Privacy Policy — KalyKala Climbers

This Privacy Policy explains how KalyKala collects, uses, and protects your information when you use the KalyKala Climbers mobile app. The app is operated by KalyKala LLC (“KalyKala”, “we”, “us”, “our”), a limited liability company organised under the laws of the State of New Mexico, United States, at 1209 Mountain Road Pl NE, Ste N, Albuquerque, NM 87110, United States. KalyKala LLC is the data controller for the data described here, and hello@kalykala.com is the contact point for every data question or request. Because the app is offered to people in the European Union and the United Kingdom, the GDPR and UK GDPR apply to their data. We apply this policy to everyone who uses the app, wherever you are.

Information We Collect

- Your Google account name and email address (via Google sign-in) - The profile information you provide in the app: first name, profile photo, climbing area and zones, trip dates, languages, climbing and belay comfort, gear, transport, and a short note - Your estimated weight, if you choose to provide it — see “Profile Visibility” below for exactly how it is handled - Photos you upload to your climbing profile - Messages you send to matched users - Your swipes, matches, and any blocks or reports you file - Climbing areas you request or ask to be notified about, and any optional notes you add about an area - A push notification token for your device, and whether the app is open (so we don’t send you notifications for things you’re already looking at) - A record of the Terms version you accepted and when - Feedback you send us and, if a photo upload fails, basic device details (manufacturer, model, OS version, app version, and the error) so we can fix the problem The app does not collect your device location, and it contains no analytics or advertising trackers.

How We Use Information

- To show your profile to other climbers in your chosen climbing area whose trip dates overlap with yours - To match you with compatible climbing partners - To enable messaging between matched users - To send push notifications about matches and messages, and to notify you when a climbing area you asked for goes live (by push and email) - To act on blocks, reports, and feedback - To provide and improve the KalyKala service

Why We Are Allowed to Hold It (Lawful Bases)

- Your profile, matches, messages, and push token: performance of our agreement with you — they are what the app is for. - Optional fields you choose to add (like estimated weight): consent — you can leave them empty or remove them at any time. - Blocks, reports, feedback, and upload-failure diagnostics: legitimate interests — keeping the service safe and working. - You can object to anything based on legitimate interests by emailing hello@kalykala.com.

Profile Visibility

Your profile (name, photo, climbing details, and trip dates) is visible to other signed-in climbers in your climbing area. Profile photos are served from our storage provider via a public link so the app can display them; anyone with that link can view the photo. Your email address is never shared with other users. Your estimated weight is never displayed to other users — it does not appear on your card or profile. It is, however, processed by the app on a matched or browsing user’s device to compute the belay-compatibility indicator; like the rest of your profile record, it is technically readable by other signed-in users’ apps. If you are not comfortable with that, leave the weight field empty — matching works without it.

Data Storage and International Transfers

Your data is stored on Supabase servers located in the European Union (Frankfurt, Germany), and the app also keeps an offline copy of your matches and chats on your device so they stay readable without signal; this copy is removed when you sign out. Some processing does happen in the United States: KalyKala LLC itself is established there, Supabase is a US company (even though the servers holding your data are in the EU), and push notifications and emails are delivered through US providers (Expo, Google, and Resend). Where the data of EU or UK users is transferred to the United States, the transfers rely on the safeguards available under EU law — such as the European Commission’s Standard Contractual Clauses and, where a provider is certified, the EU–US Data Privacy Framework. Ask us at hello@kalykala.com which safeguard applies to a particular provider. We do not sell your data to third parties.

How Long We Keep Things

- Your profile, photos, matches, messages, and the rest of your account data are kept while your account exists. - When you delete your account, everything listed in “Your Rights” below is deleted from our live systems immediately. - Backups: we keep periodic database backups for disaster recovery. Residual copies of deleted data can persist in those backups for up to about 60 days before the backups themselves are rotated out. Backups are not used for any other purpose.

Your Rights (GDPR)

You can, at any time: - See your data — in the app, or ask us for a copy (Edit Profile → Download my data gives you a full export); - Correct anything — edit your profile whenever you like; - Delete your account and data — Edit Profile → Delete Account permanently removes your profile, photos, matches, messages, likes, push tokens, blocks, reports, feedback, area requests and interests (including any area notes), email preferences, and account; - Withdraw consent — where we process data because you consented (like the optional estimated weight), you can withdraw that consent at any time by removing the data in the app; withdrawing does not affect processing that happened before; - Object to processing based on legitimate interests, or ask us to restrict processing; - Take your data elsewhere (the JSON export above is a portable copy); - Complain to a supervisory authority — if you are in the EU or the UK, the data protection authority where you live, work, or where the problem happened. For anything you can’t do in the app, email hello@kalykala.com; we respond within one month, as the GDPR requires.

Third-Party Services

- Google OAuth (sign-in) - Supabase (database and storage) - Expo and Google Firebase Cloud Messaging (push notification delivery — notification content, such as a message preview, passes through these services) - Resend (email delivery for area-launch notifications)

Email We Send

We email you only when a climbing area you asked about goes live, and for messages strictly about your account. Area-launch emails may include short news about KalyKala’s own related services; every such email has an unsubscribe link, and unsubscribing stops them without affecting your account.

Children

The app is not directed at children. You must be at least 18 years old to use it (see our Terms of Service), and we do not knowingly collect personal data from anyone under 18. If you believe a child has provided us personal data, contact hello@kalykala.com and we will delete it.

Changes to This Policy

We may update this policy from time to time. When we do, we will update the text here and at kalykala.com/climbers/privacy and change the “Last updated” date. If we make material changes, we will take reasonable steps to notify you in the app — for example, by asking you to review and accept the updated policy before you continue.

Contact

For any privacy-related question or request: hello@kalykala.com, or by post to KalyKala LLC, 1209 Mountain Road Pl NE, Ste N, Albuquerque, NM 87110, United States.