Privacy Policy
1. Who we are
Bleau Limited is the data controller for the personal data described here. We operate the BLEAUBLOC app and bleaubloc.com.
- Company number: 17208711
- Registered office: 66 Paul Street, London EC2A 4NA
- Contact: info@bleaubloc.com
- ICO registration number: ZC218675
2. The short version
BLEAUBLOC is a climbing logbook. Almost everything we hold is something you typed in, because you wanted the app to remember it.
- We collect your email address so you can sign in, and whatever profile and training data you choose to log.
- Some of what you can log, injuries and nutrition, is health data. We treat it as such, and we only process it because you chose to use those features.
- We run no analytics, no tracking, no advertising and no crash reporting. There are no third-party trackers in the app.
- We never sell your data, and we never share it with advertisers or data brokers.
- We strip EXIF metadata from every photo you upload, so the GPS coordinates and camera details in your original file are not published.
- You can delete your account and your data from inside the app, at any time, without asking us.
3. What we collect
3.1 Account and profile
| Data | Why | Where it comes from |
|---|---|---|
| Email address | To sign you in: we email you a one-time code. There is no password. | You |
| Username / display name | To identify you on leaderboards and on content you contribute | You |
| Profile photo | Optional avatar | You |
| App preferences | Grade system, units, home gym and similar settings | You |
3.2 Climbing and training records
Sessions (indoor, board and outdoor), ascents and attempts, grades, session feel, personal records, warmups, finger-training blocks and results, conditioning work, circuit progression and milestones, trips and send lists, and any private home-board problems you create.
We use this to provide the logbook, to compute your insights, circuits and milestones, and, if you appear on a leaderboard, to rank you.
3.3 Health data (special category)
Two features record data that UK GDPR treats as special category health data:
- Injuries: body part, severity, severity history over time, and the sessions each injury is linked to.
- Nutrition: meals, macronutrients, and supplements you log.
We only hold this if you choose to use those features. You can use everything else in BLEAUBLOC without entering any of it. See section 4 for the legal basis, which is different for this category.
3.4 Content you contribute
Topo photographs, drawn topo lines, climbing locations, problems, and difficulty systems and grades you submit. Contributed content is shown to other users and attributed to your username.
Photographs are resized and re-encoded to JPEG before upload, which removes EXIF metadata. The GPS coordinates, camera model, and timestamp embedded in your original file are not uploaded and are not published.
3.5 Location
If you tap "use current location" when placing a map pin for a crag or a boulder, the app reads your device's GPS position at that moment to fill in the coordinate.
- Access is foreground-only and on-demand. There is no background location tracking.
- What gets stored is the coordinate of the crag or boulder: a fact about a place, not a record of where you have been. We do not build a location history for you.
- You can decline the permission and type coordinates or drag a pin instead.
3.6 Subscription
If you subscribe to Bleausard, Apple processes the payment. We never see your card details. We receive a subscription status (active / not active) and an anonymous identifier from RevenueCat, so the app knows whether to unlock Bleausard features.
3.7 Security and abuse prevention
We record rate-limit events and moderation records (reports made, moderation decisions) to stop spam and abuse. These are tied to an account.
3.8 Push notifications
If you turn on session reminders, your device gives us a push token, an identifier for that installation of the app. We use it only to deliver the reminders you asked for. Turning notifications off in iOS Settings stops it being used, and deleting your account removes it.
3.9 Website
The bleaubloc.com site collects an email address if you join the waitlist, and your name, email and message if you use the contact form.
4. Why we process it, and our legal basis
| Purpose | Data | Legal basis (UK GDPR) |
|---|---|---|
| Creating and running your account, signing you in | Email, profile | Contract, Art. 6(1)(b) |
| The logbook, insights, circuits, milestones, trips | Training and climbing records | Contract, Art. 6(1)(b) |
| Injury tracking and its insights | Health data | Explicit consent, Art. 6(1)(a) + Art. 9(2)(a) |
| Nutrition and supplement tracking | Health data | Explicit consent, Art. 6(1)(a) + Art. 9(2)(a) |
| Showing contributed content to other climbers | Topo photos, locations, problems, username | Contract, Art. 6(1)(b) |
| Leaderboards | Username, avatar, ascent totals | Contract, Art. 6(1)(b) |
| Managing your subscription | Subscription status | Contract, Art. 6(1)(b) |
| Moderation, security, preventing abuse and fraud | Reports, rate-limit records | Legitimate interests, Art. 6(1)(f): keeping the service safe and usable |
| Answering you when you contact us | Email, message | Legitimate interests, Art. 6(1)(f) |
| Sending session reminders | Push token | Consent, Art. 6(1)(a) |
| Waitlist emails | Consent, Art. 6(1)(a) |
On the health data. Because injury and nutrition records are special category data, we rely on your explicit consent. That means:
- Using those features is entirely optional, and the rest of the app works without them.
- You can withdraw consent at any time by deleting those records or your account.
- Withdrawing does not affect processing that already happened.
5. Who we share it with
We do not sell your data. We do not share it with advertisers or data brokers. We share it only with the service providers who run the platform, each acting on our instructions:
| Provider | What they handle | Where |
|---|---|---|
| Supabase | Database, authentication, file storage, server functions: this is where your account and logged data live | eu-west-1 (Ireland) |
| Apple | App distribution, and payment for the Bleausard subscription | Global |
| RevenueCat | Subscription status | USA |
| Resend | Sending website contact-form and waitlist email | USA / EU |
| Expo | Delivering push notifications, if you turn reminders on | USA |
| Vercel | Hosting bleaubloc.com | Global edge network |
We may also disclose data if we are legally required to, or to establish or defend legal claims.
If the business is sold or transferred, your data may transfer with it. We would tell you first.
What we do not use
There is no analytics SDK, no crash-reporting SDK, no advertising SDK and no third-party tracker in the BLEAUBLOC app. We do not track you across apps or websites, and we do not use your data for advertising.
6. International transfers
Your account and logged data are stored in the European Union, in Supabase's eu-west-1 (Ireland) region. Some other providers are outside the UK and the EU.
Where data is transferred outside the UK we rely on the UK Government's adequacy regulations, which cover the EEA, or on the International Data Transfer Agreement / UK Addendum to the EU Standard Contractual Clauses, together with the provider's own safeguards.
7. How long we keep it
| Data | Retention |
|---|---|
| Account and all personal training, injury and nutrition data | Until you delete your account, then erased |
| Contributed locations, problems and grades | Kept after account deletion, with your name removed: other climbers rely on this information |
| Topo photographs | Deleted when you delete the photo or your account |
| Backups | Deleted data persists in routine backups for up to 7 days, then ages out |
| Rate-limit records | 24 hours, then deleted automatically |
| Moderation reports | Kept as a record of what was reported and what we did about it. If you delete your account, your identifier is removed from the report |
| Push token | Until you turn notifications off or delete your account |
| Waitlist email | Until you unsubscribe |
| Contact-form messages | 24 months |
8. Your rights
Under UK GDPR you have the right to:
- access the personal data we hold about you;
- correct anything inaccurate: most of it you can edit directly in the app;
- erase your data;
- restrict or object to our processing, including processing based on legitimate interests;
- portability: receive your data in a machine-readable form;
- withdraw consent where we rely on it, at any time.
The fastest route for most of these is the app itself. Profile → Delete account erases your personal data immediately; you do not need to email us or wait for us to act. Individual records can be edited or deleted in the app as you go.
For anything else, email info@bleaubloc.com. We will respond within one month.
If you are unhappy with how we handle your data you can complain to the Information Commissioner's Office: ico.org.uk, 0303 123 1113. We would appreciate the chance to put it right first.
9. Children
BLEAUBLOC is not intended for children under 13. We do not knowingly collect data from under-13s. If you believe a child under 13 has an account, email us and we will delete it.
10. Security
Data is encrypted in transit. Your session token is held in the device's secure storage (Keychain on iOS). Access to your data is enforced at the database level by row-level security, so one user's records cannot be read by another. We test those rules automatically as part of our build process.
No system is perfectly secure. If a breach affects your rights we will tell you and the ICO as the law requires.
11. Changes
We may update this policy. If a change is material we will tell you in the app before it takes effect. The current version always lives at https://www.bleaubloc.com/privacy.
12. Contact
info@bleaubloc.com Bleau Limited, 66 Paul Street, London EC2A 4NA
Version history
- 10 August 2026 First published.