Privacy policy

In short

• We store only what the logbook needs: your account, your gyms and their colours, your sessions with attempts and tops, your projects.
• Only your account sees your logbook. There is no feed and no leaderboard.
• No tracking or ad services, only cookies the site needs to work.
• We store heart rate or other health values only with your explicit consent. We do not ask for it at the moment, so we store none.
• You can export your logbook as CSV and delete your account with all data at any time.

Controller

Philipp Winkler, sole proprietor
Burghof 1
24939 Flensburg
Germany
Email: [email protected]

We are not required to appoint a data protection officer (§ 38 BDSG: fewer than 20 people are regularly engaged in automated processing of personal data).

Hosting and server logs

Cruxbook runs on servers of Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, in Germany, under a data processing agreement (Art. 28 GDPR).

In front of the server sits Cloudflare (Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA; in the EU Cloudflare Germany GmbH) as DNS service, content delivery network and protection against attacks. All requests therefore pass through Cloudflare, which processes your IP address and the technical connection data on our behalf (Art. 28 GDPR). Legal basis: Art. 6(1)(f) GDPR (secure and fast operation). The transfer to the USA relies on the EU-US Data Privacy Framework (adequacy decision of the EU Commission) or, where the provider is not certified for it, on standard contractual clauses under Art. 46 GDPR.

For every request the server processes connection data: IP address, time, requested address, browser and operating system. We need it to deliver the site and to detect attacks (Art. 6(1)(f) GDPR). Logs are deleted after 14 days.

Your account

For an account we store your email address and your password, only as an encrypted hash. We need both to sign you in and, for example, to send you a password reset link (Art. 6(1)(b) GDPR).

Data from your watch

The watch is optional. When you pair one with your account, we store an access token for that device plus its model, platform and app version. After each session the watch sends it to us: start, end and duration, gym and circuit, and for every boulder its colour or grade, attempts and tops with their time. That becomes the session in your logbook (Art. 6(1)(b) GDPR). Cruxbook does not need a GPS position.

Health data: some watches send heart rate or calories. That is health data (Art. 9 GDPR). We drop it on arrival unless you have given explicit consent (Art. 9(2)(a) GDPR). Cruxbook does not ask for this consent at the moment, so we store no health data. If that changes, we ask you first, and you can withdraw consent at any time.

You see and remove paired watches under "Watches".

Gyms, sessions and projects

What you enter on the web or your phone is stored for your logbook (Art. 6(1)(b) GDPR): your gyms with name and colour or grade system, circuits, sessions with start and end, every boulder with attempts, top and flash, and your projects. Nobody but you sees them. We do not sell data and do not build leaderboards from it.

A link with LiftSync is announced but not built yet; no data goes to LiftSync today. Before that changes, we update this policy and ask you.

Email (Resend)

Account emails such as password resets are sent through Resend (Resend, Inc., USA). Resend receives your email address and the content of the message and processes both on our behalf (Art. 28 GDPR). The transfer to the USA relies on the EU-US Data Privacy Framework (adequacy decision of the EU Commission) or, where the provider is not certified for it, on standard contractual clauses under Art. 46 GDPR. Legal basis: Art. 6(1)(b) GDPR.

Premium and payments (App Store, Google Play, RevenueCat, Stripe)

You buy Premium in the browser through Stripe; in the app the purchase goes through the store. In detail: in the browser we send you to the Stripe checkout (Stripe Payments Europe, Ltd., Ireland). Stripe processes your payment details itself, and you manage your subscription there in the customer portal. We pass Stripe your email address and an identifier of your account; we only learn what you bought and whether the payment went through. In the app you buy through Apple's App Store or Google Play. Apple or Google handle the purchase under their own responsibility; we never see your payment details. We match purchases to your account through RevenueCat (RevenueCat, Inc., USA), which receives a pseudonymous account ID and the store receipts. RevenueCat and Stripe work on our behalf to that extent (Art. 28 GDPR). The transfer to the USA relies on the EU-US Data Privacy Framework (adequacy decision of the EU Commission) or, where the provider is not certified for it, on standard contractual clauses under Art. 46 GDPR.

Legal basis: Art. 6(1)(b) GDPR, and Art. 6(1)(c) GDPR for invoices and records we must keep.

Merch shop (Printful, shipping carriers)

If you order from the merch shop, we process your order: the items ordered, your name, your delivery address, your e-mail address for the order confirmation and the payment status (Art. 6(1)(b) GDPR). Payment goes through Stripe (Stripe Payments Europe, Ltd., Ireland, see the section on payments); we never see your payment details.

The items are produced and shipped by Printful (Printful Latvia AS, Riga, Latvia, EU). To fulfil the order we pass your name, your delivery address and the items ordered on to Printful (Art. 6(1)(b) GDPR). Printful hands the parcels to shipping carriers and passes them your name and delivery address for delivery; we ourselves send nothing to carriers. We keep invoice and order data for as long as statutory retention duties require (Art. 6(1)(c) GDPR).

Cookies

Cruxbook sets only cookies the site needs to work: one for your sign-in, one for "remember me" if you tick it, one against forged forms and one for your language. These need no consent (§ 25(2) no. 2 TDDDG), which is why there is no cookie banner. We use no analytics, advertising or tracking services. Fonts are served by us, not by Google Fonts or another CDN.

Blog and partner links

In the blog we link to products on Amazon. These are partner links from the Amazon Associates programme (Amazon EU S.à r.l., Luxembourg): if you buy something after clicking, we receive a commission, and it costs you nothing extra. Cruxbook sets no cookies for this and passes no data to Amazon unless you click such a link. By clicking you leave Cruxbook; from then on Amazon's privacy notice applies, and Amazon learns through the partner ID in the link that you came from us (Art. 6(1)(f) GDPR, our interest in funding the service).

Retention, export and deletion

We keep your data as long as you have an account. You can export your logbook as CSV at any time (Art. 20 GDPR), also without Premium. Under Account you delete your account; all gyms, sessions, boulders, projects and paired watches are deleted at once. Backups drop the data after 30 days. Records we must keep for tax reasons are kept until the statutory period ends.

Your rights

You have the right of access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and to object to processing based on legitimate interests (Art. 21 GDPR). You can withdraw consent at any time for the future. Write to [email protected].

Right to complain

You can complain to a data protection authority, for example in your country or the one responsible for us: the Unabhängiges Landeszentrum für Datenschutz Schleswig-Holstein (ULD), Holstenstraße 98, 24103 Kiel, Germany.

Changes

When what Cruxbook processes changes, we update this page and the date below.