Legal
Privacy Policy
This Privacy Policy explains how we collect and use personal data when you use the HiTrek mobile application (iOS / Android) and related services. It is written to meet the requirements of the EU General Data Protection Regulation (GDPR) and comparable laws.
1. Who we are
The data controller for HiTrek is Peter Szakal. For privacy requests, contact via GitHub: @pszakal — open an issue on the hitrek-site repository with the title “Privacy request”. Do not post sensitive personal data in a public issue; we will continue the conversation privately (for example via a private GitHub channel or by arranging a non-public follow-up).
HiTrek is an offline-first hiking guide. Core trip data (saved routes, favourites, recorded tracks) is stored on your device. Some features and analytics require limited data to leave the device, as described below.
2. What we collect
Depending on how you use the app, we may process:
- Precise location — GPS coordinates while you preview routes, navigate, or record a hike, and to fetch local weather. Location permission is optional until you use those features; you can revoke it in system Settings.
- Fitness / activity metrics — distance, ascent, moving time, and related session statistics derived from GPS while hiking.
- Search history — place or route searches you perform in Discover (e.g. place name selected).
- Product interaction — app events such as opening a route, starting/finishing a hike, favouriting, opening the Plus paywall, downloading offline maps, or sharing a route.
- Identifiers — anonymous analytics and subscription IDs (not a login name). HiTrek does not require an account.
- Device information — approximate device/app metadata used by analytics (e.g. platform, app version) and a device-level analytics identifier.
- Coarse location — approximate geography inferred from network/IP when talking to analytics or content servers (not your GPS trail).
- Purchases — whether you subscribed to HiTrek Plus (processed via Apple / Google and RevenueCat). We do not receive your full payment card details.
- User-generated content kept on device — custom planned routes, favourites, and activity logs stored locally in the app database. These stay on your device unless you choose to share them (e.g. export GPX via the system share sheet).
We do not collect contact details, photos, contacts, or HealthKit data.
3. Purposes & legal bases (GDPR Art. 6)
| Purpose | Examples | Legal basis |
|---|---|---|
| Provide the hiking product | Map, guidance, recording, weather near the route, offline maps, favourites | Contract (Art. 6(1)(b)) — service you request; for GPS, consent via the system location permission (Art. 6(1)(a) / ePrivacy) |
| Subscriptions (HiTrek Plus) | Unlock Plus features, restore purchases | Contract (Art. 6(1)(b)) |
| Product analytics | Understand feature use (starts, finishes, paywall, downloads) via Mixpanel | Legitimate interests (Art. 6(1)(f)) — improve the product; we use anonymous/pseudonymous IDs, no ads, no sale of data. You may object (see Rights). |
| Security & abuse prevention | Keep services reliable and secure | Legitimate interests (Art. 6(1)(f)) |
| Legal obligations | Respond to lawful requests, keep required records | Legal obligation (Art. 6(1)(c)) where applicable |
We do not use your data for third-party advertising, cross-app tracking for ads, or sale to data brokers. We do not use Apple’s Advertising Identifier (IDFA) for tracking.
4. Processors & third parties
We use service providers who process data on our instructions (processors) or as independent controllers where noted:
- Mixpanel — product analytics (events and anonymous/pseudonymous identifiers). Configured for EU data residency where available. Mixpanel Privacy Policy.
- RevenueCat — subscription status and receipt validation with Apple/Google. RevenueCat Privacy Policy.
- Apple App Store / Google Play — in-app purchases and platform services (independent controllers for payment).
- Open-Meteo — weather for a route location (lat/lng query; no account). Open-Meteo terms.
- Map / pack CDNs — map styles, tiles, and trail pack downloads (IP and requested regions/URLs as needed to deliver content).
- Geocoding providers — place search (e.g. Photon / platform geocoder) when you search for a location.
5. International transfers
Where a provider processes data outside the EEA/UK, we rely on appropriate safeguards such as the provider’s EU/EEA hosting options, Standard Contractual Clauses, and/or an adequacy decision. Analytics are pointed at Mixpanel’s EU endpoint by default.
6. Retention
- On device — favourites, plans, and activity remain until you delete them or uninstall the app (uninstall removes local storage).
- Analytics — retained according to our Mixpanel project settings, typically no longer than needed for product analysis (ordinarily up to 24 months unless a shorter window is configured).
- Subscriptions — purchase/entitlement records kept as long as needed to provide Plus and meet accounting/legal duties.
7. Your rights
Under the GDPR you may have the right to:
- Access your personal data
- Rectify inaccurate data
- Erase data (“right to be forgotten”)
- Restrict or object to processing (including analytics based on legitimate interests)
- Data portability (where applicable)
- Withdraw consent (e.g. disable location in system Settings) without affecting prior lawful processing
- Lodge a complaint with your local supervisory authority
To exercise these rights, open a “Privacy request” issue on github.com/pszakal/hitrek-site (or message @pszakal). Because HiTrek has no user accounts, identify your request with enough detail for us to locate analytics/subscription records where possible (we may ask for device/app identifiers or purchase proof). Much of your trip data can be deleted by you in-app or by uninstalling.
8. Children
HiTrek is not directed at children under 16. We do not knowingly collect personal data from children. If you believe a child has provided data, contact us and we will delete it where required.
9. Security
We use industry-standard measures appropriate to a mobile app (transport encryption for network calls, limited data collection, and local storage for core trip data). No method of transmission or storage is 100% secure.
10. Changes
We may update this policy when the product or law changes. The “Last updated” date at the top will change. Material changes will be reflected here; continued use after an update constitutes notice of the revised policy where permitted by law.
11. Contact
Privacy questions and GDPR requests via GitHub:
github.com/pszakal
Issues:
hitrek-site → New issue
(title: “Privacy request”).
This page is provided for transparency for App Store / Play listing and users. It is not legal advice. If you need a formal review for your jurisdiction, consult a qualified lawyer.