Privacy Policy

1. Who is responsible (Data Controller)

The controller of your personal data is UtPost, operated as a sole trader based in Norway. For general questions, contact us at hello@utpost.app; to exercise your privacy rights (section 9), email privacy@utpost.app.

2. What we collect

We collect different data depending on how you use UtPost.

a) When you join the waitlist — your email address, the time you submitted it and the version of this policy you consented to, and how you reached us (e.g. invite source), where available.

b) When you are a member— account identity (email, display name, authentication details via Supabase Auth; a third-party provider’s identifier if you sign in through one); invitation and vouch relationships (who invited you and who you invite); and reputation, rank, and activity data within the club.

c) When you submit content — pins you create (camp spots, routes, gates, crossings, obstacles, staging), including their location coordinates; notes, descriptions, and photos. Photos you upload may contain embedded location (GPS) and timestamp data (EXIF); we do not currently remove this metadata, so avoid uploading images whose embedded location you would not want other members to see. A pin’s location comes from the point you place on the map, not from photo metadata.

d) Collected automatically — technical data such as IP address, device and browser information, and request logs generated by our infrastructure providers for security and operation.

3. Why we use it, and our legal basis

Under the GDPR we must have a lawful basis for each purpose: processing your access request (waitlist email) on the basis of consent; providing your account and the service on the basis of performance of a contract; running the community map and club on the basis of contract / legitimate interest; preventing abuse and securing the service on the basis of legitimate interest; and contacting you about access or your account on the basis of consent / contract.

You may withdraw consent at any time (section 9); this does not affect processing already carried out.

4. Who else processes your data (Sub-processors)

We rely on third parties to run UtPost: Supabase (database, auth, file storage), Vercel (hosting), Mapbox (map tiles and services), and MET Norway / Yr (weather data, receives coordinates to return forecasts). We aim to host data in the EEA. Each provider has its own privacy terms.

5. International transfers

Your core data stays within the European Economic Area: our database and file storage (Supabase) are hosted in Stockholm, Sweden, and our application hosting (Vercel) runs in the Stockholm region. Some sub-processors may process limited data (such as your IP address or map coordinates) outside the EEA — notably Mapbox in the United States. Where that happens, we rely on appropriate safeguards such as the EU Standard Contractual Clauses or an adequacy decision.

6. How long we keep it

Waitlist emails are kept until you are admitted, or for up to 12 monthsif you are not admitted or you ask us to remove them sooner — after which they are deleted automatically. Account data is kept for as long as your account is active, and a limited period afterward as required for security or legal reasons. Submitted content is retained as part of the community map per our Terms; you may request removal of your contributions (subject to section 9). Technical and security logs are kept for up to 90 days.

7. Location data — special care

Pins you submit are visible to other members of the club, not to the public. Photos can carry embedded GPS/EXIF metadata; we do not currently strip it, so an uploaded image may reveal where it was taken — share with that in mind. You control what you submit — consider the sensitivity of a location before sharing it. Although such location data is not a “special category” under the GDPR, we treat it as sensitive in practice.

8. Cookies and local storage

We use only essential cookies and local storage — for example, to keep you signed in. We do not use advertising or tracking cookies. If we add analytics in future, we will update this policy and obtain consent where required.

9. Your rights

Under the GDPR you have the right to access, rectify, erase, port, object to or restrict processing, and withdraw consent at any time. Some shared and relational content cannot simply vanish without affecting others — for example, a pin others have relied on, or your place in the invitation chain. Where erasing your data affects the community map or other members’ records, we handle your request in a way that respects both your rights and the integrity of the club (for example by anonymising rather than breaking the invite chain). To make a request, email privacy@utpost.app. You may also lodge a complaint with the Norwegian Data Protection Authority, Datatilsynet (datatilsynet.no).

10. Children

UtPost is not directed at children under 16 and we do not knowingly collect their data.

11. Changes to this policy

We may update this policy. We will revise the “last updated” date and, for material changes, notify members. Continued use after an update means you accept the revised policy.