Privacy
Version 2026-10-30
This is written from the database rather than from a template, so it says what is actually stored rather than what a policy usually says. If something here is wrong, it is a bug and it is worth telling us about.
Who runs this and who to ask
The Web Network is run by Vitto Pessanha, an individual developer in Alberta, Canada, and not a company. "We" and "us" on these pages mean Vitto Pessanha. Vitto Pessanha is also the person responsible for personal information here, and answers questions about it.
Write to info@thewebnetwork.co about anything on this page.
What is held, and why
| What | Why |
|---|---|
| Your email address and a password hash | So you can sign in, confirm your address and recover the account by email. |
| The address of each device you asked us to notify, which things you asked to be told about, and any pause or quiet hours you set, with the time zone they follow | So a notification can reach a phone that is not open. The address is minted by your own browser or by Apple, never by us, and it is only stored because you pressed a switch and your device granted permission. Both are yours. It is deleted outright when you turn notifications off on that device, when the push service says the address is dead, and when you delete your account. A notification says what happened. It can include the first name of a person whose profile is listed, the name of a community or the title of an event, for example "Ava commented on your post." It never contains message text, post text or account numbers, because a lock screen is a public surface. |
| A daily tally of how many times each page was served | So we can tell whether anybody is using this and where they stop. It is split only by whether the visitor was signed in, and that is read from the presence of a cookie and never from its contents. There is no identifier of any kind in it: no account, no address, no device, no location, and no visitor id. It is a table of totals, so no row in it can be narrowed to a person, including you. |
| Your email address, if you put it on the founding list | So we can tell you when the founding drop opens, which is the only thing it is used for. It is kept separately from accounts: somebody on the list has no account, no Outsider number and no password here. Joining the list and joining Base Camp are different things and neither one creates the other. |
| Which link you first arrived on, if it carried a campaign tag | So we can tell which piece of work brought people here, and stop paying for the ones that did not. It is three words a marketer typed into their own advertising URL, held for thirty days in a cookie on your device and then written once against your account. It is not an identifier, it does not follow you off this site, and there is no advertising pixel or third party script anywhere in this app. |
| An internal account number, the date you joined, and your climb stage | The account number routes requests to your account. It is not shown to other Climbers unless you become an Outsider. It is never reissued, including after you delete the account. |
| The name you choose to show, your pronouns, your city, your bio, and what you are climbing toward | Shown to other people while your profile is public, which it is when you join. In Settings, Privacy you can hide your profile, or show it only to your connections with Introductions only. |
| Your answers to the twenty intake questions and to the first test, the scores from them, and the reading built from them | To produce your archetype. It is never sold, never shared, and never sent to any third party. |
| Your journal entries | Private to you. Nothing else in this app reads them and no model is run over them. |
| The private focus you choose, any words you add, the next step shown, whether you opened it, and the answer you give afterwards | To give you one explainable next step and preserve your private history across devices. It is visible only to you, is not used to match you with people or Spaces, and is deleted with your account. |
| Which learning Resources you saved or marked complete, and when | To keep your Learn shelf and progress consistent across devices. Opening an original source does not mark it complete. |
| What you submit to shared surfaces: feed posts, perspectives, replies, answers to the daily question, service listings | To show standing items to other Climbers and to let a human review held or reported content. If you delete your account, service text is removed from both the listing and any conversation subject copied from it. |
| Your answers to the daily question, up to 500 characters each | To show them to your connections and to everyone who answered the same day's question. You can change an answer for 15 minutes and withdraw it at any time; a withdrawn answer is shown to nobody. A heart on an answer shows its author only a count. Deleting your account removes your answers. |
| The daily questions, up to 140 characters each, and which staff account wrote each one | To show one question a day to everyone. If the staff account that wrote a question is deleted, the question stays and no longer points to that account. |
| Post photos you choose to upload, their dimensions and their connection to your post | To display your chosen photos under the post's access rules and let authorized reviewers inspect them. Uploads are converted to JPEG without embedded image metadata. Unused uploads stop being accessible after 24 hours. Withdrawal and account deletion remove access and queue stored copies for cleanup. Physical cleanup depends on the scheduled job and storage availability. Random storage-key records are retained to retry interrupted deletion; they contain no account identifier. |
| Videos you choose to post, their length, size, a poster frame and their connection to your post | To play your video under the post's access rules and let authorized reviewers watch it. A video is limited to about one minute and 50 MB. Before it is stored, the place and device details an iPhone writes into the file, such as where it was recorded and the phone model, are cleared. The picture, sound and recording time are kept as you uploaded them. A file the app cannot read with certainty is stored unchanged. The poster frame is converted to JPEG without embedded image metadata. Sound is recorded only if you allow the microphone. Unused uploads stop being accessible after 24 hours. Withdrawal and account deletion remove access and queue stored copies for cleanup. Physical cleanup depends on the scheduled job and storage availability. Random storage-key records are retained to retry interrupted deletion; they contain no account identifier. |
| Photos you send in a conversation, their dimensions and their connection to the message | To show them to the people in that conversation, in one-to-one threads, group threads and community chat. Only people who have joined the conversation can see a photo. Delete for me hides it from you, and unsending hides it from everyone. Ending contact with the sender, or a block between you in a group, also hides it from you. Photos are converted to JPEG without embedded image metadata, like post photos. Unsending and account deletion queue stored copies for cleanup. Physical cleanup depends on the scheduled job and storage availability. |
| Voice notes you record and send in a conversation: the audio, its length, its type, a waveform summary and a checksum | To play them to the people in that conversation, in one-to-one threads, group threads and community chat. The microphone is used only while you record. A note can be up to two minutes and 5 MB and is stored as audio in the database, like messages, without end to end encryption. Only people who have joined the conversation and are not blocked can play it. A recording you never send expires after a day and is removed, with its audio, the next time you upload a voice note or when you delete your account. Unsending a note removes it and its audio. A sent note stays until you unsend it, the conversation is removed or you delete your account. |
| Videos you send in a conversation: the file, its length, size, type and checksums, and the conversation and message it belongs to | To play them to the people in that conversation. A video is limited to about one minute and 50 MB. Before it is stored, the place and device details an iPhone writes into the file, such as where it was recorded and the phone model, are cleared. The picture, sound and recording time are kept as you uploaded them. A file the app cannot read with certainty is stored unchanged. An upload you never send stops being accessible after 24 hours. Unsending, removal of the conversation and account deletion queue the stored file for cleanup. Physical cleanup depends on the scheduled job and storage availability. Random storage-key records are retained to retry interrupted deletion; they contain no account identifier. |
| Your profile photo, its dimensions, declared file type and checksums of the file you sent and the file we stored | To show it on your profile. Other Climbers see it only while your account is listed and not banned, and neither of you has ended contact. Authorized reviewers can also see it. The photo is converted to JPEG without embedded image metadata. Replacing or removing it, and deleting your account, remove access and queue the stored copy for cleanup. Physical cleanup depends on the scheduled job and storage availability. Random storage-key records are retained to retry interrupted deletion; they contain no account identifier. |
| Your messages, in one-to-one threads and in rooms, names of ad hoc rooms you open, the messages you pin, and the profiles you share in a message | To deliver them. They are stored in the database like everything else and are not end to end encrypted. A pin shows the message at the top of the conversation to everyone in it, not who pinned it, and a conversation holds up to three pins. If you delete your account, your shared message text and your pins are removed and an ad hoc room name you created becomes Closed room. |
| Which official Spaces you joined, were invited to, or left | To open the Space discussion room, enforce its size limit, and stop access when you leave. Joining a Space does not connect you privately to everyone inside it. |
| Who you are connected to, and who asked whom | To decide who may reach you, to show how many connections a profile has, and to suggest people you share connections with. |
| Introductions you make or are part of: who introduced whom, a note of up to 280 characters, each person's answer and when, a Not now choice, and when the one reminder was sent | So two people you know can both say yes before anything opens between them. The three people in an introduction see it. Who declined first is never shown to the introducer or to the other person. An introduction closes after 14 days. If any of the three deletes their account, the introduction is deleted; a connection or conversation it already opened follows its own rules. Introductions are included in your data export. |
| When you send connection requests to several people at once: a random key for the send, a fingerprint of the request and the answer for each person | So a send that is retried after a lost connection is not sent twice. It is working state, not history: records older than seven days are removed the next time you send, and deleting your account removes them. |
| Your Handshakes with another Climber, including their terms, state, delivery and dispute notes, and receipt | So both parties can complete an agreement and keep proof of its ending. If either party deletes their account, the other keeps only a minimum receipt with the two permanent Outsider numbers, the final status and the retention date. Names, prices, terms, due dates, delivery notes, revision notes, dispute text and older receipt wording are removed. If an introducer or canceller deletes their account, their identity field is removed without erasing evidence owned by the two surviving parties. If a third-party dispute actor deletes their account, the original account is replaced by a number-only tombstone and the surviving parties keep the dispute evidence. |
| Whether you show your activity status, when you were last active, and which conversation you are typing in while you type | So Climbers you are connected to can see when you were last active, and so the other people in a conversation can see that you are typing. The time is refreshed from ordinary use of the app at most once a minute and shows as active now within five minutes and recently within 24 hours. The typing signal clears after a few seconds. You can turn it on or off in Settings, Privacy. Turning it off clears your last active time and hides theirs from you. In a group conversation, the other people in it can see that you are typing whether this switch is on or off. Only the latest time is kept, with no history. It is included in your data export, and account deletion removes it. |
| Whether you show read receipts, and how far you have read in each conversation | The point you have read up to keeps unread counts and the inbox right. "Seen" is shown on a message only between two people who both have Show read receipts on, so turning it off hides when you read theirs and hides when they read yours from you. You can change it in Settings, Privacy. It is included in your data export. Account deletion removes the setting, and the conversation keeps your read point only on a closed membership that no longer names your account. |
| People you met by scanning or tapping a card: who, when, a place note up to 80 characters, an event label and the event if you were at one | So you can look back on who you met. Only you see your list. The other person is not told and nothing is written to them. A card scan made during an event is linked to that event by the server. If a daily limit on meeting new people applies to your account, each new person counts toward it. You can change the place note on a meeting. A single meeting cannot be removed on its own. It stays until you delete your account, and it is also removed if the person you met deletes theirs. Your meetings are included in your data export. |
| Stories you post (a photo or a video of up to a minute, with a caption of up to 80 characters, text of up to 200, or a post you share), who opened them, replies to them, the people whose stories you mute and your Close friends list | To show a story for 24 hours to the audience you pick, everyone who can see your stories or only your Close friends, and to show you who opened it. Your mutes are private. A reply is an ordinary message and stays in the conversation after the story is deleted. A story stops showing after 24 hours but its record and views stay stored, and you can still see it in your own archive. Deleting a story hides it and clears its views, not the replies sent. Account deletion removes your stories, views, replies, mutes and Close friends list. Story photos are queued for cleanup when retired, and physical cleanup depends on the scheduled job and storage availability. |
| Highlights you make from your stories, with a title of up to 16 characters | To keep a story on your profile after its 24 hours. Highlights do not expire. Removing a story from a highlight, deleting the highlight or deleting your account queues its photo for cleanup, and physical cleanup depends on the scheduled job and storage availability. |
| Communities you create or join: the name, promise and description, your answers to join questions, your role, who invited you, your notification choices there, your posts there, their lessons and the lessons you mark done | To run the community, decide join requests and show lessons. The About page is open to any signed-in Climber who is not cut off from the owner. Only Climbers who joined can see its posts and who else is in it. Your answers to the join questions are seen by the owner and hosts while the request is open and stay with your place in the community after you are approved. The owner sees how many Climbers marked a lesson done, never who. Declining, leaving or being removed deletes your place in the community and your answers. Account deletion takes you out of every community and removes your posts and lesson marks there, and a community you own is deleted with its list of who joined, its modules, its lessons and its members-only events, whoever hosts them. Its chat is closed, and other Climbers' posts in it stay stored but stop being shown in the community or in feeds. The communities you are in and your answers are in your data export. |
| Events you host (title, time, place or online, description, capacity, who can see it and, if you cancel, a note of up to 280 characters), your answer to an event (Going, Maybe or Can't go), your check-in time, whether you are on the guest list, and who you invited to an event and who invited you | To run the event and show it to the people who can open it. The host's name and photo show to anyone who can open the event. A Going or Maybe answer puts you on the guest list, which the host and other Going or Maybe guests can see unless the host hides it, and the names and photos of up to three Going guests show to anyone who can open the event. A Can't go answer is listed to nobody. The host sets your check-in time by tap or card scan. An invitation shows the invited person who sent it; when some people are skipped, the inviter is not told why. A cancelled event is hidden, not erased, and stays stored until the host deletes their account. Your answers, the events you host and the invitations you sent or received are removed when you delete your account. On the website, your name appears on your own card only for events where you ticked that box. |
| A record of each change you make to an event you host: the event, a random key, a fingerprint of the change and the new revision | So a change that is sent twice is applied once. It is removed with the event, and deleting your account removes it. |
| A record that an event's reminder went out: the event, which reminder (the day before or the hour before) and when | So each reminder is sent once. It names no person, and it is removed with the event. |
| Pieces you claimed, and when | So a physical garment can be tied to an account. |
| An opaque checkout receipt, the Shopify variant and quantity chosen, and the minimum order status and amounts returned by Shopify | So checkout can stay on Shopify while support can match a verified order to the person who opened it and, when applicable, the Climber who invited them. The receipt is a random identifier. An abandoned handoff expires after thirty days, and expired handoffs with no order are removed in bounded batches as checkout traffic resumes. Shopify receives no account ID, email, Outsider number or referral code from this app. We do not retain Shopify customer names, email addresses, phone numbers, shipping or billing addresses, payment data, raw line items, or the raw webhook. Deleting an account removes its direct links from checkout and order records while leaving the non-customer order evidence needed for support and accounting. |
| A record that an action happened, with limited operational detail | So there is an audit trail of writes. On account deletion, earlier entries lose their account attribution, subject and detail. One final deletion entry carries only the permanent Outsider number. |
| Reports you file and reports about you, including creation, update and resolution times | So a concern can be answered and the decision can be audited. Whoever reported something is never shown to the person reported. On account deletion, direct account links and personal notes are removed where they point to the deleted person. The report reason, state, outcome, creation time, update time and resolution time remain as moderation evidence. An open report that can no longer be acted on is closed at the deletion time. |
| Your business details if you add them: category, a one-line offer, the kind of place, city, email address, phone number, booking link, business name, website and Google link | To show a contact and booking card on your profile. Other Climbers see it only while you have the business switch on; off, nothing is returned to them. It is for contact and directions only: no price, no payment, and nothing on it is verified by us. Clearing it, and deleting your account, remove it. |
| Business pages you make: the name, category, offer, description, how and where you work, opening hours, up to five places, up to twenty services with prices, an email address, phone number, website, booking link and a photo from one of your projects, as a draft and as published, and a fingerprint of each save | To show a published page to the people who can see your profile, and a draft only to you. An address is shown only for a place you chose to publish. Nothing on a page is verified by us. The fingerprint lets a repeated save apply once. Unpublishing takes the page down, and deleting your account deletes your pages. |
| What you write on a business page: a review with a rating from one to five, a question or an update, the owner's response, any moderation reason and your appeal, reports you file about an entry, and a record of each of these actions | To show reviews, questions and updates with the page. A review can only come from a connection of the page's owner. The operator reads reports, and the person reported is not shown who sent one. Deleting your account deletes what you wrote, your reports and their records. |
| When you tap email, phone, website, booking or directions on a business page: the page, which one, a fingerprint of where it led and when | So the page's owner can see how many times each was used. The owner sees counts only, never who. Deleting your account deletes these records. |
| Roles you post: the details of the role, how to apply and the questions you ask, as a draft and as published, whether it is open, paused or closed, and a fingerprint of each save | To show an open role to the people who can see your profile and to collect applications for it. The fingerprint lets a repeated save apply once. If you delete your account, your roles are closed and emptied, and applications to them show the role as no longer available. |
| Applications you send: the profile details you chose to include, your note and answers, whether the poster may contact you, and where the application stands; the messages between you and the poster about it, up to 2,000 characters each; and reports you file about one of those messages | So the person who posted the role can review your application, and the two of you can talk about it if you allowed contact. A sent application cannot be changed, and you can withdraw it. An operator can remove a reported message. Deleting your account deletes your applications, your messages about them and your reports. |
| Teams you are on or were asked to join: the business, your role (manager or member), whether you accepted, declined or left, whether your name shows on the business page, who invited you and when, and the team's record of changes to your place (invited, joined, declined, left, removed, role changed, shown or hidden on the page) | So an owner can ask people they are connected to for help running a business, and the team can work together. Nobody joins a team without accepting. The owner and the team see your name, and visitors see it on the business page only if you turn that on. A block or an ended connection between you and the owner ends your place, and lifting the block does not give it back. If you decline, leave, or your place ends that way, your answer is kept until you or the owner delete your account, and for the first 30 days it stops the same business asking you again. If the owner removes you or withdraws an invitation, your place is deleted. The record of changes stays with the business. Deleting your account deletes your place and your answer and takes your name off that record. If the owner deletes their account, the team and its record are deleted. |
| Messages you send to a business from its page: whether it is a general message or a request for one of its services, the service name at the time, your messages and the team's replies, up to 2,000 characters each, and reports you file about one of those messages | So the business owner and the people they added to the team can read and answer it in one place. They see your name and profile number. These messages are not encrypted. An operator can remove a reported message. Deleting your account deletes the conversations you started, your messages and your reports. If the owner deletes their account, the business and its conversations are deleted. |
| How a business team works its team inbox: for each message, service request, public question or application to its roles, who it is assigned to, its status, a follow-up date, notes the team writes, and a history of who did what and when | So the team can share the work. Notes and history are read only by the owner and the team, and the person who wrote in is never shown them. History cannot be edited; when someone on the team deletes their account, their name is removed from it and their notes are deleted. When the person who wrote in deletes their account, what they sent, and the notes and history about it, are deleted. |
| Listings you put in your shop: whether it is a service or a product, the title, description, price and currency or that the price is on request, how long a booking takes, how it is delivered, where you sell in your own words, what happens after a request, the stock you set, whether requests are accepted at once, an optional payment link, up to four photos, whether it is active, paused or removed, which of your posts show it, and a fingerprint of each save | To show an active listing on your profile, on a business page you run, in Discover and on your own posts, to the people who can see your profile. A payment link is shown only to a buyer whose request you accepted. We do not verify what a listing says or sells: a text filter and people's reports are the checks, and an operator can take a reported listing down, which also hides its payment link from buyers. The app never takes or holds a payment. The fingerprint lets a repeated save apply once. Removing a listing takes it down, and deleting your account deletes your listings, their photos and the posts' links to them. |
| The payment link you add for yourself or for a business you run: an https address you own, such as a card, PayPal or USDC payment page | So a buyer whose request you accepted can pay you directly, outside the app. We check only that it is a plain https address, never the page behind it, and we never see the payment. Changing or clearing it, and deleting your account, remove it. |
| Requests to buy, book or get a quote that you send or receive: the listing, what it was called and what it cost when it was sent, the quantity, the note, the time asked for and the time confirmed, the seller's reply and quote, where the request stands, and when each side said a payment was made | So the seller can answer and the buyer can follow it. Each side sees the other's name; the note and the reply are seen only by the two of you, and by an operator if one of you reports it. An operator can take a reported request down, which also cancels it if it was still open. The Web Network does not process, hold, check or refund any payment: marking a payment only records what each side says. Deleting your account deletes every request you sent or received, so the other person no longer sees it either. |
| Whether you are open to work or hiring, and a note of up to 240 characters | To show it on your profile. You can change or clear it at any time, and deleting your account removes it. |
| The music and interests you write on your profile, and up to four labelled web links you add | To show them on your profile. Each of the three has its own switch and each is off until you turn it on; what is switched off is not shown to other Climbers. Your own interests also shape who is suggested to you, even while switched off; another person's interests count only when they share them. Links must start with https. Editing removes the old text, and deleting your account removes all of it. |
| Projects you list on your profile: a name, a one-line description, a kind, your role, a status, a web link, up to three more links and a cover photo | To show your work to people who open your profile. Links must start with https and we do not check where they lead. A cover photo is handled like a post photo and converted to JPEG without embedded image metadata. Removing a project removes its links and its cover. Account deletion removes all of them and queues stored photos for cleanup. |
| The narrower privacy choices you make for parts of your profile: who sees your about and aim, what you need and can offer, your archetype, your writing, each project you list and each post you keep to your connections | So each part shows only as widely as you chose: the same as your profile, your connections, or only you. A narrower choice only ever hides a part; it never shows it to anyone new. A post also travels beyond your profile: while your profile is private, it still shows in Latest without your name, and a video still reaches your connections in Reels. Only you for a post moves it to your archive. Account deletion removes these choices with the account. |
| Your likes on posts, comments and daily answers, the posts and links you save, the messages you star, and the reaction you put on a message | So the count and your own marks are right, and so you can find what you saved or starred. Removing a like, save, star or reaction deletes the row, and deleting your account deletes all of them. |
| Where you are mentioned or tagged in a post caption, a photo tag or a comment | So you can be told, and so the post can show who is in it. Deleting your account removes these records; your name can stay in the writer's words as plain text. |
| Your note: one line of up to 60 characters | To show it at the top of the inbox of Climbers you are connected to, for 24 hours. Posting a new one replaces it, clearing it deletes it, and ending contact or a block stops it showing. Deleting your account removes it. |
| Which card finish you chose to show | To draw your card the way you picked. Which finishes you have earned is worked out when it is read from other records and is not stored separately. Deleting your account removes your choice. |
| Card editions your account holds from a membership, a purchase, a gift, a promotion, a Founding grant or something you earned: which edition, where it came from, when it was given and when it ends | To show the card editions you hold. No price is stored with them. Deleting your account removes them. |
| Photos you add to an event album (up to ten per event) or as the host's cover, and which event they belong to | To show them with the event. Album photos are shown only to the event's guests; the cover is shown to anyone who can open the event. They are handled like post photos and converted to JPEG without embedded image metadata. A photo can be hidden. Deleting a photo, the event or your account removes it and queues the stored copy for cleanup. |
| People you chose not to see in Suggested for you | So they are not suggested again. It is for you only and the other person is not told. Deleting your account removes it, and it is also removed if the person you dismissed deletes theirs. Suggested for you ranks people only by mutual connections, shared communities, a shared event whose guest list is not hidden, shared interests, the same city and having met in person, with a small nudge for people who joined in the last 30 days. |
| People whose need you chose not to see in A need you can meet | So that need is not shown to you again. It is kept with a fingerprint of the need, not its words, and if the person writes a new need it can show again. It is for you only and the other person is not told. Deleting your account removes it, and it is also removed if the other person deletes theirs. |
| Passkeys you add to sign in: the public half of each key, its use counter, a name you give it, when you added it and when it was last used | So you can sign in with your device instead of your password. The public key cannot sign you in on its own. Adding one needs your password. Sign-in challenges are kept as a fingerprint for five minutes and used once. Removing a passkey stops it working at once. Deleting your account removes them all. |
| Tags, a private note and a follow-up you keep about a person | So you can remember how you know someone and when to follow up. Only you can read them; the person they are about is never shown them or told about them. Clearing them removes them. Deleting your account removes them, and they are also removed if the other person deletes theirs. |
| Requests you send asking a connection to introduce you to someone, and requests sent to you | So the person you ask can answer on their Intros page. The person you want to meet is not told about the request; they hear only if an introduction is made, and then they still choose. If the person you ask says no, you are not told. Deleting any of the three accounts removes the request. |
| Your note for people who join with your code, and your choice to show who invited you on your card | The note is shown only to people who joined with your code, never on the public invitation page. Who invited you is shown on your card only while you turn it on, and only to people who can already see that person. You can change or clear both at any time. Deleting your account removes them. |
| What you need now and what you can offer, if you add them | To show them on your Network Card and profile, so the right people can find you. Other Climbers see them wherever they can see your profile. Both are optional, you can edit or clear them at any time, and deleting your account removes them. |
| Who can message you: your connections, or nobody | So you choose who can start or continue a conversation with you. It is checked every time a conversation opens and every time a message is sent. Deleting your account removes it. |
| Your hidden words: up to 100 words or phrases of up to 80 characters each | To leave other people's comments that contain them out of what you see, to hold a matching comment under your own post for your review, and to leave matching posts out of For you. Only you see the list. Removing a word deletes it, and deleting your account deletes the list. |
| People you restricted | So a restricted person's new comments on your posts wait for your review. The connection is kept and they are not told. Only you see the list. Deleting your account deletes it, and a restriction is also deleted when the restricted person deletes their account. |
| A limit on interactions you turn on: when it started, when it ends (after 24 hours, 3 days, a week or 4 weeks) and whether it also covers people you connected with in the last 7 days | While it lasts, new comments, mentions, connection requests and invitations from people you are not connected with, and from recent connections if you chose that, are held or declined. Ending it does not publish anything that was held. Deleting your account deletes it. |
| When For you was last made for you, and the posts in that order with the reasons each one is there | To keep For you in a steady order while you scroll and to say why each post is there. No score is stored for any person or post, and likes, views and how long you look are never used. Each order expires two hours after it is made and is deleted at the next scheduled clean-up, and at most the three newest are kept. Deleting your account deletes all of it. |
| Your choices in For you: posts you hide, people you mute or want more or less of, and kinds of post you want more or fewer of | To shape your own For you and nothing else. Latest is not affected, only you see these choices and the other person is not told. Less and Fewer end after 90 days. Undo removes one, deleting your account deletes them, and a choice about a person is also deleted when that person deletes their account. |
| Answers to posts that name you, saying whether you were part of it. The app does not ask for these yet | So a post could show who confirmed it. Nothing is held until the app asks, who answered no would never be shown, and deleting your account deletes any answers. |
| That you asked to hear when Outsider opens, and when | So we can tell you in the app when it opens. No email address is collected for it and no price is shown. Saying no clears it, and deleting your account removes it. |
| Your side of each connection: what kind it is (met, worked with, client, mentor or mastermind) and who may see it | So your connections carry their meaning. It is private unless you choose otherwise, the other person never sees your choices, and they keep their own. Deleting your account removes your side. |
| Your membership and badges: which layer you hold (digital for now), where it came from (Apple, a Founding grant or an invitation), when it starts and ends, and the Founding badge | To decide what your account can open and to show badges for acts, never levels. Deleting your account removes them. |
| The invitation code and the campaign link you joined with, if any | To know which invitations and which of our own posts bring people in, and to give an invited Climber the free month a Founding Circle code carries. We use it to measure our own marketing. It is not used for third party advertising and never shared. Deleting your account removes it. |
| What you do for work, in your own words, and if you add them: the matching profession, your country and region, a licence number and your brokerage, and your language, time zone and currency | So people can find you for referrals and so the right rules for your work and your country apply. Deleting your account removes them. |
| Your verifications: which kind (identity, licence, certification, portfolio, work or references), whether each is pending, verified, rejected or expired, a pointer to the evidence, and when it was checked and when it ends | So badges are earned and never bought. A badge shows only what was actually checked. Deleting your account removes them. |
| Referrals you send or receive: who referred whom, the profession, the client (a member or a short label, never contact details) and when the client agreed, the terms, the status and its history with any short notes | So a referral is tracked and proven from first introduction to close. A referral is only sent after the client agrees, and money terms are only allowed where the rules for that work and place permit them. When you delete your account the other side keeps a minimal record without you: the client label and every note are cleared, an open referral ends as expired, and drafts you never sent are removed. |
| Receipts of work done together: the kind (introduction, collaboration, referral or job), the two people, the outcome, any amount and currency, and when each side confirmed it | So completed work has proof both sides agreed to. When you delete your account a receipt both sides confirmed stays for the other person without your identity and without the outcome text, and an unconfirmed one is removed. |
| References you write or receive, each tied to a receipt of work you did together | So a reference only comes from someone who actually worked with you, on a receipt both of you confirmed. Deleting your account removes the references you wrote and the ones written about you. |
| Your access tier, how it started (trial, grown or paid), the trial start and end dates, and when you grew into it | To decide which features your account can open. It is for you and for the service only. Deleting your account removes it. |
| Notices Apple sends us about a subscription: Apple's transaction id, the product, the kind of event, the expiry date, and a SHA-256 hash of Apple's signed message | To keep your tier in line with what Apple reports. The signed message itself is not stored. When you delete your account the link to your account is cleared and the Apple record stays without it. |
| Single-use links we email you to verify your address or reset your password, stored only as a hash, with the purpose, expiry and when each was used | So an emailed link can prove it is yours once. The link itself is never stored. Deleting your account removes them. |
| The days we sent you the daily question notification | So you get at most one a day. Deleting your account removes it. |
| When you tap through, on the website, to a place, event or service link that carries a referral code: the code, what it pointed at, where it went, the time and your account | So we can see which linked places, events and services get used. We read them only as counts. Deleting your account deletes them. |
| If you were approved as a provider: the category, who approved you, our private note on why, when, and when it was revoked or payout-ready | So we have a record of who was approved for a service category and why. It is written by us, not by you. Deleting your account removes it. |
| Our host's request logs: your IP address, the name and version of the app or browser making the request, the address requested (which can include words you searched), the response status and how long it took | To run and secure the service. Our host keeps them for up to 90 days. We do not tie them to your account, and our own error logs carry no account field. |
| Session tokens, stored only as a SHA-256 hash, and for each session a plain device name such as iPhone, a coarse place, when it was last used and an identifier used to sign it out | So you stay signed in, and so Where you are signed in can list your sessions and sign one out. The token itself is never stored, so a database copy cannot be used to sign in as you. The device name is made on the server from the request that started the session and is never a device identifier. The place is the city and country our host's network reports for that request, never your device's location and never an IP address. Deleting your account removes your sessions. |
| Your encrypted authenticator secret, its encryption-key version, account and setup identifiers, setup creation, expiry and confirmation times, failed setup attempts, and the last accepted code time step | If you start authenticator setup where it is available, the server decrypts the secret to check codes and records their time step to prevent reuse. An unfinished setup cannot be confirmed after ten minutes. Expiry does not delete its database record. It remains until replaced by a new setup after expiry or removed by account deletion. Confirmed setup records stay until account deletion. |
| Two-factor sign-in checks: hashed challenge tokens, account and setup links, a fingerprint of your password hash, creation and expiry times, setup confirmation time, attempt counts, and when a check was closed | To complete a password-verified sign-in, limit guesses and reject a check after the password or authenticator setup changes. A check expires after five minutes or stops working when completed or replaced. Expired and closed check records are not automatically deleted; account deletion removes them from the app database. A successful session also records which setup was checked and when. |
| One-way hashes of your recovery codes, linked to your account and authenticator setup, with creation and use times | To let each code complete one sign-in when you cannot use your authenticator. Ten readable codes are returned once when setup is confirmed; only their hashes are stored in the database. Using a code marks it used rather than deleting its row. Unused and used records remain until account deletion. |
| Rate-limit records containing keyed one-way fingerprints for public email and IP checks, account IDs for signed-in actions, and room plus invited-account pairs for re-invite protection | To slow guessing, account abuse and repeated room invitations. Public door rows never store the raw email address or IP address, and a server-held secret prevents those fingerprints from being reversed or joined across different door flows. Signed-in counters are linked to the account and are removed when that account is deleted. A room re-invite pair is counted for seven days so a prior answer cannot be probed through repeated invitations. Expired counter rows are removed when that rate bucket is used again, so a dormant room re-invite row can remain longer than seven days. |
Activity status and read receipts are off for a new account until you turn them on in Settings, Privacy.
Where your information is stored
Your information is processed outside Canada. Railway runs the app, its database and the storage for photos and videos. The app and the photo and video storage are in the United States. Information held in another country can be reached by that country's courts, law enforcement and national security authorities under its laws.
| Provider | Where, and what it does |
|---|---|
| Railway | United States, for the app and for photo and video storage. Hosts the app, its database, its request logs and the photos and videos you upload, so it holds everything described in this policy. |
| Resend | United States. Sends account email, such as a verification or password reset link, and alerts to the operator. It receives your email address and the message we send you. An operator alert carries at most the public number of a person who asked for help. Where outbound email is not configured, no email is sent at all and the app says so. |
| Apple | United States. Delivers notifications to iPhones. It receives your device's push token and the notification itself, which it carries to your phone. Only while notifications are switched on for that phone. |
| Google or Mozilla, whichever your browser uses | Where your browser's push service runs. Delivers browser notifications. It receives the address your browser gave us and a notification encrypted to keys only your device holds. It can see that something was sent. It cannot read it. Only while notifications are switched on for that browser. |
Who else sees any of it
| Who | What, and when |
|---|---|
| OpenFreeMap | Your IP address, because that is how any request for a map tile works. Only on the map page, and only while it is open. |
| Apple Maps | Your IP address and the part of the map on screen, because that is how map tiles load on an iPhone. The Web Network sends Apple no account information, no address and no location from your device. Only on the Map in the iPhone app, and only while it is open. |
| Shopify | Your IP address and ordinary image-request information when your browser loads product images hosted by Shopify. For checkout, the Shopify variant and quantity you chose plus one random checkout receipt. We send no Climber account ID, email address, Outsider number or referral code with that checkout request. Information you enter after Shopify checkout opens goes directly to Shopify under its own store checkout. When the Shop displays Shopify-hosted product images, and when you ask this app to open a hosted Shopify checkout. |
| The original site for a learning Resource, such as YouTube, a publisher or a course provider | Your IP address and whatever that site normally receives from a browser request. We send no Climber identity or Learn progress with the link. Only after you explicitly open the original. Learn does not preload its video, thumbnail, player or page. |
| YouTube, for a community lesson that links a YouTube video | Your IP address and ordinary image-request information, because the lesson shows a thumbnail picture hosted by YouTube. We send no Climber identity with the request. When you open a community lesson that has a YouTube link, before you tap anything. The video itself opens outside the app only after you confirm. |
| The meeting provider chosen for a live event | Your IP address and the audio, video, device or name you choose to give that provider. The Web Network sends no Learn data, messages or profile fields with the link. Only after you RSVP, the call window opens, and you explicitly press Join call. The Web Network records that the link opened, not that you attended. |
Same or equal protection
The providers that run the service for us (hosting, storage, email and notification delivery) may use your information only to provide that service to us, and must protect it to the same or an equal standard as this policy. Map tiles, Shopify, YouTube, learning sites and meeting providers are separate services. What each one receives, and when, is listed above, and each one handles it under its own policy.
What this app does not do
- No third-party analytics, tracking pixels, session recording or advertising identifiers. Page views are counted as daily totals on our server. Hosting, email, push notifications, map tiles, Shopify and the external links described above involve other services.
- Fonts are served from this app rather than from Google, so loading a page tells Google nothing.
- Nothing you write is sold, and nothing you write is used to train a model.
- No location is ever read from your device. The city on your profile is one you typed. The Map in the iPhone app puts each event and business at the centre of the city typed for it, using a list of cities kept on our server, never at a street address.
- No data is bought about you from anybody.
Taking it with you
In the app, open You, then Settings, then Download your information. You get one JSON file of what your account holds: your profile, settings and business details, including your hidden words, the people you restricted (by account number) and any limit on interactions; your For you settings and choices (a post you hid by its id, a person you muted by account number) and any answers you gave to posts that named you; your posts, comments, stories, highlights and note; the messages you sent; your likes, saves and daily answers; the communities you own or joined, with your join answers and the lessons you wrote or finished; the events you host and your answers to events; the people you met; your projects; your business pages, roles and applications, and what you wrote on business pages; your introductions; and your learning progress, private next steps and journal.
Photos, videos and voice notes are listed by reference, not included as files. Other people's posts, comments and messages, and who liked what, are not in it. You can download once a day, and each section holds up to 5,000 items.
The website's profile page has an older, shorter export, as markdown or JSON: your journal, perspectives and responses to perspectives, feed posts and comments, your reading and its correction, business details, pieces you own, saved or completed Learn Resources, Space membership history and private next-climb history. Messages, raw intake answers, service listings, event RSVPs, Handshake terms, image files and connections are not in that one.
Neither export is a complete copy of every record held about your account. For a complete copy of everything we hold about you, including files, write to us and we answer within 30 days.
Your rights
You can ask for a copy of the personal information we hold about you, ask us to correct it, and ask us to delete it. You can do most of this yourself: Download your information gives you a copy, editing your profile corrects it, and Delete account removes it.
For anything else, write to us from the address on your account, at the address under Asking about any of this below. We answer within 30 days.
If you are not satisfied with the answer, you can complain to the Office of the Privacy Commissioner of Canada, to the Office of the Information and Privacy Commissioner of Alberta, or, in Quebec, to the Commission d'accès à l'information.
Withdrawing consent
You can withdraw consent at any time. Switch notifications off in Settings or in iOS Settings, change what your profile shows in Settings, Privacy, or delete your account. Some features stop working without the information they need. Withdrawing consent does not undo what was done before you withdrew it.
Deleting it
In the app, open the You tab, choose Settings, then Delete account. The delete account page has the steps, and the way to ask by email if you cannot sign in. Deleting in the app happens right then. It is not a deactivation and there is no drawer somewhere holding your account in case you change your mind. It removes your email, password, name, city, bio, journal, feed posts, intake answers, the reading built from them, and saved or completed learning state. Perspectives, answers, listings and messages are emptied and retired, including messages inside rooms other people are still in. Your room and Space memberships are closed.
Account deletion removes access through the app and queues stored photos for cleanup. Physical deletion depends on the cleanup job and storage availability. Random storage-key records remain so interrupted cleanup can be retried; those records contain no account identifier. Checkout and order records lose their direct account links while retaining non-customer order evidence for support and accounting.
A small pseudonymous record survives without your name, email or profile. Your account number stays taken because it is never reissued. Earlier activity entries made by your account, and entries whose explicit identity fields point to it, lose their account attribution, subject and detail. Unrelated numbers in an operational entry are not treated as identity. One final deletion entry carries only that account number.
If you were part of a Handshake, the other party keeps a minimum receipt. It shows the two permanent Outsider numbers, the final status and the retention date. Names, prices, terms, due dates, delivery notes, revision notes, dispute text and older receipt wording are removed. This keeps proof that the agreement existed without retaining what either person wrote. If you were only the introducer or canceller, your identity field is removed without erasing evidence owned by the two surviving parties. If you were a third-party dispute actor, the original account is replaced by the number-only record and the surviving parties keep their dispute evidence.
Moderation reports remain as evidence without direct links to the deleted account. Their reason, state, outcome, creation time, update time and resolution time remain. Personal notes tied to the deleted reporter, author or subject are removed. If deletion closes an open report that can no longer be acted on, its resolution time records when deletion closed it.
Anything you already exported, and any copy of a resource somebody else downloaded, cannot be recalled. That is true of every system and it is stated here rather than left out.
What is not private
Messages are stored in the database like everything else and are not end to end encrypted. Somebody with database access could read them. That is said plainly because the alternative is letting a dark interface imply a guarantee the software does not make.
Live calls are opened through an outside meeting provider. The Web Network controls the Space, schedule, RSVP and access check. The provider carries the audio and video after you press Join call.
Your journal is private to you. Nothing else in this app reads it and no model is run over it.
Children
This service is for people aged 18 and older. If you are under 18, do not make an account here. If we learn that an account belongs to someone younger, we end it.
Asking about any of this
Write to info@thewebnetwork.co. A question about your own data gets an answer within 30 days.