Privacy Policy

1. Overview

This policy explains what information climbit.lol collects when you play the game or place a sponsor bid, how it is used, and who it is shared with. We collect as little as the Service can function with, we run no advertising or cross-site tracking, and your raw IP address is never stored in our database.

2. What We Collect

• Content you submit publicly: when you plant a climber flag or place a sponsor bid, we store exactly what you type — username or brand name, product name, one-line message/pitch, and URL. This information is publicly visible on the leaderboard by design.
• Payment confirmations (not card details): payments for sponsor bids are handled by our Merchant of Record, Dodo Payments. Your card number and banking details go directly to Dodo and are never sent to us. We receive only the payment confirmation needed to activate your placement (amount, transaction reference, status).
• Click counts on billboard links: when someone clicks a sponsor link, we record which link was clicked and increment its public click count. Raw IP addresses are never stored with these events; where abuse-prevention hashing is enabled, a one-way salted hash may be stored instead, which cannot be reversed into an identity.
• Transient rate-limit data: to stop spam and abuse, your IP address is used momentarily by our rate-limiting provider to throttle excessive requests. It is used for protection only and is not stored in our own database.
• Local game progress: things like your high score, sound preference, and play history are stored only on your own device via browser localStorage. They never leave your browser and you can erase them anytime via your browser’s site-data settings.

3. How We Use Information

• Displaying climber flags, sponsor rankings, and in-game billboards.
• Activating paid sponsorships after payment confirmation.
• Showing sponsors aggregate click counts for their placements.
• Preventing fraud, spam, and abusive submissions.

We do not sell personal data, and there are no ads or third-party analytics scripts on the site.

4. Third-Party Providers

The Service runs on a small number of infrastructure providers:

• Dodo Payments (Merchant of Record): processes sponsor payments, billing, and invoicing. Your payment data is handled under Dodo’s own privacy policy.
• Supabase: cloud database hosting with row-level security, storing public leaderboard records.
• Vercel: hosting, edge network, and server infrastructure.
• Upstash: rate-limiting service used for abuse prevention.
• Public logo/favicon services: leaderboard entries load brand icons from public logo CDNs. Like any image loaded from the internet, those providers see standard request data (such as your IP) when your browser fetches them.

5. Data Retention & Deletion

Public submissions are kept while they remain active on the leaderboard. If you want your flag, sponsor entry, or pitch updated or removed, email us and we will action it. Local game data never reaches us, so deleting it through your browser removes it completely.

6. Children

The Service is not directed at children under 13, and we do not knowingly collect personal information from them. If you believe a child has submitted personal information, contact us and we will remove it.

7. Changes to This Policy

If this policy changes, the revised version will be posted here with an updated “Last Updated” date.

8. Contact Us