This policy explains how Tacca processes personal data when you use the app and this website.
1. Contact
For questions about this policy or to exercise your rights, write to support@taccaclimb.com. Tacca has not appointed a data protection officer (DPO).
2. Data we process
- Account: email, technical authentication identifiers, the language of the sign-in codes we email you and, if you choose it, data from the Apple or Google provider.
- Profile: nickname, avatar, language, home gym, disciplines, experience level, weekly goals and leaderboard preferences.
- Sex: woman, man or “Prefer not to say”. It is used only to build the gym’s women’s and men’s leaderboards.
- Acceptance of the terms: the version of the Terms and community rules you accepted, with the date and time, recorded at sign-up to document your consent.
- Activity: sessions, attempts, grades, notes, workouts and derived statistics.
- Community: routes, photos, reports and blocks you submit.
- Location: used, with your permission, to find nearby gyms; your precise location is not stored in your profile.
- Notifications: rest-over alerts are local notifications created by your device. We do not collect push notification identifiers.
- Technical data: the minimum needed for security, sync and troubleshooting.
- This website: when you visit it, the hosting provider receives technical request data, such as your IP address and browser type, to deliver the pages and protect them. The site does not use cookies.
3. Why we use it
We process data to create and protect your account, sync your journal, show progress and optional leaderboards, find gyms, moderate content and answer support requests. The legal bases are performance of the service you asked for, consent where required, and our legitimate interest in the security and integrity of the community.
We do not use your data for advertising, profiling or behavioural analytics, and we do not sell it. The app and the website contain no analytics, tracking or automatic crash-reporting tools. If you allowed it in iOS settings, Apple may share anonymous crash reports for the app with us.
4. Service providers
Tacca uses Supabase for authentication, database and storage, with data hosted in the European Union (Frankfurt, Germany); Google Maps/Places to search for gyms; Google Cloud Vision for automatic photo checks; Resend to deliver email codes; Vercel to host this website; Apple or Google for federated sign-in when enabled. Each provider processes only the data needed for its service.
5. Sharing and leaderboards
Your nickname, avatar and results can be seen by other users in leaderboards only if the option is on. Routes and photos published in the gym’s catalogue are shared content. You can turn leaderboards off, report content and block other users in the app.
6. Retention
- Account, profile and journal: as long as your account is active. When you delete it, they are removed from the database straight away; daily backup copies are overwritten within 7 days.
- Technical service logs: up to 7 days.
- Content reports: 12 months after the report is closed.
- Support requests by email: 24 months after the last message.
We may keep data longer only where the law requires it or to defend a right in an ongoing dispute.
7. Deletion and your rights
You can delete your account from Tacca’s Settings. Your profile, private data and photos are removed; references needed to keep other users’ journals consistent may remain in a form that no longer identifies you. See the account deletion page.
You can ask for access, rectification, erasure, portability, restriction or objection by writing to support@taccaclimb.com. We reply within one month. You can also lodge a complaint with the supervisory authority of the country where you live; in Italy it is the Garante per la protezione dei dati personali.
8. Transfers and security
App data is hosted in the European Union. Google, Resend and Vercel may process some data in the United States: in those cases the transfer relies on the EU-U.S. Data Privacy Framework or on the standard contractual clauses approved by the European Commission. We use access controls, encryption in transit and separation of privileges, but no system is free of risk.
9. Children
You must be at least 14 years old to use Tacca. If we learn that an account belongs to someone younger, we delete it together with its data.
10. Updates
We may update this policy. We will show the date of the latest change and, where needed, let you know in the app.