← Back to Highpoints

Privacy Policy

Last updated: 14 August 2026 · highpoints.org

This policy describes how Highpoints (“we”, “us”) handles information when you use highpoints.org and related services.

Who we are

Highpoints is operated at highpoints.org. For privacy questions contact kier@highpoints.org.

What we collect

• Account data — username you choose, a hashed password, and an optional hashed recovery code if you create or regenerate one. We do not require an email address to create an account.
• Session data — an HttpOnly cookie (hp_session) so you stay logged in. Adding Highpoints to your home screen (installable web app) uses the same site and cookie; the service worker does not store extra personal data.
• Access status — whether your account has paid map access, account creation time, and active sessions.
• Payment data — checkout and billing are handled by Stripe. We receive confirmation that payment completed (e.g. session id, amount, currency) but not your full card number.
• Acquisition survey — after checkout, we may ask where you heard about Highpoints (e.g. Instagram, TikTok, Reddit). Your answer is stored with your account.
• Analytics — privacy-friendly page analytics via GoatCounter (no ad tracking; see GoatCounter privacy).
• Technical logs — our host (Cloudflare) may process IP address, browser type, and request metadata for security and delivery.

How we use data

• Provide accounts, authentication, and map/data access.
• Process lifetime purchases and prevent abuse (rate limits, fraud prevention).
• Understand how customers discover Highpoints via optional post-checkout survey responses.
• Operate, secure, and improve the service.
• Comply with legal obligations (e.g. tax and payment records).

Legal basis (EEA/UK)

Where GDPR applies, we rely on: contract (providing the service you signed up for), legitimate interests (security, analytics, abuse prevention), and legal obligation (tax/accounting where required).

Sharing

We do not sell your personal data. We share data only with service providers needed to run Highpoints (hosting, payments, analytics) under their own privacy terms, or when required by law.

Retention

Account data is kept while your account exists. Payment records and survey responses are kept as long as needed for tax, disputes, and service improvement. Session tokens expire automatically. You may ask us to delete your account by email.

Security

Passwords are stored hashed. Map data files require a valid logged-in session with access. No method of transmission over the internet is 100% secure.

Your rights

Depending on where you live, you may have rights to access, correct, delete, or restrict use of your data, or to object to certain processing. Contact kier@highpoints.org. You may also lodge a complaint with your local data protection authority.

Children

Highpoints is not directed at children under 16. We do not knowingly collect data from children.

Changes

We may update this policy. The “Last updated” date at the top will change when we do. Continued use after changes means you accept the updated policy.

Contact

kier@highpoints.org