Privacy

Who is responsible

Røky is the data controller for this site. Write to info@jjsebastianfuertes.com with any question about your data, including a request for our postal address.

What we collect

If you subscribe to the newsletter: your email, and optionally your name. If you write to collaborate: your email, name, roles, location, a portfolio link and your message. If you ask a question from the FAQ page: your email, optionally your name, and the question you sent. If you request deletion of your account: your email address, and a record that you confirmed the request and acknowledged that it is permanent. In every case we also store the time, the page language, and a salted one-way hash of your IP address — the hash lets us stop abuse without keeping the address itself. If you accept analytics, the tools below collect usage data.

Your location on this website

On the Explore page you can ask for results to be ordered by distance. Your browser asks your permission first, and the position is used in your browser only: it is never sent to our servers, never stored, and never shared. Decline it and the list simply keeps its normal order. This is separate from the location the app collects, described further down.

Why we are allowed to

Consent, in every case (GDPR Art. 6(1)(a)). You provide it by ticking the box on a form or by accepting cookies, and you may withdraw it at any time without giving a reason. We retain a record of what you agreed to and when, as Art. 7(1) requires that consent be demonstrable.

How long we keep it

Newsletter and collaborator records are retained until you ask us to delete them or unsubscribe. Analytics data expires on the schedules above. We delete personal data on request — no retention period takes precedence over that. A deletion request is kept while it is in progress. Once it has been actioned and we have written to tell you so, your address is erased from it, and only a dated record that the request was made remains. A request that is never confirmed keeps the address it was submitted with until you ask us to remove it.

Who else sees it

Google (Analytics) and Microsoft (Clarity) if you accept them, and Google Firebase, which stores the form submissions. All three process data outside the EU, under the European Commission's standard contractual clauses. We do not sell your data and we do not share it with anyone else.

Your rights

You may request a copy of your data, have it corrected or deleted, restrict or object to its processing, or receive it in a portable format. Write to info@jjsebastianfuertes.com and we will respond within one month. If you believe we have handled your data improperly, you may lodge a complaint with your national data protection authority.

Cookies

One cookie is always set: the one that records your choice here. The others are set only if you allow them.

• roky_consent

  Set by

  Røky

  Purpose

  Remembers your cookie choice so you are not asked again.

  Kept for

  6 months

• _ga, _ga_*

  Set by

  Google Analytics

  Purpose

  Tells visits apart and measures how the site is used.

  Kept for

  Up to 2 years

• _clck, _clsk

  Set by

  Microsoft Clarity

  Purpose

  Groups a visit into one session recording and heatmap.

  Kept for

  Up to 1 year

Change your mind

You can reopen these choices at any time. Disabling a category also deletes the cookies it has set and reloads the page, so processing stops immediately rather than at the end of the session.

What this covers

This section describes the Røky mobile app, which processes far more than the website does. If you have an account, this is the part that applies to you. We do not sell your data, we show no advertising, and the app contains no advertising or analytics SDK of any kind.

Your account

To create an account we need an email address, a display name and a password. Passwords are handled by Firebase Authentication and we never see them. If you sign in with Google or Apple we receive the email address, name and profile photo that provider releases to us — if you use Apple's Hide My Email, we only ever see the relay address, which is fine. Your display name and photo are public.

Your profile

Everything beyond your name and email is optional and is entered by you, in Edit Profile or Settings: full name, profile photo, date of birth, gender, height, weight, your preferred grade systems and current grades, your unit preferences, and which notifications you want. You can change or clear any of it at any time.

Training and body data

If you use the training features we store what you record, so the app can show you progress over time: completed workout sessions with duration, sets, reps, effort and notes; assessment-test results in kilograms, repetitions or seconds; a history of your weight; a history of your grades; and your logged ascents, projects and favourites. Some of this is information about your body. We treat it as sensitive, we do not share it, and it is not used for anything except showing it back to you.

Location

Røky asks for location only while you are using it, never in the background, and only for two things. It sorts gyms and crags by how far away they are — that fix stays on your device. And when you add a route or a zone it takes a fresh, accurate reading to confirm you are actually at the place you are describing, which is what keeps the map honest; simulated locations are rejected.

One consequence is worth being explicit about: if you use "my current location" while submitting a gym, crag, zone or route, that coordinate becomes the published location of a public listing recorded against your account. Separately, using the map, address search and address lookup sends the relevant queries — including what you type into address search, as you type it — to Google, under Google's own privacy policy.

Photos

Photos you take or choose are uploaded to Firebase Storage: your profile photo, and any photo you attach to a gym, crag, zone or route, including approach photos and photos you draw a route line onto. Every one of these can be viewed by any signed-in Røky user. Photos uploaded while drafting a submission are kept even if you never publish it, because published listings may already reference them.

What other climbers can see

Røky is a social app, and a large part of it is public to anyone signed in:

• your public profile — display name, photo and total XP — and your position on the leaderboard and in climber search;
• who you follow and who follows you;
• the gyms, crags, zones and routes you submit, attributed to you;
• your reviews and ratings, with your name and photo;
• your sends, including the date, the number of attempts, and any comment, rating or suggested grade you added — attempts that are not sends keep their comment and rating private;
• the congratulations you write on other climbers' ascents;
• your activity in the feed of climbers who follow you.

Your training sessions, assessment results, weight and grade history, projects and favourites are not public. One current exception we want to state plainly rather than bury: because of how older versions of the app build the leaderboard, another signed-in user can at present read the rest of your profile document — including your email address, date of birth, gender, height and weight. This is being changed, and the app itself no longer reads that data; until the change reaches enough installed versions, treat those fields as visible to other users, and leave the optional ones blank if that concerns you.

Notifications

If you allow notifications we store a device token, your platform, your language and your time-zone offset, so that a notification arrives in your language at a sensible hour. Notifications tell you about reactions, congratulations, new followers, a daily summary from climbers you follow, and submissions of yours being approved. Note that the text of a congratulation appears in the notification itself, so it may be visible on your lock screen. You can turn any category off in Settings, or notifications off entirely in your device settings.

Crash reporting

The app sends crash reports to Firebase Crashlytics so we can fix what breaks. A report carries your user id and nothing else we attach — no email, no name, nothing from your profile — alongside the technical information the tool collects automatically: device model, operating system, app version, session and the stack trace of the crash. Crash reporting is disabled in development builds.

Who processes it for us

We use a small number of providers, each of them under a data-processing agreement and the European Commission's standard contractual clauses where data leaves the EU:

• Google — Firebase Authentication, Cloud Firestore, Cloud Storage, Cloud Messaging, Crashlytics and Cloud Functions host essentially all app data; Google Maps, Places and geocoding serve the map and address search; Google Play processes in-app purchases on Android.
• Apple — Sign in with Apple, geocoding on iOS, and App Store purchases on iOS.
• Our own server functions run in the United States (us-central1), so app data is processed there as well as in Google's other regions.

We share nothing with anyone else, and we sell nothing to anyone. We may disclose data where the law obliges us to, or to protect someone's safety.

How long we keep it

We keep your account data for as long as your account exists. Deleting your account erases everything that identifies you and disables your sign-in permanently — what we erase and what we keep is set out on the account page. Content you contributed to the community map is retained with your name and photo removed from it, because other climbers depend on it, and it identifies nobody once it is no longer attached to you. Anything we are legally required to keep is kept; backups expire on their own schedule rather than being edited.

Your rights

Wherever you live, you may ask us for a copy of your data, have it corrected or erased, restrict or object to our use of it, ask us to suspend it, or receive it in a portable format. Write to info@jjsebastianfuertes.com from the address on your account and we will answer within one month. Under Ecuador's Ley Orgánica de Protección de Datos Personales these are the rights of acceso, rectificación, eliminación, oposición, suspensión and portabilidad; under the GDPR they are Articles 15 to 22. You may complain to Ecuador's Superintendencia de Protección de Datos Personales or, if you are in the European Union, to your own national data protection authority.

Age

Røky is not for anyone under 16, and you confirm you are 16 or older when you create an account. We do not knowingly collect data from anyone younger. If you believe a child has an account, write to us and we will delete it and the data behind it.

Security

Data in transit is encrypted, access to the database is controlled by server-side security rules, and administrative access is limited to accounts holding an explicit privilege. Two honest caveats: the copy of your training data held on your own device is stored in an ordinary database file protected by your phone's own encryption rather than separately by us, and no service can promise perfect security. Use a password you do not use elsewhere.

Deleting your account

You do not have to write to us to exercise the right to erasure. The app deletes your account immediately, from Profile, and if you cannot open the app there is a request form on our account deletion page. That page also sets out what is erased, what stays on the community map without your name on it, and why none of it can be undone.

Contact

info@jjsebastianfuertes.com