Privacy

The controller of this data is Nitramix Ltd., Bulgaria, 208499938. Questions, access requests and deletion requests: support@outclimbed.com.

• Your email address, taken from the payment. It is how you sign in to your climbs and how we send receipts and sign-in links. Necessary to perform the contract.
• Your listing - name, link, tagline, icon, category, points and clicks. Public by design; that is the product.
• Visitor hashes. Visits and outbound clicks are recorded as a salted one-way hash of IP address and browser string. The IP itself is never written down and the hash cannot be turned back into one. Our legitimate interest in counting points honestly.
• A hash of the IP at signup, so a climb cannot quietly refer itself.
• Payment records - amount, payment id, date - from Dodo Payments. Card details never reach us. Kept because tax law requires it.

Points have to be honest: one point per person, once. That needs a way to recognise the same browser again, and nothing more. The click counter rotates its salt every day, so it cannot follow anyone across days at all. The referral hash is stable, because a point promised per unique person must not be earned again tomorrow by the same visitor.

Neither is stored next to an IP address or a browser string, and neither is shared.

We use Umami, self-hosted on our own infrastructure, to count page views and see which pages people arrive on. It sets no cookies, assigns no cross-site identifier, and does not follow anyone to other websites. Nothing it records is sent to an advertising network, and there is no Google Analytics, no ad pixel and no session recording on this site.

A session cookie when you sign in, and a referral cookie for 30 days if you arrive through someone's share link, so the referrer gets credit if you later buy a place. Both are needed for the service to work as described. No advertising cookies and no cross-site trackers, which is why there is no consent banner in your way.

Only the services that run the site, each seeing only what its job needs: Dodo Payments for payments as merchant of record, Supabase for the database and sign-in, Resend for email, Vercel for hosting and for our Umami instance. We do not sell data and we do not run ad networks. Some of these process data outside the EU under the safeguards in their own data processing terms.

A listing and its email stay while the climb is on the wall. Removing a climb takes it off the wall and out of public view immediately, but the record is kept behind the scenes: it is what stops a removed listing being used to claim points again, and it is tied to the payment records that tax rules make us keep. Visitor hashes are kept only as long as the points they support.

If you want the record itself erased rather than hidden, email us and we will delete everything that is not legally required to stay.

You can ask us what is held against your address, correct it, get a copy of it, object to it, or have it deleted, and you can complain to a supervisory authority - in Bulgaria, the Commission for Personal Data Protection. Write to support@outclimbed.com and we will answer within a month.

Erasing your data removes your climbs from the wall for good. That is not reversible and it is not a refund - see the Terms.