Privacy policy · Blok Sessions

Blok Sessions is a training app for boulderers. You need a free account to use it, but most of what it records stays on your phone unless you switch on backup. This page says exactly what does leave it.

Blok Sessions is the trade name of Frank Blokdijk (KvK 42113691, VAT NL005504221B81) in the Netherlands. He decides how the data described here is used, which makes him responsible for it under the GDPR (the "controller"). Contact: hello@bloksessions.com.

At a glance

What	Where it lives
Your training log: sessions, blocks, plans, test results, custom exercises and metrics	Your phone. Copied to our server only for profiles you choose to back up while signed in, so a new phone can get it back and you can plan on this website. We publish anonymous totals across all backups, such as the most-logged exercises (see "Community statistics").
How you feel and old injuries: readiness check-ins and the injuries in your profile	Your phone. Backed up only if you tick "Also back up how you feel and old injuries" for that profile, because they're health information.
Account details: your email address, the name you chose, and three numbers about when you train (see "Training days") and, if you answered it, where you found Blok Sessions	Our server. You need an account to use the app. With Sign in with Apple and a hidden email, we only see Apple's relay address. With Sign in with Google, we get your Google account's email address and name.
Cycle tracking (off unless you turn it on)	Your phone only. It's never in the Blok Sessions backup or sent to our server.
Apple Health or Health Connect (off unless you turn it on)	The Health app on an iPhone, or Health Connect on Android. Blok Sessions can write your sessions there as workouts and, for Pro's training load, read your other workouts. What it reads stays on your phone, and none of it reaches our server.
Benchmark contributions (off unless you turn it on)	Our server, with no name, email or account attached.
Waitlist email (only if you joined before it closed)	Our server, until the launch email is sent. Then it's deleted.
Training emails (only if you asked for the strength plan)	Our server: your email address, which page you signed up on, and how far through the email series you are. Until you unsubscribe.
Invites (only if you invite someone, or join with an invite)	Our server: your invite code, who invited whom, and on which days an invited friend logged a session, until the invite counts.
Plan links (only if you send a plan with a private link)	Our server: the plan and the name you show with it, readable by anyone who has the link.
Feedback (only if you send some)	Our server and our inbox: your message, the reply address you give, and your app and phone system (iOS or Android) versions.
Community plans and exercises (only if you share, add, rate or report one)	A plan or exercise you share is public on this website, under the name you choose. Adds, ratings and reports sit on our server against your account; only the totals are public.
Coaching (only if you join a coach's squad)	Our server: your membership, and what you log becomes visible to that squad's coaches, including the check-ins you send them. See "Coaching".
Payment details	Never seen by us. In the app, Apple or Google takes the payment; on this website, Stripe does.
Website page counts	Our server: which page, which website sent you there, and the day. Nothing that identifies you.
Analytics (off unless you say yes)	HeyCatch, in the United States, in the iPhone app only: the tabs you open, with a random ID kept on your device, and your account's email and name. This website stopped using it on 25 October 2026. See "Analytics".
Advertising	Never, in the app or on this website. The only tracking is the analytics above, and only after your yes.

This website

This website sets no cookies and runs no analytics. Fonts and images are served from this site. Like any website, our hosting provider keeps short-lived request logs, including your IP address, for security and troubleshooting. They aren't linked to anything else and aren't used to profile you.

The planner

If you log in on this website to plan your training, you use the same account as the app, and you see the same backup the app keeps (see "What gets backed up" below). Plans, session templates and logbook entries you add or change here are saved straight to that backup, and the app picks them up the next time it syncs. A profile you create on the website is backed up from the start.

To keep you logged in, your browser stores your sign-in in its local storage on your device. It isn't a cookie, it isn't sent anywhere except to our database with your own requests, and it's removed when you sign out. It's needed for the planner to work, so it isn't used for anything else. The page also remembers which of your profiles you last looked at.

Community plans

If you share a training plan to the community page, from the app or from this website, it's public. Anyone can see its title, the description you wrote, the name you chose for the page, and its weeks and exercises, including exercises you created yourself, and anyone with a Blok Sessions account can add it to their own account. Its dates, your logbook and the rest of your profile aren't shared. We keep the shared plan with your account so you can remove it, and it goes when you remove it or delete your account. Copies other climbers already added stay in their accounts, like a file you sent them.

Sharing an exercise you made works the same way, from the app. Anyone can see its name, the description you wrote, the name you chose for the page and everything the exercise holds: how to do it, its sets and rest, its section and its equipment. It's kept with your account until you remove it or delete your account, and copies other climbers added stay with them.

When you add, rate or report a community plan or exercise, we store that against your account, in the same EU database. Adds count how often it was added and let you rate it; ratings make up its average, and nobody else sees who gave which rating; a report, with the reason you wrote, is read only by us. The number of adds, the average rating and each creator's totals are public, under the name they chose. It's all deleted with your account. We process this to provide the features you use, and the reports on our legitimate interest in keeping the page free of abuse.

Page counts

To see whether anyone reads this site, each page view adds one to a daily counter for that page. The counter stores three things: the page's address, the domain of the website that linked you here (for example reddit.com, never the full link) or the campaign tag in the link you followed (such as ?via=instagram), and the date. A second counter adds up all page views per hour, with nothing else attached, and is deleted after 14 days. It stores no IP address, no browser or device details, no cookie and no identifier, so a count can't be traced back to you or linked to your other visits. On the training quiz, each question, the result and the add and share buttons count as pages of their own (such as /quiz/q2a or /quiz/result/strength), so we can see where people stop. On the result, if you pick what's put you off training apps before, that choice counts the same way (such as /quiz/type/burned), with nothing else attached. The other answers aren't sent. If your browser sends a Do Not Track or Global Privacy Control signal, nothing is counted at all.

The counts are stored in the same EU database as everything else and kept for as long as they're useful for seeing how the site is doing. Because they contain no personal data, we rely on our legitimate interest in knowing whether the site works.

Analytics

This website ran analytics from HeyCatch until 25 October 2026, only for visitors who said yes in a box at the bottom of the page. It doesn't any more: the box is gone and nothing is sent. What it recorded until then (the pages people opened, what they clicked, how they got here, and for planner accounts the account's ID, email address, name and whether it had Pro) stays with HeyCatch until it deletes it, within two months after we stopped, or sooner if you ask us to have it deleted.

The iPhone app still asks once, after you've signed in, and you can change your answer under Settings → Analytics. With your yes, HeyCatch records which tabs you open and when you open or leave the app, with your phone's model, its system version and your IP address, linked to your account's ID, email address, name and whether you have Pro. It records no taps and nothing you log. Accounts of people under 16 are never asked. The next version of the app drops it too.

HeyCatch is based in the United States and handles this as our processor. From your IP address it may work out roughly where you are, such as your country and city. It passes the data to processors of its own, including PostHog and OpenRouter in the United States. HeyCatch isn't certified under the EU–US Data Privacy Framework, so the transfer relies on the EU's standard contractual clauses. Saying no in the app stops it straight away.

Abuse protection

To stop someone flooding the page counter, the app's benchmark pool, the community page, invite codes, plan links or the feedback form, each keeps a scrambled version of your IP address: a one-way, salted hash, never the address itself. It's used only to count how many requests come from the same network within an hour, it isn't linked to your email or to anything else, and it's deleted after 24 hours. The legal basis is our legitimate interest in keeping the service working.

Training emails

If you ask for a plan by email on this website (the strength plan, or the plan the quiz built for you), we hold your email address, the date you asked, which page or campaign link you used (such as /plan or ?via=instagram), which version of this policy you agreed to, and how many of the emails you've received, in the same EU-hosted database as the app's data, in a table nobody can read from the website. Your address is confirmed first: we send one confirmation link, and nothing else until you tap it. Unconfirmed addresses are deleted after 7 days. If you ask for your plan from the quiz, we also store the quiz result's plan code (the training period, days a week, minutes a session and whether it includes high-risk exercises) so the emails are about your plan, and it's deleted along with your address. If you make an account to save a quiz plan, the same code sits on your account until your first login, when the plan goes in and the code is deleted.

What you get is the plan and short emails on how to run it: seven over the seven weeks of the strength plan, or five over the four to eight weeks of a quiz plan. After that, at most one email a month about Blok Sessions and training. Every email has an unsubscribe link. Unsubscribing stops the emails at once and deletes your address within 30 days. We process this on your consent, which you withdraw by unsubscribing. The emails are sent through Resend (see below); nothing is tracked in them, no open or click pixels.

Comments on our Instagram posts

Some posts on @bloksessions say "comment a word and we'll send you something". If you comment that word, we send you one direct message on Instagram with what the post promised. To send it only once, we keep the ID Instagram gives your comment, and which post it was on, for 8 days, then delete it. We don't keep your username, your comment's text or anything else about you, and we don't message you again unless you write back. Instagram's own privacy policy covers the comment and the message themselves.

Our TikTok, Instagram and YouTube accounts

We connect our own accounts (@blok.sessions on TikTok, @bloksessions on Instagram and our YouTube channel) to post our own videos and to see how they do. For that we keep each account's access tokens on our servers in the EU, plus what TikTok tells us about our account for posting: its display name, profile photo, and which audiences and interactions it allows, which we show while we schedule a post. We use them only to publish the posts we pick, at the time we pick, and to count the views, likes, comments, shares and saves on our own posts. Apart from the comment IDs described above, we don't collect anything about the people who watch or react to our videos. Taking our access away in the platform's settings, or asking us at hello@bloksessions.com, deletes the tokens.

The waitlist

The waitlist is closed. If you joined it, we hold your email address, the date you signed up, and which version of this policy you agreed to, in the same EU-hosted database as the app's data (see below), in a table nobody can read from the website. Unconfirmed addresses were deleted after 7 days.

We use it for one thing: a single email when Blok Sessions is available on the App Store. After that email is sent, the list is deleted. If the app hasn't launched within 12 months of your sign-up, your address is deleted anyway. To be removed sooner, email us and we'll do it within a few days. We process it on your consent, which you can withdraw at any time.

Emails to gyms and coaches

If you run a climbing gym or coach climbers, you may have had one email from us, about a poster for your gym or about the coach area. We sent it to an address your gym or business publishes on its own website for enquiries, and only in countries where a first business email like that is allowed. For each one we keep the address, the name of the gym or business, the website we found it on, the country, a first name and a sentence about your work if we wrote one, and when we sent it, in the same EU-hosted database as the app's data, in a table nobody can read from the website. The email goes out through Gmail, from hello@bloksessions.com.

We send one email and nothing after it unless you reply. If you reply "stop" or ask us not to write, we keep only your address and that you said no, so you never hear from us again. Everything else is deleted 12 months after the email was sent. We do this on our legitimate interest in telling climbing gyms and coaches about Blok Sessions, and you can object at any time by replying or writing to hello@bloksessions.com.

The coach demo

The demo of the coach area opens after you give us your email address and say whether you coach a squad or climbers one on one. We keep that address, your answer, which page or link you came from, which version of this policy you were shown, when you first and last opened the demo and how many times, in the same EU-hosted database as the app's data, in a table nobody can read from the website. When you first open it, we get an email at hello@bloksessions.com with your address and answer, so we can write back.

You get two emails at most, both sent through Resend: the link to the demo straight away, and three days later one from Frank asking how it went, which we skip if you've made a coach account with that address by then. Nothing else: no newsletter, and we never share your address. Reply "stop" to either email, or write to hello@bloksessions.com, and we delete it. Otherwise it's deleted 12 months after you last opened the demo. We process it on your consent, which you give by asking for the demo and can withdraw at any time. The demo itself holds nothing you type: its climbers are made up, and what you change is gone when you close the page.

Dry-rock emails (caniclimbtoday.com)

caniclimbtoday.com is run by Blok Sessions. If you ask it to email you when an area is dry, we keep your email address, the area and when you signed up and confirmed. We use them only to send you a confirmation email and, after that, an email the evening before that area turns dry after rain, at most once every three days. The emails are sent through Resend. Every one has a link that stops them straight away. We delete an address that's never confirmed after 7 days, and one that's stopped 30 days after you stop it. The site itself sets no cookies; the forecast comes from Open-Meteo through our own server, so Open-Meteo never sees your IP address.

The Friday email. If you sign up for "Dry this weekend, near you", we keep your email address, where you drive from rounded to about 10 km (we never store your exact location or address), how many hours you'd drive, your language and when you signed up and confirmed. We use them only to send you a confirmation email and then one email on Friday mornings listing the climbing areas within that drive that look dry that weekend. If you type a town, it's looked up through Open-Meteo's place search from our own server, so Open-Meteo never sees your IP address. The emails are sent through Resend; each has a link that stops them straight away. We delete an address that's never confirmed after 7 days, and one that's stopped 30 days after you stop it. Signing up in the Can I climb iPhone app is the same email: the app sends your address, your drive and where you are, rounded to about 10 km. Next to the sign-up, on the site and in the app, there's an unticked box for Blok Sessions' free strength block. Only if you tick it does your address also join the training emails, with their own confirmation email and their own stop link.

Rock reports. On an area's page, on caniclimbtoday.com and in the app, you can say whether the rock was dry, damp or wet today. We keep the area, what you said, what we'd forecast for it, the language and the time, and nothing that identifies you: no account, no location, no device ID. We use them to check the drying model, and the last 24 hours' totals show on the area's page.

The Can I climb iPhone app. The app has no account, no ads and no analytics. It asks for your location while you use it and uses it on your phone to find the areas nearest you; it isn't sent to us. To show the forecast it asks our server for the areas you've saved, in your phone's language, and we don't keep those requests. If you switch on "Tell me when it's dry" for an area, we keep your phone's push token, that area and your language. If you switch on "Dry this weekend, near you", we also keep where you drive from, rounded to about 10 km, and how many hours you'd drive. We use them only to send those notifications, through Apple's push service, and delete them when you switch the alert off or when Apple tells us the app is gone. Tips are bought through the App Store: Apple handles the payment and we never see your payment details.

Your account

You need a free account to use Blok Sessions. It's what lets your log follow you to a new phone, lets you plan on this website, and ties Pro to you rather than to one device. You create it in the app or on this website, in one of three ways:

Sign in with Apple. Apple gives us a stable identifier for you and, if you allow it, your name. If you choose to hide your email, Apple substitutes a relay address and we never learn your real one.
Sign in with Google. Google tells us your email address, your name and a stable identifier for your Google account. We don't get your Google password or anything else from your Google account.
Email and password. We store your email address. Your password is handled by our authentication provider and stored only as a hash. We never see it in readable form.

Having an account doesn't upload your training. Backup is still your choice, per profile (see below): until you switch it on, what you log stays on your phone.

When you set up the app, it asks a few questions: what you're training for, your grades, your strength-training experience and the year you were born, which the app turns into an age band. It can also ask your sex. That's optional, and it's only used to group benchmark contributions (see Benchmarks below). The answers are saved in your training profile, on your phone, and are backed up only if that profile is.

A new account is also asked where it found Blok Sessions: TikTok, Instagram, a friend, the App Store and so on. That one's optional too, and it's kept on your account on our server rather than in your training profile. We only ever look at the answers as totals across all accounts, to see where people hear about the app. It's deleted with your account.

If you used Blok Sessions without an account on an older version, your training is still on your phone. Signing in makes it your account's, and nothing is uploaded until you switch on backup.

The welcome email

About an hour after you make an account, we send you one email: a short tour of the app. If a week later you haven't logged a session, we send one more, with a few easy ways to start and a question about what got in the way. Each goes once, to the address on your account, so there's nothing to unsubscribe from. We send them to help you use the service you signed up for.

An offer after checkout

If you start buying Pro and don't finish, or you cancel a Pro free trial, we may send you one email from Frank: half off your first month of Pro. If you start paying for a coach team and don't finish, the email offers your team's first month free. It comes a day after the checkout, or once the trial has ended, and only if you haven't bought by then. To know when to send it, we keep that you started a checkout (in the iPhone app or on this website) or cancelled a trial, when, which team it was for, and when we sent the email, in the same EU database. It greets you by the first name on your account, says how many days you've trained (see "Training days") or names your coach team, and goes at most once for Pro and once for coaching, never to an account under 16 or in a youth squad. Reply "stop" and we won't send it. It's deleted with your account. We send it on our legitimate interest in telling you about the plan you were looking at, and you can object at any time by replying or writing to hello@bloksessions.com.

Training days

When you log a session or a setting day, the app tells our server, and we keep three things on your account: the first day you trained, the most recent day, and how many days you've trained in total. Not what you trained, how long or how hard, and not a list of the days. We use them as totals across all accounts, to see whether people who make an account go on to train with the app and whether they come back, so we know what to fix. We also use the first day to decide whether to send you the email a week after sign-up (see "The welcome email"), which only goes if you haven't logged a session yet. The number of days can appear in the offer after an unfinished checkout (see "An offer after checkout"). For accounts that already had backup switched on, we filled them in once from the backup's session dates. They're deleted with your account. The legal basis is our legitimate interest in improving the app, and you can object to it at the address below.

Invites

Under Invite friends in the app you get an invite code and a link to share it. When a friend uses your code, we store that they joined with your invite. Each day they log a session, the app tells our server, and we store the date (the date only, not what they trained) until they've logged sessions on three different days. Then the invite counts, and you both get a month of Pro: we ask RevenueCat to add it to each account, on top of any promotional Pro already there.

You see how far each friend is, as days out of three. You don't see their name or email address, and they don't see yours through the invite. A code you tapped before signing in waits on your phone until you've signed in. Invite codes, invites and their dates are deleted with the account they belong to. We process this to provide the invite feature you chose to use.

Plan links

If you send a plan with a private link, we store a copy of that plan (its weeks, periods and exercises, including exercises you created yourself) and the name you show with it, under a random link that can't be guessed. Anyone who has the link can see that plan, in the app or on this website, and add a copy to their own account. The page isn't listed anywhere or shown to search engines. Your logbook, your other plans and the rest of your profile aren't shared.

Stop sharing a plan and its link stops working. Copies people already added stay in their accounts, like a file you sent them. The stored plan is deleted with your account. We process this to provide the sharing you asked for.

Feedback

If you send feedback from the app, we store your message, the reply address you give (if you do), your app version, build and phone system version (iOS or Android), and your account, in the same EU database. We also email it to hello@bloksessions.com, with your account's name, so we can read it and reply. The stored message is deleted with your account. The email copy is deleted once it's dealt with, and within 12 months at the latest.

What gets backed up, and where it sits

Backup is a choice you make per training profile. The app asks when you set up a profile or sign in to one, and you can switch it on or off for any profile under Profile. For each profile you back up, while you're signed in, the app keeps a copy of it and its records in a database hosted by Supabase, in the EU (Ireland). That copy covers sessions, session templates, training plans, test results (including force tests from a Tindeq Progressor), custom exercises and custom metrics. Readiness check-ins (how you feel before training) and the old injuries in your profile are information about your health, so they stay on your phone unless you tick "Also back up how you feel and old injuries" for that profile. Untick it and we delete the copies on our server; the ones on your phone stay. The planner on this website reads and edits the plans in that same copy.

Every row is tagged with your account and protected by database rules that make it readable only by you. Nobody else using the app can query your training. The only things that are ever public are the plans and exercises you choose to share to the community page (see "Community plans" above).

Community statistics

From 16 October 2026, we add up what's in every backed-up profile into totals about everyone who uses Blok Sessions, and we may publish those totals in our emails, on this website and in our posts. For example: how many climbers have an account, how many sessions and boulders were logged, which catalog exercises are logged most, the spread of grades climbers log and set as their level, and how many climbers have Pro. We also use the same totals to decide which exercises to improve first.

The rules for every number we publish:

It's a total or a share across at least 50 climbers, and no group within it has fewer than 10. Nothing is ever shown about one person, and nothing that could single you out.
It comes from the backup that's already there and collects nothing extra. Profiles you don't back up aren't part of it, and exercises you created yourself aren't counted.
It never uses anything about your health or your body: old injuries, how you felt, cycle tracking (which never reaches us anyway), Apple Health, bodyweight, your birth year or your sex. Your sex is only ever part of the benchmark pool, and only if you switched that on (see "Benchmarks").
Profiles of anyone under 16 are never counted, and neither is anything coaching adds (check-ins, measurements, memberships).

The legal basis is our legitimate interest in improving the app and showing climbers how it's used. You can object at the address below, and we'll leave your profiles out of every total from then on.

Cycle tracking is treated separately. It's health information, so it's off by default and never reaches us. It isn't part of the Blok Sessions backup, and our server refuses to store it even if asked to. If you back up your phone to iCloud or a computer, that backup includes it like any other app data; that's between you and Apple or your computer, and we can't see it. The Android app keeps its data out of Google's cloud backup of your phone.

Apple Health and Health Connect

There are two separate switches, both off until you turn them on.

Saving sessions to Health. If you switch this on in Settings, each training session you log from then on is saved in the Health app as a climbing workout: when it happened and how long it took. Nothing else goes with it, not your exercises, grades, notes or how you felt. The workout sits in Health, on your phone and in whatever backup of Health you use with Apple, and never passes through our server. Deleting the session in Blok Sessions deletes its workout.

Reading workouts for your training load. If you have Pro and tap Add workouts from Apple Health on the Load screen (or switch on "Count workouts from other apps" in Settings), Blok Sessions reads the workouts other apps saved to Health in the last 120 days, such as runs, gym sessions or a climb you tracked on a watch: what kind of workout, when, how long, and the effort rating Apple Watch gives it, if there is one. It reads nothing else: no heart rate, sleep, steps or anything medical. It uses them only to work out your training load, on your phone, each time you open the Load screen. They aren't saved by Blok Sessions, aren't part of your backup, and never reach our server.

On Android, Health Connect does the same two jobs, under the same two switches in Settings. Saving writes each session you log as a rock-climbing exercise session: when it started and how long it took. Reading, for Pro, takes the exercise sessions other apps saved in the last 120 days: what kind of exercise, when and how long. It reads nothing else: no heart rate, steps, sleep or anything medical. What it reads is used on your phone to work out your training load, isn't saved by Blok Sessions and never reaches our server. Android asks before either one starts. Our use of data from Health Connect follows the Health Connect Permissions policy, including its Limited Use requirements.

You can remove either permission any time in the Health app or in Health Connect. We never use anything from Health for advertising, never share it with anyone, and never use it for anything but the features described here.

Tindeq Progressor

If you connect a Tindeq Progressor, the app talks to it over Bluetooth and nothing passes through Tindeq. It reads how hard you pull, many times a second, plus the device's battery level and firmware version. A force test you save keeps its curve (the force over time), the numbers worked out from it and the hold and hand you named, like any other test result: on your phone, and in your backup if you back that profile up. Live readings you don't save are thrown away. The device's battery, firmware and the name you give it stay on your phone. On Android 11 and older, Android only lets an app look for Bluetooth devices once it has location permission, so the app asks for it there. It never reads your location.

Benchmarks

If you switch on benchmark contributions, when you set up the app or later in Settings, each test you log from then on is also sent to a separate pool, so it can be compared with other climbers' results. A contribution holds the test, the number you logged, that number as a percentage of your bodyweight if you've logged your bodyweight, your strength-training experience, age band and highest grade from your intake answers, and the day it arrived. It also holds a five-year age band worked out from your birth year (such as 25–29), and your sex if you gave it. The year itself is never sent. If you switched this on before the app asked about them, it asks you again before sending either. It's sent without your sign-in, so it carries no name, email, account or device identifier. Tests logged before you switched it on, and bodyweight readings on their own, are never sent.

We look at the pool only as totals for a group, and we never show a group of fewer than 10 contributions. Because the pooled rows carry nothing that points back to you, they can't be pulled back out individually once submitted, and later edits or deletions in your log don't reach them. Switching the setting off stops any further contributions.

Blok Sessions Pro

Pro is sold as a one-time purchase or a monthly or yearly subscription, in the app through Apple's In-App Purchase or Google Play Billing, and on this website through a checkout run by RevenueCat. In the app, Apple processes the payment and holds the payment details; we never see your card, billing address or Apple ID. On Android, Google does the same with your Google account's payment details.

On this website, the checkout page is RevenueCat's and the payment is processed by Stripe. You give them your email address (for the receipt and to manage the subscription) and your payment details, and a billing address where tax rules need one. Stripe holds the card details; we never see them. RevenueCat and Stripe keep the purchase record, and we can see it (which product, when, the price, and the email address on the receipt) to answer questions and handle refunds. The checkout link carries your Blok Sessions account's id, so the purchase lands on your account.

The app checks your purchase through RevenueCat, which reads Apple's or Google's record of the purchase and tells the app whether Pro is active. RevenueCat receives the purchase itself (which product, when, the price and currency, the renewal and expiry dates), your device's country and app version, and a random identifier. When you're signed in, that identifier is your Blok Sessions account's id, so Pro follows your account, and RevenueCat tells our server when it starts or ends. We keep only that: whether your account has Pro, and until when. That's also how the planner on this website knows to unlock Pro features. Before you sign in, the identifier is random and isn't linked to anything else. When an invite earns you a month of Pro, we tell RevenueCat to add it to your account.

You can manage or cancel an App Store subscription in the app (Settings → Manage subscription) or in your Apple ID settings, a Google Play subscription in the Play Store app under Payments and subscriptions, and a subscription bought on this website with the link in your purchase email.

The exercise catalog and server logs

The app downloads its exercise catalog from our server on launch so that corrections reach you without an app update. Like any web request, this leaves an entry in our hosting provider's logs, which includes your IP address and is kept briefly for security and troubleshooting. It isn't linked to your training data and isn't used to build a profile of you.

Coaching

If you're young, read this first

Your coach sees what you log in Blok Sessions: your climbing, your tests and the check-ins you send.
A check-in asks how you slept, how you feel and if something hurts. You can skip any question. Coaches have promised not to hold your answers against you.
In a youth squad your coach also sees your age and your height, to spot when you're growing fast.
If you're under 16, a parent says yes first.
You can leave your squad any time in the app without asking anyone. Your coach then stops seeing your training.
If you're under 16 and in no squad for 30 days, your whole account is deleted, with all your training on our server. We email you a week before.
Want to see what we have, or want it gone? Email hello@bloksessions.com. From 12 you can do that yourself.

How it works

A coach, club or gym can run a team on this website, with squads for adults and squads for youth. You join a squad with the code your coach gives you, after reading what its coaches will see and agreeing to it, and a coach of that team lets you in. Nothing is shared with anyone until they do.

A coach can also add you to a squad before you're in the app, so your plan is ready when you join. For that they give your name and, in a youth squad, your birth year if they want. They send you your personal join link themselves. Joining with that link lets you in straight away, and the plans they made for you are in your account. Nothing of yours is shared with them until you join, and under 16 until a parent says yes. If you never join, what they added is deleted after 90 days, or sooner when they remove it.

What your coaches see

Once you're in, the coaches of your squad and the team's head coaches see:

your logbook from the last 12 months: sessions, boulders, grades, effort, how tired you were, how you climbed, your notes and Workload
every test you've logged, force tests from a Tindeq Progressor included (in a youth squad, not bodyweight), and the exercises you made yourself
the plans the team sent you, and which sessions you logged against them
your grade and how much strength training you've done
the check-ins you send before training: how you slept, how your body and head feel, how keen you are, and whether something hurts and where
in a youth squad, your age and the height and sitting height you or your coach add, so your coach can spot a growth spurt and go easy on your fingers

Your coaches can ask you for tests. A test of their own goes into your list of tests, and from 16 we email you which tests they asked for, with any note they added. Your results show up for them the way your other tests do.

Your coaches can also tick whether you came to a team training, and write notes for each other about what they did after a check-in, like talking to you or your parent. You don't see those notes; you can ask us for them.

In an adult squad with messages switched on, you and your coaches can write to each other in the app and on this website, and a coach can write to the whole squad. Only the people in a conversation read it: you and your squad's coaches, or everyone in the squad for a message to all of it. When something new arrives, we email you once an hour at most, and if you allowed notifications on your phone, it shows one. Both say who wrote and never what they wrote. Youth squads never have messages.

They don't see plans you made yourself, your profile's name, old injuries or sex, cycle tracking, Apple Health or Health Connect. They see you under the name you gave when you joined. If you're in squads of two teams, each team only sees the check-ins and measurements from after you joined it.

Pain, sleep, how you feel and your height as you grow are all health information. Your coaches only see them because you agreed to it when you joined, or, under 16, a parent did. You can skip any check-in question, and a coach can't make you answer.

Coaches agree to the coach terms before they get a team: they use what they see only to coach you, and delete any copy they made when you leave. The team you join, the club, gym or business, is responsible for what its coaches do with what they see. We're responsible for how Blok Sessions stores it and shows it to them. We tell you what's shared, collect the consent and answer your requests. If you ask your team about your data, they pass it to us. For what a coach did outside Blok Sessions, contact your team as well.

What we keep, and for how long

Your membership: the squad, the name you gave, when you joined and left, your agreement to what coaches see and when you gave it, your birth year if it's a youth squad, and for under-16s a parent's email address, when they said yes and what they agreed to. The birth year and parent details are deleted 30 days after you leave. The rest is kept two years after you leave, to show the consent was given, and then deleted.
Check-ins: 12 months.
Height measurements: 24 months. They're deleted when you leave your last squad, and in the January after you turn 18.
Attendance: which team trainings a coach ticked you as there for, kept 12 months.
Coach notes: kept while you're in the squad, and deleted 30 days after you leave it.
Messages: 24 months. A conversation with you is deleted 30 days after you leave the squad, and a squad's 30 days after it's archived. Anyone can remove their own message, and a coach any message in their squad.
Notifications: if you allow them, your phone's notification address and which account it belongs to, until you sign out on that phone or Apple tells us the address no longer works.
Who looked: which coach looked at your training and when, kept 12 months, so misuse can be traced.
Before you join: the name and birth year a coach added for you, and the plans they made, until you join or for 90 days at most.
Coaches: their name, team and role, and when they accepted the coach terms, until they leave the team.

When you leave your last squad, your check-ins and height measurements are deleted straight away.

Paying for a team

A head coach pays for a team on Stripe's checkout page. Stripe takes the payment details, the billing name, email address and address, and a VAT number when a club or business pays. With the subscription, Stripe keeps whether a business or a private coach paid, and for a private coach when they asked for the plan to start straight away. It holds the card details; we never see them. Stripe sends the invoices and keeps them. On the team we keep only Stripe's customer and subscription ids, the plan, how it's paid, its status and when it renews or ends, so the team gets the room it paid for. This is processed to provide the plan the team pays for. The ids and plan go when the team is deleted; invoices are kept for seven years, as Dutch tax law asks.

Under 16

Blok Sessions is for people of 16 and over, with one exception: a youth squad. We go by the year you were born, so these rules use the age you turn this year.

If you turn 14, 15 or 16 this year: you can have your own account to join a youth squad, but a parent or guardian says yes first. Once a coach has let you in, we email the parent a link. They give your date of birth and confirm they're your parent or guardian, and your coach checks their address against the club's records. Until they say yes, your coaches see nothing. A request nobody answers within 14 days ends.
If you turn 13 or younger this year: only as a profile in a parent's own account, added by the parent. The link then goes to that account's address, which your coach checks too.
On an account under 16 we send no training emails, and community sharing, invites, benchmarks, "where did you find us" and backing up how you feel and old injuries are off.
An account under 16 that's in no squad for 30 days is deleted with everything in it on our server. We email a week before, and joining a squad in that week keeps it.
From 12, you can leave a squad yourself at any time without asking anyone, in the app, by telling your coach or by emailing us. A parent can take back their yes with the same link. Either way your coaches stop seeing anything, and if it was your last squad, your check-ins and measurements are deleted.

For parents

You can ask us for a copy of what your child's coaches can see, ask us to correct or delete it, or take back your yes with the link from the email. Write to hello@bloksessions.com from the address you gave, and we'll answer within 30 days. From 12, your child can make these requests too. If something goes wrong with your child's data, we tell you, your child and the Autoriteit Persoonsgegevens.

Who else sees any of this

We don't sell your data, and we don't share it for advertising. Data reaches exactly these other parties:

Supabase hosts the database and handles sign-in, as a processor acting on our instructions.
RevenueCat checks Pro purchases for the app, adds the months of Pro earned through invites and runs the checkout on this website, as a processor, so it handles the purchase details and identifier described under Blok Sessions Pro. It's based in the United States.
Stripe processes payments for Pro bought on this website and for coach teams. It handles your payment details under its own privacy policy, and your email address, billing details and the purchase for us.
Apple handles Sign in with Apple and purchases in the iPhone app, under Apple's own privacy policy. If you allow notifications, Apple's push service delivers the ones about new messages, with who wrote but not what.
Google handles Sign in with Google, and Health Connect and purchases in the Android app, under Google's own privacy policy. Its Gmail sends our one-off emails to gyms and coaches from hello@bloksessions.com, as a processor.
Resend sends the account emails (the sign-up confirmation and password-reset links, a one-time welcome email about an hour after you make an account, and the emails asking a parent to say yes to coaching, and the email saying a coach asked you for tests), the feedback you send us, the waitlist emails, the coach demo email, the offer after an unfinished checkout and the training emails from the EU, as a processor, so it handles your email address and those messages.
HeyCatch runs the analytics in the iPhone app (and ran them on this website until 25 October 2026), only if you say yes, as a processor based in the United States, so it handles what's described under "Analytics".
Our website host serves this site and keeps its short-lived request logs.
Your coaches, if you join a squad, see what's listed under "Coaching", and only that.
Other climbers see the plans and exercises you share to the community page, under the name you chose, and nothing else about you.
Anyone who has a plan link you sent sees that plan and the name you showed with it.
Anyone you send something to. If you use the app's share or export features, that file goes wherever you send it. That's your choice, at the moment you make it.

We would also disclose data if legally required to. If that ever happened, we would tell you unless prohibited from doing so.

Getting your data, or getting rid of it

You can delete your account from inside the app, under Settings, or on this website, under Account in the planner. Deleting an account removes your sign-in credentials and every training record we hold for you, together with your invites, plan links and feedback, permanently, and it takes effect immediately rather than after a waiting period. If you signed in with Apple and delete from the app, we also revoke Blok Sessions' access to your Apple ID; from the website you can do that yourself in your Apple ID settings. Anonymous benchmark contributions are excluded, because they no longer carry anything that identifies which account submitted them.

Training on your phone stays there after you delete the account, but you'll need an account again to keep using the app. Deleting the app without deleting your account leaves the backup in place, so you can reinstall and sign back in.

Under the GDPR you can also ask us for a copy of what we hold, ask us to correct it, ask us to restrict how we use it, or object to our use of it. Write to the address below and we'll respond within 30 days. If you think we've handled your data badly, you can complain to the Dutch data protection authority, the Autoriteit Persoonsgegevens.

Why we're allowed to hold it

Account and training data, the welcome email, invites, plan links, and the community plans and exercises you share, add and rate, are processed to provide the service you asked for. Feedback is processed to answer you, and on our legitimate interest in fixing what you tell us about. The one-off emails to gyms and coaches rely on our legitimate interest in telling them about Blok Sessions. So does the one offer email after an unfinished checkout or a cancelled trial. Community statistics (totals across all backed-up profiles) rely on our legitimate interest in improving the app and showing climbers how it's used. Benchmark contributions, where you found the app, the analytics, the waitlist and the training emails are processed on your consent, which you can withdraw at any time. Readiness check-ins and old injuries are backed up only on your explicit consent, the tick described above. What your coaches see is shared on your explicit consent, or a parent's if you're under 16, given when you join a squad. Leaving withdraws it; what was shared before that stays lawful. We keep a parent's address, their yes and their declaration to show the consent was given. We log which coach looked at your training because we have a legitimate interest in catching misuse. A coach's name, team, role and terms acceptance are used to give them the coach area they asked for. Cycle tracking never reaches us, so we don't process it at all.

How long any of it lasts

Your training data is kept for as long as your account exists. A training log is only useful if it stretches back years, so we don't expire it. Delete your account and it goes with it. Server request logs are kept for a short period and then discarded. Feedback emails are deleted once they're dealt with, and within 12 months at the latest. Waitlist addresses are deleted as described above, and so are training-email addresses: 7 days after an unconfirmed sign-up, 30 days after an unsubscribe.

Coaching data is kept as described under "Coaching". Apart from youth squads (see "Under 16"), Blok Sessions isn't for children and we don't knowingly collect data from anyone under 16. If you believe a child has created an account, joined the waitlist or asked for the emails, contact us and we'll remove it.

If this page changes

If we change how the app or this website handles your data, this page is updated and the date at the top changes with it. A change that materially affects what we collect will be flagged in the app before it takes effect, not quietly shipped.