Privacy Policy

Who we are

KATS Passport (“KATS”, “we”, “us”) is a platform where climbers collect the gyms and crags they visit as a personal climbing passport. This policy explains what personal data we collect, why, and what rights you have over it.

The data controller is [LEGAL ENTITY / NAME — to be completed before launch], based in Spain. For any privacy question you can reach us at hello@katspassport.com.

What we collect

We only collect what we need to run the platform:

• Account data: your email address and a password (passwords are handled and encrypted by our authentication provider — we never see them in plain text).
• Profile data: your display name, username, country, bio and avatar — the things you choose to share on your profile.
• Climbing activity: your check-ins, visits, reviews and ratings, home gym, bucket list, and any spots you add.
• Content you upload: photos you attach to check-ins, spots or your avatar.
• Community data: crews you create or join, event participation, and chat messages you send inside crews.
• Approximate location: only if you actively use the "spots near me" feature. Your device location is used once to sort spots by distance and is not stored as a location history.
• Basic technical data: standard information your browser sends (such as device and general connection data) needed to serve the site securely.

What we do NOT do

• We do not sell your personal data.
• We do not use third-party advertising or ad-tracking.
• We do not run third-party analytics or tracking cookies at this time. If we add privacy-friendly analytics in the future, we will update this policy.
• We do not track your location in the background.

Why we use your data (legal bases)

Under the GDPR, we process your data on these bases:

• To provide the service (performance of a contract): creating your account, storing your passport, showing your activity.
• With your consent: optional features like accessing your device location for "spots near me", which you can decline.
• Our legitimate interest: keeping the platform safe, preventing abuse, and moderating reported content.
• Legal obligation: where we are required by law to retain or disclose certain information.

What's public vs private

KATS is partly a social platform, so some of what you create is visible to others by design:

• Public by default: your profile (name, username, country, bio, avatar), your stamps and reviews, your passport and community titles, and spots you add.
• You control: whether your whole profile is private, and whether your home gym is shown or hidden.
• Private to you: your email, your bucket list, and your account settings.
• Shared within a crew: messages you post in a crew chat are visible to that crew’s members.

Who processes your data for us

We rely on a small number of trusted providers who process data on our behalf, under their own security and data-protection commitments:

• Supabase — database and authentication. Our data is hosted in the European Union (Frankfurt, Germany).
• Vercel — hosting and serving of the website.
• Geoapify — converts addresses and coordinates for maps and the location search. Address text or coordinates are sent to their service only to perform a search.

These providers act as data processors and are not permitted to use your data for their own purposes.

International transfers

Your core data is stored within the EU. Some providers may process limited technical data outside the EU; where that happens, it is covered by appropriate safeguards such as the European Commission's Standard Contractual Clauses.

How long we keep it

We keep your data for as long as your account is active. If you delete your account, we delete or anonymise your personal data, except where we must keep something to comply with a legal obligation or to resolve disputes. Some content you shared publicly (such as a review) may persist in anonymised form.

Your rights

Under the GDPR you have the right to access, correct, delete, restrict or object to the processing of your data, and the right to data portability. You can exercise most of these directly from your account settings, or by contacting us at hello@katspassport.com. You also have the right to lodge a complaint with your local data protection authority (in Spain, the AEPD).

Children

KATS Passport is not intended for anyone under 16. We do not knowingly collect data from children under 16. If you believe a minor has created an account, contact us and we will remove it.

Cookies

We use only the essential cookies needed to keep you logged in and to keep the site secure. We do not use advertising or tracking cookies. Because we currently use only essential cookies, no cookie consent banner is required; if that changes, we will ask for your consent first.

Changes to this policy

We may update this policy as the platform evolves. When we make material changes, we will update the date at the top and, where appropriate, notify you.