Last updated: October 22, 2026
The data controller for longtrails.org is Dan Eils, an individual based in Florida, United States. Contact for anything in this policy: privacy@longtrails.org. We have no postal address for correspondence.
If you sign in with Google we receive your name, email address and profile photo from Google. If you sign in with an emailed link we store your email address. There are no passwords. You can add a username, display name, bio and avatar; these are public.
When you save or share a trip without signing in, or open a trip somebody shared with you, we create a guest account on your device with a random name and no email. It lets you keep your work and suggest changes to a shared trip. It holds no personal data unless you later sign in and attach it to a real account.
Routes, planned trips, comments, trip reports, collections and profile details are stored to provide the Service. Public content is visible to anyone.
Our servers keep request logs (the address requested, time, response code, timing, your IP address and browser identifier) for debugging and abuse prevention. Error reports sent to Sentry include the page, browser and what went wrong, with a request id; they do not include your comments or trips. Cloudflare Turnstile checks that a browser is not a bot before an account is created or a sign-in link is sent.
We count how often trail pages are viewed and how often planning is started and finished. These counts hold only the event name, the trail and the time: no user id, device id, session id, cookie, IP address or user agent is recorded with them, they are kept on our own servers, and nothing is written to your device to enable them. Because nothing in them can identify you, rights over personal data cannot be exercised on them. If your browser sends Do Not Track or Global Privacy Control, nothing is sent at all.
Your browser's local storage holds your preferences (for example units), your sign-in token and any map data you downloaded for offline use. It stays on your device.
For people in the European Economic Area and the United Kingdom, the legal bases are performance of our contract with you (providing the Service), our legitimate interests (security, abuse prevention, fixing errors), and consent where the law requires it. We do not sell your personal information and we send no marketing email.
We are a small operation and use these providers to run the Service. Each receives only what its job needs:
When the map or a photo loads, your browser fetches tiles and images directly from the sources that publish them, which see your IP address like any website does: OpenTopoMap, Esri World Imagery, Wikimedia Commons. Each is listed with its licence on the data sources page.
We operate from the United States and most providers above are there; the API server is in Germany. If you use the Service from the EEA, the UK or Switzerland, your data is transferred to the United States. We rely on the providers' standard contractual clauses and, where they hold it, their Data Privacy Framework certification. Email privacy@longtrails.org for a copy of the safeguards.
Account data stays while your account exists. When you delete your account, your personal data is removed within 30 days; encrypted database backups are kept for 28 days and then expire, so a deleted account is gone from backups within about two months. Request logs are kept for up to 90 days. Anonymous usage counts are kept indefinitely.
Public content you posted may stay visible after you delete your account if other people have replied to or built on it; it is shown without your name. We remove it on request.
Hut and route pages show photographs from open sources (Wikimedia Commons, Flickr, alpine-club sites, hut websites) with the author and licence they were published under (see the data sources page). Faces in the photos we publish are blurred. If you are the author of a photo and want it removed or credited differently, or if a photo shows you, email privacy@longtrails.org and we will act within 48 hours.
You can at any time:
If you are in the EEA or the UK you also have the right to lodge a complaint with your data protection authority. We answer requests within 30 days.
We use no advertising cookies and no cross-site tracking. Sign-in state lives in your browser's local storage, not a cookie. Cloudflare may set a functional cookie for its bot checks.
Everything is served over HTTPS with HSTS. There are no passwords to leak: sign-in is through Google or a one-time emailed link. Access to the database is restricted by role, rate limits protect the API, and backups are encrypted. No system is perfectly secure; tell us at privacy@longtrails.org if you find a problem.
The Service is not directed at children under 13 and we do not knowingly collect their personal information. If you believe a child has given us personal data, email us and we will delete it.
We may update this policy. Material changes are announced in the Service and the date at the top moves.
privacy@longtrails.org for privacy matters; hello@longtrails.org for anything else. See also the support page and our accessibility statement.