What this covers
This policy explains how we handle your data in the Cims, sempre amunt app and on the fescims.com website. Shop purchases also have their own text: Shop privacy.
1. Controller
The controller of your data is , tax ID (NIF) , address . Contact: hello@fescims.com.
2. What data we process
- Account: your name, email and profile photo, which we receive from Google or Apple when you sign in with them, and that account's identifier. With Apple you can use a hidden email.
- What you do in the app: your summits and their dates, photos and comments, challenges, plans and outings with other people, who you follow and your settings.
- Location, only if you allow it on your phone: we use it to show you nearby summits and record your routes. We keep your last approximate location to recommend summits and tell you about plans nearby. From the photos you upload we read the date and, if present, the location.
- Technical data: your country (inferred from your connection), operating system, app version, when you last connected and the identifier for sending you notifications.
- Pro: purchase identifiers and the status of your subscription (see section 6).
- Website: the technical cookie and, only if you accept them, Google Ads cookies (see the Cookie policy)
To use the app you need an account: without your name and email we can't provide the service. All other data is optional.
3. Why, and on what legal basis
- Providing the app (your account, summits, challenges, plans and the community): necessary to perform the Terms of Service you accept.
- Using your location and sending push notifications: your consent, given through your phone's permission, which you can withdraw in its settings or in your profile.
- Saving your outings as workouts in Apple Health or Health Connect: only if you turn it on. The app only writes to them; it doesn't read your health data.
- Service emails (about your account, your plans and your purchases): performing the contract. Emails with news and offers: only with your consent; you can unsubscribe with the link in each email or by turning emails off in your profile.
- Keeping the app secure, preventing abuse and fixing bugs: our legitimate interest in a working service.
- Measuring our Google Ads campaigns on the website: your consent, through the cookie notice.
- Invoicing, accounting and tax obligations: required by law.
You can withdraw your consent at any time, without affecting anything we did before. You can object to processing based on our legitimate interest by writing to us.
4. Uploaded photos and brand promotions
You retain ownership of your photos. For photos uploaded after you accept the revised Terms of Service, you grant Cims a non-exclusive, worldwide, royalty-free licence to use them to operate the service and promote the Cims brand, app, products, services and community. Uses include websites, app listings, social media, paid ads, email campaigns, videos, press materials and printed promotions, with cropping, resizing and other edits that respect your moral rights. Providers and campaign partners may receive photos only to carry out these uses for Cims. Public promotions may be seen and shared by people outside the app. Older uploads require separate permission for promotional use.
Read the full photo licence in section 11 of the Terms of Service.
5. People in photos and consent
The copyright licence is separate from permission to process personal data or use a person's likeness. Before using a photo of an identifiable person in a promotion, Cims must obtain any legally required, separate consent from that person or their legal representative. Simply uploading a photo or accepting the terms does not provide that consent.
Deleting a photo or your account, or asking us by email, ends the licence for new promotional uses of that photo. We will also remove it from ongoing promotions under our control within a reasonable time. Printed materials already distributed and copies shared by others may not be recoverable; your statutory rights remain unaffected. Any copies retained to meet legal obligations or handle legal claims will not be used for new promotions.
6. Pro payments and subscriptions
Pro purchases are processed by Apple App Store or Google Play. Cims sends a private billing identifier to associate a purchase with your Cims account. We store store transaction identifiers, purchase tokens, subscription status and expiry dates to verify purchases, restore access and process subscription notifications. Apple and Google handle payment details; Cims does not store full card numbers or security codes. Cancel Apple renewal in App Store settings before deleting your account; Cims stops Google Play renewal during account deletion.
7. Who we share your data with
Other people using Cims see your name, your profile photo and what you post (summits, photos and comments). Beyond that, we only share with these providers what each of them needs:
- Railway (servers and database): all the app's data. Railway Corporation is in the US; the transfer relies on the EU-US Data Privacy Framework.
- Amazon Web Services (photos): we store them in its Paris region (eu-west-3) and contract with Amazon Web Services EMEA SARL (Luxembourg). Should they be accessed from outside the European Economic Area, its standard contractual clauses apply.
- Resend (email): your email address and the content of the emails. Resend (Plus Five Five, Inc.) is in the US; the transfer relies on the EU-US Data Privacy Framework and standard contractual clauses.
- Expo (push notifications): your phone's notification identifier and the text of each notice, which Expo (650 Industries, Inc., US) delivers through Apple or Google.
- Mapbox (maps): when showing a map, the app requests it from Mapbox, Inc. (US), which receives your IP address, device data and the map area.
- Google and Apple: to sign you in, deliver push notifications and charge for Pro, as independent controllers under their own policies.
- Google Ads, on the website only and only if you accept its cookies: Google Ireland Limited, as an independent controller; Google LLC processes data in the US under the EU-US Data Privacy Framework.
- Discord (internal alerts): the name and email of new accounts, Pro subscription changes, the reason you give when deleting your account, error reports, reports of flagged content and the messages you send us from the app or website, so we can deal with them. Discord, Inc. is in the US; the transfer relies on the EU-US Data Privacy Framework and standard contractual clauses.
Where a provider processes data outside the European Economic Area and we don't say so above, it does so under a European Commission adequacy decision or its standard contractual clauses. You can ask us for a copy of these safeguards at hello@fescims.com. We don't sell your data.
8. How long we keep data
- Your account and what you post: for as long as you have the account. You can delete photos and summits at any time.
- Your last approximate location: replaced each time the app updates it.
- If you delete your account from your profile, we delete your profile, summits, photos and comments. Summits you did with other people stay on their profiles.
- Pro billing records: disconnected from your user, only for as long as accounting, disputes or the law require.
- Shop orders: see Shop privacy.
9. Your rights
You can ask to access, correct, delete, restrict or port your data, object to its processing or withdraw your consent, by writing to hello@fescims.com. We will answer within one month at the latest. If you think we have mishandled your data, you can complain to the Spanish Data Protection Agency (AEPD) or the data protection authority in your country.