OnSet Operations LLC
Privacy Policy
Effective Date: April 28, 2026
Last Updated: August 2, 2026
1. Introduction
OnSet Operations LLC ("OnSet," "we," "our," or "us") operates the OnSet web application, the OnSet staff mobile application, and the Onset Climb customer mobile application (collectively, the "Services"). This Privacy Policy explains what personal information we collect across all three platforms, how we use it, with whom we share it, and the rights and choices available to you.
By accessing or using the Services, you acknowledge the collection, use, and disclosure practices described in this Privacy Policy. If you do not agree with this policy, please discontinue use of the Services and contact us to request deletion of your data.
We are committed to transparency. This policy is written in plain language and covers our actual practices — not aspirational ones. If you have questions about anything here, please contact us at billy@onsetops.com.
2. Categories of Users
OnSet serves several distinct audiences across its Services:
Facilities
Gyms, climbing facilities, and other organizations ("Facilities") that subscribe to the OnSet platform. Facilities control how the platform is configured and used within their organization. Where Facilities provide the platform to their staff or members, the Facility acts as the data controller for the operational data generated within that account.
Staff Users
Individual staff members, route setters, administrators, and other personnel who access the OnSet web application or staff mobile application through a Facility account. Staff Users generate operational data — such as setter assignments, climb logs, and route records — that is controlled by their Facility.
Member Users
Climbers and members who access the Onset Climb customer mobile application to view routes, track activity, or interact with their facility's content. Member Users interact with Facility-controlled content but maintain their own personal account with OnSet.
This policy addresses all three relationships. If you are a Staff User or Member User accessing OnSet through a Facility account, please also refer to your Facility's own privacy policy.
3. Information We Collect
a. Account Information
- Full name, if provided during registration
- Email address
- Authentication credentials, managed and encrypted by Supabase; we never store raw passwords
- Profile photo, if uploaded voluntarily
b. Facility Operational Data (Processed on Behalf of Your Facility)
The following data is generated and controlled by your Facility. OnSet processes it on the Facility's behalf as a data processor, under the Facility's instructions:
- Climb logs, route data, setter assignments, notes, and grading information
- Wall and inventory records, scheduling data, and route lifecycle information
- Role assignments, permissions, and team structures within your facility
- Member activity, check-ins, and engagement data within the customer app
- Any other operational content entered into the platform by you or your Facility
Because your Facility controls this data, requests to access, correct, or delete it should be directed to your Facility administrator first. OnSet will assist the Facility in fulfilling such requests as required.
c. Device and Technical Data
- Device type, model, and operating system version
- App version and session data
- IP address and general location, at country or region level only
- Crash reports, error logs, and performance diagnostics collected via Sentry
- Browser type and version for web application users
d. Push Notification Data
- Device push tokens, used solely to deliver notifications
- Notification preferences and interaction data, such as whether a notification was opened
e. Website Usage Data
When you visit our website, we may collect information such as:
- IP address
- Browser type
- Device information
- Pages viewed
- Referring website
- Date and time of access
This information is used to operate, secure, maintain, and improve our website and Services.
f. Information We Do NOT Collect
We do not collect precise GPS location, financial or payment information, government ID numbers, biometric data, health information, or contacts from your device.
g. Data Minimization
OnSet collects only the minimum personal data necessary to provide the Services' features. We do not require users to provide personal information beyond what is needed for the Services to function. We periodically review what data we collect and delete or stop collecting data that is no longer necessary.
4. Cookies and Similar Technologies
Our website and web applications may use cookies, local storage, session tokens, and similar technologies that are necessary for authentication, security, account management, and operation of the Services.
We do not currently use advertising cookies, third-party advertising technologies, or cross-site behavioral tracking technologies.
You may control cookies through your browser settings, although disabling certain cookies may affect functionality of the Services.
5. How We Use Information
We process your data only for the following purposes and do not use it for any other purpose without your consent:
- Provide, operate, and maintain the OnSet platform across all Services
- Create and manage user accounts, roles, and permissions
- Enable real-time collaboration among facility staff and setters
- Deliver route and facility content to member users via Onset Climb
- Send push notifications related to assignments, route updates, or system activity
- Monitor app performance, diagnose bugs, and fix crashes via Sentry
- Improve features and user experience based on aggregated, anonymized usage patterns
- Respond to your support inquiries and communications
- Comply with applicable legal obligations
6. Legal Bases for Processing
For users in jurisdictions that require disclosure of legal bases for processing personal data, we rely on the following grounds:
- Contractual necessity: Processing required to provide the Services you have requested, including account creation, authentication, and core platform features
- Legitimate interests: Processing necessary for our legitimate interests in improving and securing the Services, preventing fraud, and maintaining operational reliability, where those interests are not overridden by your rights
- Legal obligation: Processing required to comply with applicable laws and regulations
- Consent: Where required by law, such as for push notifications or certain cookies, we rely on your explicit consent, which you may withdraw at any time
7. Organizational Accounts and Data Processing Roles
When a Facility subscribes to OnSet and grants its staff or members access to the Services, OnSet acts as a "data processor" for that Facility with respect to the operational data generated within the platform. The Facility is the "data controller" for that data.
What This Means for Staff Users
- Your Facility, not OnSet, is primarily responsible for how your operational data is managed, retained, and disclosed
- Your Facility administrator has access to data you enter into the platform as part of normal operations
- Questions about how your Facility handles your data should be directed to your Facility administrator or your Facility's own privacy policy
- OnSet will process your data only as instructed by your Facility, except where we are independently required by law to act otherwise
What OnSet Controls Independently
Separate from Facility operational data, OnSet acts as an independent data controller for:
- Account credentials and authentication data, including your email and login
- Device and technical data collected for app performance and diagnostics via Sentry
- Push notification tokens and preferences
- Support communications you send directly to OnSet
Data Processing Agreements
OnSet enters into Data Processing Agreements (DPAs) with Facilities that require them, including those subject to GDPR or other applicable data protection laws. Facility administrators may request a copy of OnSet's standard DPA by contacting billy@onsetops.com.
8. Data Ownership
Facilities own the operational data they and their staff generate within the OnSet platform. This includes route records, setter assignments, climb logs, wall configurations, and all other content created through the Services under a Facility account.
OnSet does not claim ownership of Facility data. Upon termination of a Facility account, OnSet will provide a reasonable opportunity for the Facility to export its data before deletion, subject to the terms of any applicable service agreement.
Individual user account data — such as your email address, profile information, and authentication credentials — belongs to you as the account holder. You may request deletion of this data at any time by contacting billy@onsetops.com.
9. User Content
Users may submit content to the Services, including route notes, setter comments, photos, and other materials ("User Content"). By submitting User Content, you grant OnSet a limited, non-exclusive license to store, display, and transmit that content as necessary to operate the Services.
We do not use User Content for marketing, advertising, or any purpose beyond operating the platform feature for which it was submitted. You retain ownership of your User Content.
If User Content is submitted within a Facility account, the Facility also has rights to that content as described in Section 8. When you leave a Facility or your account is removed by an administrator, operational content you submitted may remain within the Facility's account per the Facility's data retention practices.
10. How We Share Information
We do not sell, rent, or trade your personal data to third parties for marketing purposes. We share information only in the following limited circumstances:
a. Service Providers
We share data with third-party vendors who help us operate the Services. These vendors are contractually prohibited from using your data for purposes beyond those specified in our agreements. See Section 22 for a full list of subprocessors.
b. Within Your Facility
Certain profile information, such as your name and role, is visible to other authorized users within your facility or organization. You consent to this by joining a facility workspace.
c. To Your Facility Administrator
If you access OnSet through a Facility account, your Facility administrator has access to operational data you generate as part of normal platform operation. The Facility is responsible for its own data practices with respect to its staff and members.
d. Legal Requirements
We may disclose your information if required by law, court order, or government authority, or if we believe in good faith that disclosure is necessary to protect our rights, prevent fraud, or ensure the safety of users or the public.
e. Business Transfers
If OnSet is involved in a merger, acquisition, or asset sale, your information may be transferred as part of that transaction. We will notify you via email or prominent in-app notice before your data becomes subject to a different privacy policy.
f. With Your Consent
We may share your data with additional third parties when you explicitly authorize us to do so.
11. Social Sharing Features
The Onset Climb customer application may include features that allow members to share route completions, grades, or other activity within a facility's community feed or with other members. Participation in these features is voluntary.
When you use a social sharing feature, the content you share becomes visible to the audience you select — which may include other members of your facility or, where applicable, a wider audience. OnSet does not control how recipients of shared content further use or distribute it.
We do not share your activity data with external social networks, advertising platforms, or third-party apps without your explicit consent.
12. Data Security
- Data is stored in secure cloud infrastructure provided by Supabase, using AES-256 encryption at rest and TLS 1.2+ in transit
- Access to production systems is restricted to authorized personnel only, using role-based access controls
- We conduct periodic reviews of our security practices and promptly address identified vulnerabilities
- In the event of a data breach that affects your personal information, we will notify you in accordance with applicable law
While we implement industry-standard safeguards, no system is completely immune to risk. You are responsible for maintaining the confidentiality of your account credentials.
13. Data Retention
We retain your personal data for as long as necessary to:
- Provide the Services and their features
- Maintain your account and its history
- Comply with legal, tax, and regulatory obligations
- Resolve disputes and enforce our agreements
When you request account deletion, we will delete or anonymize your personal data within 30 days, except where retention is required by law. Aggregated, anonymized data — which cannot identify you — may be retained indefinitely for analytics purposes.
For Facility operational data, including climb logs, setter assignments, and route records, retention is governed by the Facility's instructions and any applicable Data Processing Agreement. End Users seeking deletion of operational data should contact their Facility administrator. OnSet will fulfill deletion requests from Facilities within 30 days of instruction.
14. Your Privacy Rights and Choices
Depending on your location, you may have the following rights regarding your personal data:
- Access: Request a copy of the personal data we hold about you
- Correction: Request correction of inaccurate or incomplete data
- Deletion: Request deletion of your account and associated personal data
- Portability: Request your data in a machine-readable format
- Objection / Restriction: Object to or request restriction of certain processing activities
- Withdraw Consent: Where processing is based on consent, withdraw it at any time without affecting prior processing
To exercise any of these rights, contact us at billy@onsetops.com. We will respond to verifiable requests within 30 days, or as required by applicable law. We do not charge a fee for reasonable requests. We may require identity verification before fulfilling requests.
If you access OnSet through a Facility account, some rights — particularly access, correction, and deletion of operational data — must be exercised through your Facility administrator, as the Facility is the data controller for that data.
15. Push Notifications
OnSet uses push notifications to alert Staff Users to assignment updates, route changes, and other facility activity. Onset Climb may notify Member Users of new routes, facility announcements, and relevant activity. Notifications are delivered via Apple Push Notification Service (APNs) on iOS and Google Firebase Cloud Messaging (FCM) on Android.
Your Consent Is Required First
We will never send you push notifications without your explicit prior consent. When you first launch a mobile app, your device will present a system permission prompt asking whether you allow notifications. We only begin sending notifications if you tap "Allow." We do not send notifications to users who have declined or not yet responded to this prompt.
What We Send
- Assignment notifications — for example, when you have been assigned a new route to set
- Route and wall update alerts relevant to your facility
- System and account activity relevant to your role
- Facility announcements for member users, where enabled by the Facility
We do not send marketing, promotional, or advertising push notifications. All notifications are limited to operational activity directly relevant to your role and facility. No promotional content will ever be sent via push notification without your separate, explicit opt-in consent.
Revoking Consent
You may withdraw your consent and disable notifications at any time through:
- Your device's system Settings > Notifications > OnSet (or Onset Climb)
- Notification preferences within the app settings
Revoking notification consent will not affect your ability to use any core features of the Services. If you later re-enable notifications, you will resume receiving them.
Email Communications
We may send service-related emails regarding:
- Account activity
- Security notifications
- Password resets
- Facility activity
- Administrative communications
- Product updates related to the Services
Users may opt out of non-essential communications where applicable. Certain operational, security, and account-related communications cannot be disabled while maintaining an active account.
16. Children's Privacy
The OnSet staff application and web platform are intended for use by adults and professional facility staff. The Onset Climb member application is intended for climbers aged 13 and older (or 16 in certain jurisdictions). None of our Services are directed to children under 13.
We do not knowingly collect personal data from children under 13. If you believe we have inadvertently collected information from a child, please contact us immediately at billy@onsetops.com and we will delete that information promptly.
17. International Data Transfers
OnSet is operated from the United States. If you access the Services from outside the United States, your data may be transferred to and processed in the United States or other countries where our service providers operate. These countries may have different data protection laws than your country.
Where required by law — for example, transfers from the EEA or UK — we rely on appropriate transfer mechanisms such as Standard Contractual Clauses (SCCs) to safeguard your data.
18. Do Not Track Signals
Some browsers and mobile operating systems include a "Do Not Track" (DNT) feature that signals your preference not to be tracked across websites and apps. Because there is no universally accepted standard for how apps must respond to DNT signals, OnSet does not currently alter its data practices in response to DNT signals.
However, we do not engage in cross-app tracking, behavioral advertising, or the sale of your data regardless of DNT status. If industry standards for DNT compliance are established, we will evaluate and adopt them accordingly.
19. California Privacy Rights (CCPA/CPRA)
If you are a California resident, you have the following additional rights under the California Consumer Privacy Act (CCPA), as amended by the California Privacy Rights Act (CPRA):
- Know: The right to know what personal information we collect, use, disclose, and sell
- Delete: The right to request deletion of your personal information
- Correct: The right to correct inaccurate personal information
- Opt-Out of Sale/Sharing: We do not sell or share your personal information for cross-context behavioral advertising
- Limit Use of Sensitive Information: We do not collect sensitive personal information as defined by the CPRA
- Non-Discrimination: We will not discriminate against you for exercising your privacy rights
To submit a CCPA request, contact billy@onsetops.com. You may designate an authorized agent to submit requests on your behalf with written authorization.
20. Additional U.S. State Privacy Rights
Residents of certain U.S. states — including Virginia (VCDPA), Colorado (CPA), Connecticut (CTDPA), Texas (TDPSA), and others with comprehensive privacy laws — may have rights similar to those described in Section 14 and Section 19, including rights to access, correct, delete, and opt out of certain processing.
OnSet does not sell personal data or process personal data for targeted advertising. We do not engage in profiling that produces legal or similarly significant effects on individuals.
To submit a privacy request under applicable state law, contact billy@onsetops.com. We will respond within the timeframes required by applicable law and will not discriminate against you for exercising your rights.
21. EEA and UK Privacy Rights (GDPR / UK GDPR)
If you are located in the European Economic Area or the United Kingdom, the following additional information applies:
- Data Controller: OnSet Operations LLC is the data controller for the personal data you provide directly to OnSet
- Legal Bases: We process your data based on contract performance, legitimate interests, legal obligation, or your consent (see Section 6)
- Data Protection Contact: billy@onsetops.com
- Right to Lodge a Complaint: You have the right to lodge a complaint with your local supervisory authority
- Automated Decision-Making: We do not make decisions about you using solely automated processing that produce legal or similarly significant effects
To submit a GDPR data subject request, contact billy@onsetops.com. We will respond within the timeframes required under applicable law.
22. Subprocessors and Service Providers
OnSet uses the following third-party subprocessors to operate the Services. All subprocessors are contractually required to protect your data to standards consistent with this policy and applicable law.
Supabase
Provides secure cloud database infrastructure and authentication services. Data is stored in encrypted form. Privacy policy: supabase.com/privacy
Sentry
Provides error monitoring and crash diagnostics. Diagnostic events may include app and device metadata, crash reports, stack traces, the action where an error occurred, and internal user and Facility identifiers. OnSet uses this information solely to diagnose errors, maintain app reliability, and provide support. It is not used for advertising or cross-app tracking. Privacy policy: sentry.io/privacy
Apple Push Notification Service (APNs)
Used to deliver push notifications to iOS devices. Only device push tokens are shared, solely for routing notifications. Message content is not disclosed to Apple beyond what is required for delivery. Privacy policy: apple.com/legal/privacy
Google Firebase Cloud Messaging (FCM)
Used to deliver push notifications to Android devices. Only device push tokens are shared, solely for routing notifications. Privacy policy: firebase.google.com/support/privacy
We will update this list if we add new subprocessors. Facilities operating under a DPA will be notified in advance of any material changes to our subprocessor list.
23. Mobile Application Disclosures
Tracking Technologies and SDKs
Our mobile applications use the following third-party SDKs. We do not use any tracking technologies for advertising or cross-app tracking.
- Sentry: May assign a persistent device-level identifier to correlate crash reports across sessions, used solely for diagnostic purposes
- APNs / FCM: Assign push tokens to your device when you grant notification permissions, stored solely to route notifications
We do not use analytics SDKs, advertising SDKs, or fingerprinting technologies beyond what is described above.
Apple App Privacy Label
In accordance with Apple's App Privacy requirements, our App Store listings disclose all data types collected and their purposes. The categories disclosed in this policy are consistent with those labels. If you observe any discrepancy, please contact us immediately.
Privacy Manifest (PrivacyInfo.xcprivacy)
OnSet's iOS application bundle includes privacy manifests for the app and applicable third-party SDKs. These manifests describe required-reason API usage and applicable data-collection practices. OnSet's App Store privacy disclosures and this Privacy Policy provide additional information about how the app collects and uses data.
24. Artificial Intelligence and Automated Technologies
OnSet does not currently use third-party artificial intelligence services to process your personal data. We do not send user data to any external AI providers such as OpenAI, Google Gemini, Anthropic, or similar services.
If this practice ever changes, we will update this policy, notify you in advance, and obtain any required consent before your data is shared with an AI service, in accordance with applicable law and platform guidelines.
We do not make automated decisions about users that produce legal or similarly significant effects without human review.
25. Account Suspension and Termination
OnSet may suspend or terminate accounts that violate our terms of service or applicable law. In the event of suspension or termination:
- We will provide notice to the account holder where reasonably possible, except where doing so would compromise an active investigation or be prohibited by law
- Personal data associated with a terminated account will be deleted or anonymized within 30 days, subject to any legal retention obligations
- Facility operational data will be handled in accordance with the terms of any applicable service agreement and Data Processing Agreement
If you believe your account was terminated in error, please contact us at billy@onsetops.com.
26. Changes to This Privacy Policy
We may update this Privacy Policy periodically. When we make material changes, we will:
- Post the updated policy on this page with a new effective date
- Send you an in-app notification or email, where required by law, at least 30 days before changes take effect
Your continued use of the Services after the notice period constitutes acceptance of the updated policy. If you do not agree to the updated policy, you may discontinue use and request deletion of your data by contacting us at billy@onsetops.com.
27. Contact Information
If you have questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us:
OnSet Support
Email: billy@onsetops.com
Mailing Address: OnSet Operations LLC, 3817 Evanston Ave N, Seattle, WA 98103
For verified data subject requests under CCPA or GDPR, we will respond within the legally required timeframe.
This Privacy Policy is available at the following locations:
- Web: /privacy-policy
- Staff app: Settings > Privacy Policy
- Onset Climb: Settings > Privacy Policy
- App Store and Google Play listings for both mobile apps
28. Miscellaneous Provisions
Entire Agreement
This Privacy Policy, together with any applicable Data Processing Agreement and our Terms of Service, constitutes the entire agreement between you and OnSet regarding the collection and use of your personal data.
Severability
If any provision of this Privacy Policy is found to be unenforceable, the remaining provisions will continue in full force and effect.
No Waiver
Failure by OnSet to enforce any provision of this Privacy Policy does not constitute a waiver of our right to enforce that provision in the future.
Governing Law
This Privacy Policy is governed by the laws of the State of Washington, without regard to its conflict of law provisions, except where superseded by applicable federal or international law.