Privacy information

Who is responsible and how to contact us

Controller identity: not yet supplied.

Controller address: not yet supplied.

A monitored privacy contact must be supplied before launch.

For product help, visit support.

Data and purposes

• Google sign-in through Beta’s self-hosted Better Auth supplies account identifiers, name, email and, when provided, profile image. Session records can include IP address and browser/device information. Beta uses an internal athlete ID to keep your account separate.
• Your climbing profile, grades, goals, capabilities, body weight when entered, assessments, preferences, named training locations and equipment support your requested training. A location is a place you enter or select, not continuous GPS tracking.
• Workout plans, performed repetitions, duration, loads, quality, external climbing and progress history support adaptation and history. Only performed work advances training state.
• Pain, tiredness/readiness and derived capability, recovery and load information can reveal health information. Beta uses them to adapt, reduce, stop or withhold training. It does not diagnose or provide medical care.
• Device identifiers, local recovery state, sync cursors and retry records keep workouts available offline. Consent decisions and notice versions, privacy requests and restricted deletion receipts support privacy choices and prevent deleted accounts being recreated by stale requests.
• Limited operational records contain safe error codes, request correlation IDs, route templates, timing and result status. The application logger excludes tokens, request bodies, pain notes and export contents.

Legal bases and your health-data choice

Proposed bases, subject to review before launch: account and ordinary training services you request: GDPR Article 6(1)(b); health-related input and health-derived training state: separate explicit consent under Articles 6(1)(a) and 9(2)(a); handling statutory rights: Article 6(1)(c); limited security and preventing account resurrection: Article 6(1)(f), subject to a documented balancing assessment.

Health consent is separate from general terms and is requested before training setup. You can refuse or withdraw in Privacy & account. Without it, personalized training stops; privacy controls remain available. Withdrawal does not undo processing that was lawful before withdrawal. Withdrawal clears training data on this device, including workouts that have not synchronized. It is also recorded for operator erasure of consent-based server health and training data; it does not instantly erase the account. You can separately request full account deletion. Any narrow retention exception must be explained.

Beta uses deterministic rules to recommend training from your inputs and performed work. It may return no workout, and you decide whether to start. It does not use your data for advertising, credit, insurance or employment decisions. You can ask about a recommendation or challenge inaccurate information.

Providers and international transfers

Beta hosts Better Auth for authentication; Google handles your chosen sign-in. Synchronized application records use PostgreSQL. Hosting, database, backup and support operators can process data needed to provide those services. Beta does not store account export files in a cloud bucket.

Launch input missing: exact provider entities, roles, regions and subprocessors.

Launch input missing: access or transfers outside the EEA and the applicable adequacy decision or other safeguards, including how to obtain a copy. An EU database region alone does not establish that all processing stays in the EEA.

Necessary browser storage, no advertising tracking

The PWA uses necessary sign-in cookies (HttpOnly on the web) and stores an offline account hint, private training inputs and recovery information in this browser’s local storage; it is not an encrypted device keychain. Account-scoped SQLite browser storage holds workouts and pending sync. A service worker caches the app shell and static assets, not API responses or OAuth callbacks. Requested timer and reminder preferences may persist on this device. Legacy session storage is cleared when sign-in storage migrates.

This storage supports sign-in, offline workouts, recovery and settings you choose. The implemented public pages add no advertising cookies, analytics scripts, tracking pixels or third-party media embeds. No nonessential tracking or cookie consent banner is added. Deployment providers must be checked before launch.

Sign-out and confirmed account deletion clear account-specific private state on the current device. When the app receives a changed consent decision, it also clears older local training data, including unsynced work, before loading account data again. Other devices receive the change when they reconnect and refresh account state. You can also remove this site’s data in your browser settings, but doing so can lose work that has not synchronized. Other devices and downloaded export files need separate cleanup. Static app assets and device-wide timer preferences may remain until you clear site data.

Retention and deletion

Account and training records are kept for the service while your account exists, subject to the approved retention schedule. Deletion removes application records and the Beta authentication identity/sessions after verification. It does not delete your Google account. Pending requests stay pending until fulfillment succeeds.

Launch input missing: maximum periods or precise criteria for inactive accounts, support messages, consent/request records, security receipts, logs and backups. Backups are not described as erased immediately; the operator must publish their expiry and ensure deleted data is not restored into service.

Registering again after deletion

At present, the same Google identity also cannot register a new Beta account after deletion. This prerelease limitation blocks fresh registrations as well as stale requests. The retention and re-registration policy must be finalized before launch.

Access, correction and other rights

In You → Settings → Privacy & account, download your account data or request deletion. Edit profile information in settings. For other corrections, access, erasure, restriction, portability where applicable, or objections to legitimate-interest processing, contact the privacy address above. Do not email health notes, passwords, tokens or an export file. Identity verification may be needed before disclosure or deletion.

Requests normally receive a response within one month. Where legally permitted, a complex or numerous request can take up to two additional months; you must be informed within the first month with reasons. An acknowledgement is not confirmation of deletion.

If you cannot sign in, use the account-deletion page or privacy contact. You may complain to the Belgian Data Protection Authority, or the competent authority where you live, work or where an alleged infringement occurred.

Registration and age

Beta is intended for adults aged 18 and over. When registering, you acknowledge this privacy information. Acknowledging this notice or accepting general terms is not consent to health-data processing: Beta asks for that separately before training.