Privacy Policy for Bolted: Rock Tools

1. Information We Collect and Access

A. Device Permissions and Media

To provide core topo-creation and annotation features, the App requests access to specific device capabilities:

• Camera Access: Allows you to capture photos of climbing walls and crags to draw topos over them.
• Photo Library / Storage Access: Allows you to import existing images from your gallery to create topos and save or export annotated topos back to your device.

B. Connected Third-Party Accounts & Authentication

• No Direct App Account: You do not create or register an account directly with Bolted.
• Third-Party API Integration: You may optionally link supported external climbing management platforms (currently supports: TABVAR — The Association of Bow Valley Area Rockclimbers).
• Authentication & Tokens: When you connect an external system, authentication is handled via the external provider (e.g., OAuth2 or secure API token exchange). The App securely stores an authentication token on your local device to authenticate requests made on your behalf.
• External Account Identifiers: The App may receive and process an account identifier or user ID assigned by the connected system to authorize syncing actions.

C. Diagnostics and Crash Reporting

To ensure app stability and debug issues, we use diagnostic tools such as Sentry (or similar services). These tools automatically gather technical information when an error or crash occurs:

• Device hardware model and operating system version.
• App version, build number, and orientation/state at the time of an error.
• Technical crash stack traces and diagnostic logs.
• Pseudonymous identifiers (such as an external system account ID or session ID) strictly used to correlate and resolve technical sync failures.

D. Information We DO NOT Collect

• We do not collect your legal name, physical address, email address, or phone number.
• We do not track your real-time GPS location.
• We do not use third-party advertising SDKs or tracking frameworks for behavioral profiling.

2. How We Use Collected Information

We use the data accessed or processed by the App solely for the following purposes:

• App Functionality: To capture, render, annotate, and export climbing topos and route condition issues.
• Offline-First Storage & Synchronization: To allow you to draft route issues and topo drawings offline, and push them to connected third-party platforms (like TABVAR) when network connectivity is available.
• Troubleshooting & Maintenance: To monitor application health, detect performance bugs, and fix crashes via crash-reporting tools.

3. Data Sharing and Third Parties

We do not sell, rent, or trade your data. Data is only transferred in the following limited contexts:

• Connected Systems (TABVAR): When you link a third-party service and choose to sync route issues or topos, your annotations, route reports, and associated metadata are transmitted directly to that service's API according to their terms of service and privacy rules.
• Diagnostics Providers (e.g., Sentry): Crash reports and error telemetry are securely transmitted to crash monitoring infrastructure to help us maintain app reliability.
• System Share Sheet: When you export or share a topo, the image is passed to your operating system's native share sheet (e.g., AirDrop, email, messaging apps) according to your explicit actions.

4. Data Retention, Storage, and Security

• Local Storage: Your topos, offline issues, and authentication tokens are saved directly on your local device.
• Security: Authentication tokens are stored securely using platform-standard secure storage mechanisms (such as iOS Keychain or Android Keystore/EncryptedSharedPreferences).
• Crash Log Retention: Crash logs collected through third-party services like Sentry are retained only as long as necessary to debug and resolve system defects (typically 30–90 days).

5. Your Rights and Data Deletion

Because Bolted does not operate a centralized user account database:

• Local Data Deletion: You can delete local topos, drafts, and unsynced issues at any time directly within the App, or by clearing the App's local storage / uninstalling the App from your device.
• Disconnecting Services: You can revoke or disconnect external accounts (such as TABVAR) at any time through the App settings. Disconnecting will delete the stored authentication token from your device, along with synchronized data from the service.
• Data Synced to Third Parties: Any data that has already been synced to an external system (such as route issues published to TABVAR) is managed by that external system. To request modification or deletion of data published to TABVAR or another connected platform, please contact that provider directly under their respective privacy policies.

6. Children’s Privacy

The App is not directed toward children under the age of 13 (or under the age of 16 in certain jurisdictions), and we do not knowingly collect personal information from children. If you believe a child has provided personal information to our third-party error monitoring tools, please contact us so we can take steps to remove it.

7. Changes to This Privacy Policy

We may update this Privacy Policy periodically to reflect changes in our practices, app features, or regulatory requirements. We will notify you of any material modifications by updating the "Last Updated" date at the top of this policy and publishing the revised version within the App and on the App Store / Google Play Store listings.

8. Contact Us

If you have questions, concerns, or requests regarding this Privacy Policy or our data handling practices, please contact us at: privacy@boltedrock.app