Privacy Policy
Last updated: 16 October 2026
This is a deliberately small privacy policy, because hikes.guide deliberately collects almost nothing. There are no accounts and no advertising. We set one cookie of our own, and only if you answer the Instagram question; and if you subscribe to the Fell Report we ask for an email address, which MailerLite hold to send it. To understand how the site is used we run privacy-friendly, cookieless analytics (Plausible) that collect no personal data — no cookies, no persistent identifiers, and nothing that can identify you (see Analytics). The exceptions are optional and there are two: if you choose to load Instagram photos on some pages, or to load an embedded Strava activity on one page, those companies set their own cookies — and only then, and only if you ask for it by clicking. Hikes Today, our walk-choosing app at hikes.today, works the same way: see Hikes Today, the app. This page explains exactly what does and doesn't happen with your data.
What data we collect
Almost none. You don't need to create an account or give us any personal information to use the Website. We don't ask for your name, and we only ask your browser for your location if you press a “Near me” button; it sorts the list on the page and is not sent to us. The one thing we do ask for is an email address, if and only if you subscribe to the Fell Report; we don't sell or share personal data with anyone for marketing.
Cookies
hikes.guide sets one cookie of its own, hg_consent_instagram, and only when you answer the Instagram consent question. It records your answer (granted or denied) so you are not asked again, lasts 180 days, is mirrored in your browser’s local storage, identifies nothing and is sent to no one. There are no advertising networks and nothing that places a persistent identifier on your device for our purposes. Our analytics (Plausible) is deliberately cookieless and stores no personal data (see Analytics below). The only other cookies on the site come from Instagram or Strava, and only if you choose to load their content, as described below.
Because the only non-essential cookies are opt-in, you'll only see a cookie-consent prompt on pages that actually offer Instagram photos, and only until you've made a choice. You can change or withdraw that choice at any time using the "Cookie settings" link in the footer.
Analytics
We use Plausible Analytics (opens in new tab) to understand how the site is used — which pages people read, roughly where visitors arrive from, and whether the changes we make actually help. We chose it specifically because it is privacy-friendly by design:
- No cookies and no persistent identifiers — the analytics script stores nothing on your device, and reads from it only a setting that leaves our own visits out of the counts.
- No personal data retained. According to Plausible's data policy (opens in new tab), visitor counts are derived from a daily-rotating salted hash that is discarded within 24 hours; your IP address is never stored and cannot be recovered from it.
- Approximate location only. Plausible works out a visit’s country, region and city from the connection’s IP address; the IP address itself is not stored.
- No cross-site or cross-device tracking, no advertising, and no data sold or shared with anyone.
- Only aggregate statistics are produced — never a profile of you as an individual.
- Data is collected and processed within the EU.
- Nothing after a
#. Our setup cuts the part of an address after a#from every page address and every link the analytics counts, so a fell log carried in a link between the logbook and Hikes Today is never sent.
Because Plausible sets no cookies and stores no personal data about you, it needs no consent banner under PECR or the UK GDPR; to the extent any minimal processing applies, our lawful basis is our legitimate interest in understanding and improving the site. The full detail is in Plausible's data policy (opens in new tab).
Embedded content from Instagram
Some pages — for example our Most Instagrammable Viewpoints guide — can display photographs hosted on Instagram, shown as an "Editor's favourite photo". These embeds are provided by Instagram, part of Meta Platforms, Inc.
We do not load any Instagram content until you allow it — either by choosing "Allow Instagram content" in our consent banner, or by clicking an individual "View on Instagram" card. Until then, nothing is requested from Instagram and no Instagram cookies are set.
When you do allow it, Instagram/Meta may set cookies on your device and receive your IP address, browser and device information, and the page you are viewing, in order to render the post and for Meta's own purposes. This processing is carried out by Meta as an independent controller under Meta's Privacy Policy (opens in new tab). Meta is based in the United States, so allowing this content may involve a transfer of your data outside the UK/EEA.
You can withdraw consent at any time via "Cookie settings" in the footer; this stops further Instagram content from loading (any embed already loaded on the page you're looking at may remain until you refresh).
| Category | Set when | Purpose | Controller | More |
|---|---|---|---|---|
| Embedded social media (Instagram/Meta) | You accept the banner, or click a card to load it | Display Instagram posts | Meta Platforms, Inc. | Meta's policy (opens in new tab) |
Apart from this opt-in content and the Strava map below, the only cookie on the site is our own record of your Instagram answer, as described above.
Embedded activity from Strava
One page — The perfect Wainwright round — offers an embedded map of a public Strava activity, so you can see the record holder’s actual line beside our computed one. Strava is operated by Strava, Inc.
Nothing loads from Strava unless you click it. The page shows a plain placeholder with a button; until you press it, your browser makes no request to Strava, sends them no IP address, and receives no cookies. There is no auto-loading and no pre-connecting, and ignoring the placeholder is not consent.
If you do click, your browser contacts strava-embeds.com to fetch the map. At that
point Strava can see your IP address and may set cookies, exactly as if you had visited their site
directly. That choice applies to that one embed, on that visit only — we store nothing about
it, so it is not remembered and not carried to any other page.
We never send Strava anything about you, and we receive nothing back about you. What Strava does with the request is governed by Strava’s own privacy policy (opens in new tab).
Local storage — your progress, on your device
Three things live in your browser’s localStorage, on your device, and none of them leaves it: your light-or-dark theme choice, your answer to the Instagram question (mirroring the cookie above), and your fell-bagging progress. If you use the "tick fells you've climbed" feature, your list of bagged fells is saved only in your own browser's localStorage, on your device. This data never leaves your device and is never sent to, or seen by, hikes.guide or any third party — there is no account and no server copy. It's purely functional storage that you actively request by ticking fells, so it doesn't require a consent banner under PECR. You can back it up with the Export button, and remove it at any time by clearing your browser's site data (note that doing so, or your browser evicting local storage, will erase your progress — Export first if you want to keep it).
Hikes Today, the app
Hikes Today, at hikes.today, is our app for choosing a Lake District walk for the day. Its older address, app.hikes.guide, now forwards to hikes.today. Anything you saved in the app under the old address (kept walks, your fell log, outings) stays in your browser, but hikes.today cannot read it. It works like the rest of hikes.guide: there is no account and no advertising. It asks your phone for your location only when you press “Show my position” on its “Help on the hill” screen. It shows the position on that screen and does not store it or send it anywhere. It is a separate site from hikes.guide, so what it keeps on your phone is kept apart from what hikes.guide keeps.
What stays on your phone
The app keeps these in its own storage on your phone (the browser’s localStorage and its cache for the app’s address). None of them is sent to us or to anyone else:
- your choices on Today: where you start from, your walking time and the essentials you picked;
- the walk you last opened, your saved walks with the date you saved each, and the walks you kept on the phone for no signal, with the files and photos they need;
- your fell log, with the dates you gave, the milestones it has reached, and when you last saved a backup;
- the outings you record, with the date, how it went, the summits you confirmed and any effort or note you added, and the collections you joined;
- the date you last opened the app, so it can tell, at most once a day, roughly how long it has been (see Analytics in the app, below);
- small settings: light or dark, how My fells is shown, the cards and invitations you closed, any trial features switched on for testing on that phone, and, for the “Get your first walk ready” steps, whether they apply on that phone and the days you first saw walks to choose from and first had a walk ready;
- if you opened the app from a place to stay’s guest page, which place it was, until you choose to see every walk instead.
A backup is a file you save yourself. It holds your fell log and, when you have them, your outings, collections and milestones. Restoring one, bringing your log across from hikes.guide’s logbook, or pasting in a log another fell app shares all happens on your phone; the app does not send the file or the pasted text anywhere. The link from hikes.guide carries your log after a # in the address, and the app removes it from the address as soon as it has read it. The app’s “Open my log on hikes.guide” works the same way back: the link carries your log to hikes.guide’s logbook in your browser, which removes it from the address as soon as it has read it and adds nothing until you choose Bring it in.
To remove all of it, clear the site data for hikes.today, and for app.hikes.guide if you used that address, in your browser’s settings. Clearing it deletes your fell log and outings too, so save a backup first if you want to keep them.
What the app fetches
The app fetches its walks, photos, map code and terrain files from its own address, and today’s summit conditions from hikes.guide. Both are hosted by IONOS, whose server logs are described under Server logs below. Nothing about you is added to these requests. Rate my route reads the GPX file you choose on your phone and does not send it anywhere; to rate it, the app fetches the terrain files for the ground the route crosses.
When you open a map in the app (a walk’s route, where to park, or your fells on a map), your phone fetches the map tiles directly from OpenTopoMap (opens in new tab), as the maps on hikes.guide do (see Third-party services). Like any web request, that gives OpenTopoMap your IP address and the part of the map you are looking at. The app does not keep the tiles in its own storage.
Analytics in the app
The app uses the same Plausible Analytics (opens in new tab) as the site, set up the same way: no cookies and no persistent identifier (see Analytics). Besides counting visits, it counts the events below. Each carries at most a few short labels and the app’s version number, and never your fell log, your notes or anything you type:
- Today Shortlist: how many walks were shown (none, one, two or three);
- Walk Opened: that a walk was opened; when it was opened from the shortlist, a band of how long choosing took (under 30 seconds, 30 to 60, 60 to 120, over 120, or no choice made); and when it was opened from a shared link, that it was;
- Next Three Opened: which of “Three for you today” was opened, such as “Best day out”;
- Return Visit: at most once a day, a band of days since the app was last opened on that phone (1 to 6, 7 to 13, or 14 or more);
- Fell Logged: that a fell was logged, not which one;
- Log Pasted: that a log pasted from another app was added, not what it held;
- Pack Kept: whether keeping a walk on the phone worked or failed;
- Outing Recorded: that an outing was recorded, and whether it was walked in full, shortened or turned back, not which walk;
- Collection: which of our collections was joined, paused, resumed or left;
- Route Rated: that a route was rated, and whether it lay inside the area the app has terrain for, not the route;
- Walk Shared: that a walk’s link was copied or shared, not which walk;
- Share Card and Milestone Shared: that a share card was saved or shared, its shape, whether it used a photo or a drawing, and for a milestone what kind it was (a first fell, a number of fells, all of them or an area);
- App Error: when something in the app goes wrong, the kind of error, the name of the app’s file and the line number, never the error’s message or what was on the screen; to send no more than three, the app counts them in the browser tab’s own storage;
- Guest Opened: that the app was opened from a place to stay’s guest page, and which place.
When the app is opened from a guest page, each event also carries a short code for that place and, for Walk Opened, which walk, so we can tell the place how its guests use the page. It is about the place, never about the guest.
Plausible’s script reads the address of the screen you are on. Before it sends that address, the app cuts off everything after a #, so a walk, a place to stay or a log from hikes.guide carried there never reaches Plausible. Plausible’s data policy (opens in new tab) says it stores the host and path of an address.
Sharing and directions
Nothing leaves the app unless you choose it. “Share this walk” copies a link to that walk’s page on hikes.today, or hands it to your phone’s share sheet; the link names the walk and nothing about you. A share card is an image drawn on your phone, and it goes only where you save or share it. “Directions”, where the app shows where to park, opens a Google Maps link with that parking place as the destination, which your phone may hand to its own maps app; the link carries nothing about you, and what Google Maps does from there is covered by Google’s privacy policy (opens in new tab).
Feedback, reports and route suggestions
The app has three ways to tell us something, and each is your choice. “Tell us what you think” opens a short Google Form in your browser; Google holds the answers for us under Google’s privacy policy, and you see the form’s questions before you send anything. “Something wrong on this walk?” opens your own email app with the walk’s name filled in. Rate my route can write an email suggesting your route to us: it shows you the whole text first, including where the route starts and a simplified copy of its line, with your first name only if you ask for credit. Nothing is sent until you send it. We use what you send to fix the app and its walks and to consider walks for the guide, and we delete it when you ask (see Contact below).
The Fell Report newsletter
If you subscribe to the Fell Report, the form sends your email address and the page you signed up from to MailerLite (opens in new tab), the service that stores the list and sends the emails for us. You get one email asking you to confirm; nothing is sent until you click it. Nothing else is collected with the address, and it is used for the Report and for nothing else. Every email carries an unsubscribe link. Unsubscribing stops the emails at once; MailerLite keeps the address marked as unsubscribed so it cannot be added back by mistake, and if you would like it deleted outright, ask through the Contact page and we do it. We keep an address for as long as you are subscribed, and delete it when you ask. MailerLite process the address as our processor under their own policy, linked above.
Third-party services (maps & weather)
To show maps and forecasts, your browser makes requests directly to a small number of outside services:
- Map tiles — OpenStreetMap (opens in new tab) and OpenTopoMap (opens in new tab).
- Weather — Open-Meteo (opens in new tab).
Like any web request, these may record your IP address in those services' own server logs under their respective privacy policies. They do not set cookies through this Website. We don't send them any information about you beyond the ordinary technical details of the request.
Server logs
The Website is hosted by IONOS. Standard hosting server logs (such as IP addresses and request times) may be kept by the host for security and operational purposes, in accordance with UK data-protection law — the UK GDPR and the Data Protection Act 2018. We don't use these logs to build profiles of visitors.
Your rights under UK GDPR
Because we don't hold personal data about you (no account, and no contact details unless you email us or subscribe to the Fell Report), there's normally nothing for us to look up, change or delete. If you have emailed us, you still have the usual rights under UK GDPR — to access, correct or erase any personal data we hold, to object to or restrict its processing, and to complain to the Information Commissioner's Office (ICO) (opens in new tab). To exercise any of these, get in touch (below).
How to contact us about privacy
For any privacy question or request, please use our Contact page. The Website operator is the data controller for hikes.guide.
Changes to this policy
If this policy changes, the "Last updated" date above will be revised. Given how little data is involved, we don't expect substantial changes.