Privacy Policy

This Privacy Policy explains how CragSocial (“Crag Social,” “we,” “us”) collects, uses, and shares personal information when you use our website, dashboard, and the public 3D viewer at cragsocial.com and its gym subdomains (the “Service”). Questions? Contact us at privacy@cragsocial.com.

Information we collect

• Account information. When you create an account we collect your email address. Authentication and passwords are handled by our provider (Supabase); we never receive or store your password.
• Gym & organization details. Information you enter to set up a gym — organization name, gym name, subdomain, contact email, and website.
• Waitlist information. If you join our waitlist we collect your email and, optionally, a gym name.
• Uploaded content. The videos you upload and the frames and 3D models we derive from them, plus problem metadata you add — including setter names and links (e.g. Instagram) that you choose to publish.
• Usage analytics. Once enabled, aggregate, non-identifying information about how the Service is used (such as pages viewed, referrer, and device/browser type), collected without cookies and without storing your IP address.
• Payment information. If you subscribe, payments are processed by Stripe. We receive limited billing details (such as plan, status, and the last four digits of a card) but never full card numbers.
• Technical & error data. To keep the Service reliable we collect error reports and diagnostic data (which may include IP address and the email of a signed-in user) via Sentry.

How we use information

• To provide, operate, and improve the Service and reconstruct 3D models from your videos.
• To create and secure your account and communicate with you about the Service.
• To process subscriptions and payments.
• To understand usage, diagnose problems, and prevent abuse.
• To comply with legal obligations and enforce our Terms.

Automated screening of uploads

To keep reconstructions clean — and to respect the privacy of anyone nearby — uploaded videos should capture only the wall and holds, not people or other moving subjects. We may automatically scan uploads to detect the apparent presence of people and reject those that appear to contain them. This screening is best-effort and is not guaranteed to catch every case; you remain responsible for what you upload (see our Terms).

Publicly displayed content

Reconstructed 3D models, section names, problem details, setter names, and any links you add are shown publicly on your gym’s viewer (e.g. yourgym.cragsocial.com) to anyone with the link. Do not publish information about a person that they have not agreed to make public.

How we share information — sub-processors

We do not sell your personal information. We share it with service providers that process it on our behalf:

• Supabase — authentication and database.
• Cloudflare — hosting, content delivery, and object storage (R2) for videos, frames, and models.
• Fly.io — backend application hosting.
• Modal — compute for frame extraction and 3D reconstruction.
• Resend — transactional email.
• Sentry — error monitoring.
• Stripe — payment processing (once billing is enabled).
• Plausible Analytics — privacy-friendly, cookieless usage analytics (once enabled).

We may also disclose information to comply with law or to protect our rights, users, or the public.

Data retention

We keep personal information for as long as your account is active and as needed to provide the Service. After your account is closed, we delete or anonymize your personal information within 90 days, except where a longer period is required by law.

Your rights & choices

Depending on where you live, you may have the right to access, correct, delete, or receive a copy of your personal information, and to opt out of certain processing. California residents have rights under the CCPA/CPRA — including the right to know what personal information we collect, to request access to or deletion of it, to correct it, and not to be discriminated against for exercising these rights. We do not sell or share your personal information as those terms are defined under the CCPA/CPRA. To exercise any of these rights, contact privacy@cragsocial.com.

Cookies

We use cookies and similar technologies as described in our Cookie Policy.

Security

We use reasonable technical and organizational measures to protect personal information. No method of transmission or storage is completely secure, so we cannot guarantee absolute security.

Children

The Service is not directed to anyone under 18 and is intended for gym operators and adult users. We do not knowingly collect personal information from anyone under 18.

Changes

We may update this policy from time to time. Material changes will be posted here with a new “last updated” date.

Contact

CragSocial. Email: privacy@cragsocial.com.