Effective date: 2026-07-23 Last updated: 2026-07-23
1. Who we are
This Privacy Policy describes how WINE PLUS LTD ("we", "us", "our") collects, uses and shares your personal data when you use the Bouldy mobile application (the "App").
Data controller:
- Legal entity: WINE PLUS LTD
- Registered office: 58 Harehills Road, Leeds, LS8 5LE, England
- Contact: support@bouldy.app
We are registered in the United Kingdom and we comply with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.
2. Personal data we collect
Information you provide to us
- Account information: if you choose to sign in, the email address associated with your Apple or Google account. Bouldy creates an anonymous account on first launch, so you can use the App without providing any personal details.
- Profile data: display name (optional) and the avatar you pick.
- Party data: the parties you create or join, and your membership in them together with the teammates you climb with.
- Support correspondence: the content of messages you send to us when contacting support.
Information collected automatically
- Device information: device model, operating system version, locale, timezone
- Anonymous identifiers: IDFV, analytics anonymous IDs generated by third-party SDKs
- Advertising identifier (IDFA): only if you grant permission via Apple's App Tracking Transparency prompt
- Usage data: screens viewed, features used, interaction events within the App
- Subscription status and purchase history: synced from Apple's App Store via Adapty
Information generated by the App
- Activity data: your alarms, completed push-up sessions and rep counts, meters climbed, streaks, and your party's progress up each mountain.
3. Camera and push-up detection
To count your push-ups, the App uses your device camera together with on-device pose detection.
- The camera feed is processed live on your iPhone to count reps.
- Camera images and video are never recorded, stored, or transmitted off your device — not to us and not to any third party.
- Only the resulting rep count (a number) is used in the App and synced with your account so your party's climb stays up to date.
4. How we use your data
We use your personal data for the following purposes:
| Purpose | Lawful basis (UK GDPR) |
|---|---|
| Providing the App's core features (alarms, push-up sessions, parties, climbs) | Performance of a contract |
| Managing your account and authentication | Performance of a contract |
| Processing subscription purchases and managing entitlements | Performance of a contract |
| Measuring analytics, attribution, and app performance | Legitimate interest |
| Sending service updates and security notices | Legal obligation |
| Preventing fraud, abuse, and security incidents | Legitimate interest |
| Advertising measurement (when IDFA consent granted) | Consent |
5. Third parties we share data with
We share personal data with the following categories of service providers who act as data processors on our behalf:
Core infrastructure
- Supabase — backend database and authentication infrastructure
- Expo — mobile app build and distribution platform
Subscription and billing
- Apple In-App Purchase — payment processing (we do not receive your payment card details)
- Adapty — subscription management and entitlement sync
Analytics and attribution
We may also disclose personal data where required by law, to respond to lawful requests from public authorities, to protect the rights, safety, and property of WINE PLUS LTD or our users, or in connection with a merger, acquisition, or sale of assets.
We do not sell your personal data, and we do not serve advertising inside the App.
6. Your rights under UK GDPR
If you are located in the United Kingdom or the European Economic Area, you have the following rights regarding your personal data:
- Right of access — obtain a copy of the personal data we hold about you
- Right to rectification — request correction of inaccurate or incomplete data
- Right to erasure — request deletion of your account and associated data. You can do this directly in the App via Profile → Delete Account, or by emailing support@bouldy.app
- Right to restrict processing — request that we limit how we use your data
- Right to data portability — request a copy of your data in a machine-readable format
- Right to object — object to processing based on legitimate interests, and to direct marketing
- Right to withdraw consent — where processing is based on consent, you can withdraw it at any time
- Right to lodge a complaint — with the UK Information Commissioner's Office (ico.org.uk) or your local supervisory authority
To exercise any of these rights, please contact us at support@bouldy.app. We will respond within one month.
7. Data retention
- Active accounts: we retain your personal data for as long as your account is active.
- Account deletion: when you delete your account using the in-app Delete Account feature, your personal data is permanently removed from our systems, including your profile, activity history, and party membership.
- Inactive accounts: accounts that have been inactive for 3 years may be automatically deleted.
- Third-party analytics: anonymised analytics data already transmitted to third-party providers (such as PostHog or AppsFlyer) is retained by those providers according to their own retention policies.
- Legal obligations: we may retain certain information for longer where required by law, to resolve disputes, or to enforce our agreements.
8. Security
We implement reasonable administrative, technical and physical safeguards to protect personal data against unauthorised access, alteration, disclosure, or destruction. These include encryption of data in transit, access controls limiting who can view personal data, and row-level security on our database.
No method of transmission over the internet is completely secure, and we cannot guarantee absolute security.
9. Children's privacy
The App is not intended for use by children under the age of 16. We do not knowingly collect personal data from children under 16. If you are a parent or guardian and you believe that your child has provided us with personal data, please contact us at support@bouldy.app and we will promptly delete it.
10. International data transfers
Some of the third-party service providers we work with (such as PostHog, AppsFlyer, Adapty) are located outside the United Kingdom and European Economic Area, including in the United States. Where we transfer personal data outside the UK/EEA, we rely on appropriate safeguards including:
- UK and EU Standard Contractual Clauses
- Adequacy decisions recognised by the UK government
- Data Privacy Framework certification (where applicable)
11. Changes to this policy
We may update this Privacy Policy from time to time. We will post any changes to this page and update the "Last updated" date above. Material changes will be communicated through in-app notices or by email where reasonable. Your continued use of the App after a change takes effect constitutes acceptance of the updated policy.
12. Contact us
For any questions, requests, or complaints regarding this Privacy Policy or your personal data, please contact:
WINE PLUS LTD Email: support@bouldy.app Postal address: 58 Harehills Road, Leeds, LS8 5LE, England
If you are not satisfied with our response, you have the right to lodge a complaint with the UK Information Commissioner's Office at ico.org.uk.