Privacy
HikesAlike has no accounts and asks you for nothing. It still handles a little personal data, as every website does: your IP address reaches the servers your browser talks to. This page describes plainly what the site collects and what it does not, why, and who receives it. It is a plain description, not a formal GDPR privacy notice.
Who runs the site
The site is run by the maintainer of this open-source project. For any question or request about your data, write to contact@hikesalike.com. You can also open an issue on the GitHub repository, but issues are public, so put no personal data in one: say only that you want to make a request, and the maintainer will reply with a private way to send the details.
What is processed, and why
- Request logs. The hosting platform logs each request: your IP address, your browser's user agent, the referring page, the time and the address requested (which includes what you type into the hike search and the place search, and the map area you look at). They are kept for 30 days and then deleted.
- The app's access log. The app writes a line per request (the request and the address the connection comes from) into the same logs, kept the same 30 days.
- The rate limit. To stop one client from using up the server, the app counts requests per IP address in memory for about a minute. It is never written anywhere.
- Your starting point. A place or position you give for the drive-time or distance limit (typed in, or from "Use my location" when you allow it) is sent to the server with that search, used to work out drive times and distances, and not stored. A place name you type is looked up on this site's server first, so it is in the request logs; only the coordinates sent with the search stay out of them.
The purpose is to run the site, keep it secure and see how much it is used. The legal basis is legitimate interest (GDPR Art. 6(1)(f)). The site makes no automated decisions about you and builds no profiles.
Who receives it
- Google Cloud (Google Cloud Run, region europe-west1, Belgium) hosts the site, and Google Cloud Logging keeps the request logs in a storage location that follows Google's defaults, as a processor under its Cloud Data Processing Addendum.
- The OpenStreetMap Foundation (UK) serves the map tiles, so your browser sends it your IP address and the map area you look at (its privacy policy).
- GitHub receives your data only when you follow a link to the code; its own privacy policy then applies.
- Email. If you write to contact@hikesalike.com, your message and your email address reach the maintainer through an email provider. They are kept only as long as needed to answer your request, then deleted.
Transfers outside the EU
The site is hosted in the EU (Google Cloud Run, europe-west1, Belgium). The request logs are kept by Google Cloud Logging, whose storage location follows Google's defaults and may be outside the EU. Google may still process data outside the EU; its Data Processing Addendum covers such transfers with the EU standard contractual clauses, and Google is certified under the EU–US Data Privacy Framework. The OpenStreetMap Foundation is in the United Kingdom, which the EU recognises as giving adequate protection. The email provider that delivers messages to contact@hikesalike.com may process them outside the EU.
Your rights
You can ask for access to your data, its correction or erasure, a restriction of its processing, and you can object to processing based on legitimate interest. Ask by email or through the GitHub repository, as above. The site cannot tell who you are from a log line, so it may need you to say when you visited and from which IP address.
You can complain to a data protection authority, in particular the one in the EU country where you live or work, or where you think the infringement took place.
No cookies, no consent banner
The site sets no cookies and stores nothing in your browser: no cookies, no localStorage, no tracking. That is why there is no consent banner.