Privacy policy
How Summit Fever handles your information, and the choices available to you.
In short (this summary does not replace the policy below):
- We use your location while you use the app, and while you record a hike also when the screen is locked or the app is in the background, to show your position, find peaks, record your hike and check summits. Your summit records show where and when you were.
- Your logbook is stored on your device and synchronised with our servers in Ireland.
- Display names, the optional full name and avatar photos are screened automatically by OpenAI's moderation service before they are published.
- Completed hike recordings (GPS tracks) are uploaded to your account automatically and kept until you delete your account. Your approved followers can see them once a recording is linked to a summit.
- Analytics and crash reports are off until you switch them on, and you can switch them off at any time.
- We do not sell your data, show ads or use your data for targeted advertising.
- Purchases and subscriptions (from the beta version) are paid through Apple or Google or our payment provider. We receive confirmation of your purchases, never your card details.
- If you join the community, your followers can see your summit activity, and other members can see your display name and photo, and your full name if you choose to add one. Other members can also search for you by your approved full name.
- You can delete your account at any time in the app or at https://summitfever.app/delete-account.
1. Who is responsible
Giambattista Salvi, Madrid, Spain, NIF/NIE Y8662110W ("Summit Fever", "we", "us") is the controller of your personal data.
- Privacy questions and requests: info@summitfever.app
- General support: support@summitfever.app
We have not appointed a data protection officer because we are not required to. As we are established in the EU, we do not need an EU representative. We have not appointed a Swiss representative because the thresholds of Art. 14 FADP are not met.
2. Scope
This policy covers the Summit Fever mobile app for iOS and Android, our support services and our website https://summitfever.app. Services you choose to use from the app, such as Google or Apple sign-in or apps you share content to, process data under their own policies.
3. What we use, why, and on what legal basis
The legal bases below are those of Art. 6(1) GDPR: contract (necessary to provide the services you request), legitimate interests (which we name), consent (which you can withdraw at any time) and legal obligation. Device permissions and acceptance of our Terms do not replace any separate consent required by law. For users in Switzerland, see section 16.C.
| Information | Why we use it | Legal basis |
|---|---|---|
| Account: email address, authentication credentials (handled by Supabase; we never see your password, nor your Google or Apple password), account identifier, profile information from Google or Apple sign-in, and an Apple authorisation token kept only to revoke the authorisation when you delete your account | Creating and securing your account, sign-in, synchronisation, service messages | Contract; legitimate interests in account security |
| Profile: display name, optional full name, avatar, country, language, units and preferences | Personalising the app; identifying you in community features; letting other members find you by searching for your approved full name | Contract |
| Optional birth year and sex: stored separately from your public profile and never shown to other users | Age-group statistics and badges | Consent; you withdraw it by clearing the field |
| Location: precise or approximate location, with your device permission, while you use the app and, while you record a hike, also when the screen is locked or the app is in the background | Map position, nearby peaks, route guidance, hike recording and summit checks | Contract |
| Hiking activity: summit records (peak, date and time), GPS tracks of the hikes you record (route points with time, altitude and accuracy), uploaded automatically when a recording is completed, logbook notes, challenges, achievements, progress, carabiner balances and offline-route entitlements | Logbook, statistics, challenges, route unlocks and synchronisation across devices | Contract |
| Purchases (from the beta version): product purchased, price, currency, store country, date, store transaction and order identifiers, purchase status (completed, refunded or cancelled), subscription status, trial and renewal dates, promotional codes redeemed, and the resulting carabiner balance, unlocks and premium access. We never receive your payment card details | Delivering and restoring purchases and subscriptions, verifying them with Apple, Google or our payment provider, handling refunds, cancellations and support, preventing fraud, accounting and tax | Contract; legal obligation (accounting and tax); legitimate interests in preventing fraud |
| Photos: avatar images you select or take; summit-share images prepared on your device | Avatar (moderated before publication); sharing when you choose to | Contract |
| Automated moderation: your display name, optional full name and avatar images are sent to OpenAI's moderation service for screening | Checking that display names, full names and avatars follow our rules before they are published | Legitimate interests in a safe service |
| Community: follows and other social connections and interactions, acceptance of the Community Guidelines, block lists | Providing the community features you choose to use | Contract; legitimate interests in keeping a record of acceptance |
| Reports and moderation: reports, reasons, decisions, restrictions | Safety, enforcing our rules, handling complaints and appeals | Legal obligation (Digital Services Act); legitimate interests in a safe service and in defending legal claims |
| Analytics (Google Analytics for Firebase): app interactions, screen and navigation events, device and app information, installation identifiers, your account identifier while signed in, approximate location derived from network information | Understanding how the app is used and improving it | Consent |
| Crash reports (Firebase Crashlytics): errors, diagnostic logs, device and app information, installation identifiers, your account identifier while signed in | Finding and fixing errors, reliability | Consent |
| Maps and place search: the map area you view, place-search text and technical request data such as your IP address, sent to Stadia Maps. Peak search bundled with the app stays on your device | Displaying maps and returning search results | Contract; legitimate interests in delivering maps efficiently |
| Support: your email address, messages, attachments and delivery information | Answering your requests | Contract; legitimate interests |
| Security logs: IP addresses and request metadata | Protecting the service and investigating abuse | Legitimate interests in security |
| Legal matters: information needed to comply with the law or defend legal rights | Legal compliance, disputes | Legal obligation; legitimate interests |
3.1 Analytics and crash reports: your choice
Analytics and crash reports are switched off until you enable them. You can enable each one separately and withdraw either choice at any time in the app's privacy settings. Reporting stops when you withdraw your consent; the change can take full effect the next time you open the app, and data already sent is removed under the schedule in section 9. Crash handlers built into your device or the Firebase software may still record a crash on your device, but nothing is sent to us unless you have enabled crash reports. Declining does not prevent you from using the app's core features. We have disabled the collection of advertising identifiers in our analytics configuration.
3.2 What we do not do
We do not sell personal data or share it for targeted advertising. The app currently contains no advertising. If we show sponsored content or partner offers in the future, they will be clearly labelled, and we will not use your data for personalised advertising without your consent. We do not connect analytics to advertising accounts or use it for remarketing or personalised advertising. Camera access never includes microphone recording. We do not access your contacts.
4. What other users can see
If you join the community, the members who follow you can see your summit activity and challenge activity, together with your approved display name, avatar and country. Other members can see your approved display name and avatar, for example when they look you up to follow you.
Your full name is optional. If you add one and it passes moderation, other members can see it on your profile and can find you by searching for it. If you prefer not to be searchable by your real name, leave the field empty; you can edit or clear it at any time in the app, and it stops being visible and searchable once cleared. Like your display name, it must follow our Community guidelines and is screened before it is published. Do not enter a name that is not yours.
Your approved followers can also see the GPS track of a recorded hike that is linked to a summit. Other members can like a shared summit activity, which stores their account identifier. Approved avatars are public and can be accessed by anyone who has their web address. People who see your information can keep copies of it.
Your email address, optional birth year and sex, private logbook notes and block list are never shown to other users. Summit-share images you send to other apps may reveal your summit, date, photo and other displayed details.
5. Information stored on your device
Your account data is stored on your device and synchronised with our servers. Signing out does not delete it from the device. Deleting your account clears that account's data on the device you use to delete it. On other devices, clear the app's storage or uninstall the app to remove local copies. Restored device backups may contain old data.
6. Who receives information
Service providers that process data on our behalf under data processing agreements:
| Provider | Service | Location |
|---|---|---|
| Supabase | Authentication, database, file storage, backend processing | Ireland (EU) |
| Google (Firebase) | Analytics and crash reports, only with your consent | EU and United States |
| Stadia Maps | Map tiles and place search | United States |
| OpenAI | Automated screening of display names and avatar images | United States |
| Cloudflare | Website hosting and content delivery | Worldwide, including the United States |
| Namecheap (Private Email) | Support mailbox | United States |
Other recipients: Google and Apple process sign-in and, for in-app purchases, payment and billing under their own policies, as independent controllers, and send us confirmations of your purchases and refunds; apps you select from your device's share sheet process content under their own policies; other members see what is described in section 4; authorised moderation personnel see the information needed to review reports; courts, authorities and public bodies receive information where required by law; our professional advisers do so under confidentiality; and, in a merger or sale of the business, the acquirer, which remains bound by this policy.
Countries to which data may be disclosed: Spain, Ireland and other EU/EEA states, Switzerland (for Swiss users) and the United States.
7. International transfers
Some providers process information outside your country. Switzerland and the EU/EEA recognise each other as providing adequate protection. Transfers to the United States rely on the provider's certification under the EU–US and Swiss–US Data Privacy Frameworks where available, or otherwise on the European Commission's Standard Contractual Clauses (with the adaptations required for Switzerland) included in our providers' data processing agreements. Contact us for information on, or a copy of, the safeguards that apply to your data.
8. Security
We use access controls, encrypted network connections and moderated private storage for avatars awaiting review. Account data also resides on your device, so please protect it with a screen lock. No storage or transmission method can guarantee absolute security. If a breach is likely to put you at risk, we notify the competent authority and, where required, you.
9. Retention and deletion
You can delete your account in the app or request deletion at https://summitfever.app/delete-account. Successful deletion removes your active account and associated profile, avatar files, summit history and related account records, and clears that account's data on the device performing the deletion.
| Information | Retention |
|---|---|
| Account data | While your account exists; deletion requests are normally completed within 14 days, including any ownership verification |
| Database backups | Rolling 7-day backup window; deleted records disappear when the backups containing them expire |
| Analytics (user- and event-level data) | 2 months, removed through Google's monthly deletion process; aggregated reports contain no personal data |
| Crash reports | 90 days |
| Security logs | 30 days from collection |
| Support correspondence | 90 days after the request is closed |
| Moderation records, including reports about you | 180 days after the case is closed |
| Purchase and transaction records | 6 years from the end of the financial year (Spanish Commercial Code), or longer where tax law requires; after account deletion, kept blocked for this purpose only |
Deleting your account does not immediately erase analytics or crash data already collected, backups, copies on other devices, or copies shared to other services; these are removed under the schedule above or the recipient's policy. Information needed for an ongoing investigation, dispute or legal obligation is kept only for that purpose and only until the need ends, with access restricted.
10. Your rights
You can request access to your data, rectification, erasure, restriction of processing and a portable copy of your data, and object to processing based on legitimate interests. Where processing relies on consent, you can withdraw it at any time without affecting earlier processing.
How to exercise them:
- In the app: edit your profile, add, change or clear your optional full name and other optional fields, change your analytics and crash-report choices, manage camera and location permissions in your device settings, block users and delete your account.
- By email to info@summitfever.app, for everything else.
We may verify account ownership using proportionate information. We respond within one month (EU) or 30 days (Switzerland), extendable for complex requests. Requests are free unless manifestly unfounded or excessive. Your right to complain to a supervisory authority is explained in section 16.
11. Minimum age
Summit Fever is intended for people aged 14 and over, and you must be at least 14 to create an account. If you believe a younger child has given us personal data, contact us and we will delete it.
12. Automated decisions
We do not make decisions based solely on automated processing that have legal or similarly significant effects on you. Display names, full names and avatar photos are screened automatically before publication; if one is rejected, you can ask us to review the decision (see the Community guidelines). Automated location checks, achievements and challenge progress are features of the app; prize challenge rules explain how results are verified.
13. Device permissions
- Location (optional): map position, nearby peaks, navigation, hike recording and summit checks, while you use the app and, while you record a hike that you start, also when the screen is locked or the app is in the background. The app does not ask for "always" location access, and tracking stops when you end the recording.
- Camera (optional): avatar and summit-share photos, without microphone recording.
- Photos (optional): only the image you select.
You can decline or revoke these permissions; related features may then be unavailable. The app also stores data on your device that is necessary for the features you use (local database, offline maps, sign-in session).
14. Changes
We publish changes at https://summitfever.app/legal/privacy.html and give additional notice in the app, or ask for your consent, where required.
15. Contact
Giambattista Salvi · Madrid, Spain · info@summitfever.app
16. Country-specific information
16.A Spain
16.A.1 We also comply with the Spanish Organic Law 3/2018 on Data Protection and Guarantee of Digital Rights (LOPDGDD).
16.A.2 Supervisory authority. As we are established in Spain, the Spanish Data Protection Agency (Agencia Española de Protección de Datos (AEPD)) is our lead authority. You can complain to it or to the authority of your country of residence.
16.A.3 Blocking. Where data must be kept after deletion because of a legal obligation or possible legal claims, it is blocked as required by Art. 32 LOPDGDD: kept separately with restricted access, used only for that purpose and deleted when the relevant period ends.
16.A.4 Age. Spanish law allows people aged 14 and over to consent to data processing themselves, which is why our minimum age is 14.
16.A.5 Deceased persons. Relatives and heirs can contact us regarding the data of a deceased user, as provided for by Spanish law.
16.B Italy
16.B.1 We also comply with the Italian Personal Data Protection Code (Legislative Decree 196/2003, as amended by Legislative Decree 101/2018).
16.B.2 Supervisory authority. You can complain to the Italian Data Protection Authority (Garante per la protezione dei dati personali, https://www.garanteprivacy.it). As we are established in Spain, the Spanish AEPD is our lead authority and cooperates with the Garante.
16.B.3 Age. Italian law allows people aged 14 and over to consent to data processing themselves, which is why our minimum age is 14.
16.B.4 Deceased persons. The rights of a deceased user can be exercised by a person with an interest of their own, acting on the user's behalf or for family reasons worthy of protection, unless the user expressly prohibited this, as provided for by the Italian Code.
16.C Switzerland
16.C.1 For users in Switzerland, we process personal data in accordance with the Swiss Federal Act on Data Protection (FADP). The FADP does not require a legal basis for each processing; where a justification is needed, we rely on your consent, our contract with you or our overriding interests, as described in section 3.
16.C.2 Your rights include the right to information about your data, to receive or transfer your data, and to correction, deletion and objection. We respond within 30 days.
16.C.3 Countries. The countries to which your data may be disclosed are listed in section 6.
16.C.4 Supervisory authority. You can report concerns to the Federal Data Protection and Information Commissioner (FDPIC, https://www.edoeb.admin.ch) and enforce your rights in the civil courts.
16.C.5 Swiss representative. We have not appointed a representative in Switzerland because the conditions of Art. 14 FADP are not met.