Privacy policy

The short version: your logbook is private unless you share it. We do not sell your data or use it for advertising. You can switch analytics off, and you can delete your account and everything in it from Settings. There is a plain summary at Your data.

1. Who we are

Crux is developed and operated by Benjamin Widdowson, trading as Crux, a sole trader based in the United Kingdom. Under UK and EU data protection law, Benjamin Widdowson is the data controller for the personal data described here.

This policy covers the Crux apps for iPhone, Apple Watch and Android, their backend services, and the website at cruxlog.app. It does not cover services you reach through the app, such as the App Store, Google Play or Apple Health. Those have their own policies.

2. What we collect

We collect what you give us, what the app measures with your permission, and a small amount of technical data.

Account

• Email address and password. Your password is never stored in readable form. It is hashed by our authentication provider, Supabase.
• Username, if you choose one to use friends, crews or a public profile.
• A sign-up check by Cloudflare Turnstile, which confirms a real person is creating the account.

Profile and preferences

• Display name and profile photo, both optional.
• Date of birth, gender, height, activity level and units. These are used for calculations such as calorie targets and BMI.
• Goals you set, such as a target weight, a target grade or an event, and any notes you write for the coach.
• Training locations you add, your weekly availability, and your reminder settings.
• Gear, climbing style and achievements you choose to show on your profile.

Device and notifications

• A push notification token, if you allow notifications. It is used to deliver notifications to your device.
• The date you last opened the app. It is used to decide whether to send one reminder after a long break.

Subscription and payment

Crux Pro is bought through the App Store or Google Play and managed through RevenueCat.We never see or store your card details. We receive only your subscription status, so the app knows what to unlock.

3. Health and fitness data

This is the core of Crux. Health data is a special category under UK and EU law and needs your explicit consent. You give it by creating an account and choosing to log this information.

What you log

• Climbing: boulders, routes and board climbs, with grades, terrain, holds, attempts, notes and any photos or videos you attach.
• Workouts: exercises, sets, reps, weight, distance, time and effort.
• Hangboard sessions and finger strength tests.
• Nutrition: foods, recipes and water, including the results of a barcode or meal photo scan.
• Body: weight, measurements and progress photos.
• Reviews and plans the coach writes for you.

Apple Watch

During a climbing session the watch app uses the altimeter, motion sensors, step counter and heart rate sensor to detect attempts, height, falls and rest. The results are saved with your climbs.

Apple Health

If you connect Apple Health, Crux can read steps, resting heart rate, active energy, sleep, heart rate variability, VO₂ max, weight and workouts. It can write a weight you log and the workouts you record with Crux. This needs your permission on the iOS Health screen, and you can withdraw it in iOS Settings, under Privacy and Security, then Health. Apple Health data is never sent to our analytics or crash reporting providers, and is never used for advertising.

Location

With your permission, Crux uses your location to match a session to a saved gym and to show a small map on the session summary. Location is optional. Crux does not track your location in the background.

Photos, videos, camera and microphone

Media you attach is stored privately in your account. The camera is used for photos, barcodes and meal scans. If you dictate a note, speech is turned into text by your device's own dictation.

4. Beta, the AI coach

Beta writes session reviews, training plans, workouts and nutrition guidance. To do this, the data a feature needs is sent from our backend to Anthropic, the company behind the Claude models. Depending on the feature, this can include recent sessions, effort ratings, goals, body weight, nutrition totals, and recent sleep, resting heart rate and heart rate variability. A meal photo scan sends the photo.

Under Anthropic's terms for API customers, this data is not used to train their models. Your account name and email address are not included in these requests.

A request is only made when you use a coach feature. Listening to a review uses your device's built-in text to speech, and nothing is sent anywhere for that. Beta does not give medical advice.

5. Crews, gyms and sharing

By default, nothing you log is visible to anyone else. These features change that, and each is your choice.

• Friends and crews. Other people can find you by username. Members of a crew can see its member list.
• Sharing a session to a crew. The crew sees a snapshot: the title, date, gym, one highlight and up to four figures. You can remove it.
• Crew board. If you opt in, crew members see your sent grades, climbing days and flashes for the week.
• Tagging. If someone tags you in a session, nothing is linked until you accept. Once linked, a shared reel can show the grade, colour, terrain, attempts and outcome of your climbs that day. It never shows notes, photos, heart rate or location.
• Public profile. Off by default. When on, it shows what you choose, such as your grades.
• Share links. When you share a send or your profile, Crux creates a web page and image that anyone with the link can open.
• Gym statistics. Off by default. If you opt in, your sessions count toward anonymous totals for the gym. Totals are shown only when at least five climbers are included. Gyms never see an individual's data.
• Blocking and reporting. You can block a person and report a crew. Reports are reviewed by Crux.

6. How we use your information

• To run the app: logging, tracking and reviewing your training, climbing and nutrition.
• To produce the coach features described above.
• To keep your data in step across your own devices.
• To manage your subscription.
• To send reminders you have switched on. Most are scheduled on your device. News from gyms you have favourited, and one reminder after a long break, are sent from our servers. You can switch notifications off.
• To understand how the app is used and to fix problems.
• To contact you about your account if needed.

We do not sell your data, and we do not use it for advertising.

7. Who we share it with

We use a small number of service providers. Each receives only what it needs.

We do not share your data with data brokers or advertisers. We would only disclose data beyond this list if the law required it, or to protect the safety of Crux, its users or the public.

8. Analytics and crash reports

Analytics describes how the app is used. It never describes how you train.

• Events record that the app was opened, that you logged a type of activity, such as "climbing" or "nutrition", and that you used a coach feature.
• They never include grades, weights, heart rate, food, notes, photos, locations or anything you typed. The app only sends event types declared in advance and drops anything else before it leaves your phone.
• Crash reports include the error, the screen it happened on, the app version and the device model.
• Both are linked to your account's internal ID, a random string, and never to your name or email address.
• Analytics data is stored in the EU.
• You can switch analytics off in Settings, under Privacy, with "Help improve Crux".
• Crash reports cannot be switched off, because they are how faults get fixed. They do not include the contents of your logbook.

9. This website

• This website sets no cookies and runs no analytics or advertising scripts.
• Fonts and images are served from this site, not from a third party.
• Our host, Cloudflare, keeps standard server logs, which include IP addresses, for security.
• If you join the beta or email us, we keep your message and address so we can reply and invite you. Ask us to delete them at any time.

10. Retention and deletion

We keep your data while your account is active. You can delete your account and everything in it from Settings, then Delete account. This happens at once and cannot be undone.

• Your analytics profile and its events are deleted at the same time.
• Crash reports have no per-person delete. They keep an ID that no longer matches anyone, and they expire under Sentry's retention period.
• Backups are cycled out within a short period.

If you cannot open the app, email privacy@cruxlog.app from your account's address and we will delete it for you.

11. Legal basis

• Consent for health and fitness data, and for optional features such as Apple Health, location, camera, notifications and gym statistics. You can withdraw consent by switching the feature off, removing the permission, or deleting your account.
• Contract for account and subscription data, which we need to provide the service.
• Legitimate interests for analytics and crash reporting, which keep the app working. You can object by switching analytics off.

12. Your rights

If you are in the UK or EU, you have the right to:

• access the personal data we hold about you;
• correct data that is wrong;
• erase your data;
• restrict or object to some processing;
• move your data to another service;
• withdraw consent.

To use any of these, email privacy@cruxlog.app. We reply within one month. If you are not satisfied, you can complain to theInformation Commissioner's Office, or to your local authority in the EU.

If you live in California, you have similar rights under the CCPA. We do not sell personal data, so there is nothing to opt out of.

13. International transfers

Some providers, including Anthropic and Sentry, process data outside the UK and EU, including in the United States. Where this happens we rely on that provider's safeguards, such as Standard Contractual Clauses, to protect your data to UK and EU standards. Analytics data stays in the EU.

14. Children

Crux is not intended for anyone under 16. We do not knowingly collect data from children. If you believe a child has given us personal data, contact us and we will delete it.

15. Security

Connections are encrypted. Access rules mean your data can only be read by your own account, except where you have chosen to share it. Photos and videos are stored privately. No system is completely secure, but we work to keep Crux's practices sound for an app of its size.

16. Changes to this policy

We update this policy as Crux changes, and we change the date and version at the top when we do. If a change is significant, we will tell you in the app.

• 1.2, 29 September 2026. Added Android and Google Play, crews, gyms, tagging, push notifications and this website. Changed the contact address.
• 1.1, 28 September 2026. Added the analytics switch, EU analytics hosting and what happens to analytics on deletion.
• 1.0, 24 September 2026. First version.

17. Contact

For any question about this policy or your data:
Benjamin Widdowson, trading as Crux
privacy@cruxlog.app