Privacy Policy

Last updated: June 14, 2026

Overview

HikeSafe is a self-hosted personal hiking safety application. This privacy policy explains what information we collect, how we use it, and your rights regarding your data.

Information We Collect

From Hikers (Account Holders)
  • Username and password (password stored as a bcrypt hash, never in plain text)
  • Phone number (for sending and receiving SMS commands)
  • Timezone preference
  • Hike plans: route details, departure/return times, GPS tracks, location data
  • Integration credentials for third-party hiking platforms (encrypted at rest)
From Emergency Contacts
  • Name and relationship — provided by the hiker who invited you.
  • Phone number, email address, and/or WhatsApp number — provided by you when you opt in via the public enrollment form. We do not store any contact address until you submit the enrollment form yourself.
  • Notification preferences (which channels and which event types you wish to receive) — set by you at enrollment and editable at any time via your "Manage your notifications" link.
  • Consent record — the timestamp, IP address, and User-Agent string captured when you submitted the enrollment form. We retain these as proof of opt-in consent (TCPA compliance evidence).

How We Use Your Information

  • SMS notifications: We send text messages to emergency contacts to inform them of hike departures, check-ins, safe returns, and overdue alerts.
  • Email notifications: If an email address is provided and opted in, we send the same notifications via email.
  • Dashboard access: Emergency contacts receive a unique link to view the hiker's status on a web dashboard.
  • Safety monitoring: We use hike return times to detect overdue hikers and send alerts.

Who Can See Your Information

The hiker who invited you — the account holder who runs this HikeSafe instance — can see your name, relationship, and the phone number, email address, and/or WhatsApp number you provide, along with your notification preferences. They need this to manage their emergency contacts and to reach you during a hike. This is the core purpose of HikeSafe: letting the people you trust stay informed and coordinate if something goes wrong. The hiker can view these details but cannot change them — you control your own contact addresses from your "Manage your notifications" link.

If you are an emergency contact, the hiker's other emergency contacts can see your name, relationship, phone number, and email on the shared hike dashboard so the group can coordinate during an emergency. Followers do not see this. Your details are only ever reachable through the private, unguessable dashboard link — they are never listed publicly.

Information Sharing

We do not sell, rent, or share your personal information with third parties for marketing, advertising, or any commercial purpose. SMS opt-in data and consent will not be shared with third parties or used by HikeSafe for any reason other than safety notifications described in this policy.

The only third parties who receive your information are our delivery providers, and only for the express purpose of delivering messages you have consented to receive:

  • SMS delivery: Phone numbers are shared with our SMS provider (Twilio, ClickSend, or Telnyx) solely for the purpose of delivering text messages you opted in to receive.
  • Email delivery: Email addresses are shared with our SMTP provider solely for delivering email notifications you opted in to receive.

These delivery providers act as data processors on our behalf and are bound by their own carrier-level privacy obligations.

Data Retention

  • Hike records are retained indefinitely (soft-deleted only) because they may be needed for search and rescue purposes.
  • SMS message logs are retained for delivery verification and safety auditing.
  • Contact information is retained while the contact is active. When a hiker removes a contact, the row is kept (soft-deleted) so message-delivery audit history isn't broken, but the contact's name, phone number, email, WhatsApp/voice numbers, consent IP, and user agent are automatically wiped 30 days after removal. Sender and recipient addresses on any messages sent to or from that contact are redacted at the same time. Hike records and message timestamps / channels / bodies are preserved.

Your Rights

As an emergency contact, you have the right to:

  • Opt out of SMS: Reply STOP to any message, or use the unsubscribe link in any notification.
  • Opt out of email: Use the unsubscribe link in any email notification.
  • Re-subscribe: Reply START to any SMS number, or contact the hiker to re-enable notifications.
  • Request data deletion: Contact the hiker who added you to request removal of your information.

SMS Terms

  • Message frequency varies based on hiking activity.
  • Message and data rates may apply.
  • Reply STOP to opt out. Reply START to opt back in. Reply HELP for assistance.
  • Supported carriers include all major US carriers. Carrier support may vary.

Security

We take reasonable measures to protect your information, including password hashing, encrypted storage of integration credentials, webhook signature validation, and masking of phone numbers in application logs.

Changes to This Policy

We may update this policy from time to time. The "Last updated" date at the top of this page reflects the most recent revision.

Contact

If you have questions about this privacy policy or your data, contact the HikeSafe instance operator (the hiker who added you as an emergency contact).