Privacy Notice

Mazinga is a climbing training planning and logging service operated by Mazinga Climbing Ltd ("Mazinga", "we", "us" or "our"). For the purposes of UK data protection law, Mazinga Climbing Ltd is the data controller of the personal information described in this Privacy Notice.

Account information

When you create and use a Mazinga account, we may collect your email address, account identifier, display name, profile photograph or avatar (if you choose to upload one), information about your authentication method, account preferences and settings (such as training units, grading-system display, timer and rest-suggestion preferences), and account and security information associated with sign-in, password recovery and account changes. If you choose to sign in using Google, we receive the account information required to authenticate you through Google, such as your email address and provider account identifier.

Training information

Mazinga allows you to create, schedule and record your climbing training. Depending on which features you use, this may include exercises and workouts you create, training plans and plan templates, scheduled training sessions, private user-created category labels, week and day focus information, sets and repetitions, exercise and workout duration, weights and loads, climbing grades, your preferred grading system and recorded climbing-grade details, planned intensity, Rate of Perceived Exertion (RPE), exercise and workout completion information, training history, training notes, and other values you choose to enter when planning or logging a session. This information is primarily stored so that you can organise your training, maintain your own training record and review your own training history.

Journal entries and free-text notes

Mazinga may provide private journal entries and free-text Notes fields. Depending on the feature used, we may therefore process the date associated with a journal entry, the journal text you choose to enter, training notes, workout or exercise notes, quality notes, modification or skip explanations, and other free-text information you choose to record. You control what you enter into these fields.

Mazinga does not require medical records, diagnoses or other health information in order to provide its normal training-planning, logging or journal functionality. We recommend that you do not enter unnecessary medical, financial, identification or other highly sensitive personal information into journal entries or Notes fields. Because these fields are unrestricted free text, they could contain health or other sensitive information if you choose to enter it. We do not ask you to provide health information, use these fields to conduct a medical assessment, or use their contents to build health profiles. If you need information in these fields corrected or deleted, you can use available account controls or contact us using the details at the end of this Notice.

Exercise and profile media

If you choose to upload content, we may process profile photographs, images associated with your private exercises, and images or other permitted media associated with content you create. Private user media is stored using access controls intended to restrict it to the relevant account. Content published to Mazinga's global exercise library may be made available to other Mazinga users.

Self-service data exports and imports

If you request an account data export, we compile selected information from your account into a downloadable ZIP file. Depending on what your account contains, this may include profile and settings information, training history, journal entries, your private exercises and workouts, and your training plan templates. This self-service export does not include every category of information held by Mazinga (for example, operational security records), and it does not include copies of uploaded image or video files.

The export is temporarily stored in a private Supabase Storage area. We provide a time-limited download link. Creating a new export replaces the previous one; stored export files are normally eligible for automatic deletion after approximately 24 hours.

When you choose to import compatible training-data JSON files, Mazinga processes the file contents to validate them and create the requested private exercises, workouts or templates in your account. The import function does not automatically reproduce associated uploaded media files.

Reports and support information

If you report a problem, report content, or contact us for support, we may collect your account identifier, the content or feature being reported, your selected report reason, information you provide in your report or support message, a snapshot of relevant reported content, and information about how we handled and resolved the report. Please avoid including unnecessary health or other sensitive information in reports or support messages.

Technical, security and diagnostic information

When you use Mazinga, we and our service providers may process limited technical information necessary to operate, protect and troubleshoot the service, including IP address, authentication and session information, request and security information, security-event information, information used to apply rate limits and prevent abuse, browser, device or runtime information made available as part of normal web requests, information relating to security-policy violations, and limited application error and diagnostic information.

We use this information to operate Mazinga securely, investigate problems, diagnose technical failures and protect accounts and infrastructure. Mazinga is configured to minimise personal information sent through its application error-monitoring system. For example, the current configuration disables default PII collection, user-information collection, request-body capture, tracing and application logs, and applies additional sanitisation intended to remove credentials, email addresses, user identifiers, free-text notes and other sensitive values before error information is transmitted. No technical filtering system can guarantee that unexpected diagnostic information will never contain personal information, so we continue to treat error-monitoring data as protected operational information.

Providing Mazinga

We process your account and training information to create and maintain your account, authenticate you, provide the Daily, Week, Plan, Exercise, Workout, History, Timer, Journal and Analytics features where available, save training plans and schedules, store and display training logs, store and display private journal entries, save your account preferences, store private exercises, workouts and categories, display your own training history, statistics and progress information, process account changes, prepare and deliver a copy of supported account data when you request an export, process compatible training-data imports you choose to make, and allow you to delete your account.

Mazinga's user-facing Analytics feature is calculated from information already stored in your Mazinga account, such as training logs and scheduled training. Mazinga does not currently use a separate third-party behavioural or user-tracking analytics provider to generate those in-app statistics. Our lawful basis for processing required to provide these features is generally that it is necessary to provide the Mazinga service under our contract with you.

Security and prevention of abuse

We may process account, technical, security, diagnostic and report information to protect Mazinga and its users, prevent unauthorised access, enforce rate limits, detect attempted misuse, investigate abuse reports, protect the integrity of our global exercise and workout libraries, investigate security incidents and technical errors, and establish, exercise or defend legal claims where necessary. Where this processing is not necessary to perform our contract with you, we generally rely on our legitimate interests in operating a secure and reliable service, preventing fraud and abuse, and protecting Mazinga and its users. We consider the nature and impact of the processing before relying on legitimate interests.

Communications

We may use your email address to send service-related communications such as account confirmation messages, password-reset messages, security notifications, email-change confirmations, and important information concerning your account or the Mazinga service. These communications are part of operating and securing your account and are not marketing messages. If we introduce optional marketing emails in the future, they will be handled separately and you will be able to control whether you receive them.

Legal and regulatory requirements

We may process or retain information where necessary to comply with a legal obligation, respond to a valid legal request, or establish, exercise or defend legal rights. Where processing is required by law, our lawful basis is compliance with a legal obligation.

At the date of this Privacy Notice: we do not sell your personal information; we do not sell your training history; we do not provide other ordinary Mazinga users with access to your private training logs or private journal entries; we do not use a third-party behavioural or user-tracking analytics provider to monitor how you use Mazinga; we do not use behavioural advertising technologies; and we do not use your training information to make automated decisions that produce legal or similarly significant effects.

Mazinga's in-app Analytics feature is a product feature that calculates information from your own Mazinga training records. It is not an advertising or cross-site tracking service. If our practices materially change, we will update this Privacy Notice before the new processing begins where required.

Supabase

Mazinga uses Supabase for account authentication, its primary database and private/public media storage. Our production project is hosted primarily in the Ireland (eu-west-1) region. Account details, training records, journal entries, private media and temporary data-export ZIP files may be processed through Supabase infrastructure. The chosen primary region does not necessarily limit every location from which Supabase or its subprocessors may provide support or other infrastructure services.

Google

If you choose Sign in with Google, Google participates in authentication and exchanges the information needed to connect your Google identity to your Mazinga account. Email-and-password sign-in is available as an alternative.

Cloudflare

We use Cloudflare Turnstile for bot protection on some authentication and security-sensitive functions. Cloudflare may process technical information necessary to provide this service.

We also use Cloudflare R2 for independent production database and Storage backups. The backup bucket has been configured with a Western Europe location setting. This is a location setting or hint rather than a guarantee that all processing is restricted to an EU jurisdiction.

Rate-limiting provider

We use Upstash to apply rate limits that help protect Mazinga and its users from abuse, excessive automated requests and misuse of security-sensitive functions. To do this, Mazinga's servers send Upstash rate-limiting requests containing only a hashed rate-limit identifier (a cryptographic digest of an internal namespace and an IP address or account identifier) together with the applicable limit and time window. Raw IP addresses and account identifiers are not included in these requests. Upstash processes and stores these hashed identifiers and counters temporarily, and deletes them automatically once they expire (typically minutes to an hour).

Upstash provides processing locations in multiple regions, including the European Union and the United States; Upstash, Inc. is based in the United States and may act as a processor, and its support or other operations may involve processing outside the United Kingdom or the European Union. Choosing a database region does not guarantee that all processing by Upstash remains within that region.

Hosting provider

Mazinga uses Vercel to host and operate the application. Our configured production function regions include London, United Kingdom, and Washington, D.C., United States. Vercel may process application requests and associated technical information necessary for hosting, security and operation; content delivery and other service processes may take place elsewhere.

Transactional email provider

We use Resend for account and security emails such as verification, password-reset and email-change messages. The sending-domain region is Ireland, but Resend stores customer email and delivery-related data in the United States. We also receive limited email-delivery-event metadata for operational troubleshooting.

Error-monitoring provider

We use Sentry for application error monitoring in staging and production. Our selected Sentry data-storage region is the European Union. The application is configured to minimise personal information transmitted to Sentry: default PII collection, user information, request bodies, tracing and application logs are disabled, and captured URLs and diagnostics are additionally sanitised.

Sentry may nevertheless process limited information such as application environment, error type, browser/runtime context, request method and sanitised URL path. We do not use Sentry for behavioural analytics or advertising.

Professional advisers and authorities

We may disclose information to professional advisers, insurers, regulators, courts, law-enforcement authorities or other organisations where this is reasonably necessary to comply with the law, respond to a valid legal request, protect our legal rights, investigate fraud or serious abuse, or protect the rights or safety of Mazinga, our users or others. We do not give service providers permission to use your private training information or private journal entries for their own advertising purposes.

Mazinga is operated by a UK company but uses infrastructure and service providers that may process personal information in several countries.

For example, our production Supabase project's primary data region is Ireland; Sentry is configured for EU data storage; Vercel's configured function regions include the United Kingdom and the United States; and Resend's email-sending region is Ireland while its customer data is stored in the United States. Our Cloudflare R2 backup bucket has a Western Europe location setting, which is not a guarantee that all data or processing remains within a specific EU jurisdiction. Upstash offers processing locations in multiple regions (including the EU and the US) and its support or other operations may involve processing outside the United Kingdom or the European Union. Cloudflare security services, Google sign-in and providers' support or other operations may also involve processing outside the United Kingdom.

Some of these arrangements may constitute restricted international transfers under UK data-protection law. For those transfers, the applicable legal mechanism depends on the destination, the recipient and the data concerned. The mechanisms we assess include UK adequacy regulations (including the UK Extension to the EU–US Data Privacy Framework only for eligible, appropriately certified US recipients), and, where applicable, contractual safeguards such as the UK International Data Transfer Agreement or the UK Addendum to EU Standard Contractual Clauses with any required transfer risk assessment.

We do not treat a provider's chosen hosting region alone as proof that all its processing remains in that region. You may contact privacy@mazinga.app for information about the safeguards relevant to your information.

Account and profile data: We normally retain your account and profile information while your Mazinga account remains active. If you delete your Mazinga account, we delete or anonymise account information that we no longer have a lawful reason to retain.

Training and journal information: Training plans, schedules, exercises, workout information, training logs, private categories, journal entries and related notes are generally kept until you delete the relevant information, you delete your account, or the information is otherwise no longer required to provide Mazinga. Mazinga is designed to allow users to maintain a historical training record and private journal, so this information may remain stored for as long as you choose to retain it in your account.

Abuse reports: Reports that have been resolved are normally retained for 12 months after their last review or update. Reports that have been dismissed are normally retained for 6 months after their last review or update. This covers the report, any accompanying notes and relevant content snapshot. Pending and reviewing reports remain available while the matter is open. Where a specific legal obligation or dispute justifies longer retention, relevant material may need to be preserved separately as permitted or required by law.

Security, error and email-delivery records: Security and technical information is retained according to its operational purpose and, for platform-generated logs and diagnostic events, the applicable provider retention settings. Such records may be needed to investigate faults, misuse or security incidents. We do not routinely keep all diagnostic events as long as account training records.

Rate-limit counters and hashed rate-limit identifiers are temporary operational security data. They are retained only for the short time window in which they are needed to apply a rate limit and are deleted automatically by the rate-limiting provider when that window expires (typically minutes to an hour).

Under our current supplier plans, Sentry normally retains error events for approximately 30 days (Basic/Free plan), Vercel normally retains function runtime logs for approximately one day (Pro without Observability Plus), and Resend normally retains email content and its own email-delivery logs for 30 days (Basic/Free plan). Supabase's Pro plan currently offers access to approximately seven days of hosted logs; dashboard access periods do not necessarily establish when every underlying provider record is irreversibly deleted. These supplier periods are separate from our own application database records and may change if our service arrangements change.

We also retain limited service-email delivery-event records (such as a delivery event type, timestamp and provider message reference) for investigating whether important account messages were sent, delivered or rejected. These records do not contain the body of the email. Their retention is determined by operational troubleshooting and security needs; we periodically assess whether they remain necessary.

Temporary data exports: If you request a data export, the ZIP file is stored in a private area for approximately 24 hours, after which it is eligible for deletion by a scheduled cleanup. A new export overwrites the previous stored copy. The signed download link itself has a shorter lifetime, normally 10 minutes.

Deleted information and backups: Information removed from the live application can remain in restricted-access backup copies while those backups are retained for disaster recovery.

Independent database backups: The current automated backup workflow normally removes compressed database dump files when they are more than approximately 30 days old. Our Supabase Pro project also has managed daily database backups, with the last seven days normally available for restoration under that plan; optional point-in-time recovery, if enabled, would be subject to its separate configuration.

Independent Storage backups: Copies of uploaded media and related objects are also backed up to Cloudflare R2. These copies use different retention controls from the database dumps and may currently remain for longer than 30 days. The duration depends on the retention/lifecycle rules applied to the relevant backup objects. Deleting information from the live account does not necessarily remove every historical backup copy immediately.

We do not use an older backup to intentionally restore access to information that a user has since deleted, except where necessary for disaster recovery or another legitimate operational reason, with appropriate checks and reconciliation after restoration. You can contact us at privacy@mazinga.app for further information about how retention applies to a particular category of data.

We use technical and organisational measures designed to protect personal information from unauthorised access, disclosure, alteration or loss. These measures include authentication controls, per-user database access controls, Row Level Security, private storage for user-owned media, server-side controls for privileged operations, restrictions on privileged credentials, rate limiting, bot protection, server-side file validation, access controls for administrative functions, and security monitoring and protective browser policies.

No internet service can guarantee absolute security. You should use a strong, unique password for Mazinga and protect access to your email account and authentication methods. If we become aware of a personal-data breach, we will assess it and take the steps required under applicable data protection law.

Mazinga uses browser storage and similar technologies where necessary to operate the application — for example, to maintain authentication sessions, remember the training plan you have selected, collapsed workout cards and chosen timer sound volume, maintain timer state while you navigate within the application, temporarily remember versions of the Terms and Safety Disclaimer acknowledged during registration, and provide security functionality. Some of these technologies provide or secure requested functionality; others remember preferences you have selected in the application. Mazinga may also use technologies required by security providers such as Cloudflare Turnstile.

Mazinga's in-app Analytics feature does not require a third-party analytics provider or analytics-tracking cookie. The Analytics feature calculates statistics from Mazinga account data that is already processed to provide the training service. Mazinga does not currently use optional behavioural analytics, advertising pixels or cross-site tracking technologies.

If we introduce a non-essential tracking technology in the future, we will assess it before deployment and provide any additional information and consent controls required before using it. Further details are available in our Cookie Policy.

Depending on the circumstances and the lawful basis on which we process your information, you may have rights including:

• Access: ask us for a copy of the personal information we hold about you. The Data Export Self-Service feature in Mazinga's Settings can provide a ZIP copy of supported account information, but it is not a substitute for a full request for access to personal information under data-protection law.
• Correction: ask us to correct personal information that is inaccurate or incomplete.
• Deletion: ask us to delete personal information in circumstances where the right to erasure applies. Mazinga also provides an account-deletion process for deleting your account and associated application data.
• Restriction: in certain circumstances, ask us to restrict how we use your personal information.
• Data portability: where the legal requirements apply, ask to receive certain information you provided to us in a machine-readable format. Mazinga's optional self-service data export provides supported data in JSON files within a ZIP archive; requests for additional eligible information can be sent to our privacy contact.
• Object: where we rely on legitimate interests, you may have the right to object to the processing.
• Withdraw consent: where we rely on your consent, you can withdraw that consent at any time. Withdrawing consent does not make processing carried out before withdrawal unlawful.
• Complain to the regulator: if you are concerned about how we handle your personal information, please contact us first at privacy@mazinga.app. You also have the right to complain to the Information Commissioner's Office (ICO), the UK's data-protection regulator.

Mazinga does not currently use your personal information to make decisions about you solely by automated means that produce legal or similarly significant effects. If we introduce materially different automated processing in the future, we will review the privacy implications and update this Privacy Notice before using it where required.

You can request deletion of your Mazinga account through the account controls provided within the application. Account deletion is designed to remove your account and associated application information, including user-owned storage objects, subject to limited information that we are legally required to retain, information that is necessary to establish or defend legal claims, temporary data-export ZIP files that have not yet reached their scheduled expiry, and temporary copies that remain in backup systems until the relevant backups are deleted. Deleting your account is permanent once the deletion process has completed.

We may update this Privacy Notice as Mazinga develops, our service providers change, or our legal obligations change. When we make changes, we will update the version number and effective date at the top of this Notice. If a change materially affects how we use your personal information, we will provide an appropriate notice within Mazinga or by another suitable method before the change takes effect where required. If a new use of information requires consent, we will ask for that consent rather than treating your previous acceptance of this Privacy Notice as consent to the new processing.

If you have questions about this Privacy Notice, want to exercise a data-protection right, or have a concern about how Mazinga handles your information, contact: