Privacy policy

The short version

peakbag records the peaks you climb, and that can include GPS tracks of where you walked. Tracks can reveal where you live, so we treat privacy as the first rule of the site: nothing you add is ever more visible than your profile allows, we never sell your data, and you can delete your account and everything in it whenever you like.

peakbag is run by Lee Pownall in the UK, who is the data controller for the information described here. Questions go to support@peakbag.com.

What we store

• Your account: your name, username, email address, password (stored only as a secure hash), passkeys and two-factor settings, and your profile and notification preferences.
• Bags: the peaks you have climbed, the date, and anything you choose to add, such as a write-up or a conditions report.
• Tracks: the GPX, FIT or TCX files you upload, kept as GPX with their route, times and statistics.
• Photos: the images you add to a Bag. We keep each original, including its camera and location metadata, privately so it can be placed on your Track. Copies shown to anyone else have that metadata removed.
• Community activity: who you follow, the lists you subscribe to, kudos and comments, and the people you mute or block.
• Privacy Zones: the places, such as home or work, you ask us to hide.
• Connected apps: AI assistants you have allowed to read your data, and a log of their requests, so you can review and revoke them.
• Technical data: your IP address, browser and the pages you request, in server logs and error reports that keep the site secure and working.

We use this information to run peakbag for you: showing your progress, sharing what you choose to share, sending the emails you need (verifying your address, resetting a password, and the notifications you have switched on) and keeping the site safe. Our lawful basis is that we need it to provide the service you signed up for, and, for logs and security, our legitimate interest in keeping peakbag secure.

Who can see it

Your profile is Public or Private. Each Bag and list you create is Public, Followers or Private. The stricter setting always wins, so nothing can be more visible than your profile. A Private profile is visible only to the followers you accept, and a Private item is visible only to you. There are no secret share links: if something is not public, a link will not expose it.

Privacy Zones trim your Tracks and hide photo locations inside the places you choose before anyone else sees them.

Private and followers-only Bags still count, without your name, towards public totals such as how many people have climbed a peak, and towards conditions reported on a date. On a quiet peak, a date could hint at who was there.

You can mute people to stop seeing their posts, or block them to remove follows both ways and stop them interacting with you.

Who helps us run peakbag

We use a small number of service providers who process data only on our instructions:

• Laravel Cloud hosts the site, its database and its file storage.
• An email provider delivers the emails peakbag sends you.
• PostHog (EU Cloud, with data held in Frankfurt) provides our analytics, described below, and records the errors peakbag hits so we can fix them.

Some of these providers may process data outside the UK. Where they do, we rely on the safeguards UK law requires, such as adequacy regulations or standard contractual clauses. We do not use advertising trackers and do not sell or share your data with advertisers.

Analytics

We use PostHog to understand whether people get as far as their first Bag, which is in our legitimate interest in making peakbag work well. It is set up to collect as little as possible:

• Your browser sends page views only. Nothing is stored on your device, no cookies are set, and sessions are never recorded.
• Page addresses are reduced to their pattern, so a profile address is sent as /@{username}, never your actual username.
• Our server sends a few events: signing up, creating a Bag, uploading a GPX file (with only a count of the peaks found), subscribing to a list, and a daily "active" signal.
• Events carry a one-way hashed id in place of your account. No names, usernames, email addresses, Tracks or coordinates are sent.
• Admin pages are not tracked.

Cookies

peakbag only uses cookies it needs to work: one to keep you signed in, one to protect forms against forgery, and a few that remember display choices such as your theme. None are used for advertising, analytics or tracking, so there is no cookie banner.

How long we keep it

We keep your account and everything in it until you delete it. Deleting a Bag or photo removes it, and its files, straight away. Server logs, error reports and backups are kept for a limited time and then deleted.

Your data, your choice

You can see and change most of your information in peakbag itself. You can delete your account at any time from your profile settings, which removes your profile, Bags, Tracks, photos, comments, kudos and follows.

Under UK data protection law you also have the right to a copy of your data, to have it corrected or erased, to object to or restrict how we use it, and to take it elsewhere. To ask for any of these, including an export of your data, email support@peakbag.com. We will reply within a month.

If you are unhappy with how we have handled your data, please tell us first. You can also complain to the Information Commissioner's Office at ico.org.uk.

Changes to this policy

If we change how we use your data, we will update this page and its date, and tell you by email or on the site before any significant change takes effect. Using peakbag is also covered by our terms of use.