Skip to content
Topo

Privacy Policy

Last updated: October 14, 2026

Topo is operated by Brooklyn Uprising LLC (“Topo,” “we,” “us” or “our”). This Privacy Policy explains how we collect, use, disclose and retain personal information through Topo websites, mobile apps and software services.

Topo and your gym

Topo provides technology that gyms use to manage memberships, check-in, purchases, events, waivers and communications. When we handle information to provide those services for a gym, we generally do so on that gym's behalf. The gym determines how it uses information for its operations and is responsible for its own privacy notice.

We also handle information for our own purposes, including operating and securing Topo, responding to requests addressed to us, and managing our relationships with gym customers and staff. Brooklyn Uprising LLC also operates Brooklyn Uprising gym. Where you use that gym, the same company acts both as the gym operator and the provider of Topo. This policy describes the Topo services; the gym's notice describes its gym operations.

A gym's name, branding or website address does not change which company operates Topo. You can contact your gym about its records and services, or contact us using the details below for help identifying who handles your request.

Information we collect

The information we handle depends on the features you and your gym use.

Account and contact information. Names, email addresses, telephone numbers, dates of birth, addresses, account identifiers, profile photos and information needed to authenticate access. Staff accounts also include roles and permissions.

Family and emergency information. Guardian and dependent relationships, household membership and payment arrangements, emergency contacts and information supplied by someone authorized to act for you.

Gym activity and transactions. Memberships, passes, visits and check-in times, bookings, purchases, receipts, credits, refunds and payment status. Payment providers such as Stripe process payment details. Topo handles payment references and limited payment-method details, such as card brand and last four digits, rather than storing full payment card numbers.

Waivers, forms and communications. Signed waivers, signature evidence, answers to gym forms, messages, support requests and information entered by authorized gym staff. Depending on the gym's forms, answers may include health, accessibility or other sensitive information. Provide information about another person only when you have authority to do so.

Technical and service information. IP addresses, browser and device information, app version, cookies and session information, push-notification tokens, logs, crash and performance information, and interactions with the service. Visit records identify the gym you attended; this is different from continuous GPS tracking.

Business information. Contact details, correspondence, billing and account information for gym representatives and people contacting Topo directly.

We receive information from you, your gym, authorized guardians and payers, service providers and your use of the services. Gyms may import existing records when they begin using Topo.

How we use information

We use information to:

Some support tools can use an AI service provider to prepare a draft response for staff review. When a gym uses those tools, relevant message content and context may be supplied to that provider. These tools do not replace the gym's responsibility for its decisions or advice.

Using Topo with several gyms

If you ask Topo to find your gym accounts by email, we check for eligible matching accounts and verify your access before providing sign-in options. Your records remain associated with the relevant gym. Using the same email address at more than one gym does not by itself give one gym access to another gym's records.

The app remembers gyms you have used and keeps sign-in information on your device. Account actions identify the gym they affect. Removing the app or a remembered gym does not itself delete gym records or cancel a membership.

When information is shared

With your gym and authorized people. Gym staff and other authorized users can access information needed for their roles. Guardian, household and payer features may make relevant information available to people authorized to manage that relationship.

With service providers. We use providers for functions such as hosting, database and file storage, payments, email delivery, push notifications, diagnostics and support processing. Examples include Stripe for payments, Resend for email and Sentry for diagnostics when enabled. Apple provides iOS distribution, notification and Wallet services. Providers' roles and practices can differ; payment and platform providers may also process information under their own policies. Providers processing information on our behalf are subject to appropriate contractual and security obligations.

With gym-selected integrations. A gym may connect other services for functions such as access control, communications, analytics or advertising. The gym's notice should identify its practices and applicable choices. Advertising identifiers and hashed contact information remain information about people or devices; hashing is not the same as making information anonymous.

For legal and business purposes. We may disclose information to comply with applicable legal process, protect rights and safety, investigate fraud, or complete a merger, acquisition or similar business transaction subject to applicable protections. Retained gym records may be provided to authorized insurers, legal advisers or authorities where needed for the relevant purpose and permitted by law.

We do not make your private account records publicly visible merely because you use Topo. Sharing information through a feature you choose is governed by that feature's visibility and permissions.

Cookies, analytics and advertising

Cookies and similar storage support sign-in, security, preferences and service operation. Some gym websites can also use analytics and advertising tools that measure visits, campaign referrals, signups and purchases. These tools may use browser identifiers, IP and device information, and conversion information. When you follow a gym's campaign link, Topo sets a first-party cookie named topo_ca that records which link you followed, so that signing up at that gym can be credited to the campaign; it expires after 90 days, or sooner once it has credited a signup, and is not set in the Topo native app.

You can manage browser cookies through your browser settings. Disabling essential storage may prevent parts of Topo from working. Browser controls do not necessarily stop server-side advertising disclosures.

Gym-configured advertising pixels, tags and advertising conversion reporting are disabled for activity inside the Topo native app. Gym websites opened in a browser may still use these integrations. Contact us or your gym to ask about available privacy choices.

Notifications, photos and Wallet passes

Push notifications use a device token if you enable them. You can change notification permission in your device settings and use available preferences within Topo. Promotional messaging choices are separate from necessary service communications; unsubscribing from marketing does not prevent necessary receipts or security notices.

When you choose to upload a photo, we process the photo you supply. Device permission requests explain the relevant access. Adding a pass to Apple Wallet supplies information needed to display and use that pass. A household bundle can include passes for several household members, so consider who can access the device where you add it.

Deletion and retention

You can request account deletion at help@topoclimb.com or through the relevant gym's available account controls. We may verify your identity and authority before acting. We will explain any additional steps needed for a guardian, household payer or linked account, and any effect on memberships, bookings and payments. Deleting an account at one gym does not delete accounts at other gyms. Uninstalling the app does not itself cancel a membership or delete records.

Closing an account does not necessarily erase the gym's underlying records. Gyms may retain identifying and contact information, date of birth, relevant guardian and emergency-contact information, signed waivers and signature evidence, visits, membership and transaction history, and relevant incident or dispute records. These records can be necessary to identify a participant, retrieve their waiver, establish attendance and respond to legal, insurance, tax and accounting obligations.

Deleting your account also removes your profile photo, native and web push-notification tokens and subscriptions, beta clips, and First Ascent share videos and cards. A guardian can delete a minor dependant’s account through the same confirmation process. The account system retains archived profile details, communications, form responses and staff notes for legal, insurance and accounting reasons. Staff archiving an account without self-deletion may retain its photo. An archived record is not the same as information being erased. If you request erasure of particular information, we and the responsible gym assess whether it remains necessary and whether an applicable retention exception permits it to be kept. We will explain material exceptions, subject to legal restrictions.

Retention depends on the type and purpose of the record, applicable obligations and claim periods, insurance requirements, the participant's age and any legal hold. Contact us to ask about the records retained for your account and to exercise applicable deletion rights. Saved payment methods may remain while outstanding payment obligations are resolved; transaction and dispute records may remain separately.

We may also retain limited information to record privacy choices, prevent unwanted resubscription, document requests and protect the service. A request to restore access does not itself renew marketing permission. Copies held by payment providers or other independent services are subject to their applicable obligations and policies.

Your privacy choices and requests

You can update available profile information, change communication preferences and initiate account deletion through the service. Depending on where you live and applicable law, you may also have rights to access, correct, delete or receive a copy of information; object to or restrict certain processing; withdraw consent; or appeal a request decision.

Contact us at help@topoclimb.com to make a request or ask for help. For information controlled by a gym, we may direct the request to that gym and assist it in responding. We may verify your identity and the authority of a guardian or authorized agent. We will respond within the applicable legal period and explain any permitted extension or exception. We will not unlawfully discriminate against you for exercising your rights.

Children and families

Gyms use Topo for youth and family activities, including information supplied by parents or guardians. We distinguish those records from a child using an online account directly.

Children under 13 may not independently create or sign in to a Topo account. Their gym records and participation are managed by a parent or authorized guardian. People aged 13 to the age of majority may use their own account with the required permission of a parent or guardian and subject to applicable law. We may require additional age or authority verification.

If you believe a child under 13 has independently used the service, contact us so we can investigate, restrict unauthorized access and address the information as required by law. This does not automatically remove a gym's appropriately maintained guardian-supplied waiver or attendance records.

Parents and guardians can contact the gym or help@topoclimb.com about their child's records and available controls. We may verify their authority before providing access or acting on a request.

Security and processing locations

We use safeguards designed to protect information and limit access according to organizational and user roles. No system guarantees absolute security. Protect your device and sign-in codes and notify us if you suspect unauthorized access.

Information may be processed in the United States and other countries where we or our providers operate, subject to applicable legal requirements. Contact us for information about the processing locations relevant to your account.

Changes and contact

We may update this policy as our services or practices change. We will show the effective date and provide additional notice or obtain consent where required.

Brooklyn Uprising LLC, operating Topo
Email: help@topoclimb.com