NightClimb

Privacy Policy

Last updated 3 August 2026

NightClimb is a sleep-tracking game. This policy explains exactly what it stores, why, and what you can do about it. It is written to be read, not to be survived.

Who is responsible

NightClimb is an independent app. For anything in this policy, contact nightclimb.app@gmail.com.

What NightClimb collects

Your account

  • Email address, so you can sign in and recover your account.
  • A display name that you choose. This is shown to other players on the leaderboard, so pick something you are happy for others to see.
  • An optional bio. It is public. Anyone signed in can read it on your profile, so do not put anything there you would not put on a noticeboard.
  • Who you follow, and who follows you. Both lists are public and can be opened from any profile. Following someone is not private, and they can see it. When two people follow each other the app calls them friends.

If you sign in with Apple or Google, we receive your email address from them. If you use Apple's "Hide My Email", we only ever see the relay address Apple gives us, never your real one.

Your sleep

  • When each sleep session starts and ends.
  • How long you slept, any breaks you took, and the score the app calculates.
  • The bedtime and wake-up targets in your plan.

Your answers to the introduction

All of them are stored on your profile:

  • Your goal, age range, chronotype, and how long you take to fall asleep.
  • Your caffeine habits, the difficulties you picked, and how you rate your own sleep.
  • Your alarm and notification preferences.
  • Where you heard about NightClimb.
  • The companion you chose.

Feedback you send

If you use Profile → Send feedback, we store your message, your display name, the type of feedback, and any star rating. Please see the deletion section, because feedback is the one thing that outlives your account.

Technical

  • A record of when you last sent feedback, used only to rate-limit spam.
  • In-app notifications addressed to you.

What NightClimb does NOT collect

  • No microphone, motion, camera or location data. The app never asks for them, and microphone access is explicitly switched off in the build.
  • No health data. NightClimb has no HealthKit or Health Connect permission, so it could not read it if it tried.
  • No advertising identifiers. There are no ads and no ad networks.
  • No analytics, crash-reporting or tracking SDKs of any kind. There is no third-party SDK in this app that receives your data.

What other people can see

Any signed-in player can open your profile and see your display name, bio, companion, rank points, league, streak, best streak, whether you are asleep right now and when that sleep session started, your most recent night's score, how many nights you have logged, your average score, your best-ever score, and your followers and following lists.

Signed-out visitors see none of it. All of the above needs an account.

Two of those are worth being explicit about:

  • Your most recent night's score is visible to other players. Your older scores and your full history are not.
  • When your current sleep session started is visible while you are asleep, which means other players can see roughly what time you went to bed tonight.

Nobody else can see your email address, your bedtime targets, your sleep durations, your night-by-night history, or your introduction answers. Those are readable only by you, enforced by database row-level security rather than by convention.

The averages on your profile are calculated inside the database and only the finished number ever leaves it. Another player learns that you average 78; they never receive a single one of your nights.

Moderation

NightClimb has an owner account used to run the game. It can adjust rank points, suspend an account, and delete an account that breaks the Terms of Service. Those actions are logged with the affected display name and account id, so there is a record of what was done and why.

Where the data lives

Data is stored with Supabase, which hosts it on servers in the EU (eu-central-1). Session tokens on your phone are encrypted before being written to storage, with the encryption key held in the iOS Keychain or the Android Keystore.

How long it is kept, and what deletion really removes

Profile → Delete account removes your account and, with it, your profile, your bio, your entire sleep history, your rank, your streaks, every follow in both directions, your in-app notifications and your rate-limit records. That happens immediately. There is no grace period and no soft delete, and it cannot be undone.

Two things are kept, and it would be dishonest not to say so:

  • Feedback you sent, with your name removed. The message survives because it is useful for improving the app, but your account id and the display name attached to it are both erased at the moment you delete, leaving a comment nobody can trace back to you. If you would rather the message went too, email the address at the top of this policy.
  • Moderation records, if any action was ever taken on your account. These keep the display name and account id, because a suspension record with the subject removed is not a record.

Blocking and reporting

Profile → the menu in the top corner of any other player.

  • Block hides you and them from each other everywhere in the app, removes any following in both directions, and stops either of you following again. It works both ways on purpose: a one-sided block would let the other person keep watching you, which is the thing people are trying to escape.
  • Report sends the reason and any note to the owner. The person reported is never told who reported them.

We store the report, who sent it, who it is about, and when. Blocks are private and are never shown to the person blocked.

Private accounts

Profile → Privacy → Private account.

Turning it on means only your friends — people you follow who follow you back — can see your nights logged, average and best score, and your followers and following lists.

You still appear on leaderboards with your display name, companion, rank and streak. That is what makes the leaderboard a leaderboard, so private hides the detail rather than removing you from the game.

Your controls, all inside the app

  • Profile → Start over clears your rank, streaks and sleep history but keeps your account.
  • Profile → Delete account removes your account, as described above.
  • You can change your display name and companion at any time.
  • Notifications are optional. The app works without them, though the alarm is much less reliable if you decline.

Your rights under GDPR

NightClimb is run from Norway, so the GDPR applies to everyone who uses it, wherever they are. The data controller is the person named at the top of this policy, and that email address is how you exercise any of the following.

  • Access — ask for a copy of everything held about you.
  • Portability — ask for it in a machine-readable file you can take elsewhere. Email and it will be sent as JSON within 30 days. There is not yet a button in the app for this; until there is, email is the way.
  • Rectification — correct anything wrong. Your name, bio and companion are editable in the app; anything else, email.
  • Erasure — Profile → Delete account, which is immediate and total except for the two things named above.
  • Restriction and objection — ask that processing be paused or stopped.
  • Withdraw consent — turn off notifications, or delete your account.

What we rely on to process your data: performing the contract you entered into by making an account. There is no legitimate-interest processing, no profiling for advertising, and no automated decision-making with legal effects. The scoring is arithmetic on your own nights, shown only to you and, in the narrow form described above, to other players.

Complaints. If you think this is being handled badly, tell us first. If you are not satisfied you can complain to your national data protection authority. In Norway that is Datatilsynet (datatilsynet.no); elsewhere in the EEA it is your local equivalent.

International transfers. Data is stored in the EU (eu-central-1) and is not transferred outside the EEA.

This website

Everything above is about the app. The website itself has no cookies, no analytics and no tracking of any kind — visiting it leaves nothing behind.

The one exception is the contact form on the support page, and only if you actually use it. Sending a message stores what you wrote, the topic you picked, whatever name and email address you chose to give, your browser's user-agent string, and a one-way hash of your IP address. The hash exists only to stop one person flooding the form; the raw IP address is never written down and the hash cannot be turned back into one.

Those messages sit in the same EU database as everything else, are forwarded to the email address at the top of this policy, and are deleted once the conversation is over. Emailing directly instead of using the form avoids all of it.

Children

NightClimb is not directed at children under 13 and does not knowingly collect their data. If you believe a child under 13 has made an account, email the address above and it will be deleted.

Changes

If this policy changes materially, the app will say so before the change takes effect.