Privacy

The controller of this data is Nitramix Ltd., Bulgaria, 208499938. Questions, access requests and deletion requests: support@outclimbed.com.

• Your email address, taken from the payment. It is how you sign in to your climbs and how we send receipts and sign-in links. Necessary to perform the contract.
• Your listing - name, link, tagline, icon, category, points and clicks. Public by design; that is the product.
• Visitor hashes. Visits and outbound clicks are recorded as a salted one-way hash of IP address and browser string. The IP itself is never written down and the hash cannot be turned back into one. Our legitimate interest in counting points honestly.
• A hash of the IP at signup, so a climb cannot quietly refer itself.
• If you add a directory - your email address, taken from the payment, to send the receipt and contact you about the listing; and the directory's name, website, type, link policy and description, which are public on the startup directories page.
• Payment records - amount, payment id, date - from Dodo Payments. Card details never reach us. Kept because tax law requires it.
• If you take Always on Today - the subscription's id and status, your customer id at Dodo Payments, the email it was bought with, the dates it was paid until and cancelled, and each monthly charge. We need them to add the daily point, stop it when the plan ends, and open your billing page. Necessary to perform the contract.

Points have to be honest: one point per person, once. That needs a way to recognise the same browser again, and nothing more. The click counter rotates its salt every day, so it cannot follow anyone across days at all. The referral hash is stable, because a point promised per unique person must not be earned again tomorrow by the same visitor.

Neither is stored next to an IP address or a browser string, and neither is shared.

To keep the points from share links honest, each visit through a share link also keeps a salted hash of the browser string (not the string itself) with a short description of it such as "Chrome on iOS", the country and city that its IP address points to, the site the click came from, and - sent by the page a few seconds after it opens - the time zone, language and screen size. The IP address itself is still not stored. Visits our own checks cannot settle may be shown to Claude, an AI model made by Anthropic, to help decide; it sees those visits alone, with no address, name or email.

We use Umami, self-hosted on our own infrastructure, to count page views and see which pages people arrive on. It sets no cookies, assigns no cross-site identifier, and does not follow anyone to other websites. It also records steps such as listing a product, opening a checkout or closing it, with the product's name and address as the wall would show them, never your email. After a purchase your browser keeps a note that it was counted, so a reload does not count it twice. If you arrived through a share link, your browser also keeps which one for 30 days, the same as the referral cookie below, so those steps say whose link brought them. While you are signed in, your visits are labelled with your first product's name and four characters of your account id, together with the names of your products, how many you have and whether one is on Always on Today, so we can see how owners use the site. Never your email. Signed out, nothing is labelled. Links to this site in our emails carry tags (utm_source, utm_campaign and so on) that say which email and which link a visit came from; they say nothing about who you are. Nothing it records is sent to an advertising network, and there is no Google Analytics, no ad pixel and no session recording on this site.

A session cookie when you sign in, and a referral cookie for 30 days if you arrive through someone's share link, so the referrer gets credit if you later buy a place. Arriving that way also sets a cookie for 10 minutes that lets the page report its time zone, language and screen size for that one visit (see above), and is then deleted. On a device where you open your dashboard, one more lists the codes of your own climbs, so that opening your own share link there earns nothing; it holds nothing else. All are needed for the service to work as described. No advertising cookies and no cross-site trackers, which is why there is no consent banner in your way.

Only the services that run the site, each seeing only what its job needs: Dodo Payments for payments as merchant of record (for Always on Today it also keeps the card on file that renews the plan, and runs the billing page you open from your dashboard), Supabase for the database and sign-in, Resend for email, Anthropic for the occasional review of suspicious share-link visits described above, Vercel for hosting and for our Umami instance. We do not sell data and we do not run ad networks. Some of these process data outside the EU under the safeguards in their own data processing terms.

To show a Domain Rating and a traffic rank, we send the domain names of listed sites and directories to Ahrefs and Tranco. That is not personal data and nothing about you goes with it. Product and directory icons are loaded by your browser from where they live: Google's favicon service, the product's own site, GitHub for a repository, or a link the owner chose. Whoever serves an image sees your IP address when your browser asks for it, like any other site. To pick a product's icon our server reads its public homepage and icon files once, the way a browser would.

A listing and its email stay while the climb is on the wall. Removing a climb takes it off the wall and out of public view immediately, but the record is kept behind the scenes: it is what stops a removed listing being used to claim points again, and it is tied to the payment records that tax rules make us keep. A directory listing and its email are kept the same way, for as long as the listing is on the page. Visitor hashes are kept only as long as the points they support. A copy of each email we send you is kept for 180 days, then only the record that it was sent; sign-in links are never kept. An Always on Today plan's record is kept with the payment records it belongs to, after the plan ends as well.

A free listing that is still neither paid for nor showing the outclimbed badge when its 30 free days end is removed from the wall, and we may delete it together with the email it was listed with. Nothing paid is attached to it, so nothing has to be kept.

If you want the record itself erased rather than hidden, email us and we will delete everything that is not legally required to stay.

You can ask us what is held against your address, correct it, get a copy of it, object to it, or have it deleted, and you can complain to a supervisory authority - in Bulgaria, the Commission for Personal Data Protection. Write to support@outclimbed.com and we will answer within a month.

Erasing your data removes your climbs from the wall for good. That is not reversible and it is not a refund - see the Terms.