Privacy Policy — Rinja

Version of 21 October 2026 — draft for review, not yet published.

This policy explains what data Rinja (the "App") collects, why, who it is shared with, how long it is kept, and what your rights are. It is written to be read in full in a few minutes.

1. Data controller

Izi-IA [legal form, registration number and address to be completed].

Contact for any question about your data: support@rinja.com. We have not appointed a data protection officer: this address is read by the person who acts in that role.

2. The data we process

All this data comes from you or from your use of the App. Data marked "optional" can be left empty; the rest is needed to provide the service, and without it the account cannot be created or the programme cannot be generated.

2.1 Identity and account

Email address, password (stored hashed, never readable by us), first name, last name (optional), climbing gym (optional), profile photo (optional), language, account creation date.

2.2 Training profile

Sex (or "undisclosed"), date of birth, height, weight, the month you started climbing, how many times a week you climbed before the programme, fingerboard experience, current level and target grade, disciplines, practice environments, available equipment, goal, number and length of sessions, available days, other sports practised, the wall heights of your gym.

2.3 Health-related data

Some data is used to adapt training to your body and to protect you. This is health data under the GDPR (article 9), which we process only with your explicit consent, given at sign-up:

• your weight and its evolution;
• your strength tests (pull-ups, dips, hangs, smallest edge held, added weight);
• your declared pain and injuries: area, side, discomfort, movements to avoid, chosen mode (adapt or pause);
• your end-of-week feedback: difficulty, fatigue, painful areas.

You can withdraw this consent at any time by deleting your account. Without this data, the App cannot generate a suitable and safe programme: this is why withdrawing consent ends the service.

2.4 Activity

Generated programmes, sessions (prescribed, done, skipped), validated sets, perceived effort, sends (boulders and routes), records, badges, consistency streaks, estimated metres climbed, and the free-text end-of-week comment (300 characters at most).

The coach's notebook: short observations (160 characters at most) that the coach writes about your training from one week to the next — for example "skips core work when it comes at the end of a session". They are not shown in the App, but are included in the copy of your data (see 7); an observation the coach does not renew is deleted after eight weeks.

2.5 Circle

Friends list, sent and received requests, invitation links, posts (text, photo, attached session or record), comments, reactions, reports you submit, people you block, the metrics you choose to share, invisible mode.

2.6 Subscription

The state of your trial and subscription (plan, status, end date), technical subscriber identifier. No banking data: payment is handled by Apple or Google, who do not pass your payment method on to us.

2.7 Technical data

Crash and error reports (device model, system and App version, technical error trace), programme generation log (duration, cost, safety adjustments applied). No advertising trackers, no cookies.

3. Why, and on what basis

We do not use your data for advertising and we do not sell it to anyone.

4. AI generation

To build your programme, our servers send Anthropic PBC (provider of the Claude model, United States) an extract of your data, strictly limited to what serves training:

• age, sex, height, weight, experience, climbing rhythm before the programme, fingerboard experience, level, current grades (boulder, route, flash) and target grade, target date, goal, disciplines, equipment, availability, sessions per week or the choice to let the coach decide;
• your strength tests: the latest battery and the three before it;
• active pain or injury areas and the chosen mode;
• your sessions from the last month, exercise by exercise: what was planned, the sets done, the exercises skipped and why, how hard it felt, the routes and boulders you sent; your free sessions too (date, duration, how hard it felt, routes and boulders sent);
• for main exercises done earlier, the last dose held in full and its date;
• your end-of-week feedback from the last month and its 300-character comments;
• your season plan, computed by our servers from this data: the current step, the next grade milestone and whether it is reached;
• a summary of your last year, computed by our servers from the same data: how your tests evolved, your best send per quarter, consistency by day and by session type, exercises often skipped or done in full, the gap between felt and target effort, and the dates of past pain;
• the coach's notebook (see 2.4), which it reads and updates at each generation.

Never sent: your first name, last name, email address, photos, circle posts, comments or friends.

The model only picks from validated exercises and session templates; our servers then check every programme against safety rules before showing it to you. Under Anthropic's commercial terms, this data is not used to train its models and is kept only for a limited period (30 days at most) for safety purposes. This transfer outside the European Union is covered by the European Commission's standard contractual clauses.

No decision with legal effect on you is taken automatically.

5. Who your data is shared with

5.1 Your friends

An accepted friend only sees a reduced card: first name, last name, profile photo, level, badges, and only the metrics you chose to share in the settings. Your weight, height, strength tests, injuries, detailed sessions and comments never leave your account; this filtering is enforced by the database itself, not by the App.

Your posts are visible only to your accepted friends. Invisible mode removes you entirely from search, suggestions and the ranking.

5.2 Our processors

Every transfer outside the European Union relies on the European Commission's standard contractual clauses or on an adequacy decision (Data Privacy Framework).

5.3 Authorities

We may disclose data where the law requires it or in response to a legitimate request from an authority.

6. How long

7. Your rights

At any time you may:

• access your data and obtain a copy;
• rectify it (most of it can be changed directly in the App);
• erase it: the "Delete my account" button, in the settings, erases everything immediately;
• obtain its portability in a machine-readable format;
• request its restriction (a temporary freeze, for example while we check data you dispute);
• object to processing based on our legitimate interest;
• withdraw your consent to the processing of your health data (see 2.3), without affecting what was done before;
• set directives about what happens to your data after your death.

Write to us at support@rinja.com; we answer within one month. We may ask you to confirm your identity from the account's email address.

If you believe your rights are not respected, you may lodge a complaint with the French data protection authority, the CNIL (cnil.fr), 3 place de Fontenoy, 75007 Paris, or with the supervisory authority of your country of residence.

8. Security

Your data is encrypted in transit (TLS) and at rest at our host. Access to every piece of data is controlled row by row by the database (row-level security policies): a user can only read what belongs to them or what a friend chose to share. Post photos are stored in a private space and served through signed, time-limited links. The keys to the AI services never leave our servers.

No system is infallible: in the event of a data breach likely to harm you, we will inform you and the CNIL within the legal deadlines.

9. Minors

The App is for people aged 15 and over. For 15–18 year olds, more cautious training rules apply automatically. If you believe a child under 15 has created an account, write to us: we will delete it.

10. Changes

We may update this policy. A substantial change will be signalled in the App before it takes effect. The date at the top of this document indicates the version in force.

11. The website

The Rinja presentation website sets no cookies or trackers and does not measure its audience. Like any server, its host keeps a technical connection log (IP address, page requested, date) to keep the site secure, for [duration to be completed].