Privacy

What stays on the phone

Your position, the track of every walk you record, saved plans, your measured pace, the summit log and the maps you download live in the app’s own storage, on your phone.

The account does not upload them. We have no server that reads them and we keep no copy: uninstall the app and they go with it, account or no account.

The account

Using the app means making an account. No password, in three ways: with Apple, with Google, or with a six-digit code sent to your email. We hold no passwords because we ask you for none.

What we hold: your email address, the method you signed in with, when the account was made and when you last signed in, which tier you are on, and — if you set one — a name. Nothing else.

The name is the only thing in the account anybody else sees, and only if you open a live link: it is what that page says instead of “Somebody is on the mountain”. You can leave it empty.

With Apple: we receive an identifier and an email address, and the name only on the very first sign-in. Choose “Hide My Email” and what we receive is Apple’s relay address, not yours. With Google: we receive the account identifier, the email address and the name on it. We do not ask for and do not receive contacts, calendar, photos or anything else.

Accounts live at Supabase, on AWS infrastructure in Ireland (eu-west-1). The email carrying your sign-in code goes out through the same provider’s email service.

You delete the account inside the app, from the “Contul tău” screen, in two taps. It goes immediately and permanently, name and all. You do not have to write to us and you do not have to visit a website. What the phone holds is not the account’s and stays where it is.

What leaves the phone

Besides signing in, above, three things:

• The coordinates of the route you are planning go to api.open-meteo.com, so the forecast can be for the points of that route. They are the coordinates of the drawn line, rounded to four decimals, not a feed of where you are. Open-Meteo is operated from Switzerland; its terms are at open-meteo.com/en/terms.
• A map request goes to packs.mountiq.app, hosted on Cloudflare R2. The server sees an IP address and which massif was asked for, as any file download does. It does not see who you are, because there is nothing to tell it.
• The update check goes to Expo’s servers (u.expo.dev) and carries the app version and the platform.

The forecast is fetched for the route on screen. Plan a walk in the Retezat from your kitchen and Retezat coordinates are what Open-Meteo receives, not your kitchen.

A fourth thing leaves only if you switch it on, and it has its own section below.

The live link, if you open one

On the walk screen you can create a link and send it to whoever you choose, for as long as the walk lasts. It is the only thing in the app that sends where you are. It is off to begin with, it never switches itself on, and it closes when you stop the walk.

While it is open the phone sends to mountiq.app, every few minutes: the positions since the last send, their time and altitude, and — if you had planned a route — its line, its distance, its ascent and the hour you were expected back.

The link carries a 22-character code generated at random on our server. Whoever holds the link sees the page; whoever does not cannot guess it. The code is not tied to your account: on the server the track has no account against it, no email address of yours and no device identifier. The one thing that crosses over from the account is the name, if you set one, because that is exactly what it is for.

How long positions are kept, and why there are two clocks:

• 48 hours from the last position, if you stopped the walk — which is you saying you are back. The link is already closed; the positions stay a couple of days only so you can look at your own day.
• 30 days from the last position, if you never stopped it. This is the case the feature exists for: a phone that went quiet and a walker who never said they were down is exactly the situation where somebody will ask, possibly days later, where the last signal was. Deleting that on the 48-hour clock would destroy the only record at the moment it is wanted.

You can close the link and delete the positions on the spot, from the same screen. A sweep runs every night and deletes everything past the clocks above, whether or not anybody read the page.

If the person watching has the app and asks to be told, their phone gives us a push token. It is a device identifier, the only one in the whole feature, which is why it lives inside the track it follows: it is deleted with the track, on the same two clocks, or straight away if they turn notifications off. It is used for three messages and nothing else: they got back, their phone has been quiet for two hours, or they are past the hour they were due back.

Those messages travel through Expo’s push service (exp.host) and then through Apple, as every notification on an iPhone does. What they see is the token and the text — the name the walker typed, if they typed one, and one of the three sentences above. No position ever passes through them.

Positions are stored with Vercel Inc. (Vercel Blob), the same provider that hosts the site. They go nowhere else, they are not counted, and they are not used for anything else.

What we do not do

The app has no analytics. No advertising SDK, no tracking pixel, no third-party tracker, and it does not read the phone’s advertising identifier.

We do not sell or rent data. We do not build profiles. The email address on the account is there so that you have an account and for nothing else: no newsletter from us, and nobody else gets it.

The permissions, and what they are for

• Location while the app is open: for your position on the map, the turnaround time, and the alert when you have left the route.
• Location in the background, only while you are recording a walk: without it the turnaround and the wrong-turn alert stop when the screen goes dark, which is precisely when you need them. It ends by itself when you stop recording. It is also what feeds the live link, if you opened one.
• Notifications: the turnaround alarm and the storm alarm. They are the only notifications the app sends.
• Motion and fitness: for the step count that corrects distance when GPS is weak, under a ridge or in forest.

Every one of them can be refused. The app keeps working and tells you, in words, what it can no longer do.

The waiting list on this site

If you leave your email address on mountiq.app we keep it to write to you once, when the beta opens. It is stored with Vercel Inc. (USA) and goes to nobody else.

Write to [email protected] and we delete it, without asking why.

Your rights

You have the right of access, rectification, erasure, portability and objection under the GDPR.

The account is deleted from inside the app, on the “Contul tău” screen, without asking us. For what the phone holds, erasure is exercised by uninstalling the app — and that is not a polite formula: there genuinely is no copy of ours to delete.

Controller: DIVEX S.R.L., Romania. Contact: [email protected]. If our answer does not satisfy you, you may complain to ANSPDCP, the Romanian supervisory authority.

Children

The app is not directed at children under 13 and does not knowingly collect data from them.

Changes

When something changes, the date at the top changes with it. If the change is about what leaves the phone, we say so in the app too, not only here.