Climbwise is a private learning app. I run it myself, for me and a few people I have invited. This page says which data is collected, on this website climbwise.ch and in the app at app.climbwise.ch, where the data is kept, who sees it and how you can have it deleted.
In short
- This website stores nothing about you: no cookies, no trackers, no form.
- The app's data is kept on a small server in my home in Switzerland, not in a cloud.
- The way to the app goes through Cloudflare, a company in the USA. That is where you sign in: with a code Cloudflare emails you, or with your Google account. From Google, the app uses only your email address.
- No ads, no ad trackers. I do not sell your data. It goes on only to Cloudflare for signing in and the transport and, in confidence, to service providers who help me analyze it.
- An email to me is enough: you learn what is stored, or I delete your data.
Who is responsible
I am responsible for the website, the app and your data:
Dominic Langeneggerdominic@langenegger.email
Write to this address with questions, to see your data or to have it deleted.
This website
The pages at climbwise.ch are fixed files, with no programs or fonts from other servers. They set no cookies, store nothing on your device, count no visits and have no form.
They are hosted on Cloudflare Pages (Cloudflare, Inc., USA). When you open a page, Cloudflare sees your IP address, the address requested and your browser, as with any website, and keeps its own logs, for example to fend off attacks. I have not turned on any visitor statistics.
Signing in to the app
In front of the app is the sign-in at Cloudflare (Cloudflare Access). Only invited email addresses get further. You have two ways:
- Code by email: you enter your email address and get a one-time code from Cloudflare at that address.
- With Google: you sign in at Google. Google learns that you are signing in to Climbwise and gives Cloudflare your name, email address and profile picture. The app gets only your email address from Cloudflare and uses it to check that you are invited; it neither uses nor stores your name or profile picture. Your Google account falls under Google's privacy policy.
Cloudflare logs your email address, the time, IP address and browser of each sign-in (I can see these logs) and sets a sign-in cookie valid for 30 days. The app has no password or passkey of its own.
What the app stores
To sign you in
- at Cloudflare: your email address on the list of invited people and the log of your sign-ins (see above);
- in the app: your email address as the name of your account.
For learning
- your progress: trails learned, your answers, the review schedule, goals and settings;
- learning events: which page or question you worked on, with the result and the active time;
- feedback you send me about a page or a question.
While it runs
- server logs with the time, IP address, the address requested, the browser and your email address, to find errors and for security.
On your device
- a copy of the app, so it starts without a network, your settings, a copy of your learning progress and answers that have not reached the server yet. After you sign out, the copy stays on the device until you delete the website data;
- Cloudflare's sign-in cookie.
Why
So that you can learn and your progress is the same on all your devices. I also analyze usage data and feedback, per person too, to improve the app and its content, for example which learning pages and questions are hard. For this I may share them in confidence with service providers who help me analyze and interpret them. No automated decisions are made about you.
Where the data is kept
On «leto», a small server in my home in Switzerland. A backup copy is kept there every night too. Only I have access to this server.
The way through Cloudflare
The app is reached through Cloudflare (Cloudflare, Inc., USA). The encrypted connection from your device ends at Cloudflare; there it is decrypted and passed on to leto through a separate encrypted connection. While the data travels, Cloudflare therefore sees your IP address, the addresses requested and the content of the requests, and keeps its own logs, for example to fend off attacks. Cloudflare is set up to cache nothing of the app. It may set its own cookies, for example to detect bots.
The data may pass through data centers in several countries. For companies in the USA certified under the Swiss-U.S. Data Privacy Framework, data protection is considered adequate under Swiss law (Data Protection Ordinance, Annex 1); Cloudflare states that it is certified. More in Cloudflare's privacy policy.
The former sign-in
Until the switch to the sign-in at Cloudflare, the app had a sign-in system of its own with a username, password and passkeys. Its data (usernames, passwords only as check values, the passkeys' public keys, sign-in attempts with time and IP address) is backed up once when it is switched off, and I delete that backup 30 days later.
How long
- Sign-in at Cloudflare: after 30 days Cloudflare asks for the code or Google again; your email address stays on the list until you have it deleted.
- Learning data and account: until you have them deleted or I shut the app down.
- Backups: one every night; the last 14 are kept, older ones are deleted.
- Logs: older entries are overwritten continuously once a log reaches a fixed size.
- Data of the former sign-in: 30 days after it is switched off.
- This website: stores nothing; Cloudflare's logs fall under its privacy policy.
Access and deletion
At any time you can learn which data the app stores about you, have errors corrected and have everything deleted. Send me an email. I then delete your account and all your learning data on leto, and take your email address off the list at Cloudflare. What does not disappear at once: it stays in the backups until 14 new nightly copies have been made; the server logs are overwritten bit by bit; extracts for analysis that I keep are deleted with it; summarized results that no longer reveal anything about you stay; Cloudflare's logs fall under its privacy policy.
What is on your device you delete yourself: in your browser's settings, delete the website data of app.climbwise.ch or remove the app from the home screen. If you signed in with Google, you can remove the connection to Climbwise in your Google account.
If you feel I am not handling your data properly, you can contact the Federal Data Protection and Information Commissioner (FDPIC).
The German version is the original. If anything changes, I update this page; the date at the top shows when it was last changed.