Privacy Policy
Last updated: October 5, 2026
Onelior ("we", "us") turns your workouts, sleep and study into progress on a virtual climb. This policy explains what the Onelior app and its server use, why, and how you stay in control.
In short: Onelior only reads from Apple Health and never writes to it. Health data is used only to calculate your climb. It is never sold, never used for advertising or marketing, never shared with data brokers, and you can delete it at any time.
1. Your account
- Sign in with Apple or Google: a provider account identifier, the email address the provider shares (which may be a private relay address) and your name.
- Trying the app without an account: a random credential stored in your device's Keychain; no email or name.
- Profile and preferences: your display name and handle, the goal, training level and focus you choose when you start, reminder preferences, and your time zone (so your days, streaks and limits follow your local day).
2. Apple Health (HealthKit)
With your permission, and only for the types you allow in the Health app, Onelior reads the following. Once connected, it syncs in the background whenever Apple Health records something new.
| Health data | Used for | Sent to our server |
|---|---|---|
| Workouts: type, start and end time, duration, distance, and the name of the app that recorded it | Metres on your climb, your stat compass, your activity history and streak | Yes |
| Average heart rate of a workout | Estimating how hard the workout was (easy, moderate, hard, max) | No — only the resulting intensity level is sent |
| Date of birth | Estimating your maximum heart rate for the intensity above | No — it stays on your device |
| Sleep: bedtime and wake time, time asleep, the timeline of sleep stages (awake, core, deep, REM), the apps that recorded it, and whether it was entered by hand | Your nights in Camp, the weekly constellation, sleep score and rhythm, and metres for good nights | Yes |
| Mindful sessions: start and end time | The Intelligence stat and metres | Yes |
Onelior does not read steps, calories, heart rate variability, body measurements, medical records or any other Health data, and does not write anything to Apple Health. You can change or revoke access at any time in the Health app under Sharing → Apps → Onelior.
In line with Apple's rules, data from Apple Health is never used for advertising, marketing or data mining, never sold, and never disclosed to third parties except the infrastructure provider that hosts our server (section 5), and is not stored in iCloud by us.
3. Things you add yourself
- Study and reading logs: the kind of session, how long it lasted, when it happened, and an optional note.
From all of the above, the server calculates your altitude, level, camps, stat points, streak and sleep scores.
4. Security and device integrity
- Sign-in tokens are kept in the iOS Keychain on your device (available only while the device is unlocked, never synced to other devices).
- App Attest: to stop fake data from earning progress, the app uses Apple's App Attest service. This creates a device-bound key; we store its identifier to verify that sleep data came from the genuine app.
- Request information: like any web service, our server processes your IP address and request details briefly to keep the service secure and to limit abuse.
- Notifications: if you turn on reminders, a push notification token for your device is stored so we can send them.
All traffic is encrypted with HTTPS/TLS. Onelior hides its content when the app is in the app switcher or while your screen is being recorded or mirrored.
5. Where the data lives, and who else sees it
Your data is stored on servers we operate at Hetzner, our hosting provider, which processes it only on our behalf and under its data processing terms. Sign in with Apple and Google Sign-In are provided by Apple and Google under their own privacy policies. We do not sell, rent or trade personal data, and we do not use advertising or analytics SDKs. We disclose data only if the law requires it.
6. How long we keep it
We keep your data while your account exists. When you delete your account, your profile, workouts, nights, study logs, progress and sign-in tokens are deleted from our database. Copies may remain for a limited time in encrypted backups that we keep only to recover from a failure; they are not used for anything else.
7. Your rights and deleting your account
Under laws such as the GDPR, KVKK and CCPA you can ask to access, correct, export or erase your data.
- Delete your account in the app:
Climb → your profile button (top right) → Settings → Delete Account. See the account deletion page for help. - For any other request, write to privacy@onelior.com.
8. Children
Onelior is not directed to children under 13, and we do not knowingly collect their data. If we learn that we have, we delete it.
9. Changes
When this policy changes, we update the date at the top of this page. Significant changes are also announced in the app.
10. Contact
Email: privacy@onelior.com or support@onelior.com
Web: onelior.com/support