Privacy Policy

CragReport is an independent project run by Riley Tavasso. Contact: cragreport@gmail.com.

We only collect what we need to run the service.

Account data

• OAuth identity — when you sign in with Google, GitHub, or Apple, we receive your unique provider ID, name, and email. We store only an identifier derived from the provider ID; we do not persist your email address in our database except as needed to send alert emails you have explicitly enabled.
• Username — a display name (auto-generated or chosen by you) attached to community condition reports.
• Favorites, alerts, preferences — climbing areas you save and notification thresholds you configure.

Location

• When you allow location access, your approximate coordinates are sent to our servers only to find nearby crags for that request. We do not store your location history.

Condition reports

• Reports you submit (conditions, friction, optional photo, optional note) are attached to your username and are visible to other users.

Push notifications (mobile)

• When you enable push, we store the device push token issued by Apple (APNs) or Google (FCM) so we can deliver condition alerts.

Technical & analytics

• Server logs — request paths, response codes, and a hashed IP for abuse-prevention rate-limiting. Raw IPs are not retained.
• Product analytics — we use PostHog (self-hosted in the United States) to capture page views and feature events. Events are linked to your account if you are signed in, and to an anonymous device ID otherwise. We do not use third-party advertising trackers.

• To compute and display climbing-condition forecasts.
• To save your favorites, alerts, and preferences across devices.
• To send the condition alerts you have explicitly subscribed to.
• To understand which features are used and to fix bugs (analytics + crash diagnostics).
• To prevent abuse (rate-limit by hashed IP and account).

We do not sell your data, and we do not use it for advertising or for cross-application tracking.

We only share data with the providers needed to run the service:

• Google, GitHub, Apple — only as part of the OAuth sign-in flow you initiate.
• Render — application hosting, PostgreSQL, and Redis (United States).
• PostHog — product analytics.
• Resend — sending the condition alert emails you have subscribed to.
• Apple APNs / Google FCM — delivering mobile push notifications.
• Open-Meteo, NOAA MRMS — weather data sources. Only crag coordinates are sent; no user identity is shared.

Your username and any condition reports you submit are visible to other users of CragReport. Treat anything you submit as public. Photos attached to reports are stored on our servers and shown publicly.

• Edit your username at any time on the profile page.
• Delete your account. You can permanently delete your account and everything associated with it (favorites, alerts, reports, photos, push tokens, preferences) from the in-app Settings screen on mobile, or the Danger Zone section of the web profile page. Deletion is immediate and irreversible.
• Disable push or email alerts any time from in-app settings.
• Disable location access at the OS level (iOS/Android Settings) or in your browser. CragReport still works without location.
• Disable analytics. Set the environment variable NEXT_PUBLIC_DISABLE_ANALYTICS=1 for self-hosted users, or block the PostHog domain via a privacy extension.
• Request a data export. Email us at cragreport@gmail.com and we will send you a copy of the data we have on your account.

• Account data is retained until you delete your account.
• Condition reports are retained for the life of the service (community history) unless you delete them or your account.
• Server logs and aggregated analytics are retained for up to 12 months for debugging and abuse prevention.

Connections to CragReport are encrypted with HTTPS. Authentication tokens are stored in iOS Keychain / Android Keystore on mobile, and in HttpOnly cookies on the web. Sensitive secrets (database credentials, OAuth client secrets) are stored only on our hosting provider and are never sent to your device.

CragReport is not directed to children under 13, and we do not knowingly collect data from anyone under 13. If you believe a child has provided us data, email cragreport@gmail.com and we will delete it.

CragReport servers are located in the United States. By using the service from outside the U.S. you consent to the transfer of your data to the United States.

If we make material changes we will update the “Last updated” date at the top of this page and, where appropriate, surface a notice in the app. Continued use of CragReport after changes constitutes acceptance.

Questions, data requests, or concerns: cragreport@gmail.com.