Privacy Policy

We collect and process the following:

• Account information your email address, and (if you sign in with Google) the basic profile information Google provides, such as your name and email.
• Your activity in the app the peaks you mark as climbed (ascents), the dates and notes you add, and any walks you plan.
• Photos any photos you choose to upload and associate with your ascents.
• Location data if you use the "Walks Near Me" feature, we use your device's location to show you nearby peaks. We do not store your location history; it is used only at the time you request it.
• Technical data basic technical information needed to run the service, such as your authentication session.

We do not collect special category data, and we do not knowingly collect data from children under 13.

We process your data on the following lawful bases under UK GDPR:

• To provide the service (performance of a contract): to create and manage your account, store your ascents, photos, and planned walks, and let you use the app's features.
• With your consent: to access your device location for the "Walks Near Me" feature. You can withdraw this consent at any time through your device settings.
• Legitimate interests: to keep the service secure, prevent abuse, and maintain and improve the app.
• Legal obligation: where we are required to retain certain records by law.

Your data is stored using Neon (our database provider) and Vercel Blob (our file storage provider). Photos are stored in secure, access-controlled storage where each user's files are kept in a separate folder accessible only to that user. Access to your data is restricted through row-level security policies so that you can only access your own records.

We take appropriate technical and organisational measures to protect your data against unauthorised access, loss, or disclosure.

We do not sell your personal data. We share data only with service providers who help us run the app, and only to the extent necessary:

• Neon — database hosting.
• Vercel Blob — photo storage.
• Vercel — application hosting.
• Google — if you choose to sign in with your Google account (authentication only).

These providers process data on our behalf under appropriate data-processing terms. Some may process data outside the UK; where they do, appropriate safeguards are in place as required by UK data protection law.

We keep your personal data for as long as your account is active. If you request deletion of your account, we will delete your account and associated personal data (ascents, photos, and planned walks) without undue delay and within one month of your request.

In limited circumstances we may retain certain information for longer where the law requires it (for example, records relating to payments, once payment features are introduced).

Under UK GDPR you have the right to:

• Access the personal data we hold about you.
• Rectify inaccurate or incomplete data.
• Erase your data ("right to be forgotten").
• Restrict or object to certain processing.
• Data portability — receive your data in a usable format.
• Withdraw consent at any time, where processing is based on consent.

To exercise any of these rights, email us at cairn@cairnlabs.co.uk. You can also request account deletion directly from your profile settings in the app. We may ask you to verify your identity before actioning a request.

If you are unhappy with how we handle your data, you have the right to lodge a complaint with the Information Commissioner's Office (ICO), the UK's data protection regulator, at ico.org.uk.

We may update this policy from time to time. When we do, we will update the "Last updated" date at the top of this page. Significant changes will be communicated within the app where appropriate.

Cairn Labs Ltd
Crome, School Lane, Frodsham, Cheshire, WA6 6PB
Email: cairn@cairnlabs.co.uk