Privacy Policy

1. Who We Are

TORVA Climbing is the data controller responsible for your personal information under this Policy. For privacy questions or to exercise your rights, contact us at hello@torvaclimbing.com or at the address in Section 16.

2. Information We Collect

We collect the following categories of information:

a. Information you provide to us

• Account information: your email address and password when you register.
• Profile information: your first and last name, username, biography, and profile photo. Your legal name is collected so that partner gyms can verify your identity at the front desk when you redeem a day pass.
• Content you create: gym check-ins (“stamps”), visit dates, ratings, notes, posts, captions, photos you upload, comments, and “likes.”
• Social connections: friend requests and connections you make with other users.
• Payment information: if you purchase a Wall Pass, our payment processor (Stripe) collects and processes your payment card details. We do not store full payment card numbers on our systems.
• Mailing list: if you sign up for updates on our website, we collect your email address. Our email provider (Resend) processes and delivers these messages on our behalf. You can unsubscribe at any time.
• Contact and support: if you use our contact form or email us, we collect your name, email address, and the contents of your message. Messages submitted through the website are delivered to us via our email provider (Resend).

b. Information collected automatically

• Location information: with your permission, the App accesses your device’s approximate or precise location while you are using it, in order to show nearby gyms and sort them by distance. You can disable location access at any time in your device settings.
• Device and push information: device type, operating system, and a push notification token (via Expo) used to deliver notifications you have enabled.
• Usage and log data: interactions with the Services, approximate access times, and diagnostic information.
• Cookies: the Site uses strictly necessary cookies and similar technologies to operate and secure the website and to process checkout.

3. How We Use Your Information

We use personal information to:

• provide, operate, and maintain the Services, including your passport, stamps, and social feed;
• enable gym discovery, day-pass redemption, and identity verification at partner gyms;
• process Wall Pass purchases, renewals, and related transactions;
• deliver notifications, mailing-list updates, and communications you request;
• maintain safety and integrity, including content moderation and enforcement of our Terms;
• analyze and improve the Services; and
• comply with legal obligations and enforce our agreements.

4. Legal Bases for Processing

Where the EU/UK General Data Protection Regulation applies, we process personal data on the following legal bases: performance of a contract (to provide the Services you request); your consent (for location access, push notifications, and marketing, which you may withdraw at any time); our legitimate interests (to secure, improve, and promote the Services); and compliance with legal obligations.

5. How We Share Information

We do not sell your personal information. We share information only as described below:

• Service providers: vendors who process data on our behalf under contract, including our cloud database, authentication, and storage provider (Supabase), our payment processor (Stripe), our push-notification provider (Expo), and our email provider (Resend).
• Partner gyms: when you redeem a day pass, the relevant gym receives the information needed to honor the redemption and verify your identity.
• Other users: your username, profile photo, bio, and content you post (stamps, posts, comments, and social activity) are visible to other users as part of the feed and public profiles. Do not post information you wish to keep private.
• Legal and safety: when required by law, subpoena, or legal process, or to protect the rights, property, or safety of TORVA, our users, or the public.
• Business transfers: in connection with a merger, acquisition, financing, or sale of assets, subject to this Policy.

6. Your Content and Public Information

The App includes social features. Your profile and the content you choose to share are visible to other users. You can edit or delete your posts, stamps, and comments, and you can control certain visibility settings in the App. Content may persist in caches or in others’ views for a period after deletion.

7. Data Retention

We retain personal information for as long as your account is active or as needed to provide the Services, comply with our legal obligations, resolve disputes, and enforce our agreements. You may delete your account at any time from the App’s Settings. Deletion is processed immediately: your profile, stamps, posts, comments, redemptions, and associated files are removed from our active, production systems as soon as the deletion completes. Because we maintain routine backups of our database for disaster-recovery purposes, residual copies of your information may persist in encrypted backups for up to 30 days before being permanently purged as part of our normal backup rotation, and will not be restored to active use except to recover from a system failure. Certain information may be retained longer where required by law.

8. Security

We use technical and organizational measures designed to protect your information, including encryption in transit, access controls, and secure, industry-standard infrastructure. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

9. Your Rights and Choices

Depending on where you live, you may have the right to access, correct, update, port, or delete your personal information, and to object to or restrict certain processing. You can exercise many of these directly in the App, or by emailing hello@torvaclimbing.com. You may also:

• turn off location access and push notifications in your device settings;
• unsubscribe from marketing emails using the link in any such email; and
• request a copy or deletion of your personal information as described below.

California residents (CCPA/CPRA)

If you are a California resident, you have the right to know the categories and specific pieces of personal information we collect, the sources and purposes, and the categories of third parties with whom we share it; to request deletion or correction of your personal information; and to not be discriminated against for exercising your rights. We do not sell or share personal information for cross-context behavioral advertising as those terms are defined under California law. To submit a request, email hello@torvaclimbing.com; we will verify your request before responding, and you may use an authorized agent.

EEA/UK residents (GDPR)

If you are located in the European Economic Area or the United Kingdom, you have the rights described above and the right to lodge a complaint with your local supervisory authority. Where we transfer data outside your region, we rely on appropriate safeguards such as Standard Contractual Clauses.

10. Children’s Privacy

The Services are not directed to children under 13, and we do not knowingly collect personal information from anyone under 13. If you believe a child under 13 has provided us personal information, please contact us and we will delete it. Users must be at least 18 years old (or the age of majority in their jurisdiction) to purchase a Wall Pass.

11. International Users

TORVA is based in the United States, and your information will be processed in the United States and other countries where our service providers operate. These countries may have data-protection laws that differ from those in your country.

12. Third-Party Services and Links

The Services may link to or integrate with third-party websites and services, including partner gyms and the Apple App Store and Google Play. Their privacy practices are governed by their own policies, and we are not responsible for them.

13. Changes to This Policy

We may update this Policy from time to time. We will post the updated version with a new “Last updated” date and, where required, provide additional notice. Your continued use of the Services after an update constitutes acceptance of the revised Policy.

14. Do Not Track

Some browsers offer a “Do Not Track” signal. Because there is no common industry standard for responding to these signals, the Site does not currently respond to them.

15. Data Protection Contact

If you have questions or concerns about this Policy or our handling of your information, contact us first and we will work to resolve them.

16. Contact Us

Torva Climbing LLC
424 Mine Rd, Asbury, NJ 08802
hello@torvaclimbing.com