Who runs the app

The app is made by ROSS GELDART LIMITED, a company registered in Scotland (company number SC800908). We are the data controller for anything the app sends off your device.

Any question about privacy — access, deletion, a copy of your data, or anything else you're wondering about — comes to ross@climbamunro.com.

The short version

The app runs no analytics or telemetry. Ever.
We don't do crash reporting through third parties.
We don't show ads or use ad IDs.
We don't send push notifications.
We don't sell, rent, or share your data with anyone.
You can use the app without an account.
Weather forecasts come from Apple on iPhone and Open-Meteo on Android. Sign-in and sync go through Firebase (Google).
climbamunro.com uses no cookies. It counts page views so we know which pages folk read — see below.
The newsletter is optional and separate. If you sign up, MailerLite records whether emails are opened and links clicked — see below.

What stays on your phone

If you use the app without signing in, all of the following stays on your device and never leaves it:

Your GPS track while you're walking.
Text notes you drop at a location on a walk.
Which hills you've marked as summited.
Your progress against each list.
Step counts, if you allow Motion & Fitness access — read from your phone's motion sensor and never sent anywhere.

If you delete the app, that data goes with it. There is no cloud copy we can restore.

What we hold when you sign in

Signing in is optional. It exists for two reasons: syncing your log across devices, and adding walking friends as Baggers. When you sign in, we store the following in Google Firebase (Auth and Firestore):

Your email address and — if you choose to add one — a display name.
A copy of your walk log, notes, and list progress, so it can sync.
Your Bagger connections (the friends you've added, and who has added you).
Any walks you choose to share with Baggers — including the route and any notes on it. Only people you've added see these.

We use Google as our sub-processor for this. Data is stored on Google Cloud servers, encrypted in transit and at rest. Google's own privacy notice is at policies.google.com/privacy.

On Android, signing in uses Google Sign-In (Google Identity Services) as the authentication method. Google receives your Google account email as part of that sign-in; we only receive the account identifier and email that Firebase Auth then stores against your Climb A Munro account.

Where your data is stored

Firebase stores account and sync data in Google Cloud data centres, which may be located outside the UK or European Economic Area (typically the United States or the EU depending on Google's allocation). Google is certified under the UK–US and EU–US Data Privacy Framework, and any transfer takes place under Google's Standard Contractual Clauses. In plain English: your data is safe, encrypted, and covered by the same UK GDPR protections wherever Google's servers happen to sit.

Location

When you tap Track or Just walk, the app uses your phone's location to draw your route and count down the distance to the summit. That location data is processed on your device. It is only sent off the phone as part of a walk log when you're signed in and syncing.

You can revoke location permission any time in your phone's settings. The app will still work — you just won't get the live tracking bits.

Weather

On iPhone, weather forecasts come from Apple's WeatherKit service. When you open a hill's weather panel, the app sends the hill's coordinates to Apple so it can return a forecast. Apple handles that request under its own privacy terms — see Apple's Weather & Maps privacy notice. We don't see or store the query.

On Android, weather forecasts come from Open-Meteo, a free open-source weather API. The app sends the hill's coordinates to Open-Meteo to fetch a forecast. Open-Meteo does not require an account, does not use cookies, and states that it does not log personal data. See their terms and privacy for the full detail.

Payment

The app is a one-off purchase through Apple's App Store or Google Play. Payment is handled entirely by them. We never see your card details, address, or receipt. Apple and Google tell us only how many copies have been paid for, not who bought them.

This website

The website and the app are separate things. The app measures nothing. The website counts page views, so we know whether anyone reads the walk reports.

That's done by Vercel, who host the site. There are no cookies and nothing is stored on your device. What gets recorded is the page you looked at, the site you came from if you followed a link, your country, and roughly what sort of device and browser you're on. No name, no email address, no IP address kept, nothing that follows you around other sites, and nothing joined up with the app or the newsletter.

The counting script is served from climbamunro.com itself, so your browser isn't asked to fetch anything from anywhere else. We do this on the basis of legitimate interests — knowing which pages get read is how we decide what to write next. Vercel's privacy notice is at vercel.com/legal/privacy-policy.

Cookies

There aren't any. climbamunro.com sets no cookies at all, which is why there's no banner to click through and nothing to opt out of.

One exception worth naming: if you sign up for the newsletter without JavaScript, you land on MailerLite's own confirmation page. That page is theirs, and their cookies apply there rather than ours.

The newsletter

The newsletter has nothing to do with the app. It's a separate thing you can sign up for on climbamunro.com, and you never have to.

If you do sign up, your email address is held by MailerLite, who send the emails for us. You confirm the address by clicking a link in an email before anything else is sent. Nothing is joined up with anything in the app — signing up for the newsletter doesn't create an account, and having an account doesn't sign you up for the newsletter.

MailerLite records whether an email was opened, and which links in it were clicked. That's standard for email, and it's how we know whether any of this is worth writing. It isn't used to build a profile of you, it isn't shared with anyone, and it never leaves MailerLite.

We do this on the basis of your consent, given when you sign up and confirm your address. You can withdraw it whenever you like — every email has an unsubscribe link, and unsubscribing removes your address. MailerLite's own privacy notice is at mailerlite.com/legal/privacy-policy.

We keep your address for as long as you want the newsletter. Stop it, and it goes.

Who we share your data with

A short and complete list:

Google (Firebase Auth & Firestore, plus Google Sign-In on Android) — only if you sign in. Used for authentication, sync, and Baggers.
Apple (WeatherKit, iPhone only) — coordinates only, to fetch forecasts.
Open-Meteo (Android only) — coordinates only, to fetch forecasts.
Google Maps SDK (Android only) — used to render the terrain map. Google receives standard map-tile requests as part of that.
Apple / Google (App Store & Play Store) — for the one-off purchase.
MailerLite — only if you sign up for the newsletter. Your email address, and whether you opened an email or clicked a link in it.
Vercel — the website's host. Page views on climbamunro.com. Nothing from the app.

That's it. No advertising networks. No data brokers. Nothing in the app is measured at all.

Your rights under UK GDPR

You have the right to:

Ask what personal data we hold about you.
Ask us to correct anything that's wrong.
Ask us to delete it — see Delete your account for the step-by-step, or email us direct.
Ask for a copy in a portable format.
Object to how we process it, or ask us to restrict processing.
Complain to the UK Information Commissioner at ico.org.uk if you're not happy with how we've handled it.

For any of the above, email ross@climbamunro.com. Expect a reply within a few days, and an answer within a month at the outside.

How long we keep it

If you're signed in, we hold your data until you delete your account or ask us to. See Delete your account for the process — deletion is inside 30 days and backups roll over on the same timescale.

Children

The app isn't aimed at children under 13, and we don't knowingly collect data from them. If you're a parent and think we've received data from your child, email us and we'll delete it.

Changes to this policy

If we ever change what data we hold or who we share it with, we'll update this page and note the date at the top. Material changes — the kind that would change your mind about using the app — will be flagged in-app the next time you open it.

Contact

ROSS GELDART LIMITED (SC800908)
Registered office: Wards House, Wards Road, Elgin, Morayshire, IV30 1NL, Scotland, United Kingdom
Email: ross@climbamunro.com