Privacy Policy

1Who is responsible for your data

The data controller is MountyApp, based in Spain. Contact: support@mountyapp.com. We process data under the EU General Data Protection Regulation (GDPR) and the Spanish Organic Law 3/2018 (LOPDGDD).

2What we collect and why

Account

• Email address and sign-in identifier from Sign in with Apple or Google Sign-In. Used to create and secure your account. If you choose Apple’s “Hide My Email”, we only receive the relay address.
• Display name and avatar style you choose. Used to identify you to other climbers.
• Account creation date.

Legal basis: performance of the contract (providing the app you signed up for).

Health and activity data

• With your permission, Mounty reads the “Flights Climbed” data from Apple Health. It never writes to Apple Health and reads no other health type.
• From those flights we compute metres climbed (1 floor = 3 m) and store derived values on our servers: total height, progress on each mountain, the dates you summited, your daily streak, today’s metres and challenge progress.

Activity data may be considered health data. We process it only with your explicit consent, which you give by granting Apple Health access and can withdraw at any time in iOS Settings → Health → Data Access & Devices → Mounty. Health data is never used for advertising, sold, or shared with data brokers.

Phone number and contacts (optional)

• Phone number: if you add one, it is stored privately on your account and is never shown to other users. Its only use is letting people who already have your number in their contacts find you on Mounty. You can turn this off (“Let contacts find me”) or delete the number at any time in Settings.
• Your contacts: if you allow contact access, each phone number is normalised and converted on your device into an irreversible SHA-256 hash. Only those hashes are sent to our server to check which ones belong to Mounty users; they are not stored. Names and raw numbers of your contacts never leave your device.

Legal basis: your consent.

Social features

• Who you follow and who follows you, likes and comments on activity posts, group challenges you create or join (including join requests and invitations), friend-streak invitations and in-app notifications.

Legal basis: performance of the contract.

Notifications and Live Activities

• Push notification tokens, your device time zone and Live Activity tokens, so we can send reminders, challenge updates and the evening streak countdown at the right local time.

Legal basis: your consent (you can disable notifications in iOS Settings at any time).

Purchases

• When you buy coins or a subscription, Apple processes the payment. We receive the transaction identifier, product and date to credit your purchase. We never receive your card or payment details.

Legal basis: performance of the contract and compliance with legal (tax and consumer) obligations.

App analytics, crashes and performance

• Through Firebase Analytics we record usage events such as sign-up, log-in, starting a climb, reaching a summit, unlocking a mountain and streak events, together with device and app information (model, iOS version, app version, approximate country).
• Through Firebase Crashlytics and Performance Monitoring we collect crash reports and technical performance data.

We use this only to understand how the app is used, fix bugs and improve it. We do not use advertising identifiers (IDFA), we do not track you across other companies’ apps or websites, and we show no ads. Legal basis: our legitimate interest in keeping the app working and improving it.

3What other users can see

Any signed-in Mounty user can see your public profile: display name, avatar, XP, total height climbed, current and best streak, follower/following counts and when you joined. Participants in a challenge with you see your progress in it. Your comments and likes are visible to people who can see the post. Your email, phone number and raw health data are never visible to other users.

4Who processes data for us

• Google (Firebase) — authentication, database, cloud functions, push notifications, analytics, crash reporting and performance. Our main database is hosted in the European Union (Firebase multi-region eur3).
• Apple — Sign in with Apple, Apple Health, push notification delivery and App Store payments.
• Google Sign-In — if you choose to sign in with Google.

Some of these providers may process data outside the European Economic Area, notably in the United States. Those transfers are covered by the EU–US Data Privacy Framework and/or the European Commission’s Standard Contractual Clauses. We do not sell your personal data to anyone.

5How long we keep it

• Account, activity and social data: while your account exists. When you delete your account, it is erased from our systems (see below).
• Purchase records: kept after account deletion for as long as tax and consumer law requires (generally up to 6 years in Spain), only to handle refunds, disputes and audits.
• Analytics data: up to 14 months. Crash reports: up to 90 days.
• Backups: deleted data may remain in encrypted backups for a short period before being overwritten.

6Deleting your account

You can delete your account at any time in the app: Settings → Delete account. This permanently removes your profile, activity, progress, phone number, social connections, comments, likes, notifications and the challenges you created, and deletes your login. If you signed in with Apple, we also revoke Mounty’s access to your Apple ID. You can also ask us to do it by email.

7Your rights

You have the right to access, rectify and erase your data, to restrict or object to its processing, to data portability, and to withdraw any consent at any time without affecting earlier processing. To exercise them, write to support@mountyapp.com from the email linked to your account; we answer within one month. You can also lodge a complaint with the Spanish Data Protection Agency (www.aepd.es).

8Minimum age

Mounty is intended for people aged 14 or older. We do not knowingly collect data from younger children. If you believe a child under 14 has created an account, contact us and we will delete it.

9Security

Data is encrypted in transit (HTTPS/TLS) and at rest by our providers. Access is restricted by database security rules: your private data (email, phone number, raw progress) can only be read by you and by our server code.

10Changes to this policy

If we make material changes, we will update the date above and let you know in the app before they apply.