Cutloose

Privacy Policy

Last updated November 7, 2026

This policy covers the Cutloose iPhone app, the website at cutloose.dev and its email list. It is written to be read, not skimmed past, so it says exactly what leaves your phone and what doesn't.

• Who we are
• What we collect, at a glance
• What stays on your phone
• Your account
• Your climbing log
• Wall scans
• Route photos
• Erase holds
• Research sharing
• Cloud backup
• Location
• Notifications
• Purchases
• Body-position analysis
• Who else sees your data
• Where data is processed
• How long we keep it
• Deleting your account
• Your rights and choices
• Children
• Security
• This website and the email list
• Changes
• Contact

Who we are

Cutloose is made by Arcane Forge Technical Solutions Inc., a corporation incorporated under the laws of Canada ("we", "us"). We decide how and why the data described here is used, which makes us the controller under European law. Write to us at cutloose.app@gmail.com (the postal address is at the end of this page). We have not appointed a data protection officer; the law doesn't require one of a company our size, and the founder answers privacy mail personally.

What we collect, at a glance

This table mirrors the App Privacy label on the App Store. Everything in it is linked to your account. Nothing is used to track you across other companies' apps or websites.

Not collected: your climbing videos and audio unless you choose it, by turning on Backup (off by default), by attaching a single attempt's clip to a feedback message, or by turning on research sharing (off by default); body-position data (the research exception only), your GPS coordinates, contacts, health records, browsing history, payment card details, advertising identifiers. The app has no third-party analytics or crash-reporting SDK. When the app crashes, it sends us its own crash report on the next launch (see Crash reports): the build, your iPhone model and iOS version, how it stopped and where in our code, never your footage, your log or anything you typed.

What stays on your phone

• Your recordings. Every climbing video you film, with its audio if you allowed the microphone, is written to the app's own storage on your iPhone and nowhere else. It is not uploaded, not backed up by us and not reachable by us, unless you turn on Backup or research sharing. A video you import from your Photos library is treated the same way: it is copied into the app's own storage on your iPhone, cut and logged like a recording, and stays there; the app reaches only the video you pick, never the rest of your library. If you export a reel it is saved only where you send it: your Photos library or the share sheet. Settings offers to clear recordings after 30 days; otherwise they stay until you delete them or the app.
• The analysis. After a recording ends, the app looks at sampled frames on the phone to cut it into attempts, work out which holds you touched and call each attempt a send or a fall. The results (where each attempt starts and ends, the call, the route) go into your log. The movement summary behind them is kept on the phone beside the recording and deleted with it. See Body-position analysis.
• Your log, locally. The log lives in the app's database on your phone, which iCloud device backup includes if you have it on; a copy syncs to us as described next. Deleting the app deletes everything local.

Your account

The first time the app runs it creates an anonymous account: a random id with no name, email or phone number attached. That id is what your synced log, scans and notification token are filed under.

If you choose Sign in with Apple, Apple links its stable identifier to the same account, and the app receives the name and email address you allowed Apple to share (the email may be Apple's private relay address). We use them only to sign you in on another phone and to recognise you when you write to support. We never try to work out who is behind a relay address. Your account id, log and scans stay the same when you link.

Your climbing log

What syncs is the log, not the footage: each problem (the name the app or you gave it, hold colour, the wall it's on, a colour signature and where on the wall it sits), each session (gym, date, minutes of footage), each attempt (the call, whether it was a flash, when it was climbed, how long it took, which part of the recording it is, whether the phone was propped or handheld and, for a video brought in from Photos, when it was imported) and each project. We also keep what the app proposed and what you chose on the route and wall screens, to measure how often it was right. The log is private to you. We don't read it; the admin tools show only counts.

Wall scans

Scanning a wall is a separate mode you choose in the app's recorder. It is the one feature where photos leave your phone, so here it is in full.

• What a scan contains. Up to about 80 photos of the wall, the phone's position for each (from ARKit), a sparse cloud of tracked points, the compass heading, your device model and iOS version, the time, the gym, and the wall name you type. A scan does not contain your climbing footage.
• Where it goes. When a scan finishes and the phone is online (cellular included), it uploads to private storage at Cloudflare R2. A server we operate ourselves downloads it, builds a 3D model, a panorama and still images of the wall, and writes those back. A nightly backup copies the storage to Backblaze B2. The record of the scan (not the photos) lives in Supabase.
• What is shared. The 3D model, the panorama and the wall images are shown to every Cutloose user who looks at that gym. The wall name you typed is shown with them. Your account id, device and the time you scanned are not: other climbers can't see who scanned a wall.
• Other people in the frame. Scan when the wall is clear: someone walking past ends up in the photos, and the photos are uploaded with the scan. The phone measures how much of each photo a person fills, notes it on the scan (the PEOPLE IN FRAME line on its receipt) and prefers a photo with nobody in it for the wall's picture, but it does not drop photos for it; no face recognition is run on any photo, ever. If you find yourself in a wall model, use Report this wall on its page in the app or write to cutloose.app@gmail.com, and we will remove the photos or the model.
• Staff access. The founder can open a scan's raw photos to check quality or act on a report. Each such view is logged with a reason.
• After deletion. When you delete your account, your raw scan photos are deleted from storage and the backup copies expire within 30 days. The shared wall model, panorama and images built from them stay as part of the gym's record, with your account id removed. The scan's entry stays with the id removed too (the device model, iOS version, time, gym and distance stay on it; nothing that names you).

Route photos

When you confirm the route of a propped recording, or take the one photo of the wall the app asks for after a handheld recording, the app may upload that one still of the wall together with the holds you picked. It helps us make route detection better. Before anything is sent, the phone checks the picture with Apple's on-device person, face and body detectors; if any of them finds someone, nothing is uploaded. Route photos are stored privately, never shown to other users, and linked to your account only while it exists: when you delete your account they are unlinked and kept with no account and no date finer than the month. The switch is in Settings, Share route photos, on by default; the app also shows a one-time notice before the first upload.

Erase holds

In the player, an attempt filmed from a stand with its route picked offers ERASE, which paints the other routes' holds out of your clip. Nothing happens until you tap it. The phone then builds one still of the wall from frames in which nobody is in view, checks it with Apple's on-device person detector (if someone is found, nothing is sent), and uploads that still together with a mask of the holds to paint out, to private storage at Cloudflare R2. A server we run ourselves fills the holds in and writes the result back; your phone downloads it and lays it behind you, locally. No video and no sound leave the phone for this; the clean clip is made on your phone. The still, the mask and the result are deleted 7 days after the upload, are never shown to other users, are not part of the nightly Backblaze copy, and are deleted at once with your account. The job record (when, which attempt, how it went) stays with your account. Up to five erases a day. Legal basis (EEA, UK, Switzerland): performing the service you asked for by tapping ERASE.

Research sharing

Settings has a switch, Share recordings for research, which is off unless you turn it on. With it on, every recording you make from then on is sent to us, including recordings you delete without logging them, together with what the app worked out about it and what you corrected, so that attempt splitting, send detection and route detection can be measured and improved against real climbing. Turning it on also sends the recordings already on your phone at that moment. Nothing is sent while it is off.

• What is sent. The recording, re-encoded at 720p and 30 frames per second with the sound removed; the app's analysis of it (the clean picture of the wall it worked out, where it thinks each attempt starts and ends, the holds it thinks you touched, its send or fall call for each attempt, the body-position skeletons it estimated in sampled frames, and the phone's motion-sensor readings during the recording); the wall photo you take after a handheld recording; and your answers and corrections (the cuts you changed, the route and wall you picked, every result you changed, trimmed, merged, split or deleted afterwards). Other people who happen to be in your shot are in the recording too, so film where that is OK.
• How it is sent. Over Wi-Fi only, unless you also turn on the cellular option under the switch. The app stages the files on your phone and sends them when it is idle; staged files are deleted once sent, and the whole staging area is deleted if you turn the switch off.
• Where it goes. Private storage at Cloudflare R2, with the nightly backup at Backblaze B2, and a copy on a server we operate ourselves where the analysis is replayed and scored. The record of each bundle (not the video) lives in Supabase. Nothing is ever shown to other users or published.
• Turning it off stops future uploads at once and withdraws your consent for the future; it does not delete what was already sent. Deleting your account does not delete shared recordings either: they are kept with the link to your account removed, as the deletion section says. To have them removed, email cutloose.app@gmail.com and we delete every bundle of yours, including backup copies within 30 days.
• Legal bases (EEA, UK, Switzerland): your consent, given by turning the switch on and withdrawn by turning it off, for the collection and upload; and our legitimate interest in improving the detectors the app is built on, with the audio removed and the link to your account removed, balanced by the removal route above, for keeping what was shared after the switch goes off or the account is deleted. Nothing in a shared recording is used to identify anyone (Body-position analysis).

Cloud backup

Settings has Backup, which is off unless you turn it on, and asks you to sign in with Apple first so the copy can be found again from another phone. With it on, the app cuts each attempt it is set to keep out of your recording and uploads that clip to private storage, so a lost or replaced phone does not take your climbs with it.

• What is sent. The attempt's clip, with its sound, re-encoded at 1080p (Cutloose Studio keeps sends at their original quality), and for each clip its length, size, digest and the attempt it belongs to. The rule is yours: sends only (the default), sends and project attempts, or everything, and you can pin or exclude any attempt by hand. A free account can hold 5 GB; Studio 100 GB. Nothing else from your recordings is sent.
• How it is sent. Over Wi-Fi only, unless you turn on the cellular option under the switch, while the phone is idle or charging. The app stages the files on your phone and deletes them once they have landed.
• Where it goes. Private storage at Cloudflare R2, with the nightly copy at Backblaze B2. The list of your clips, not the video, lives in Supabase. Your phone fetches a clip with a short-lived link that only your signed-in account can obtain. Nothing is shown to other users or published, and our admin tools show counts and sizes, not the clips.
• Deleting a clip. Delete clips in the app one at a time or all at once; a deleted clip can be put back for 30 days, then it is gone, and the nightly copy expires within 30 days after that. Removing a clip from the cloud library, or deleting your account, is what removes a stored clip; nothing else does. Turning Backup off stops uploads at once; what is already stored stays until you delete it or your account.
• When Studio ends. Nothing is deleted. If you hold more than 5 GB, new clips wait until you are under it; everything stored stays available to view and restore.
• Legal bases (EEA, UK, Switzerland): performing our contract with you, since you turn Backup on to have us keep the copy, and your consent for the upload itself, withdrawn by turning the switch off.

Feedback

Settings has Send feedback. What you type there, the email you give if you want a reply, and your app version, iPhone model and iOS version are stored with your account and read by the founder on our admin tools. You can attach one attempt from your log: the app cuts that attempt from its recording, re-encodes it at 720p and uploads it privately. The clip keeps its sound. Nothing is read from your recordings without that pick, and only the attempt you pick is sent. A clip may show other people, so attach one only when they'd be fine with the founder seeing it. The founder views a clip through a logged action with a stated reason, never downloads it to share, and it is never shown to other users. Clips are deleted after 180 days; the message stays until you delete your account. The email you type is used to answer that message and for nothing else. An alert tells the founder a message arrived and whether a clip came with it, and nothing of what you wrote.

Location

The app asks for your location only while you scan a wall or pick a gym, to work out which gym you're in and to put nearby gyms at the top of the list. Your coordinates are used on the phone and are not stored or sent to us. What is stored is the gym (and whether the app chose it from your location or you picked it), on each scan and in your home-gym setting, and, on each scan, how far the phone was from that gym, rounded to 50 metres. A gym plus a date is building-level location, so treat your log as that private. If you add a gym that isn't in the directory, the map opens near your position but no location is saved until you move the map and put the pin on the gym; the pin, the name and the address then become that gym's public entry. Gym locations in the directory come from OpenStreetMap contributors (ODbL) and from climbers who added them.

Notifications

If you allow notifications, the app stores the device token Apple issues, your app version, language and time zone, so we can send "new wall at your gym" alerts (and later, quiet hours). Apple delivers the notification. Each one we send is recorded with the wall and gym it named. Turn them off in Settings in the app or in iOS; the token is marked revoked and is deleted with your account.

Purchases

Cutloose Studio is an optional auto-renewing subscription (CAD 59.99 a year with a 7-day free trial, or CAD 6.99 a month) sold through Apple's in-app purchase. Apple takes the payment, holds your card and gives refunds; we never see your card details or your Apple ID. RevenueCat, our subscription processor, receives from Apple the transaction identifiers and the receipt for your purchase together with your anonymous account id, and keeps from them your subscription status: the product, whether it is active, in a trial, cancelled or expired, the renewal date, and whether it was made in Apple's sandbox or for real. Our servers keep a copy of that status against your account so the app can unlock Studio on every phone you sign in to and set your backup allowance; the admin tools show it as counts. Nothing about a purchase is used for advertising or shared beyond Apple, RevenueCat and us.

Your purchase history stays with your account while it exists and is deleted with it, at RevenueCat too. Apple keeps its own record of your purchases under Apple's policy; cancelling is done in your iPhone's Settings under Subscriptions, and Restore purchases in the app asks Apple to recognise a subscription on a new phone.

Refer a friend

Settings has Refer a friend, a code and a link you can share; the programme's terms say what it pays and when. If you use it we store which account referred which, the earnings and refunds behind your balance (each tied to one of Apple's transaction identifiers, never to a card), and, while a payout request is open, the PayPal or Wise address you give us to pay you; that address is removed once the request is settled or withdrawn. Your friend never learns that you earned from them, and you never learn who your friends are beyond a count. On its first launch the app checks, without reading it, whether your clipboard holds a web link, so it can offer to paste a friend's link; nothing is read unless you tap Paste, and the check happens once per install. The referral record is deleted with your account; the money rows stay in our books with your id removed, as accounting records must.

Crash reports

When the app crashes, iOS hands it a diagnostic on the next launch and the app sends that to us with your account id: the app build, your iPhone model and iOS version, the kind of failure and the places in our own code where it happened, as positions in the program, not source or screen contents. It never includes your footage, your log, your location or anything you typed. We read these on our admin tools to fix the crash; no third-party crash or analytics service is involved. They are kept until you delete your account.

Body-position analysis

This section doubles as our written policy on biometric-style data, for climbers in places whose laws ask for one.

• To cut a recording into attempts and call sends and falls, the app uses Apple's Vision framework on your phone to estimate where your joints are in sampled frames. It is the same kind of skeleton a fitness app draws.
• It is never used to identify anyone. No face template, no fingerprint, no voiceprint and no signature of your body is made, by us or by any service we use.
• The raw joint positions are used in memory during analysis and discarded. A summary of the movement (when a climber was on the wall, which holds were touched) is kept on the phone beside the recording and deleted with it. Nothing pose-related is uploaded, stored on our servers, sold or shared, with one exception: with research sharing on, the estimated skeletons of sampled frames are sent with the recording, to replay the analysis. They are still never used to identify anyone.
• Retention, in short: on your phone, for as long as the recording; off your phone, never, unless you turned research sharing on.

Who else sees your data

Other climbers see what Wall scans says: shared walls, with your name and id kept out. They never see your log, your recordings, your gym answers or your account.

Service providers process data on our behalf, each under a contract that binds them to protect it at least as well as this policy does and to use it only to provide their service to us:

• Supabase: accounts, the database and the functions behind sync, deletion and notifications.
• Cloudflare: scan, wall and backed-up clip storage (R2), delivery of wall models to the app, and this website.
• Backblaze: the nightly copy of our storage: scans, walls, backed-up clips and our encrypted database copies.
• Apple: Sign in with Apple, push notifications, in-app purchase, maps and location on the phone.
• RevenueCat: subscription status, from the Apple transaction and receipt it receives for a Studio purchase (see Purchases).
• Resend: the website's email list (below).
• ntfy.sh: alerts to the founder when the wall-building server needs attention and when a feedback message arrives. An alert can name a scan's storage path, which includes the scanner's account id, or say that a feedback message came with or without a clip, and nothing else about you.
• Our own server: the computer that builds wall models, which we run ourselves. Scan photos are on it while a wall is being built and in its working files afterwards.

Staff means the founder. The admin tools show accounts by id, with your email hidden unless revealed through a logged action, counts of your log rather than its rows, your scans in full, and the feedback you send, including the email you typed into it. The law: we disclose data if legally required to, and we tell you first unless the law forbids it. A sale of the company would pass data to the buyer under this policy, and we would tell you. We do not sell personal information, share it for advertising, or combine it with data from other companies.

Where data is processed

Supabase and Backblaze hold data in the United States. Cloudflare stores and caches it in its global network. Our own server is operated by us. If you use Cutloose from the European Economic Area, the United Kingdom or Switzerland, your data is transferred to the United States; our providers rely on the EU-US Data Privacy Framework where they are certified and on the European Commission's standard contractual clauses (and the UK addendum) otherwise. Write to us for a copy of the safeguards.

How long we keep it

Anonymous accounts that were never signed in with Apple are kept like any other until deleted from the app; we may in future remove accounts with no activity for a long time, and will say so here first.

Deleting your account

In the app: Settings, then Account, then Delete account & data. If you signed in with Apple, the app asks Apple to confirm it's you and revokes the sign-in. Then, at once and in one step: your raw scan photos, backed-up clips and feedback clips are deleted from storage, your account is deleted, and with it your log, gym answers, telemetry, reports, feedback messages, notification token, subscription status (and your customer record at RevenueCat) and records. On the phone, the app wipes its database, your recordings and its working files. Database backups expire within about two weeks and are never used to bring an account back, so this cannot be undone.

What remains: shared wall models and images and gyms you added, with your id removed; route photos, anonymised; recordings you shared for research, kept with the link to your account removed (deleting your account does not withdraw that; the switch and an email to us do, see Research sharing); the admin log of any action taken on your account; backup copies of scan photos, backed-up clips and feedback clips for up to 30 days, and the database backups above until they expire; and whatever you exported or shared yourself. If you can't open the app, email cutloose.app@gmail.com from the address you signed in with, or describe your account, and we'll delete it for you.

Your rights and choices

Wherever you live, you can ask us what we hold about you, ask for a copy in a portable form, ask us to correct or delete it, or object to how we use it. Write to cutloose.app@gmail.com; we answer within 30 days and may ask you to prove the account is yours. We never treat you differently for asking.

• Permissions for the camera, microphone, location and notifications are yours to change at any time in iOS Settings. Backup, route photos and research sharing have their own switches in the app.
• EEA, UK and Switzerland. Our legal bases: performing our contract with you (the account, sync, wall models you ask for, the Backup you turn on, Studio); your consent, given through the iOS prompts, the Backup switch, the Share route photos switch and the Share recordings for research switch, which you can withdraw there; our legitimate interests in keeping the service secure, measuring whether the app's suggestions are right, improving the detectors from recordings shared for research after the switch is off or the account deleted (as Research sharing describes), and building shared wall records, including the incidental processing of people who happen to be in a scan or a shared recording, which we limit as Wall scans and Research sharing describe; and legal obligations. You can also complain to your data protection authority.
• United States. We don't sell personal information or share it for cross-context behavioural advertising, so there is nothing to opt out of. Residents of states with privacy laws can exercise the rights above by email; if we ever decline a request you can appeal by replying.
• California. We don't track you across other sites or apps, so a browser's Do Not Track signal changes nothing. We don't disclose personal information to third parties for their direct marketing.
• Washington, Nevada and Connecticut consumer health data. A climbing log could be read as fitness data. We collect it only to run the app for you, we don't sell it or share it for advertising, and you delete it by deleting your account. The analysis of your body position stays on your phone (Body-position analysis). Questions and requests: cutloose.app@gmail.com.

Children

Cutloose is for climbers aged 13 and over (16 and over in the European Economic Area and the United Kingdom). We don't knowingly collect information from anyone younger. If you believe a child has an account, write to us and we'll delete it.

Security

Data travels encrypted (TLS) and is encrypted at rest by our providers. Every row in our database is protected by access rules that let only your account read your data. Scan uploads use signed URLs that expire. When the app creates your account it proves it is a genuine copy of Cutloose on a real iPhone through Apple's App Attest, and we store that key's id with your account; sign-ups the check could not verify are logged with the IP address they came from for 30 days. The admin tools sit behind two layers of sign-in with a second factor, and every sensitive action in them is logged. No system is perfectly secure; if a breach affects you we will tell you and the authorities as the law requires.

This website and the email list

cutloose.dev sets no cookies and stores nothing in your browser. It has no ads, no tracking pixels and no social media plugins. Cloudflare hosts it and, to deliver and protect it, processes what every web request carries: your IP address, browser type, the page you asked for and when. Cloudflare keeps standard request logs under its own policy; we don't use them to identify you.

If you sign up for the email list, we keep your address and when you signed up, for two emails: one right away saying you're on the list, and one when the app is out. Nothing else, and never for anyone else's marketing. There is no confirmation step, so sign up only with an address you own; if an address was entered without its owner's say-so, the unsubscribe link in either email removes it in one click, or write to us. The list is stored with Supabase in the United States, without your IP address, and the emails are sent through Resend. The address is deleted within 30 days after the launch email, or as soon as you unsubscribe.

Changes

When this policy changes, the date at the top changes with it. If a change means we collect something new or use data in a new way, the app will tell you before it applies.

Contact

Arcane Forge Technical Solutions Inc.
23 Edgewood Ave, Unit 104
Toronto ON M4L 3G8
Canada
Privacy: cutloose.app@gmail.com
Everything else: cutloose.app@gmail.com