Privacy & Cookie Policy
Last updated: June 2026
Who we are
Hillbagger (“we”, “us”, “our”) is the data controller for personal data processed through this website. We are subject to the UK General Data Protection Regulation (UK GDPR) and the EU General Data Protection Regulation (EU GDPR) where applicable.
Contact: privacy@hillbagger.com
Data we collect and why
Account data
When you register we collect your email address and, optionally, a display name, username, biography, and profile avatar. Your email address is used to authenticate you, send transactional emails (email verification, password reset, welcome message), and — only if you opt in — occasional product updates.
Lawful basis: performance of a contract (account); consent (marketing emails).
Session and security data
Each authenticated session stores your IP address and browser user-agent. This information is used solely to detect suspicious activity and to display active sessions to you in account settings. It is not used for advertising or profiling.
Lawful basis: legitimate interests (security and fraud prevention).
GPS and route data
When you upload or plan a route, we store the full GPS track (latitude, longitude, elevation, and timestamps) in our database and in Vercel Blob file storage. We also store which hills you have summited (“bagged”) and any notes you attach to a summit.
Lawful basis: performance of a contract (providing the hill-bagging and route-tracking service you signed up for).
Route planning and Mapbox
When you use the route planner, the waypoints (coordinates) you place on the map are sent to the Mapbox Directions API to calculate a walking path between them. These coordinates are transmitted to Mapbox's servers. Mapbox's own privacy policy applies to data processed by them.
Lawful basis: performance of a contract.
Preferences
We store your preferred distance and elevation units (km/mi, m/ft), timezone, and unit display format so the app behaves consistently across devices.
Lawful basis: performance of a contract.
Payments (Supporter tier)
Payment processing for the Supporter subscription is handled entirely by Polar. Hillbagger never sees or stores your card details, billing address, or any other payment-sensitive data. We only store a boolean flag indicating whether your account is currently a Supporter. Polar's own privacy policy applies to data they process.
Lawful basis: performance of a contract.
Analytics
We use Swetrix, a privacy-focused analytics tool we run ourselves, to understand how people use the site. If you're browsing without signing in, Swetrix has no way to identify you or link your visit to anything. If you're signed in, we let Swetrix know it's the same account across visits, so we get accurate numbers on how many people actually use the site — but this is stored in a scrambled form that can't be traced back to you.
Swetrix records: page URLs, referrer, browser, operating system, device type, and an approximate country derived from IP address. The raw IP address is not stored.
Lawful basis: legitimate interests (understanding site usage).
Third-party processors
Cookies
Session cookie (strictly necessary)
Set when you sign in. Keeps you authenticated across page loads. Cannot be rejected.
Unit preferences cookie (strictly necessary)
Remembers your choice of distance and elevation units. Cannot be rejected.
Data retention
Account and route data — held indefinitely while your account is active. You can delete individual routes (which removes both the database record and the GPX file from storage) or delete your entire account at any time.
GPS / GPX files — stored in Vercel Blob indefinitely until you delete the route or your account. These files contain GPS tracks linked to your user ID and are treated as personal data.
Sessions — expire automatically. Active sessions can be revoked from your account settings.
Your rights
Under UK GDPR and EU GDPR you have the right to:
- Access — request a copy of the personal data we hold about you.
- Rectification — correct inaccurate data (most fields can be updated directly in account settings).
- Erasure (“right to be forgotten”) — deleting your account permanently removes all your personal data from our database and file storage. This action is irreversible.
- Restriction — ask us to limit processing in certain circumstances.
- Data portability — receive your data in a structured, machine-readable format.
- Object — object to processing based on legitimate interests, including our use of analytics. To exercise this right, email privacy@hillbagger.com.
- Withdraw consent — opt out of marketing emails at any time via the unsubscribe link in any email.
To exercise any of these rights, email privacy@hillbagger.com. You also have the right to lodge a complaint with the UK Information Commissioner's Office (ICO) or your local supervisory authority.
Contact
Questions about this policy or our data practices? privacy@hillbagger.com