Privacy Policy
Last updated: 06/12/26
This Privacy Policy explains how Skillsoar APT Pte. Ltd. ("Climbout", "we", "us") collects, uses, and protects personal data when you use climbout.app (the "Service"). We handle personal data in accordance with Singapore's Personal Data Protection Act 2012 (PDPA), and we apply equivalent protections to users in the EU/EEA.
1. Controller and contacts
Controller: Skillsoar APT Pte. Ltd., 10 Choa Chu Kang Rd, Singapore 689379.
Email: support@climbout.app / privacy: privacy@climbout.app
- Data protection contact: privacy@climbout.app
2. What data we collect
a) Account data — when you sign up, our authentication provider Clerk processes your email address, name (if provided), password (hashed; we never see it), and, if you use social sign-in (e.g. Google), the basic profile data you authorise.
b) Usage and progress data — test attempts, scores, answers, progress metrics, settings, and timestamps generated as you use the Service. This is stored in our application backend (Convex).
c) Payment and billing data — when you subscribe, payments are handled by Polar, which acts as our merchant of record. Polar (and its own payment processors) handle your payment details; we receive transaction status, subscription details, and limited billing metadata. We do not store full card numbers.
d) Technical and log data — IP address, device/browser type, pages requested, referrer, and similar log data generated by our hosting (Vercel) and network/CDN (Cloudflare), used for delivery, security, and abuse prevention.
e) Communications — the content of emails you send to us (via our Namecheap-based email forwarding) and any support correspondence.
f) Cookies and similar technologies — see our Cookie Notice and Section 8.
3. Why we process your data
| Purpose | Data | Basis |
|---|---|---|
| Create and operate your account; provide the Service | a, b | Performance of a contract |
| Process subscriptions and payments | c | Performance of a contract |
| Security, fraud/abuse prevention, service stability | d | Legitimate interests |
| Product improvement and aggregate analytics | b, d | Legitimate interests / consent where required |
| Non-essential cookies / optional analytics | f | Consent |
| Comply with tax, accounting, and legal obligations | c | Legal obligation |
| Respond to your enquiries | e | Legitimate interests / pre-contractual steps |
Under the PDPA we rely on your consent and the applicable statutory exceptions (e.g. performance of a contract, legitimate interests) for this processing.
4. Service providers
We share data with the following providers strictly to operate the Service, under appropriate agreements:
| Provider | Function | Location |
|---|---|---|
| Clerk (Clerk, Inc.) | Authentication, user accounts | USA |
| Convex (Convex, Inc.) | Application database / backend | USA |
| Polar (Polar Software, Inc.) | Merchant of record / payments | USA / EU |
| Vercel (Vercel, Inc.) | Application hosting | USA / global edge |
| Cloudflare (Cloudflare, Inc.) | DNS, CDN, security | USA / global |
| Namecheap (Namecheap, Inc.) | Email forwarding for our domain | USA |
Update this list if you add analytics, email, or error-tracking tools (e.g. PostHog, Sentry, Resend).
5. International data transfers
Your data may be processed outside your country, including in the United States and Singapore. Where we transfer personal data across borders, we rely on appropriate safeguards, such as contractual protections with our providers that ensure an equivalent standard of protection. A copy of the relevant safeguards is available on request at privacy@climbout.app.
6. Retention
We keep account and progress data for as long as your account exists. After account deletion, we delete or anonymise personal data within 90 days, except where longer retention is required by law (e.g. tax/accounting records, typically 5 years) or to establish/defend legal claims.
7. Your rights
You have the right to access and correct your personal data, to withdraw consent, and to request deletion, subject to applicable law. Under the PDPA you may also contact Singapore's Personal Data Protection Commission (PDPC). If you are in the EU/EEA, you may also have rights of erasure, restriction, portability, and objection, and may contact your local supervisory authority.
To exercise any right, contact privacy@climbout.app. We will respond within the applicable time limits.
8. Cookies
We use cookies and similar technologies that are strictly necessary for authentication (set by Clerk), payment/security, and core functionality. Non-essential cookies (e.g. optional analytics) are only set with your consent. See the Cookie Notice for details.
9. Children
The Service is intended for users aged 16 and over (or the applicable age of digital consent in your country). We do not knowingly collect data from children below that age.
10. Security
We use industry-standard measures (encryption in transit, access controls, reputable processors). No method of transmission or storage is 100% secure, but we work to protect your data appropriately.
11. Changes
We may update this Policy. Material changes will be announced on this page with a new "Last updated" date and, where required, by notice to you.
12. Contact
Questions? Email support@climbout.app or write to Skillsoar APT Pte. Ltd., 10 Choa Chu Kang Rd, Singapore 689379.