Privacy policy
Effective October 13, 2026 · Development features and private beta
Omni helps you discover board climbs, organize sessions and record your progress. This policy describes how the Omni app and its Firebase services handle information.
Who operates Omni
Omni Climbing is developed and operated by Nicholas Chan. For privacy requests or support, contact omniclimbing@gmail.com.
Information you provide
- Account information: email address, sign-in provider identifiers and your chosen username. Apple or Google may supply a name or profile information during sign-in. Your optional profile photo, country and state/province are stored when you save them.
- Climbing records: attempts, sends, climb identifiers, board/layout/angle, dates, ratings and suggested grades you enter, and your playlists and viewed-climb history.
- Sharing: the climb or playlist you share, intended recipient username when applicable, and related inbox/acceptance records. Share links are designed to expire after 30 days. People you share with can retain their own copy.
- Original contributions: information you explicitly submit through the contribution feature is stored for review. A contribution submission is separate from ordinary private logs.
Optional measurements, parties and linked media
Height and span: if you save measurements, your height and wingspan-derived span are public to signed-in Omni users by default. You can enable Private measurements to hide them. Imperial/metric display preferences stay on your device. Morpho participation is a separate optional choice: consenting measurements and send records contribute to a reach-association index only when at least five distinct consenting senders qualify. The index does not predict an individual climber’s difficulty. You can withdraw consent and delete measurements independently of your logbook.
Board parties: session members can see member names, queued climbs, turn ownership, vote-skip choices and completed-turn history. The leader’s phone controls Bluetooth lighting; a shared illuminated-hold check helps members identify the same physical board. The leader’s controller identifier is device-local, not a universal identifier for other phones. Sessions expire after twelve hours of inactivity; active queues can repeat until members end the session. Account deletion removes your party membership, queued turns and associated history.
Instagram: Omni stores a linked Instagram username, ownership-review state and public post/reel URLs you attach to your own sends. You choose whether each link is visible to other climbers; the prepared video-link service will require independent author review for new links before public display after its tested backend is deployed. Existing manually reviewed ownership claims may remain during migration. Automatic ownership proof is currently disabled: the prepared service, when enabled after testing, will receive an expiring code you send to Omni’s Instagram inbox and process the message text, sender identifier, receiving account and timestamp to check your claimed username. Do not send sensitive information as a proof message. The verification service does not send replies. Unlinking removes your stored video links and ownership association.
Public video discovery (planned): after the required Meta authorization and review, Omni intends to search a limited set of climbing hashtags through Instagram’s official API and compare public captions with climb names, board layouts and angles. Public post identifiers, captions and links would be used to propose matching climbing videos. A caption match alone does not verify the author, a completed send or the exact climb. This discovery service is not active yet. Catalogue-supplied public video links are also being prepared for exact-climb matching.
Video playback: pressing Play loads an Instagram embed; Meta receives the network information needed to render it and its own privacy practices apply. Omni does not request Instagram passwords or copy/download the video. Removed, private or non-embeddable posts may become unavailable. For an incorrect association or a removal request, contact the support address below with the public post URL and climb details.
Widgets and Live Activities: when you use these features, the chosen climb or party turn can appear on your Home Screen, Lock Screen or Dynamic Island. Only a small session snapshot is shared with the widget extension; signing out clears it and ends the Live Activity. Widget controls open Omni to perform navigation, party actions or board connection.
Gym ownership: submitted facility details, authority statements and evidence URLs are private to your account and authorized reviewers. Administrative decisions are audited. Shared spray-wall features are introduced separately as their review and publication controls are completed.
Information needed to run the app
Firebase Authentication manages sign-in credentials and provider connections; Omni does not store your Apple or Google password. Firebase/Google Cloud hosts account records and catalogue services. Firebase App Check and Apple App Attest help verify requests come from Omni. These services may process device/app attestation, IP addresses, request times and technical diagnostic information for security and operation.
Board preferences, zoom/display settings, downloaded catalogues and Bluetooth history are also stored on your device. Bluetooth is used to find nearby board controllers and transmit selected climb holds. The app does not request precise GPS location; optional profile locations are places you choose.
How information is used
We use information to authenticate your account, synchronize your records, search and download catalogues, manage playlists and sharing, display activity, prevent unauthorized access and investigate service problems. Omni has no advertising features and does not sell personal information.
Who can access it
Private account records are protected by authenticated, owner-scoped backend access. Other users cannot browse your private logbook. Measurements saved as public and party session details have the visibility described above. Username lookup and sharing expose the information needed to deliver a share; shared climb/playlist contents become available to recipients. A person with a valid share link may redeem it through a verified Omni account. Avoid putting sensitive information in a shared playlist name.
Apple, Google and Firebase process information needed for their sign-in, attestation and hosting services under their own policies. Service operators may access information to administer, secure and support Omni, comply with legal obligations or respond to your request.
Push notifications are being developed and remain disabled until provider setup and device testing are complete. In a supported build, enabling alerts allows Omni to store a notification registration token, a random app installation identifier, the current account association and delivery records to send shared-climb and party-request alerts through Firebase Cloud Messaging and Apple Push Notification service. Alerts use generic text rather than private climb comments or names. You can disable them in Omni or iOS Settings. Account deletion removes active token bindings and delivery records; a minimal installation revocation counter without an account ID or notification token may remain to prevent stale requests from restoring a binding.
Your choices and deletion
You can edit your profile, remove optional information, edit/delete climb logs, manage playlists and delete downloaded catalogues in the app. You can unlink a sign-in provider when another valid method remains. You can delete your Omni account from Account settings; the backend removes the account and associated active account records and shares. Recipients' previously saved copies and exports you retained are not removed from their devices by your account deletion.
Active account data is retained while the account exists unless you delete it. A minimal account-deletion identifier/status is retained to prevent old credentials from recreating deleted records. Technical service logs and any provider backups may remain according to provider retention and security requirements. For a deletion request when you cannot access the app, email the contact above; account ownership will need to be verified.
Security and international processing
Omni uses HTTPS, authentication, app attestation and backend access controls. Catalogue services are hosted in Google Cloud's us-central1 region; provider services may process data in other countries. No service can guarantee complete security.
Children and changes
The private beta is not designed for children under 13. Contact us if you believe a child has provided personal information so we can investigate and remove it where appropriate. We may update this policy as Omni changes; the current policy and effective date will be posted here.