Privacy policy

The short version

Summited is a local-first app. The logbook on your phone is the source of truth, and the app works without an account. If you create an account, your ascents sync to our servers so you can restore them and share them with people you choose. We do not run ads, we do not use analytics trackers, and we never sell your data.

Who we are

Summited is built and operated by Michael Hutchinson. For anything in this policy, contact support@michaelhutchinson.me.

What we collect when you create an account

Accounts are optional. If you sign up, we store the following in Supabase, hosted in the EU/UK:

• Your email address, or an identifier from Apple or Google if you sign in with them.
• Your display name and handle.
• An avatar and a short bio, if you choose to add them.

Your ascent log

When you are signed in, your summit ascents sync to your cloud account. Each record holds the summit, the date, and any notes or photo you attach. Photos are stored in a private bucket and are only ever served through short-lived signed URLs; there is no public link to them.

Social features

You can follow other users, like their ascents, and block or report accounts. If you set your account to private, your ascents and profile details are only visible to followers you approve.

Strava

Connecting Strava is optional. If you connect it, Summited reads your recent activities solely to suggest summits you may have reached. The only things we ever keep from that process are the date and the summit; we never store your GPS tracks or any other activity data on our servers.

Your Strava tokens are held in secure storage on your device, not on our servers. Disconnecting Strava in the app deletes the tokens, tells Strava to revoke our access, and removes any suggestions you have not confirmed. You can also revoke access at any time from your Strava settings.

Crash reporting

We use Sentry to learn about crashes. It is configured not to send personal information, and URLs in crash reports are scrubbed of tokens. There is no advertising and there are no analytics trackers in the app.

Who your data is shared with

We never sell your data. It is processed only by the services that run the app: Supabase stores your account and ascents, Sentry receives crash reports, and Strava is involved only if you connect it. Beyond that, your data is shared only as the social features you use require, for example an ascent shown to your followers.

Deleting your account

You can delete your account from inside the app. Deletion removes your cloud account and everything attached to it: your ascents, photos, avatar, and profile. The logbook on your device stays yours.

Your rights

Under UK and EU data protection law you can ask for a copy of your data, ask us to correct it, or ask us to erase it. Email support@michaelhutchinson.me and we will sort it out.

Changes to this policy

If this policy changes in a way that matters, we will update this page and the effective date at the top.