Privacy Policy — TMB Planner

TMB Planner ("we", "us", "our") is operated by HikingFriends DK, Copenhagen, Denmark. This policy explains what data we collect, why, and how we protect it.

1. Data We Collect

a) Newsletter signup

Email address, subscription date, and source (website).

b) Booking assistance form

Name, email, preferred trek dates, group size, fitness level, accommodation preference, and any additional notes you provide.

c) Itinerary / booking request (from the Planner)

Name, email, group size, message, and your custom itinerary data (stages, refuges, distances, elevation, notes).

d) Consulting enquiries

When you email us to book a consulting session, we store the information you share (name, email, trek details). Payment is arranged directly — we do not process card details on our site.

e) Fitness Test

Your answers are processed entirely in your browser. No quiz data is sent to our servers.

f) Interactive Planner

Your itinerary is saved in your browser's local storage. It is only sent to us if you explicitly submit a booking request.

2. Why We Collect It

To respond to your booking or consulting enquiry
To send newsletters you opted into (unsubscribe any time)
To improve our planning tools and content
To communicate about your upcoming trek logistics

We do not sell, rent, or share your personal data with third parties for marketing purposes.

3. Third-Party Services

Supabase — database hosting (EU region). Stores form submissions and newsletter subscriptions. Protected by row-level security.
Mapbox — interactive maps in the Planner. Map tile requests are sent to Mapbox servers. See Mapbox Privacy Policy.
Vercel — website hosting. Standard server logs (IP, user-agent) are retained briefly for security.

4. Cookies & Local Storage

We do not use tracking cookies, analytics pixels, or advertising trackers.

We use browser localStorage for two items:

tmb-planner-onboarded — remembers that you completed the planner setup
tmb-planner-itinerary — saves your custom itinerary in your browser

These never leave your device unless you submit a request.

5. Data Retention

We keep form submissions for as long as needed to fulfil your request and for up to 12 months afterwards for follow-up. Newsletter subscriptions are retained until you unsubscribe. You can request deletion of your data at any time by emailing us.

6. Your Rights

Under GDPR, you have the right to:

Access the personal data we hold about you
Correct inaccurate data
Request deletion of your data
Withdraw consent (e.g. unsubscribe from newsletters)
Lodge a complaint with the Danish Data Protection Agency (Datatilsynet)

Email info@hikingfriends.dk and we will respond within 30 days.

7. Security

All data is transmitted over HTTPS. Our database uses row-level security and encrypted connections. We do not store passwords or payment card details.

8. Changes to This Policy

We may update this policy from time to time. The "last updated" date at the top will reflect any changes.