Updated July 27, 2026

Privacy

Cols is a private collection. The principle behind everything below: we collect only what it takes to recognise a climbed col and place it in your album, and we give it to no one.

What we collect

Your account

The app creates an anonymous account on first launch: a random identifier, nothing else. No email, no name, no password. If you later choose to sign in with Apple or Google to find your album on another device, we keep the identifier that service returns to us, and the display name you choose to give us.

Your ascents

For each climbed col: the col and the versant, the date, the source (import or manual entry) and, if the import provides it, the duration. The duration is private: it never leaves your account, it appears on no leaderboard, there is no leaderboard.

Your Strava connection, if you make one

If you connect Strava, we keep your athlete identifier, the permissions you granted, and the access tokens needed to read your activities. Those tokens are stored server-side only: the app installed on your phone technically cannot read them, and the database refuses to serve those columns to anyone but the service that needs them.

We read your activities for one thing: comparing their trace against the versants in the catalogue to recognise what you climbed. We publish nothing on Strava, we change nothing there, and we show your Strava data to no one but you.

What comes from the device

The map asks for your location to centre itself, when you allow it; that position is used for display and is not stored. Technical logs (errors, IP addresses) are produced by our hosting providers as part of normally running the service.

What we don't do

• No selling, no sharing for commercial purposes.
• No advertising, no ad profiling.
• No third-party trackers in the app or on this site, which sets no cookies.
• No posting on your behalf, anywhere. Sharing happens when you trigger it.

Who hosts and who processes

We rely on a small number of providers, each for a single thing:

• Supabase: database and authentication (hosting: to complete: region).
• Mapbox: map tiles.
• Cloudflare: hosting for this site.
• Strava: only if you make the connection, and read-only.
• Apple and Google: app distribution and sign-in, if you use it.

For how long

Your ascents and your album are kept as long as your account exists: it's a collection, and a collection is only worth anything over time. Strava tokens are deleted as soon as you disconnect Strava, and disconnecting also revokes the authorisation on Strava's side. Technical logs are kept to complete: duration.

You can ask for your account to be deleted: everything above is erased, including your ascents.

Your rights

Under the GDPR, you can request access to your data, its rectification, its erasure, its portability, or object to a processing. One address for everything: [email protected]. You can also lodge a complaint with your data-protection authority (in France, the CNIL).

Changes

If this policy changes in any meaningful way, the date at the top of the page changes with it and the app lets you know. Version in force: July 27, 2026.