Privacy Policy

Maky Software Inc. ("we", "us", or "our") operates Cima ("the Service"). This Privacy Policy explains how we collect, use, disclose, and protect your personal information when you use our Service.

By using the Service, you agree to the collection and use of information in accordance with this policy. We are committed to protecting your privacy and ensuring transparency about our data practices.

We collect different types of information to provide and improve our Service:

Account Information

When you create an account via Google OAuth, we receive:

• Email address (for account identification)
• Display name (for personalization)
• Profile picture URL (for your avatar)

Usage Data

We automatically collect:

• Session information (climbing sessions you log)
• Problem data (grades, attempts, completions)
• Goals and achievements
• Device information (browser type, IP address)
• How you use the Service, such as the pages and screens you view, the features you use, and errors (see Section 5)

Video Content

When you upload climbing videos for AI analysis, we temporarily store and process these videos to provide technique feedback. Video data is handled with strict security measures.

We use the collected information for:

• Providing and maintaining the Service
• Authenticating your identity and managing your account
• Displaying your progress, analytics, and achievements
• Processing videos through AI for technique analysis
• Measuring how the Service is used, and finding and fixing errors (product analytics)
• Improving our AI models (using anonymized data)
• Communicating with you about updates or support
• Detecting and preventing fraud or abuse

We implement industry-standard security measures to protect your data:

• All data is encrypted in transit using SSL/TLS
• Data at rest is encrypted in our PostgreSQL database
• Sign-in provider tokens are protected. AI apps you authorize receive separate, scoped access tokens; disconnecting revokes their access.
• Videos are stored in secure cloud storage (AWS S3)
• Regular security audits and monitoring

While we strive to protect your data, no method of transmission or storage is 100% secure. We cannot guarantee absolute security.

We use the following third-party services:

AI assistants you connect

You choose whether to connect an AI app such as Claude or ChatGPT. After you sign in and explicitly approve sharing, it can read your climbing sessions, climbs, grades, projects and attempts; your free-text notes; video analysis scores and feedback; finger training, effort ratings and body weight; goals, achievements, XP and statistics; and your analysis credit balance. This may include sensitive health information, such as injury mentions in notes.

This connection does not share raw videos, media links or pose data, other users' data, passwords or payment details. It cannot change or delete your data, buy credits or start a paid analysis.

The AI provider receives the data as an independent provider and handles it under its own privacy policy, retention rules and model-training settings. Cima does not control the chats you create there. For personal ChatGPT plans, app data may be used for model training when “Improve the model for everyone” is enabled. Review your provider's settings before connecting. OpenAI's app data policy

Disconnect an app in AI assistants on the web, or Connected apps in mobile Settings. Access stops immediately, including access while you are signed out of Cima. Disconnecting does not delete data already received by the provider; delete those chats or request deletion from that provider.

We keep connection records to show the app identity, approved permissions, connection date and last use, and to enforce revocation. MCP usage analytics record the tool name, outcome and timing, not your notes, tool arguments, results or conversation content. Authorization tokens and codes are not included in these analytics.

Google OAuth

We use Google OAuth for authentication. When you sign in with Google, we only request access to your basic profile information (email, name, profile picture). We do not access your Google Drive, Gmail, Calendar, or any other Google services.

AI Analysis Provider

Videos you upload are processed using AI services to provide technique feedback. Video content is not retained by AI providers after analysis is complete.

Cloud Infrastructure

We use Amazon Web Services (AWS) for hosting and storage. Data is stored in secure, compliant data centers.

Product Analytics and Error Tracking (PostHog)

We use PostHog (US Cloud) to understand how people use Cima and to find and fix errors. PostHog processes this data on our behalf as our processor and stores it in the United States. It receives:

• Website: pages you view, features you use, errors, and session recordings of your visits. Recordings hide what you type into forms and mask your email address and notes, but can show other text on the page, such as display names.
• Mobile app: screens you view, features you use, and crash and error reports. The app does not record your screen.
• Our servers: account events such as sign-ups, video uploads, analyses, and purchases, and AI usage details (model, token counts, response time) without your videos, prompts, or AI responses.

Analytics are linked to an internal account ID, not to your name or email. We do not send PostHog your notes, messages, videos, or payment details. PostHog may also record your browser or device type and an approximate location based on your IP address.

To stop sharing analytics, turn off "Share usage analytics" in Settings (on the website, in the Account tab). This choice applies to that browser or device. Our servers still record the account events listed above.

We retain your personal data for as long as your account is active or as needed to provide you with our services:

• Account data: Retained until you delete your account
• AI connections: Active consent records are removed when you disconnect. Client registration and security records may remain for abuse prevention. Contact us with a data-deletion request.
• The former in-app chat has been retired. Existing chat history is retained for now and remains subject to account deletion; removing the chat interface does not itself delete that history.
• Session and climbing data: Retained until you delete your account
• Videos: Retained for 90 days after analysis, then automatically deleted
• Product analytics: Session recordings are deleted within 90 days. Usage events and error reports are kept for up to 7 years. You can ask us to delete the analytics linked to your account at any time.

Depending on your location, you may have the following rights regarding your personal data:

• Access: Request a copy of your personal data
• Correction: Request correction of inaccurate data
• Deletion: Request deletion of your account and data
• Export: Request a copy of your data in a portable format
• Restriction: Request restriction of processing in certain circumstances

To exercise these rights, please contact us at developer@makyinc.com. We will respond within 30 days.

For users in the European Economic Area (EEA), we process your data based on the following legal bases:

• Contract: Processing necessary to provide the Service you requested
• Consent: Processing based on your explicit consent (e.g., video analysis)
• Legitimate Interest: Processing for service improvement and security

The Service is not intended for children under 13 years of age. We do not knowingly collect personal information from children under 13. If you become aware that a child has provided us with personal data, please contact us immediately.

We use the following types of cookies:

• Essential cookies: Required for authentication and core functionality
• Preference cookies: Remember your settings (language, theme)
• Analytics cookies: PostHog stores a first-party cookie and a local storage entry on Cima's website to recognize your browser between visits. The mobile app stores a similar identifier on your device. Turn off "Share usage analytics" in Settings to stop this.

We do not use advertising cookies or advertising IDs. We do not sell your personal data or use it to track you across other companies' websites or apps.

We may update this Privacy Policy from time to time. We will notify you of any material changes by posting the new policy on this page and updating the "Last updated" date. We encourage you to review this policy periodically.

If you have any questions about this Privacy Policy or our data practices, please contact us at:

Maky Software Inc.
developer@makyinc.com

For GDPR-related inquiries, you may also contact your local data protection authority.