Privacy policy

Last updated: 17 October 2026

Who we are

onsait is a platform for climbing coaches and the climbers they train. The business behind it is onsait, a general partnership (vennootschap onder firma) registered with the Dutch Chamber of Commerce (KVK) under number 42174849.

onsait is the data controller for the personal data described here. You can reach us about anything in this policy at hello@onsait.app.

What we collect

On the waiting list

If you join as a climber, we collect:

• Your email address
• Your first name
• Your city
• What you would like coaching help with

If you join as a coach, we collect:

• Your email address
• Your first name
• Your city
• The gym you are affiliated with
• How many years you have been coaching

We also record the date and time you gave consent.

With an account

Everyone with an account:

• Your email address, and your password, which is stored only in a scrambled form that can't be read back
• Your name, and a profile photo if you add one
• Your gym, if you give it
• Your settings: grade scales, units, and whether we email you about unread messages
• The messages you send and receive on onsait
• Feedback you send us, with the page you sent it from and your browser type

If you are a climber, also:

• Your climbing profile: experience, goals, grades, years climbing, city and country
• Body details, if you choose to add them: sex, date of birth, height, arm span and bodyweight
• Your training plans and what you log: dates, what you did, your results and comments. When you log a max test, the bodyweight you enter is saved with that test.
• The applications you send to coaches: your answers to their questions, and your grades and years climbing at the time

If you are a coach, also:

• Your coaching profile: bio, how you coach, city, country, disciplines, focus areas, levels, languages and session types
• Your offerings and their prices
• The training plans and exercises you write
• Instruction videos you upload for your exercises, and how long each one is

Automatically

• Sign-in records: when you signed in and from which IP address, kept by Supabase to protect accounts.
• Page views: Vercel Analytics counts which pages are visited, without cookies and without identifying who visits.
• Videos played: when you play a coach's video, or one of our videos on the home page, Bunny.net receives your IP address and browser details, which it needs to send you the video. From the home page, nothing reaches Bunny.net until you open a video, or follow a link to one.

onsait doesn't take payments yet. Before it does, this policy will say what that involves.

Why we use it, and on what basis

• To run your account and the coaching you arrange on onsait: your account, profile, plans, logs, messages and applications. The legal basis is our agreement with you.
• Body details, only to put your strength numbers in proportion to your bodyweight (for example, turning a percentage of your bodyweight into kilograms) and, if you choose to be compared with similar climbers, to find climbers like you. Bodyweight is never shown as a chart over time. Because body details can count as health data, we store and use them only with your explicit consent: the Use my body details switch in your profile. Switch it off and save, and they are removed.
• Waiting list emails: to tell you when onsait opens for sign-ups, and to send occasional updates before then. The legal basis is your consent, given by ticking the box on the waiting list form.
• Emails about unread messages: part of the service. You can turn them off in Settings.
• Coaches' videos: to show a coach's clients how an exercise is done. The legal basis is our agreement with you.
• Our videos on the home page: to show what onsait does when you ask to watch. The legal basis is our legitimate interest in explaining onsait to people who want to see it.
• Feedback: to fix what you report and improve onsait. The legal basis is our legitimate interest in doing so.
• Sign-in records: to keep accounts secure. The legal basis is our legitimate interest in doing so.
• Benchmarking: we may compare training logs across climbers, without names, so climbers can see how their progress compares. Nothing does this yet. You can switch it off under Benchmarking in your profile.

We don't sell your data, share it with advertisers, or use it to target you elsewhere.

Who sees what

• Coach profiles and offerings: a published coach's profile and offerings are visible to climbers signed in to onsait. They are never public.
• Your coaches: each coach you work with sees your name, gym, grades, city and country, everything you log (including on another coach's plan or a plan of your own), the plans they write for you, your applications to them, and your messages with them. Coaches can't see the body details in your profile.
• Messages: only the two people in a conversation can read it.
• A coach's videos: only the coach who uploaded them and the climbers they coach now. Never public.
• Your name and photo: other people signed in to onsait can see them.
• The onsait team: the partners in onsait can access your data when needed to run onsait and to answer your requests.

Service providers

These companies process data on our behalf, only to run onsait:

• Supabase: our database, sign-in and file storage, in London, United Kingdom.
• Vercel: hosts the website and counts page views.
• Resend: sends our emails, from Ireland.
• Bunny.net (BunnyWay d.o.o.): stores and plays coaches' videos and our videos on the home page, in Frankfurt, Germany. Bunny.net is a Slovenian company, in the EU.

The European Commission recognises the United Kingdom as protecting personal data adequately. Supabase, Vercel and Resend are companies based in the United States. Where your data reaches the United States, their data processing agreements protect it with the European Commission's standard contractual clauses.

How long we keep it

• Your account: for as long as you have it. Ask us to delete it, and within 30 days we delete your account, your profile, your plans and logs, your videos, and the messages you sent.
• A coach's videos: until the coach removes them or the exercise they belong to. They are then deleted at Bunny.net.
• Feedback: up to 24 months.
• The waiting list: until twelve months after onsait opens for sign-ups, or until you ask us to delete your details, whichever comes first.
• Sign-in records: no more than 7 days, in Supabase's logs.

Your rights

Under the GDPR you have the right to:

• Ask what data we hold about you
• Ask us to correct it
• Ask us to delete it
• Ask us to limit how we use it
• Ask for a copy of it in a portable format
• Withdraw your consent at any time
• Object to how we are using it

To do any of these, email hello@onsait.app. We will respond within 30 days, at no cost. There is no delete button in onsait yet, so to delete your account, email us and we will do it.

Every waiting list email includes an unsubscribe link, which removes you from the waiting list immediately. Your name, city and anything else you told us is erased at that point. We keep only your email address, on a short suppression list, so that we don't contact you again or add you back by mistake. To have that removed as well, email us and we will delete it.

If you think we have handled your data badly, you can complain to the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) at autoriteitpersoonsgegevens.nl.

Cookies

onsait sets only the cookies that keep you signed in. It sets no tracking or advertising cookies, and counts page views without cookies.

Changes to this policy

If we change this policy in a way that affects you, we will tell you by email. The date at the top of this page always shows when it last changed.

Contact

Questions about any of this: hello@onsait.app

onsait, KVK 42174849