate chest strap. Readings are processed on your device. The app needs Android’s “Nearby devices” (Bluetooth) permission for this. On Android 11 and older, Android requires the location permission to scan for Bluetooth devices; Crimpway does not read, store or send your location.
Phone ↔ watch sync
The phone and the watch exchange routines, workouts, plan sessions, sensor settings, heart rate and session results directly between your own devices, using Google Play services’ Wear OS data layer (Bluetooth or Wi-Fi). This data does not pass through our server.
4. Optional account
If you create an account, we store: your email address; for email accounts a password hash (scrypt with an individual salt — we never store your password); for Google sign-in the Google account identifier and the email address Google confirms (Google also sends your name and profile picture; we do not store them); your language; whether your email is verified; creation date; last sign-in; and, for each signed-in device, a sign-in session with the device name the app sends (for example the phone model) so that sessions can be renewed and revoked.
We use your email only for account emails: confirming the address, password resets, deletion confirmations and answers to your support requests. We do not send newsletters or marketing.
Google sign-in: when you choose “Continue with Google”, Google processes your sign-in under its own privacy policy and tells us your account identifier, email address and whether it is verified.
5. How we protect data on the server
- All connections use TLS (HTTPS).
- Every account has its own random 256-bit data key. Backups are encrypted with it using AES-256-GCM before they are stored. The data key itself is stored only in encrypted form, wrapped with a master key that is kept outside the database.
- This is encryption at rest with server-side keys, not end-to-end encryption: our server can decrypt a backup in order to return it to your signed-in app. Our admin tools have no function to view or download backup contents.
- Server logs contain no IP addresses, passwords, tokens, email addresses or URL query strings.
6. Encrypted backup on crimpway.com (optional)
If you turn on backup, the app uploads a ZIP file of its database and settings, which contains the training data described in section 3, including health and fitness data such as bodyweight, heart rate and session history. Together with each backup we store its size, date, an identifier the app generates for the device, the app version and when the data was last changed. We keep the 10 newest backups per account; older ones are deleted automatically. You can restore a backup on a new phone after signing in with the same account.
7. Android’s own backup
Android may include the app’s data in your device backup to your Google account and in device-to-device transfers when you set up a new phone. This is done by Android and Google under Google’s terms; depending on your device and settings it is end-to-end encrypted with your screen lock. We have no access to it. You can turn it off in Android’s settings (Settings › Google › Backup).
8. Anonymous usage statistics
To learn which features are used and improve the app, the app sends usage events to crimpway.com. Each event contains only: a random install ID generated by the app on first start (not your account, not an advertising ID, not a hardware identifier), the event type (app opened, setup completed, routine/workout started or completed, plan created, test completed, watch session, backup created, account created), an identifier of the routine, workout or test concerned (for example max_hangs_20mm), the time of the event, the app version, whether it came from the phone or the watch, and the app language.
The statistics are not linked to your account, contain no email, no measurements and no health data, and we do not store your IP address with them. They are kept for 13 months and then deleted. You can switch them off at any time in the app’s settings (Me › Settings › Privacy); a new install ID is created if you reinstall the app.
Like every web server, our server necessarily processes the IP address of each request in order to answer it, and keeps it briefly in memory to limit abuse (rate limiting). It is not written to logs or to the database.
9. Health Connect (optional)
If you allow it in the app, Crimpway uses Android Health Connect:
| Access | Data types | Purpose |
|---|---|---|
| Write | Exercise sessions, heart rate | So your Crimpway training appears in your health and fitness apps. |
| Read | Weight, body fat, lean body mass, resting heart rate, heart rate variability (HRV), sleep | Bodyweight-relative targets, training-load and recovery estimates in the app. |
Health Connect data is used only to provide these training features. The app keeps what it reads as daily summaries in its own data on your device (body log: weight, body fat, lean mass; recovery: resting heart rate, HRV, sleep duration). These summaries leave your device only as part of a backup you choose: the optional encrypted backup on crimpway.com (section 6), so that you can restore them on a new phone, and Android’s own backup (section 7). We do not use Health Connect data for anything else: we do not share or sell it, do not use it for advertising, credit or insurance decisions, and no human reads it. You can revoke the permissions at any time in Health Connect’s settings.
The use of information received from Health Connect will adhere to the Health Connect Permissions policy, including the Limited Use requirements.
10. Support requests
When you contact us through the app or the website we store your email address, subject, message and, if provided, the app version and install ID, as well as our replies. We use them only to answer you. Closed requests are deleted after 2 years at the latest.
11. Website and cookies
crimpway.com uses no analytics, no advertising and no third-party resources (no external fonts or scripts). It only sets strictly necessary cookies: a security token for forms (CSRF), a session cookie when you sign in to “My account”, and a separate session cookie for administrators. No consent banner is needed for these.
12. Who receives data
We do not sell, rent or share your personal data, and we do not use third-party analytics or advertising SDKs. We use the following service providers (processors) who act only on our instructions:
- Contabo GmbH, Germany — server hosting.
- own mail server on the Contabo VPS (Germany) — sending account and support emails (SMTP).
Google acts as an independent provider for Google sign-in, Google Play, Health Connect, Wear OS sync and Android backup, under Google’s own terms. We may disclose data if required by law.
International transfers: our server is located in the European Union (Germany). If you use the service from outside the EU (for example from Latin America), your account and backup data are transferred to and stored in Germany, which offers a high level of protection under the GDPR.
13. Retention
| Data | Retention |
|---|---|
| Data on your devices | Until you delete it or uninstall the app. |
| Account | Until you delete it. Deletion is immediate and permanent. |
| Backups | The 10 newest per account until account deletion; older versions are deleted automatically. |
| Deleted accounts in server database backups | Overwritten within 30 days. |
| Email links (verification, reset, deletion) | 48 hours / 1 hour / 24 hours. |
| Anonymous usage statistics | 13 months. |
| Support requests | Up to 2 years after they are closed. |
14. Your rights
Depending on where you live — for example under the EU/UK GDPR, Brazil’s LGPD or Panama’s Law 81 of 2019 on personal data protection (ARCO rights) — you have the right to access your data, to rectify it, to have it deleted (cancellation), to object to or restrict processing, to data portability and to withdraw consent at any time without affecting earlier processing. You can do much of this yourself: export your data in the app (CSV/ZIP), switch off statistics, revoke Health Connect permissions, and delete your account in the app or at crimpway.com/delete-account. For anything else contact us at panamasismo@gmail.com or through the support form; we answer within one month (or the shorter period your law requires).
You also have the right to lodge a complaint with a data protection authority, for example the authority of your EU country of residence, Brazil’s ANPD or Panama’s Autoridad Nacional de Transparencia y Acceso a la Información (ANTAI).
Legal bases (GDPR): performance of a contract for the account and backup (Art. 6(1)(b)); our legitimate interests in improving the app with anonymous statistics and in keeping the service secure (Art. 6(1)(f)); your consent for Health Connect and other optional permissions (Art. 6(1)(a) and 9(2)(a)); legal obligations (Art. 6(1)(c)).
15. Children and young climbers
The service is not directed to children under 13, and we do not knowingly collect personal data from them. If you are under 16 (or under the age of digital consent in your country), please ask a parent or guardian before creating an account. For athletes under 16 the app offers a youth mode that trains without maximal loads. If you believe a child under 13 has given us personal data, contact us and we will delete it.
16. Changes
We will update this policy when the app or the law changes and show the date of the last update at the top. If changes are significant we will inform you in the app or by email.
17. Contact
Friedemann Ehlich · Calle Roberto Lewis, Edif. Crillon, Panama City, Republic of Panama · panamasismo@gmail.com · Support form