Privacy Policy

1. Information we collect

Account information. Name, email address, and sign-in credentials (authentication is handled by Google Firebase). Instructors may add business details such as a business name, certificate information, rates, and website content.

Training records. Lesson debriefs, grades, logbook entries, endorsements, syllabi, and progress data that instructors and students create in the service.

Booking and invoicing records. Scheduling requests, availability, and invoice records instructors create. Public booking pages collect the name and contact details a requester submits.

Contact channels. A phone number, if you enable SMS notifications; your email address for email notifications.

Usage data. Log and device information generated by operating the service (such as timestamps and error logs), including sign-in device characteristics and approximate sign-in location, which we use to secure accounts and detect credential sharing.

2. How we use information

We use information to provide and operate the service: maintaining training records, computing advisory progress views, delivering notifications you enable, processing subscriptions, providing support, and keeping the service secure and reliable. We do not use your content for advertising.

3. How information is shared inside climbrate

climbrate is built around the instructor–student relationship. Your instructor can see the training records connected to your training with them; a student can see their own records, shared read-only. Endorsement record content is restricted by default to the signing instructor and the receiving student. Instructors control what appears on their public website and booking pages.

4. Sharing with third parties

We share information only with the service providers needed to run climbrate — such as Amazon Web Services (hosting and data storage), Google Firebase (authentication), Vercel (web hosting), and, when subscription billing launches, a payment processor — each bound to use it only to provide their service to us. We may disclose information if required by law. We do not sell your personal information.

Phone numbers collected for SMS notifications, and SMS consent status, are never shared with third parties or affiliates for marketing or promotional purposes.

5. Aggregate and de-identified data

We may use data that has been de-identified and aggregated — so it no longer identifies any person or account — to improve the service and to produce industry statistics and benchmarks. We never sell or share identifiable training records.

6. Retention

We retain your information while your account is active. While active, training documentation — in particular endorsement records — is maintained in append-only form to preserve its integrity. If you close your account, or your subscription deactivates and any billing grace period ends, we compile your complete records into a document emailed to your account address, retain your data for 30 days in case the closure was accidental, and then permanently delete it — keeping only the minimal records the law requires us to keep (such as billing and tax records). Because your records are returned to you, instructors remain responsible for retaining their own training records as regulations require. You can also export your data at any time while your account is open.

7. Security

Data is encrypted in transit and at rest, access is scoped to the account it belongs to, and sensitive records carry additional default-deny access controls. No system is perfectly secure; we encourage strong, unique passwords.

8. Children

climbrate is not directed to children under 13, and we do not knowingly collect personal information from children under 13. Student accounts exist only by instructor invitation in connection with flight training. If you believe a child under 13 has provided us personal information, contact us and we will delete it.

9. Your choices and rights

You can access and update your account information in the app, export your data, disable notification channels, and request correction or deletion of personal information by contacting us. Depending on where you live, you may have additional rights under local privacy law; we will honor verified requests as required.

10. Changes and contact

We may update this Policy from time to time and will notify account holders of material changes before they take effect. Questions or requests: support@climbrate.io.