Privacy Policy

PeakMeUp is a climbing training service designed around assessment, training, logging, check-ins and adaptation. The current beta focuses on helping athletes record and understand their climbing information.

For privacy questions or a data request, contact the PeakMeUp operator through the contact channel provided during your onboarding or invitation. A dedicated public privacy email address is not currently available.

PeakMeUp processes information you provide, information returned by Google during sign-in, and the technical records needed to keep an account and its access boundaries working.

• Google authentication and profile information: a Google account identifier, email address, email-verification state, display name and profile image URL may be processed during sign-in and in the encrypted session cookie.
• Account and directory information: an internal PeakMeUp account identifier, a generated member number, and provider-synchronized display name, email and verification state.
• Climbing and training information: training-session date, type, duration, session RPE and optional notes, plus the climbing history, grades, goals, availability, training background, self-assessments and recovery inputs in the Initial Assessment.
• Profile information: date of birth, collected for the closed-beta age gate and age-aware training design.
• Safety and recovery information: two structured pain/injury or movement-restriction flags, plus self-rated sleep, sleep-duration band, life stress and fatigue inputs.
• Coaching and invite information where applicable: an active coaching relationship, a coach-facing label, and the email and lifecycle records needed to create and redeem a Coach Invite.

PeakMeUp uses Google Sign-In through Auth.js and Google OpenID Connect for authentication. The sign-in request uses the standard OpenID Connect, profile and email scopes. PeakMeUp uses the validated Google subject as the provider identity and maps it to an internal PeakMeUp account identifier; email is not used as the ownership key.

The sign-in flow may process the Google account subject, email address, email-verification state, display name and profile image URL. These claims are held in the encrypted JWT session cookie in the athlete's browser for the configured eight-hour session lifetime. They are not copied into the PostgreSQL identity mapping except for the Google subject and the separate directory fields described above.

The validated ID-token claims are used during the callback, including the fresh authentication evidence required by the fixed-purpose Coach Invite flow. PeakMeUp does not persist a Google ID token, access token, refresh token, authorization code or password.

PeakMeUp does not request or use Gmail, Google Drive, Google Calendar or Google Contacts data. Google Sign-In is used for authentication and account identification, not advertising. PeakMeUp does not sell Google user data.

The logbook stores the date, type, duration and 1–10 effort rating (session RPE) for a training session, plus optional athlete-written notes. RPE is a training-effort measure, not a medical assessment. Notes are free text: PeakMeUp does not ask for medical information there, but anything you write could contain personal or health information and should be treated as sensitive.

The Initial Assessment stores climbing background, performance measurements, goals, motivation, training history, availability, difficult styles, training resources and four closed recovery/wellbeing inputs. Some earlier assessment rows use an older schema version; they remain under the meaning they had when submitted.

The assessment also stores exactly two structured safety flags: whether current pain, injury or physical restriction affects climbing or training, and whether a medical or physiotherapy professional currently restricts exercise or movement. The product does not collect a diagnosis, pain location, pain intensity, treatment history or a medical-history narrative. It is not a medical provider and does not diagnose, triage or recommend treatment.

If a safety flag requires attention, the current assessment flow presents a neutral notice and does not itself create a medical review queue or prescribe training intensity. Recovery and wellbeing answers are self-ratings and bands, not device measurements or imports from another service.

PeakMeUp uses the information above to:

• to authenticate you and create or identify your PeakMeUp account;
• to synchronize the limited Google profile fields used by the directory;
• to store and show your own profile, logbook and assessment information;
• to apply the closed-beta 18+ eligibility rule and support age-aware training design;
• to support training personalisation and safety gating;
• to enforce access control, including the fixed-purpose Coach Invite flow and active coaching relationships; and
• to operate, secure and investigate the application and to respond to privacy or deletion requests.

A coach does not receive access merely by having a coach role. An active, explicit assignment is required. For an assigned athlete, the Coach workspace can show the factual Initial Assessment answers and the two safety flags read-only, along with the limited directory information needed to identify the athlete.

The current Coach boundary does not expose the athlete's profile, acknowledgement audit, logbook/training sessions, plans or athlete email address. Coaching access ends when the assignment is ended. Coach Invite redemption is a separate, fixed-purpose flow that requires a fresh, verified Google authentication claim and an exact invited-email match.

PeakMeUp does not add analytics, advertising trackers or social scripts. The current application has no AI provider connection and does not send your training data to an external AI model.

Google processes the sign-in interaction as the identity provider. PeakMeUp's application and database are hosted on an OVHcloud VPS in Sydney, Australia.

The operator may access data when carrying out documented operational, security, support or deletion work. Data is not sold. Data is not shared with a coach outside the narrow active-assignment boundary described above.

PeakMeUp uses access controls that restrict stored information by role and coaching relationship. Provider access, refresh and ID tokens are not stored in PostgreSQL. The encrypted session cookie remains in the athlete's browser for up to eight hours.

Account and training data are retained while the account exists. A verified deletion request is handled through an operator-managed process with a target completion time of 30 days.

Terminal Coach Invite records are retained for 90 days for operational audit and may then be removed through a manual operator process.

There is no self-service account-deletion button in the current beta. To request deletion, contact the PeakMeUp operator through the onboarding or invitation contact channel. The operator verifies the request, removes the account data through an operator-managed process and confirms completion. The target is within 30 days.

Corrections to immutable profile or assessment records are also operator actions in the current beta. PeakMeUp does not claim that a request-time user interface can edit or remove those records.

PeakMeUp uses Google Sign-In, protected sessions and technical access controls that restrict information by role and active coaching relationship. Provider access, refresh and ID tokens are not persisted. Coach Invite access is limited to its specific invite flow.

No security measure is perfect. If you believe your account or data has been exposed, use the PeakMeUp operator contact channel as soon as possible.

Depending on where you live and which rules apply to your situation, you may have rights to request access to personal data, correction, deletion, restriction or objection, and a copy of data. The current beta handles access and deletion requests through the operator; it does not provide a self-service export or rights portal.

This notice describes how information is handled without stating a particular lawful basis or claiming compliance with a specific privacy law.

PeakMeUp's production application and database are hosted in Sydney, Australia, outside the EEA. The applicable international-transfer mechanism and safeguards have not been approved or stated in this notice.

The closed beta is for people aged 18 or older. The application checks date of birth against a UTC calendar date. Supporting athletes under 18 would require separate legal, privacy and product review and is not part of the current beta.

PeakMeUp may update this notice when the product's data handling changes. The last-updated date at the top of this page identifies the current version. Material changes should be reviewed before using the affected feature.

For questions, access requests, corrections or deletion requests, use the PeakMeUp operator contact channel provided during onboarding or invitation. A dedicated public privacy contact address is not currently available.