PRIVACY POLICY

Adventure Index (adventure-index.com) is run by an individual based in the United States (“we”, “us”). We are the controller of the personal data described here. Contact: privacy@adventure-index.com.

You can browse the whole site without giving us anything. What we do collect:

• Messages and suggestions. If you use “Suggest an edit”, the contact page or email us, we store what you wrote, the page it was about, and the name and email address you chose to give (both optional on the forms; we use the address only to reply), plus our replies. If you have an account, a suggestion is linked to it and deleted with it.
• Email signup (“Notify me”). If you sign up, we store your email address, which updates you asked for, the page you signed up on, when you signed up, whether you confirmed the address (we send a confirmation email first, and only email you once you confirm) and, if you leave, when you unsubscribed.
• Server logs. Like every website, our hosting records each request: IP address, the page requested, browser type (User-Agent), referring site and time. We use these to run the site, fix errors and stop abuse.
• Rate-limit counters. To stop automated abuse, we count requests per IP address in short time windows. These counters are deleted within 48 hours.
• Location, only for trip searches. Find a Trip starts from your approximate city, which our hosting provider works out from your IP address for that request; we don’t store it. If you click “use my location”, your browser asks your permission and sends your position for that search only. Addresses you type are looked up to get coordinates and not stored.

Free accounts (optional; you never need one to read the site). If you create one, we store: your username, email address and whether you confirmed it, a password hash (never the password itself), when you confirmed you are 16 or older and accepted the Terms, and your email preference. Then only what you add: the places and trips you save (with any note), your reviews and ratings, the reports you make about other reviews, the season alerts you ask for, and, if you fill them in, your climbing grade and style, distance units and home town (rounded to about 1 km). We also keep your sign-in sessions (when each started and expires; no IP address or browser details). Your username, reviews and ratings are public; everything else is private to you.

Signing in with Google (optional). If you choose “Continue with Google”, Google tells us your email address, that Google has confirmed it, and an account identifier; we ask for nothing else (no contacts, calendar or files). Google also sends your name and profile photo: we keep neither. Instead you get a random public username (like granite_fox_4821) that you can change on your account page. Pressing “Continue with Google” is where you confirm you are 16 or older and accept the Terms. We store the identifier so you can sign in again. Google’s own processing is covered by Google’s privacy policy. You can remove our access any time in your Google Account (Security, third-party access).

We don’t knowingly collect sensitive data (health, religion and so on). Please don’t put it in reviews or your profile.

• To send the updates you asked for: your consent, which you can withdraw at any time with the unsubscribe link or by emailing us.
• To run and secure the site (logs, rate limits, error fixing): our legitimate interest in a working, safe website.
• To provide your account (sign-in, saved items, reviews, season alerts, downloads): performing our agreement with you (the Terms). Account emails (confirming your address, password resets, the season alerts you turn on) are part of that; occasional news only if you tick the box.
• To keep reviews fair: other users can report a review; after three reports it is hidden until we look at it (our legitimate interest in a safe site).
• To answer trip searches: providing the feature you asked for.
• To meet legal obligations, for example responding to valid legal requests.

We don’t use your data for advertising, profiling or automated decisions about you.

We use a small number of service providers (“processors”) who handle data only on our instructions:

• Hosting: [hosting provider], which runs the site and keeps the server logs.
• Database: [database provider], where signups, rate-limit counters and accounts are stored.
• Google (only if you choose to sign in with Google): confirms your identity and tells us your email address.
• Cloudflare: sits in front of the site for speed and security, so it sees every request (including your IP address).
• Email: Resend, which sends confirmation and update emails and our replies; Cloudflare Email Routing receives mail sent to our addresses.
• Map tiles: when you view a map, your browser loads map images directly from the tile provider ([map tile provider; OpenStreetMap during development]) and, only if you switch to the satellite view, from Esri. They receive your IP address and browser type, as with any image on the web.
• Image hosts: some photos load directly from Unsplash and Wikimedia Commons, and news thumbnails from the publishers whose articles we link to. These hosts likewise see your IP address. Some publishers’ servers may try to set their own cookies; those are theirs, not ours.

Address lookups and road routing are done by our server (U.S. Census Bureau geocoder, OpenStreetMap Nominatim, OpenRouteService), so those services don’t see your IP address.

We do not sell your personal information and we do not share it for cross-context behavioral advertising. We may disclose data if the law requires it, to protect people’s safety, or to a successor if the site is ever transferred (we would tell you first).

• Signup emails: until you unsubscribe or ask us to delete them. Unconfirmed signups are deleted after [30] days.
• Messages and suggestions: up to [2] years after the conversation ends, or sooner if you ask; spam is deleted after 30 days.
• Server logs: up to [30] days, unless needed longer to investigate abuse.
• Rate-limit counters: deleted within 48 hours.
• Sign-in sessions: until you sign out or they expire (30 days without use); expired ones are deleted. Password-reset and confirmation links expire after 1 and 24 hours.
• Accounts: until you delete your account. Delete my account on your account page removes your profile, saved items, reviews, season alerts, reports and sessions at once; backups roll off within [35] days.

We don’t use advertising, analytics or tracking cookies, so there is no cookie banner. Without an account the site sets no cookies at all.

• If you sign in, we set one session cookie that keeps you signed in. It is strictly necessary, set only when you sign in, unreadable by page scripts (HttpOnly), sent only to this site (SameSite=Lax, HTTPS only), and deleted when you sign out or it expires (30 days).
• Cloudflare may set a strictly necessary security cookie (such as __cf_bm) to tell people from bots.
• Your browser’s local storage keeps things only when you ask: trips and road-trip plans you save, and the news sports you pick. It stays on your device; we never see it. Clear it any time in your browser settings.

Fonts are served from our own domain, and there are no embedded videos or social-media widgets. If we ever add analytics, we’ll use a cookieless tool, or ask for your consent first.

We honor the Global Privacy Control signal as a request to opt out of the sale or sharing of your personal information. Since we don’t sell or share personal information, there is nothing extra to switch off today, and if that ever changes, GPC will be respected automatically. “Do Not Track” signals are treated the same way.

Wherever you live, you can ask us to:

• See the personal data we hold about you and get a copy in a portable format;
• Correct it if it’s wrong;
• Delete it;
• Object to or restrict how we use it, and withdraw consent at any time.

EU, EEA and UK residents have these rights under the GDPR and UK GDPR (access, rectification, erasure, restriction, objection, portability) and may also complain to their local data protection authority.

California residents (CCPA/CPRA) and residents of other US states with privacy laws have the right to know what we collect, to delete and to correct it, and to opt out of sale or sharing (we do neither). We won’t treat you differently for using these rights. You can use an authorized agent.

Do it yourself: signed in, your account page has Download my data (a JSON file of your profile, saved items, reviews and alerts), lets you correct your profile, and has Delete my account.

How to ask: email privacy@adventure-index.com from the address involved (or tell us which account). We may ask you to confirm it’s you. We reply within 30 days (45 for California requests), and it’s free.

The site is not directed at children under 13, and we don’t knowingly collect their data. Accounts are for people aged 16 or older. If you believe a child has given us personal data, email privacy@adventure-index.com and we’ll delete it.

We are based in the United States, and our providers may process data in the US and other countries. When data from the EU, EEA or UK is transferred, we rely on our providers’ safeguards: the EU-US Data Privacy Framework where they are certified, or the European Commission’s Standard Contractual Clauses (and the UK addendum).

The site is served only over HTTPS, passwords are stored only as strong one-way hashes (scrypt), database access is restricted, and we keep what we collect to a minimum. No system is perfectly secure; if a breach affects you, we’ll tell you and the authorities as the law requires.

When we change this policy we’ll update the date at the top. If the change is significant (for example adding analytics or new uses of your data), we’ll say so on the site and email signed-up users before it takes effect.

Questions or requests: privacy@adventure-index.com. See also our Terms of use.