Who we are
Hillbound is a hill-bagging website made by Anorthic Labs. The data controller is Steve Perry Creative Limited, trading as Anorthic Labs (“Anorthic Labs”, “we”, “us”), company number 08354632, registered office 4 Back Lane, Brown Edge, Staffordshire, ST6 8QS.
Our registration number with the Information Commissioner’s Office is ZA678923.
For any privacy question or request, email [email protected].
Information we collect
When you visit the website
Our hosting providers process the technical information needed to deliver pages to your browser and protect the site from abuse. This normally includes your IP address, browser type, the page requested and the date and time of the request. These server logs are kept for up to 30 days.
To stop people overloading the site or guessing passwords, we briefly count requests from each IP address. These counts expire on their own, after between one minute and one hour.
We don’t use any of this to identify you, build a profile of you or track you across other websites.
Visit statistics
We use Fathom Analytics to count visits, so we know which pages are useful. When you load a page, Fathom records the page, the site that referred you, your browser, device type and country. It doesn’t use cookies or store anything on your device.
Fathom uses your IP address only briefly. It combines the address with a hash that changes every day to tell whether a visit is unique, then discards it, so the address isn’t stored and your visits can’t be linked from one day to the next. We only see totals, never individual visitors. You can read Fathom’s privacy policy.
When you create an account
We collect your name, your email address and a password. Your password is stored only as a one-way hash, so we can’t read it. We also record when your account was created and when you confirmed your email address.
We use your email address to confirm it’s yours, to let you reset your password and to send you messages about your account. We don’t send newsletters or marketing.
When someone creates an account, we receive a notification email with their first name and whether they signed up by email or with Google or Apple. It doesn’t include their email address.
The registration form uses Cloudflare Turnstile to check that you’re a person and not a bot. Turnstile runs only on that page. It looks at technical details from your browser and device, and Cloudflare uses them only to decide whether the request is from a bot. We don’t receive or keep any of it. You can read Cloudflare’s Turnstile privacy addendum.
Each IP address can create only a few accounts an hour. The IP address isn’t stored with your account.
When you sign in with Google or Apple
If you choose to sign in with Google or Apple, they tell us your name, your email address and an ID for your account with them. We use these only to create your Hillbound account and sign you in. If you use Apple’s Hide My Email, we receive a relay address instead of your real one. We don’t receive your password or anything else from your Google or Apple account.
When you log your ascents
When you log an ascent, we store the hill, the date you climbed it and any notes or route you add. Each ascent is private (“Only me”) unless you mark it public.
At the moment, public ascents aren’t shown to anyone else. If we start showing them, we’ll update this policy first.
When you use account security features
If you turn on two-factor authentication, we store an encrypted secret and recovery codes. If you add a passkey, we store its public key and a name for it. Your device keeps the private key, and it never reaches us.
While you’re signed in, we keep a session record with your IP address and browser type. This record lets us keep you signed in, and it’s deleted when the session expires.
If you sign in from an app, we store an access token and the device name the app gives us. You can revoke the token by signing out or deleting your account.
When you email us
If you email us, we receive your email address, your name if you include it, and your message. We use these only to reply and to keep a record of our correspondence. We keep that correspondence for two years, unless we need it longer to meet a legal obligation or to establish or defend a legal claim.
Why we use it and our lawful basis
- Providing your account. Holding your account details and ascents, and sending account emails, is necessary to provide the service you signed up for.
- Operating and securing the website. Server logs, rate limits, Turnstile, sessions and the sign-up notification email are based on our legitimate interest in running a reliable, secure website that isn’t abused.
- Visit statistics. Our legitimate interest in understanding how the website is used, so we can improve it. Fathom doesn’t identify you, so the effect on your privacy is minimal.
- Responding to enquiries. Our legitimate interest in answering messages sent to us.
- Legal obligations. Where we must keep or disclose information by law.
Who we share it with
We use a small number of service providers. Each one processes personal data on our behalf under contract, and only to provide its service to us:
- Laravel Cloud (Laravel Holdings Inc.) hosts the website and its database. Cloudflare, Inc. handles our domain and network traffic.
- Cloudflare, Inc. also provides Turnstile on the registration form.
- Resend (Plus Five Five, Inc.) sends our account emails.
- Fathom Analytics (Conva Ventures Inc.) provides our visit statistics.
- Google Workspace (Google LLC) handles email you send us.
- Google and Apple handle sign-in, but only if you choose to sign in with them.
Maps are loaded through our own server, so your browser doesn’t contact Ordnance Survey and they don’t receive your IP address. Fonts and our own scripts are also served from our website. The only third-party scripts are Fathom’s, on every page, and Turnstile, on the registration form.
We don’t sell personal data. We disclose it to others only where the law requires us to.
International transfers
Your account data is stored in London, in the United Kingdom. Several of our service providers are based in the United States, and Fathom is based in Canada. Data may pass through other countries on its way to you, for example in emails. Where data is transferred outside the UK, we rely on UK adequacy regulations, including those for Canada and the UK Extension to the EU–US Data Privacy Framework. Where those don’t apply, we rely on appropriate safeguards such as the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses.
How long we keep it
- Unconfirmed accounts are deleted automatically 7 days after sign-up if the email address hasn’t been confirmed.
- Your account is kept until you delete it. You can delete it at any time from your settings. Deleting it immediately removes your details, ascents, passkeys, linked Google or Apple sign-ins and app access tokens.
- Backups of the database are kept for one day, so deleted data is gone from our backups within a day.
- Sessions expire after two hours of inactivity, unless you chose “Remember me” when you signed in.
Cookies and similar technologies
Hillbound uses only these cookies, and all of them are strictly necessary:
- a session cookie that keeps you signed in and remembers what you were doing on a form;
- a security cookie that protects forms from cross-site request forgery;
- a “remember me” cookie, set only if you tick that box when you sign in.
Your browser also stores your light or dark mode preference on your device. It isn’t sent to us.
Our visit statistics (see above) don’t use cookies or store anything on your device. We don’t use advertising pixels, embedded social media or other tracking technologies. Strictly necessary cookies don’t need consent, so there’s no cookie banner. If we ever add anything that does need consent, we’ll update this policy first and ask you, as the Privacy and Electronic Communications Regulations require.
Your rights
Under UK data protection law, including UK GDPR, you have the right to:
- access the personal data we hold about you;
- have inaccurate data corrected (you can change your name and email address yourself in your settings);
- have your data erased (you can delete your account yourself in your settings);
- restrict how we use your data;
- object to processing based on our legitimate interests;
- receive your data in a portable format.
To exercise any of these rights, email [email protected]. We’ll respond within one month. There’s normally no charge.
Children
Hillbound isn’t intended for children under 13. Please don’t create an account if you’re under 13.
Complaints
If you’re unhappy with how we’ve handled your data, please contact us first so we can try to put it right. You also have the right to complain to the Information Commissioner’s Office, the UK supervisory authority for data protection: ico.org.uk/make-a-complaint, or 0303 123 1113.
Changes to this policy
When our practices change, we’ll update this policy and the date at the top of the page. If a change significantly affects how we use your account data, we’ll also email you before it takes effect.
Contact
Privacy enquiries: [email protected].
Postal address: 4 Back Lane, Brown Edge, Staffordshire, ST6 8QS.