Privacy policy

Last updated: 19 September 2026

This page explains what personal data grnyte holds about you, why I hold it, who else sees it, and how you get a copy of it or get it deleted.

1. Who is responsible

I run grnyte on my own. It is a free, open source, invite-only climbing guidebook and logbook, operated by one private individual resident in Germany. There is no company and there are no employees.

I am the controller for the data described here, under Article 4(7) of the General Data Protection Regulation (GDPR). My name and a postal address are published in the imprint together with the other contact details. Section 14 gives the address to write to about your data.

I have not appointed a data protection officer. Neither Article 37 GDPR nor section 38 of the Bundesdatenschutzgesetz (BDSG) requires one from an operation this size.

The source code is public and MIT licensed. Read what it does with your data in the source repository rather than taking this page on trust.

1.1 Region admins

A region admin decides who to invite and what their region collects, and does that as a private person for their own purposes. Where that is a purely personal activity, Article 2(2)(c) GDPR places no controller duties on them, and section 1 above holds unchanged: I am the controller. Where an admin is nonetheless held to be a joint controller for that decision, clause 15 of the terms is the arrangement between us under Article 26 GDPR, and this is its essence: I answer for the service and for everything the software does with your data, the admin answers for the invite list and for what the region collects, and you can exercise your rights against either of us. I answer your requests either way, because I am the one who can reach the data, and section 8 says how.

2. What I collect

Most of it comes from you, because grnyte stores what you and the other members of your region write into it. The categories below cover what I hold.

2.1 Account data

An account holds:

• your email address, used to sign you in and to reach you
• your display name, shown to the other members of your regions
• the credentials and session records the authentication provider needs to sign you in

Those three are required, not optional: they are what the agreement between us needs to exist at all, so without them I cannot open an account and you cannot use grnyte. No law obliges you to give them to me. Everything else on this page you provide because you chose to.

2.2 Region membership and roles

A region is a closed container, and your membership of one is data about you:

• which regions you belong to
• the role you hold in each region, which decides what you can edit there

2.3 Climbing content

This is the material the app exists to hold:

• sector, block and route names, grades and descriptions
• topo lines you draw over a photograph
• Global Positioning System (GPS) coordinates you set for a sector or a block
• ascent logs: the date, the route, how you climbed it, your notes and the conditions you record
• comments, and the @-mentions of other members inside them

2.4 Photos and videos

This category holds the files you upload and the metadata inside them, including the Exchangeable Image File Format (EXIF) block a camera writes into a photo. Section 3 covers that metadata on its own, because it carries a risk the picture does not.

2.5 Push notifications

If you turn notifications on, your browser hands me a subscription: an address to deliver to, and the keys that encrypt the message. grnyte uses the Web Push protocol with Voluntary Application Server Identification (VAPID) keys. Your browser, not grnyte, picks the push service that relays the message: Apple for Safari and iOS, Google for Chrome, Mozilla for Firefox. The payload is encrypted against keys only your browser installation holds, so the push service cannot read the content, but it does see that a message was sent to your subscription and when. For Apple and Google devices, that means the message passes through a company in the United States, which section 6 covers. If you never turn notifications on, this data does not exist for you.

2.6 Server logs

Running a web service produces logs, and they are needed to keep it running and secure:

• your Internet Protocol (IP) address
• the time of a request and the address requested
• your browser and operating system version
• error reports when something fails

The address, the request time and the browser version sit with the hosting, database and email providers. I read them to find faults and to spot abuse.

Error reports are different: I keep them myself, rather than leaving them to a provider. When something in the app fails, it saves what went wrong, the page you were on, and your browser version and language. If you were signed in, it saves who you were too: a fault I cannot connect to anyone is usually one I cannot fix. It records failures on my own side the same way, such as a mail that would not send or a notification that would not deliver, and where the failure is about you it carries an internal reference to your account or your device. I delete them after 90 days (section 7), and the reference to you goes as soon as your account does.

2.7 Data about you that somebody else wrote

Article 14 GDPR covers data I did not get from you, and grnyte holds some:

• a comment or an ascent note that names you
• an @-mention that links to your profile
• a photo or a video another member uploaded that you appear in

The member who wrote it decided to write it. Nothing in grnyte is reviewed, verified or approved by me, before or after it appears. Article 14 GDPR would have me tell you directly that I hold it; somebody who is not a member, and whose name I have only because another member typed it, is somebody I have no way to reach, so Article 14(5)(b) GDPR applies and this notice is the public information instead. If something about you should not be there, section 14 says how to reach me.

2.8 Reports and moderation records

Reporting content creates a record, and so does a complaint about a decision I made. The record holds:

• what arrived and when
• who sent it, including the contact details given in the report
• the evidence attached to it, such as links, screenshots or a description of the content
• what I decided, on what ground, and when I acted

A record like this holds data about the person reporting and about the person reported. The reporting page describes the same record from the reporting side. Section 5 says who receives it and section 7 says how long it lives.

2.9 Feedback you send me

Sending feedback about the app creates a record. Feedback is about the software, never about the rock and never about another person, which is what keeps it separate from a report under 2.8. The record holds:

• what you wrote, and which kind of feedback you picked
• your account, so I know who to answer
• the language you wrote in, so the answer comes back in it
• the screen you came from and the browser you used, both captured rather than typed by you

Those last two are context you would otherwise have to describe, and a bug report without them usually costs a round trip before I can even look. I answer by email, and the answer is kept with the record. Section 5 says who receives it and section 7 says how long it lives.

3. Photos, videos and EXIF metadata

A photograph carries more than the picture. This section covers the metadata inside an uploaded file.

Cameras and phones write EXIF metadata into a file: the capture time, the device, the exposure settings and, when location services are on, the GPS coordinates of the spot you stood on.

The stored original keeps it. Your file is saved as you uploaded it, EXIF included, and nothing removes that metadata afterwards.

The smaller copies do not. Every resized version the app generates is re-encoded, which drops the metadata and keeps only the orientation, baked into the image itself. So a thumbnail carries no coordinates, and the original does.

One exception runs the other way. An iPhone photo arrives in Apple’s HEIC format, which cannot be displayed in a browser, so the app converts it to a high-quality JPEG and shows you that. The conversion carries no metadata across, so the JPEG holds no coordinates. Your HEIC file is kept unchanged beside it, EXIF included, so what your phone wrote into the photo is still stored.

Treat an uploaded file as carrying whatever metadata your camera or phone wrote into it: the exact coordinates, the time and the device. Anyone who can see the photo can read that metadata out of it, because it travels inside the file. A picture of an anonymous-looking boulder can still carry the coordinates of a crag you want kept quiet, and the person who uploaded it may not know that. If a crag’s location matters to you, check what your camera or phone writes into a photo before you upload it. This is a limit to know about, not a setting you can toggle. Strip the metadata yourself before you upload, or turn location tagging off in your camera app. If a file is already uploaded, ask me and I will delete it.

4. Why I process your data, and the legal basis

Every purpose below is tied to one legal basis in Article 6(1) GDPR.

Several of those purposes rest on legitimate interest, so here is the interest in each. For keeping the service available and secure, it is keeping the service reachable, finding faults, and stopping somebody from reaching a region they were not invited to. For reports and complaints, it is being able to show later what was reported, what I decided and why. For feedback, it is fixing what you tell me is broken and being able to tell you what came of it. For the operations screen in section 10, it is knowing which regions are in use, so I can size the service and see where something has stopped working. You can object to any of them under Article 21 GDPR.

Push notifications run on consent, and Article 7(3) GDPR lets you withdraw consent at any time. Turn notifications off in the app settings or in your browser. Withdrawal does not undo processing that already happened.

5. Who receives your data

Article 13(1)(e) GDPR asks for the recipients or the categories of recipients, so the categories come first:

• hosting and serverless execution, which serves the app and runs its server code
• database and authentication, which stores your account, your sign-in records and the content you write
• photo storage, which holds the pictures you upload and the smaller copies made from them
• video storage and delivery, which holds uploaded videos and streams them back
• transactional email, which sends the service and account mail described in section 4
• the sync server, which keeps a working copy of the database so the app loads and searches quickly

The categories above are the recipients, and these are the providers behind them: Vercel for hosting and serverless execution, Supabase for database and authentication, Bunny for video storage and delivery, Resend for transactional email, and Hetzner for photo storage, for the sync server and for the database backups. Some of them process data outside the European Union, which section 6 covers. Your browser talks to Supabase, Bunny and the sync server directly rather than through my server, so your IP address reaches those three from your device.

Each of the five is bound by a processing agreement under Article 28(3) GDPR. With Vercel, Supabase and Resend the agreement comes with the terms and takes effect on accepting them, which happened when I opened each account. With Hetzner and Bunny it had to be concluded separately, and both were concluded on 1 September 2026.

Two of the categories above sit at Hetzner Online GmbH, and they hold more than the rest. Your photos live on a Nextcloud instance Hetzner operates, and the sync server is a Hetzner machine I run myself which keeps a working copy of the database, so it holds the same content the database does. Both are in Falkenstein in Germany, so neither leaves the European Union.

One recipient is not a processor of mine at all, and it is the one to know about. The maps are drawn with tiles from OpenStreetMap, which your browser fetches directly from the OpenStreetMap Foundation as you pan and zoom. I do not send that request, your device does, so the Foundation sees your IP address and which tiles you asked for. Tile coordinates are locations: they say which part of the map you were looking at, which on this service means which crag. The Foundation is its own controller for what it does with that, under its own privacy policy, and no agreement of mine covers it. I keep it because a map without tiles is not a map, and the alternative is a commercial tile provider, which would be worse for you rather than better. If this matters to you, the map is the one screen to avoid: nothing else on the service loads anything from a third party.

The other recipients are people rather than companies: the members of your region see what you write there. That is what the product is for. Nobody outside a region sees its content, no other member’s account can see a region or list it, and there is no public mode. I am the exception, and section 10 says what I can see.

A report brings one further recipient. When you report content, I forward the substance of your report to the member who posted it, so they can respond before I decide. The reporting page describes that step. Your identity as the reporter is a separate question from the substance of the report, and it is withheld from the reported member by default. It goes with the report only where who is objecting is part of the claim, such as a personality-rights objection from the person shown in a photo or a landowner’s complaint about a location, which is the “strictly necessary” test in Article 17(3)(b) DSA.

I do not sell your data. I do not pass it to advertisers. I run no analytics, and there is no revenue here that could make any of that attractive later.

6. Transfers outside the European Union

Two of the providers in section 5 are in the United States and one contracts from Singapore, so some of your data leaves the European Union. Your photos, your videos and the sync server stay inside it.

The European Commission adopted an adequacy decision for the EU-US Data Privacy Framework, Commission Implementing Decision (EU) 2023/1795. A transfer to a US organisation holding a current certification under that framework rests on Article 45 GDPR and needs no further safeguard. Where a provider is not certified, or sits in a country with no adequacy decision of its own, the transfer needs standard contractual clauses under Article 46(2)(c) GDPR instead. Singapore has no adequacy decision. I will not claim a certification I have not checked.

I checked the Data Privacy Framework list on 19 September 2026. Vercel Inc. holds a current certification under the EU-US Data Privacy Framework. Resend is listed as active with a re-certification under review, so its certification stands while the renewal is examined; it contracts as Plus Five Five, Inc. Supabase is not on the list and does not need to be: it contracts through Supabase Pte. Ltd. in Singapore, and its agreement carries the standard contractual clauses, which accepting the agreement has the same effect as signing. Bunny is not on the list either, because it is a European company, BunnyWay d.o.o. in Ljubljana.

None of this rests on the framework alone. Resend’s data processing addendum incorporates the standard contractual clauses and defines the transfers they cover as those no adequacy decision reaches, so they take over by their own terms if the framework falls. Vercel’s incorporates them as well and does not mention the framework at all; that document is written for an enterprise agreement and reaches an account like mine through the clause in Vercel’s general terms that incorporates it by reference. Both transfers therefore have a second basis under Article 46(2)(c) GDPR.

These are the regions each provider is set to, read from its console rather than estimated. The database is in Central EU, Frankfurt. Videos are stored in Frankfurt and replicated to Stockholm. Photos and the sync server are in Falkenstein. Bunny’s delivery network is restricted to European Union locations, which its processing agreement treats as my standing instruction not to route data outside the Union. One exception is worth naming: if the player in the app fails on a video, it falls back to Bunny’s own embedded player, which is served from Bunny’s shared domain rather than from the restricted zone.

7. How long I keep your data

Your data lives as long as your account does: delete the account and the account data goes with it.

These are the periods, by kind of data:

• account and profile data: I carry out a deletion request within one month. Article 12(3) GDPR already sets one month for answering any rights request, so this is the same clock, not a second one. There is no grace period and no cooling-off window.
• climbing content you contributed: sector, block and route entries stay in the region under an anonymous author. While an entry is still linked to you, keeping it rests on Article 6(1)(f) GDPR, the legitimate interest being that other members’ logbooks keep their meaning, since their ascents are logged against those entries. Once I sever the author link, the entry is no longer personal data, and retention stops being a data protection question at all. Clause 19 of the terms of service sets out the detail per content type.
• photos and videos: deleting the record a file belongs to deletes the file from storage at the same time. A cleanup task removes an upload that was started but never attached to anything, within 30 days at the latest.
• reports and moderation records: three years. That is the regular limitation period under section 195 of the Bürgerliches Gesetzbuch (BGB), so I keep a decision record for as long as somebody could still bring a claim about that decision.
• feedback: 12 months, counted from your message or from my answer to it, whichever is later. No statute sets a period here. Twelve months is how long a report about a fault stays useful on software that changes every week, and it leaves you long enough to come back to an answer I sent you. After that the record is deleted rather than anonymised, so what you wrote and what I replied both go.
• region statistics: nothing is kept. The numbers in section 10 are counted when the screen is opened and never stored, so there is no period to state here.
• server logs: the hosting, database and email providers hold their own logs under their own retention, and I read them to find faults and to spot abuse. Section 5 lists those providers; I do not set their retention and will not publish a figure I do not control.
• error reports: 90 days. These are the one kind of log I keep myself rather than leaving to a provider (section 2.6), and I delete them once they pass that age. Where one names you, the reference to you goes as soon as I delete your account, and the rest of the report ages out on its own.
• backups: a daily copy of the database, kept for 30 days on the Hetzner server in Falkenstein that section 5 names. Deleting something takes it out of the live database at once and out of the backups within 30 days, and those 30 days are the outside limit on how long anything you delete survives anywhere. The backups exist to bring the service back after a failure, not to reverse a deletion: I do not open one to recover something that was deleted.

8. Your rights

The GDPR gives you rights against me, and you exercise them by writing one email:

• Access, Article 15: a copy of the data I hold about you
• Rectification, Article 16: correction of data that is wrong or incomplete
• Erasure, Article 17: deletion of your data, the “right to be forgotten”
• Restriction, Article 18: a halt on processing while a dispute over it is open
• Portability, Article 20: your data in a machine-readable file you can take elsewhere
• Objection, Article 21: an objection to processing that rests on legitimate interest

Send your request to the email address in section 14, and a person reads it and answers it, because there is no self-serve button for this, including for deleting your account. Article 17 gives you erasure regardless of whether the app offers a delete button. Article 12(3) GDPR sets the period at one month, extendable by two further months for a complex request, and it requires me to tell you inside the first month if I need that extension. I may ask you to confirm who you are before I act on a request about an account.

One limit is worth stating plainly. For content, the remedy I can carry out is deletion. There is no visibility setting on a sector, a block or a route, so I cannot hide an entry and leave it in place. I can remove it.

You can also complain to a supervisory authority under Article 77 GDPR: in the country you live in, the country you work in, or the country where you believe the infringement happened. The authority responsible for me is the Bayerisches Landesamt für Datenschutzaufsicht, Promenade 18, 91522 Ansbach, at lda.bayern.de . It supervises the non-public sector in Bavaria, which is where I live.

9. What is stored on your device

grnyte stores four things in your browser, and each one exists to make the app work:

• an authentication session, so you stay signed in between visits
• your preferences, such as language, units and display choices
• a service worker, the code that lets the app run without a connection
• an offline cache, holding the content you have already opened

All four are strictly necessary to deliver the service you asked for. Section 25(2) Nr. 2 of the Telekommunikation-Digitale-Dienste-Datenschutz-Gesetz (TDDDG) exempts that storage from consent, which is why you see no cookie banner here. There is nothing to consent to.

There are no analytics cookies, no advertising cookies and no third-party trackers of any kind. Nothing here follows you to another site. The fonts are served from this service rather than from a font provider, so opening a page tells nobody but me that you opened it. The map tiles in section 5 go to somebody who is not one of my processors, and they are tiles, not a tracker.

The offline cache puts guidebook data on your device, coordinates and photos included. Clearing the site data in your browser removes it.

10. What I can see

grnyte is not end-to-end encrypted. I can technically read every region, and you should decide what to upload knowing that.

Content is stored readable in the database. Access between members is enforced by Postgres row-level security (RLS): the database refuses to return rows from a region you were not invited to. That control governs the application and its users. It does not govern the person who administers the database, which is me.

What I do with that access is a choice, and here is the choice:

• I do not sell region data
• I do not publish it, and a region cannot be made public
• I do not open a region to anyone the region did not invite
• I look at region content only where operating the service or answering a report requires it

One screen is an exception to that last bullet, because I read it as a matter of routine and not because something has gone wrong. To run the service I need to know whether a region is still in use and how much it holds, so there is an operations screen that shows me counts and nothing else: how much a region holds, how its members split by role, how many routes sit at each grade, and how much happened there in each of the last 12 months.

Numbers are the whole of it. That screen carries no sector, block or route name, no coordinate, no photograph, no video, no ascent and nobody’s name.

One thing does cross that line, and it is the region’s own name. I see the name of every region on the service, and people name a region after the place they climb in. The members of a region see the same numbers for their own region, and they see no other.

What I cannot promise is what a court or an authority can require of me. I hold no professional privilege: I am not a lawyer, a doctor or a journalist, so nothing stored here is protected from seizure the way their records are. Reaching the content of a region generally takes a seizure order, which as a rule a judge has to sign. Reaching your name and your email address takes less than that: section 100j of the Strafprozessordnung lets a prosecutor require them without a judge, and being free and non-commercial does not put this service outside it. Do not store anything here on the assumption that it sits beyond legal reach.

If an order does arrive, I tell you about it, unless I am forbidden to. For an order to hand over information about you under Article 10 of the Digital Services Act, telling you is not a choice I make: the regulation requires it, at the latest when I act on the order.

11. No automated decision-making

Article 22 GDPR does not come into play here. No decision with legal or similarly significant effect is taken about you by automated means. The app does work out statistics, both from your own logbook and across a region, and no decision about you is taken from any of it.

There is no scoring of members, no ranking of people and no advertising profile. The region figures are counts with no name attached: how many people were active, never which ones. The activity feed shows what happened, in the order it happened.

12. Age

You need to be at least 18 to use grnyte.

German law gives a person under 18 only limited capacity to enter a contract: it needs a guardian’s agreement unless it is purely to the minor’s legal advantage. A free account is not that, because these terms put obligations on you, such as the warranties in clause 6 of the terms of service . An 18 year floor keeps the agreement on solid ground rather than leaving it to depend on an approval nobody asked for.

Where processing rests on your consent, and here that is push notifications alone, Article 8 GDPR sets the age at 16 in Germany. Your account itself rests on Article 6(1)(b) GDPR, a contract, as the table in section 4 sets out. The floor above is higher than either.

Sign-up does not ask you to prove your age and I do not verify it. People arrive here by invitation from somebody who knows them, which catches more than a date field would.

I do not knowingly hold data about anybody under 18. Tell me about an account belonging to a minor and I will delete it.

13. Changes to this notice

I update this page when what I do with your data changes. The date at the top records the last change.

Where a change matters to you, I email you about it. I do not hold a change back for a notice period first: keeping this page accurate is the point of it, so a change goes live and you hear about it. Wording fixes and clarifications that do not change what I do with your data go in without an email.

14. How to reach me

One address covers all of it: privacy questions, rights requests, takedown requests and complaints.

Email: info@grnyte.rocks

Post: the address published in the imprint

A person reads that inbox. There is no ticket system, no automated reply and no support queue.