Skip to content
Climber.gg is in open beta. Sign up free; paid plans launching soon.What's live
climber.gg

Privacy policy

Last updated: 20 October 2026

1. Controller

climber.gg is operated by Olena Tsiuman, Blumenäckerweg 25, 34128 Kassel, Germany. The operator is the data controller within the meaning of Art. 4(7) GDPR. Contact: privacy@climber.gg. See also the Impressum.

2. Data we collect

  • Account: email, hashed password (or the ID of your account with the sign-in provider), display name, profile picture (only when you sign in with Google — see section 5).
  • Game identifiers you link voluntarily: Riot ID, Steam ID, FACEIT nickname — strictly the publicly available identifiers needed to fetch your game statistics.
  • Game data fetched on your request from the providers in section 5: match history, match timelines, ranked statistics. We cache this data to power your analyses.
  • Coaching content: the questions you ask, the AI replies, and your feedback on answers (👍/👎 ratings and optional comments).
  • Billing metadata via Polar (our merchant of record): customer ID, plan, country, last 4 digits of the card. We never see or store your full card number.
  • Product analytics (only with your cookie consent): page views, funnel events (e.g. signup, account connect, first analysis), the acquisition source you arrived from (UTM parameters) and the site that referred you (its domain and page path; we remove the query string and fragment before it is recorded).
  • Operational logs: IP address, browser, request paths (kept ≤30 days for security).

3. Lawful bases (Art. 6 GDPR)

Account, game-data fetching, coaching and billing data: performance of a contract (Art. 6(1)(b)). Operational logs, abuse prevention and service security: legitimate interests (Art. 6(1)(f)). Product analytics and error reporting: consent (Art. 6(1)(a)) given via the cookie banner — you can use the service fully without granting it.

4. AI processing

Your coaching questions and the relevant cached game data are sent to our AI providers (Anthropic and OpenAI) to generate answers. Under their API terms, these providers do not use data submitted via the API to train their models. We do not use your data to train models either. Coaching output is informational and involves no automated decision-making with legal or similarly significant effect (Art. 22 GDPR).

5. Processors and data sources

We share data only with the processors needed to run the service:

  • Vercel (application hosting), Cloudflare (coach backend, DNS) — infrastructure.
  • Supabase (PostgreSQL database, EU region — Stockholm).
  • Anthropic, OpenAI (AI inference for your coaching prompts, USA).
  • Polar (merchant of record for payments, USA).
  • Resend (transactional email, USA).
  • PostHog (product analytics — consent-gated), Sentry (error reporting — consent-gated).
  • Inngest (background jobs, USA).

Game data is retrieved from the official Riot Games API (LoL, TFT), OpenDota (Dota 2), FACEIT (CS2) and the HenrikDev API (Valorant) using only the public identifiers you provided. Their respective terms apply to that data. climber.gg is not endorsed by Riot Games (see the notice in the footer).

Google is a sign-in provider, not one of our processors. If you choose to sign in with Google, Google authenticates you and learns that you are signing in to climber.gg. Google then sends us your Google account ID, name, email address (and whether Google has verified it) and profile picture; we store them with your account. The sign-in tokens Google issues are used only to complete the sign-in and are not stored. If a climber.gg account already uses that email address, the Google sign-in is linked to it only when both Google and climber.gg have verified the address; otherwise it is not linked, and you sign in to that account the way you did before. If no account uses the address, signing in with Google creates one; when Google has not verified the address, you can use the new account only after confirming the address through the email we send. The profile picture stays hosted by Google: your browser loads it from Google's servers whenever it is shown. Google's own privacy policy applies to your Google account.

Where processors are located outside the EEA, transfers rely on an adequacy decision (e.g. the EU-U.S. Data Privacy Framework) or Standard Contractual Clauses. Each processor is bound by a data processing agreement.

6. Retention

  • Account data, coaching content and the game-data cache: until you delete your account (or unlink the game account for its cached data).
  • Billing records: 10 years (German tax retention obligations, §147 AO).
  • Operational logs: 30 days.
  • Rate-limit records (the counters that stop abuse): 2 days after the limit window has ended.
  • Expired sign-in sessions and verification tokens: 7 days after they expire.
  • Live-game summaries: 30 days.
  • AI usage records (which AI requests your account made, their token counts and cost, and the daily totals per account): 90 days. They are deleted when you delete your account; a record still being written at that moment is removed by our daily clean-up, normally within about 25 hours.
  • IP address and browser (user agent) in security and audit records: 30 days, after which they are blanked; the audit entry itself is kept for accountability.
  • Analytics events: per PostHog retention settings, currently ≤12 months.
  • The anonymous PostHog identifier in your browser (only with consent): the cookie copy for up to 365 days after your last visit; the local-storage copy until you withdraw consent or clear your browser's site data (see section 8).

7. Your rights

You have the rights of access, rectification, erasure, restriction, portability and objection (Art. 15–21 GDPR). You can export or delete your data yourself in Settings, or email privacy@climber.gg. Where processing is based on consent, you may withdraw it at any time with effect for the future (with the “Cookie settings” link in the site footer or in Settings, or by clearing the choice stored on your device). You may lodge a complaint with a supervisory authority (Art. 77 GDPR) — in Germany, the authority of your federal state.

8. Cookies and local storage

Essential, always on: the sign-in session cookie, NEXT_LOCALE (remembers the site language you use or choose; kept for 1 year, SameSite=Lax, and Secure when served over HTTPS), and your cookie-consent choice (stored in your browser). Optional, only after you accept: PostHog analytics and Sentry error reporting, plus a first-visit acquisition snapshot (UTM source) stored in your browser. Declining keeps every feature working.

With your consent, PostHog keeps one random anonymous identifier in your browser so that your visits can be counted together. It is stored in a cookie that expires 365 days (12 months) after your last visit, and PostHog also keeps a copy of it in your browser's local storage, which has no expiry date: that copy stays until you withdraw consent (see below) or clear your browser's site data. The same cookie and local-storage entry, with the same lifetimes, also hold a session identifier, the address of the first page you opened here (with sign-in tokens and similar values masked) and the site that referred you to it (domain and path only).

You can change your cookie choice at any time with the “Cookie settings” link in the site footer and in Settings: choosing “Essential only” after accepting stops PostHog from capturing anything new, at once and on later visits. Sentry sends nothing from that moment and does not start on later visits. The choice also deletes the PostHog identifiers and the acquisition snapshot kept in your browser, as far as your browser lets us change its storage (PostHog keeps only a marker that you declined). Analytics events that PostHog had already queued in your browser before you made the choice may still be sent in the seconds that follow; nothing captured after the choice is. If your browser blocks saving a withdrawal and the earlier consent cannot be removed either, we tell you, and the withdrawal applies only to that tab.

9. Children

The service is intended for users aged 16 and over.

10. Changes

We will notify you by email about material changes at least 30 days before they take effect. This policy is provided in English and Russian; if the versions differ, the English version prevails.