Privacy policy

The short version

We collect the least we can get away with: an email address so we can send you the alerts you asked for, and whatever you choose to post. We do not sell anything to anybody and we do not run advertising. We do count pageviews, with a service that sets no cookies and cannot follow you from one visit to the next, which is why there is still no cookie banner on this site. How that works. Every email we send has a one-click unsubscribe link that works without signing in.

Photos are the exception worth reading twice. They are public and they are meant to stay up. Before a photo is published we run it through software that finds the people in it and blurs them out permanently, because the climber in somebody else's photo never agreed to be on this site. How that works.

What we collect

If you follow gyms by email

• Your email address, and a name if you give us one.
• Which gyms you follow and how often you want to hear from us.
• Random tokens that let you confirm, manage and unsubscribe from your alerts without a password.
• The date we last emailed you, so digests do not go out twice.

If you create an account

• Your email address, a name if you give one, and a password. Passwords are stored only as a salted hash, so we cannot read yours.
• Sign-in timestamps and the IP addresses used to sign in. This is how we notice a compromised account and lock it.
• Confirmation and account-unlock tokens.

If you post a reset

• What you wrote, and anything you filled in: the date, grade range, setter and route count.
• Any photos you upload. Photos are public. They join that wall's dated archive and stay there so the history stays usable. People in them are blurred out automatically before publication (see people in photos below), and that same step re-encodes the image, which drops the location and device data your camera writes into the file.
• A one-way hash of your IP address, salted with a secret only the server has. We cannot turn it back into an IP; it exists so we can spot the same source flooding the log. The same hash is taken when you submit a missing gym or suggest a name for a wall.
• Your account name, shown next to what you posted.

If you use "find gyms near me"

• Your browser asks you first, and only after you click the button. We never trigger that prompt on page load.
• We round your coordinates to two decimal places, roughly a kilometre, before anything is done with them, and the precise reading your browser gave us is discarded on the spot and never sent to us. The rounded pair does travel in the page address, and so appears in our ordinary server logs. That is exactly why it is rounded first: a kilometre is ample for a radius search and is not your address.
• The rounded coordinates are kept in your browser so a later visit can filter without asking again, along with a note that you have used the feature at all, which is what stops us asking a second time in the same session. Both are not saved to your account or to our database. Clearing your browser data removes them, and so does "Show every gym" on the gym list.

Always

• A session cookie, which is what keeps you signed in. It lasts two weeks from your last visit. Every visit pushes it back out to two weeks, so if you check in now and then you stay signed in indefinitely, and if you stop coming it expires on its own. It is strictly necessary for the site to work, so there is no cookie banner to click.
• A second cookie, set when "Keep me signed in" is ticked at sign-in, which keeps you signed in past the two weeks. That box is ticked by default, because this is a site people open standing in a gym; untick it on a shared machine and no such cookie is set. Signing out deletes it on the device you signed out from and leaves your other devices alone; to sign every device out at once, change your password. These two are the only cookies this site sets, and neither is used to track you.
• If you follow a gym by email without holding an account, your address is remembered in that first cookie for two hours so the page can show you what you already follow. That is deliberately much shorter than the sign-in cookie: typing an address is not proof of owning it, so an unconfirmed address is not allowed to sit on a shared machine and be picked up by whoever uses it next. Confirming the address from the link we email you removes the time limit.
• Ordinary server logs, containing request paths and timings.
• Your country, worked out from your connection so the gym list opens on the right one instead of on all ninety-five. It is the country and nothing narrower (no city, no coordinates), the lookup runs on our own server against a local database so nobody is told your address, and the address itself is not stored. The page says which country it picked and it takes one click to see every country instead. That lookup uses the DB-IP IP-to-Country Lite database, used under CC BY 4.0.
• One pageview count per page you load, sent to our analytics provider. The detail is below.

Counting visits

We want to know which gyms people look for and whether anybody reads the reset log. That needs counting, and counting is where most sites start following you around. So we picked a provider that cannot: Tastatur sets no cookie, writes nothing to your browser's storage, and has no identifier to join one visit to the next with. There is no profile of you to build, which is also why there is nothing here for you to consent to.

What each pageview sends

• The address of the page you loaded, and the site you arrived from, if any.
• Your rough location (country, and usually region or city), worked out from your IP address at the moment the request arrives. The IP address itself is not stored.
• Your browser, operating system and whether you are on a phone or a desktop.
• Nothing else. Not your email address, not your account, not what you typed, not which photo you were looking at beyond the page's own address.

How to switch it off

Turn on Do Not Track or Global Privacy Control in your browser and the script collects nothing at all. We have left that honoured rather than overriding it, which the provider allows and some sites do. Any content blocker will also stop it, and nothing on this site breaks if you block it.

Counts are only ever reported to us in aggregate, and breakdowns are suppressed below a minimum number of visitors, so no row on that dashboard can be traced back to one person.

People in photos

A wall photo is a photo of a room, and rooms have people in them. The person mid-crux in the background of somebody's reset photo did not upload it, was probably not asked, and in most cases will never know it exists. So we do not treat blurring them as a courtesy the uploader can decide about. It is a step every photo goes through on its way to being published.

What we do to a photo before it goes up

• Software looks for people in the image and produces an outline of each one.
• That outline is grown outwards before anything is blurred, by roughly 3% of the shorter side of the photo. Machine outlines are approximate, and we would much rather blur an extra handful of plywood than clip the edge of somebody's face.
• Everything inside is pixelated and then blurred, in that order. Pixelating replaces each block of the image with its average, which throws the detail away outright rather than smearing it, so the result cannot be undone by sharpening it, and the blur on top is applied to something already destroyed.
• The edge is softened so the blurred area reads as part of the photo rather than as a cut-out that invites people to guess what is underneath.
• The blurred version replaces the file we store. We do not keep an unblurred original anywhere, for anyone, including ourselves.

What we cannot promise

This is automatic software, not a person checking every photo, and we would rather say so here than let you assume otherwise. It is very reliable on people who are large in the frame (which is the case that matters, because that is when a face is recognisable at all), and it gets less reliable the smaller and more distant somebody is. A figure a few pixels across may not be blurred. It is also, by design, heavy-handed: photos sometimes come back with more of the wall blurred than you expected, and that is the trade we chose.

If you find a photo on this site where somebody is recognisable, tell us at [email protected] and we will take it down. You do not need to be the person in it, and you do not need an account.

If the software is unavailable

When we cannot run this step (the service is down, the photo will not process), the photo is not published. It waits for a person to look at it. We would rather your upload be delayed than published without being checked.

We use these photos to make that software better

The software described above is only as good as what it has seen, and most of what it has seen is not real. The bulk of the training set is synthetic: a 3D climbing gym we render ourselves, thousands of frames of a room that does not exist. Even there the appearance is borrowed rather than invented, because a model trained on procedurally coloured shapes learns procedurally coloured shapes and then meets a phone photograph of an actual gym. The holds, the panels and the people in those renders are textured with cutouts from openly licensed photographs, taken from Wikimedia Commons and a public climbing-wall dataset, each one carrying its licence and its photographer with it. None of those people are you.

What a render cannot supply is what a real gym in real light actually looks like, and that is the part real photographs do. So published wall photos, and the labels our reviewers add to them, are used to train and test it alongside the synthetic set.

The photos used are the published ones, which are the copies with people already blurred out. There is no unblurred original to use, because we do not keep one. It is only ever this site’s own software: nothing is sold, licensed on, or handed to anyone else, and none of it is used to identify anybody. The terms say the same thing as a permission rather than as a description.

Ask us to take a photo down and we will delete it, along with every label anybody made on it, so it is not in the next training run, and not in the set the model is measured against. What we cannot do is make a model that has already been trained unlearn it. That is true of every model everywhere, and we would rather write it here than let the takedown promise sound bigger than it is.

Who else sees it

We use a small number of outside services. They only get what they need to do their job.

• OpenAI receives the text of what you submit (a reset report's notes, reporter name and setter; a gym submission's name, brand, city and notes; a suggested wall name) so it can be screened for spam and off-topic content before it goes live. It does not receive your email address, your account, or your photos.
• Resend delivers our email, so it handles your address and the contents of the alerts.
• OpenStreetMap serves the map tiles. Your browser fetches those directly, so their servers see your IP address whenever you load a map. We never send them anything about who you are.
• Sentry receives error reports when something breaks. We have it configured not to attach personal data.
• Tastatur counts pageviews. It receives the page address, the referring site, and a rough location and browser type derived from your IP address, which it does not keep. It never receives a cookie, an account, an email address or a photo. The detail is above.

We do not sell or rent your data, and we do not share it for advertising. We will hand it over if a valid legal order compels us to, and we will tell you unless we are barred from doing so.

How long we keep it

• Reset reports and photos are meant to be permanent. The point of the archive is being able to look back, so posts stay up even after an account is deleted. Your name comes off them.
• The unblurred version of a photo is not kept. Publishing replaces the stored file with the blurred one and deletes the original, so "permanent" applies to the blurred image and to nothing else.
• Email subscriptions last until you unsubscribe. Unsubscribing marks the record inactive so we do not re-add you by accident; ask and we will delete it outright.
• Sign-in IP addresses are kept while the account exists.

What you can ask for

You can ask us for a copy of what we hold about you, ask us to correct it, or ask us to delete it. Depending on where you live you may have these rights under the GDPR or the CCPA; we apply them to everybody regardless. Two things you can do yourself, right now, without asking:

• Unsubscribe from any email using the link at the bottom of it.
• Delete your account from your account settings if you are signed in.

Children

FreshPlastic is not intended for children under 13, and we do not knowingly collect their information. If you believe a child has given us data, write to us and we will remove it.

Changes, and how to reach us

If we change this policy in a way that materially affects you, we will email everyone on the list rather than quietly editing this page. For anything on this page, contact REEDSTER LLC at [email protected].

See also the terms of service.