Privacy Policy

• Account data: when you use Sign in with Google, the user identifier, email address and name Google provides (the name prefills your nickname); when you use Sign in with Apple, the user identifier and email address Apple provides (if you choose Hide My Email, we only receive Apple’s relay address), and the name Apple shares the first time you sign in (if you share it), which we use to prefill your nickname. We never receive your Apple or Google password.
• Profile: your nickname, a system-generated username, the profile photo you upload, and the home gym you choose to add.
• Body measurements (optional): the height and reach you choose to enter, used to work out your ape index. Only you can see them.
• Onboarding questions: your climbing experience, what you want to use VARO for, and how you heard about it. We use these to tailor the app to you and to understand how people find VARO.
• Climbing logs: the sessions and routes you create (grade, hold color, wall angle, attempts, result, notes), your projects and saved gyms, and private locations you add.
• Photos and videos: only files you pick from your library or take with the camera to add to a log or set as your profile photo are used. Photos and videos (videos are compressed on your phone first) are uploaded to private cloud storage so your logs show on any device, visible only to you by default. VARO never reads or uploads anything else in your library.
• Feedback: feedback and bug reports you send in the app, along with the app version, platform and OS version at the time, so we can track down issues.
• Usage and crash data: which features you use (for example starting a session, logging a route or sharing a sticker; counts and types only, never what you type), which screens you view, crash and error reports, and your device model and OS version. This data is linked to your account ID, not your email or name. We do not record your screen. You can turn it off anytime in Me → Settings → Usage analytics.

We do not collect your location, contacts, advertising identifier or browsing history. The app contains no advertising tools and never tracks you across other apps or websites.

• To provide the app’s core features: signing in, saving and syncing your logs, and showing your stats and progress.
• To handle the feedback and bug reports you send, and to improve the app.
• To understand how features are used, find what feels clunky, and fix crashes and errors.
• To keep the service secure, for example by preventing abuse.

We never use your data for advertising, and we never sell or rent it to anyone.

Your logs, photos and videos are visible only to you by default. Uploaded photos and videos are kept in private storage and can only be read through short-lived signed links. Your profile photo and nickname may be visible to other users.

When you use the share feature, the image is sent through your device’s share sheet, so you decide where it goes and who sees it.

When you share a climbing video as a route’s beta, every user can see and play it on that route, along with your nickname and profile photo. You can stop sharing at any time, and the video goes back to being visible only to you.

Statistics for gyms: gyms that partner with VARO can see usage statistics for their own gym, such as how many climbers logged there and how many sessions they logged in the last 30 days, and how often each route was logged and sent. These statistics include logs you keep private. Gyms never see your name, account, photos, videos, notes or when each log happened; but when very few people log at a gym (for example, only you in a given week), gym staff may be able to tell who it was.

We run VARO on the following services, which process data only on our instructions:

• Supabase: authentication, database and file storage. Data is stored on Supabase’s cloud servers, which may be located outside Taiwan.
• Apple: Sign in with Apple and app distribution.
• Google: Sign in with Google.
• PostHog: usage analytics and crash reports. Data is stored on PostHog’s servers in the United States.
• Telegram: feedback and bug reports you send (the text, your username, the app version and your device’s OS), and a notice when a new account signs up (the sign-in method only, never your email or profile), are sent to the VARO team’s Telegram group so we can respond quickly.

All data is encrypted in transit (HTTPS), and database access rules ensure each user can only read and write their own data.

We keep your data for as long as your account exists. You can permanently delete your account at any time in the app under Me → Settings → Delete Account. Your profile, logs, photos, video thumbnails and the videos VARO keeps on this phone are deleted along with it and cannot be recovered, and we revoke VARO’s Sign in with Apple authorization. Feedback you sent is kept, but is no longer linked to your account.

If you can’t sign in to the app, email support@getvaro.app and we’ll delete it for you.

Under Taiwan’s Personal Data Protection Act, you may request to access, review, or receive a copy of your personal data, to supplement or correct it, to stop its collection, processing or use, or to have it deleted. Email support@getvaro.app and we’ll reply as soon as we can.

VARO is not designed for children under 13, and we do not knowingly collect personal data from children. If you believe this has happened, please contact us and we will delete the data.

If we make significant changes to this policy, we’ll update the “Last updated” date on this page and, where appropriate, let you know in the app.

Questions about privacy? Email us at support@getvaro.app.