1. Who we are
The Munro Companion is developed and operated by Paul Dickenson, who is the data controller for the personal data described here.
- Postal address: 1 Bannel Head, Windermere Road, Kendal, Cumbria, LA9 5SA, United Kingdom
- Email: support@munrocompanion.co.uk
2. What we collect and why
Most of what the app knows about you stays on your device. The categories below say where each kind of data lives and who can see it.
Location, on your device
The app uses your precise location (GPS position and altitude) to show nearby Munros, guide you along a route, warn you when you leave it, and record your walk. Location is used only while the app is open, or in the background during a walk you have started tracking. You can stop tracking at any time. Location permission is requested through iOS and can be withdrawn in the Settings app.
Your Companion Account
Signing in is optional. If you sign in, we create a Companion Account using Sign in with Apple. We request no name and no email address from Apple; Apple gives us a stable private identifier for you and nothing else; our server issues its own random account identifier, and that is what links the account data below to you.
Completions, walks and tracks
When you log a Munro you may add a date, notes, a star rating, weather conditions, companions and photos. A tracked walk records your GPS trace, distance, ascent, duration and pace. This data is stored on your device and, if you are signed in, in your Companion Account so it can be restored and synced.
Shared completions
Sharing is off unless you turn it on for a completion. A shared completion shows your display name, the Munro name, date, notes, rating, photos, and, if you include it, the walk's full route and statistics. The route is shared as recorded, including where you started and finished, unless you turn on Hide start and finish, which removes the first and last 300 metres before it is shared. Shared completions are visible only to people you have accepted as followers.
Photos
Photos you attach stay in your photo library; the app stores only a reference to them. With your permission the app also looks at photos taken on the day of a walk to suggest them for a completion. A photo is uploaded only when you share the completion it belongs to, or set it as your profile picture. Uploaded photos are re-encoded first, which removes location and camera metadata.
Profile
Your profile holds a display name, an optional bio and profile picture, your preferred units, start date and target completion date. If you use social features, your display name, bio, picture, join date and the number of Munros you have completed are visible to other users.
Following and follow requests
You can ask to follow another user, and accept or decline requests to follow you. We store who follows whom, and pending requests, so the app can show the right posts to the right people. You can remove a follower or block a user at any time.
Hazard reports
During a walk you can report a hazard (for example a path closure or a dangerous crossing). A report stores the hazard type, the position you mark, any notes, the time, and your account identifier. Hazard reports are visible to every signed-in user of the app so walkers can be warned, and expire automatically after 28 days (4 days for flooding) unless other walkers confirm the hazard is still there. Other users can vote that a report is still there or has gone.
Ratings and bookmarks
If you rate a route or bookmark a Munro or route, we store that with your other app data so it can follow you between devices. Route ratings are combined into an average shown to everyone; individual ratings are not shown.
Reports and blocks
If you report a post, profile or hazard, we store what you reported and why so we can act on it. If you block someone, we store the block so their content stays hidden from you and yours from them. The person you block or report is not told who did it.
When you block someone we keep a one-way, keyed hash of their Sign in with Apple identifier, linked to your account, so your block still applies if they delete their account and create a new one. We remove it when you unblock them or delete your account.
Apple Health
If you allow it, finished walks are saved to Apple Health as hiking workouts with distance, duration, ascent and route. This is written to your own Health database on your device. The app reads Health only to avoid saving the same walk twice; nothing read from Health leaves your device.
Notifications
If you allow notifications, a device token is stored against your account so we can deliver them. It is removed when you sign out or delete your account.
Purchases
Subscriptions and one-off purchases are handled by Apple. We receive a receipt that says what you bought; we never see your payment details.
3. Who processes your data
We use a small number of providers to run the app. Each receives only what the service needs.
- Supabase (hosted in Ireland, European Union): stores Companion Account data, shared content, hazard reports, ratings, bookmarks, follows, reports and blocks, and uploaded photos. Encrypted in transit and at rest.
- Cloudflare (global network): serves this website and the map tiles the app downloads. Cloudflare receives your IP address and the tiles you request, which reveal the area of the map you are viewing. Cloudflare also runs the bot check on the launch waitlist form and stores the waitlist details you submit, as described in the launch waitlist section below.
- brouter.de (a public routing server run by a volunteer in Germany): when you use the Route Planner, the waypoints you place are sent to brouter.de to compute a walking route. If you choose your current position as a start point, that position is one of the waypoints. Nothing else about you is sent.
- Resend (United States): delivers the email that alerts the developer when a post, profile or hazard is reported. That email includes what was reported and the reason you gave.
- Apple: Sign in with Apple, Apple Maps, Apple Health, App Store purchases and notifications, all under Apple's own privacy terms.
- Open-Meteo (weather forecasts): our server fetches forecasts for summit and regional locations and the app reads them from our server. No personal data is sent to Open-Meteo; the app never contacts it directly.
We do not sell personal data, and we do not share it with anyone else except where the law requires.
Supabase and brouter.de process data in the European Union, which the UK recognises as providing adequate protection. Resend is in the United States and Cloudflare operates a global network. For those transfers we rely on each provider's data processing agreement, which includes the UK International Data Transfer Addendum to the EU standard contractual clauses, or on the UK Extension to the EU-US Data Privacy Framework where the provider is certified under it.
4. How long we keep it
- Data on your device stays until you delete it or delete the app, or use Delete Account in Settings. Companion Account data is kept while your account exists. Launch waitlist details are kept until we have sent you the launch email or you unsubscribe, and are then deleted.
- Completions, ratings, bookmarks and achievements you delete are marked deleted straight away and permanently removed by a scheduled purge after 30 days. Deleted walks and routes, which have attached track files, are marked deleted straight away and removed when you delete your account; a scheduled purge for them is being added.
- Hazard reports expire 28 days after they are made (4 days for flooding), are extended when another walker confirms them, and are removed 30 days after they expire.
- Our database is backed up daily; backups are kept for 7 days and then overwritten, so deleted data can persist in a backup for up to that long.
- Moderation reports are kept as a record of what was reported and what we did about it. If you delete your account, your identity is removed from any reports you made.
- If you delete your account, a keyed hash of your Sign in with Apple identifier may be kept for as long as another user's block of you stands, so it can be re-applied if you create an account again.
5. Deleting your data
Delete Account in Settings is immediate and cannot be undone. Used in this app, it removes this app's data: your completions, walks, routes, ratings, bookmarks and achievements, your hazard reports and your votes on other people's, your shared posts and their photos, and the app's settings and device tokens. This is removed from your device and from our servers, and Sign in with Apple is disconnected for this app so Apple no longer lists it under your Apple ID. The bundled Munro data is restored the next time you open the app.
Your Companion Account is shared with The Wainwright Companion. While another of our apps still holds data for you, deleting from this app does not delete the account or that app's data, and your profile, follows, blocks and reactions stay.
When you delete from the last of our apps that holds your data, everything is removed from our servers, including your profile picture, profile, follows, the blocks you made, your reactions, and the Companion Account itself.
Some things outlast a deletion: our daily database backups, which are overwritten within 7 days; reports you filed about other users' content, which we keep as a moderation record with the link to you removed; and a keyed hash of your Sign in with Apple identifier, described in section 4, which may be kept for as long as another user's block of you stands.
You can also delete individual completions, walks and shared posts, and hazard reports, from within the app at any time.
6. Lawful bases
Under UK GDPR we rely on:
- Performance of a contract (our Terms of Service) to provide the app, your Companion Account, sync and social features.
- Consent for location, photo library and Apple Health access, which you give through iOS permission prompts and can withdraw at any time, and for sharing content publicly, which you choose per item, and for joining the launch waitlist.
- Legitimate interests in keeping the service safe: moderating shared content, acting on reports and blocks, preventing abuse, and keeping short-lived backups.
7. Your rights
You have the right to access the personal data we hold about you, to have it corrected (rectification), to have it deleted (erasure), to restrict or object to how we use it, and to receive a copy in a portable format (portability). Most of this you can do in the app: edit your profile and completions, unshare posts, and delete your account. For anything else, email support@munrocompanion.co.uk and we will respond within one month.
If you are unhappy with how we handle your data you can complain to the Information Commissioner's Office at ico.org.uk. If you live in the European Union you may instead contact your local data protection authority.
8. Children
The Munro Companion is rated 13+ on the App Store because social features show content posted by other users. It is not directed at children under 13, and we do not knowingly collect personal data from anyone under 13; if you believe we have, email us and we will delete it.
9. One account across our apps
The Munro Companion and The Wainwright Companion use one Companion Account. Your profile, follows and blocks are shared between the apps that keep their social features on that account; completions and walks are kept separately for each list. Deleting your account in one app removes that app's data: its completions, walks, routes, hazard reports and votes, shared posts and their photos, and its settings and device tokens. It does not delete the Companion Account or the data the other app holds, and your profile, follows, blocks and reactions stay while any other of our apps still holds data for you. When you delete from the last app that holds your data, everything is removed and the account is deleted. Data that the other app keeps only on its own device, or in that app's own iCloud data, is removed when you delete the account from that app.
10. What we do not do
- No third-party analytics, advertising or tracking SDKs, and no advertising identifiers.
- No access to your contacts, and no discovery of other users through your contacts.
- No email addresses or phone numbers, unless you choose to email us or join the launch waitlist described below.
- No selling or renting of personal data.
11. Launch Waitlist
If you join the launch waitlist on our website, we store the email address, and the name if you give one, that you submit, together with the time, the page you submitted it from, the platform you signed up for (iOS) and a record that you ticked the consent box. We use it solely to email you when The Munro Companion is available on the App Store. Submissions are checked with Cloudflare Turnstile, a bot-detection challenge, to prevent spam signups; no personal data is shared with Cloudflare beyond what a normal web request already includes, such as your IP address.
Waitlist details are stored in a Cloudflare storage service, separately from any in-app account data, and are not linked to a Companion Account. We hold them on the basis of your consent, until we have sent the launch email or you unsubscribe, and then delete them. You can unsubscribe, or ask us to delete your details, at any time by emailing support@munrocompanion.co.uk. We never use waitlist details for any purpose beyond the launch notification.
12. Changes to this policy
We may update this policy as the app changes. The date at the top shows the current version, and material changes are announced in the app's What's New. We will tell you about material changes in the app before they take effect.
13. Contact
Questions about this policy or your data: support@munrocompanion.co.uk, or write to Paul Dickenson, 1 Bannel Head, Windermere Road, Kendal, Cumbria, LA9 5SA, United Kingdom.