Last updated: 8 November 2026
Ridgeflow is a route-planning app for hiking, trail running and camping, worldwide. This page says what the app keeps on your device, what reaches us, who else sees it, how long we keep it, and how to delete it.
You need an account to use Ridgeflow, and a new account starts a 7-day trial once you add a card. You are not charged until the trial ends, and you can cancel before then. Two things open without an account: a route someone shares with you, and our demo walk (one track on the map, view only). Until you sign in, the app sends us no account data. It may send the anonymous usage and error reports described below.
Downloaded offline maps never leave your device. They are held in your browser or app storage and we keep no copy. Clearing your browser data or uninstalling the app deletes them.
Your account is stored for us by Supabase, our database provider. It holds:
Payment is handled by Stripe. We never see or store your card number. We keep your subscription status, a Stripe customer reference, and a record of each payment event Stripe sends us (amount, currency, plan, and for a failed payment the attempt number and the bank's decline code). Payment records are kept for accounting even after an account is deleted, without the link to your account.
We send email through Resend. Some of it is part of having an account and cannot be switched off: sign-in and password-reset codes, payment receipts with your invoice, a notice when a payment fails, and confirmation when a subscription is cancelled. We may also send account notices, such as your trial ending soon or an annual renewal coming up. Every one of those has a one-click unsubscribe link, and you can turn them off in Account. Resend tells us whether a message was delivered, bounced or marked as spam, so we stop writing to addresses that do not work. If you tap Email me this trip, we send that trip to your own address, once, with a PDF of it. We add the trip to your saved routes, so the link in the email can open it again; you can delete it there. We also keep a count of how many you sent, to limit how many go out in a day. If you add safety details (who is going, your vehicle, phone numbers), they go into that email and its PDF only: we do not store them, and we send them to no one but you. So you need not type them again, the app remembers them on this device, for your account only, except the alarm time; signing out deletes them.
The app uses your device's location to show where you are, guide you along a route, record a trip and measure distances. That happens on your device. Your location reaches us only when:
To plan a route or fetch a forecast, the coordinates involved are sent to the routing and weather services listed below. The app works without location access: you can deny the permission and use the map by hand.
Your country. When you open the app signed in, we save on your account the country your internet connection is in, as our host Cloudflare reports it. It is only the country, never your position, and we do not keep your IP address. We use it to see where our members are. If you switch off usage reports on the Help page, we stop saving it.
The app sends anonymous usage and error reports so we can see when something is broken. Examples are the app opening, how far down the welcome page you read, whether its film played and which button you tapped, a step of sign-up or checkout being reached or failing, an error inside the app, and how long the map took to answer after you moved it or tapped a place (a time only, never where). A report carries a short event name, a number, the app version, the kind of device, the country your network reports, your unit setting, which page you were on, and the name of the website that sent you here, if one did (its name only, never the full address). If a campground or holiday park's link sent you, it also says which park, and whether you came from its poster, its email or its page. It carries no account id, no email address, no name, no location and no route. Error text is cleaned of anything that looks like an address or an email first. Each device has a random id that we store only in a scrambled form, so it can be counted but not traced to you. Reports made with no signal wait on your device and are sent later. We keep them for 90 days. You can switch them off on the Help page, which also deletes anything waiting to be sent.
If you use Report a problem, we receive your message, what it is about (the app, a track, a place or a route), the app version and the kind of device. Your location is included only if you tick the box. A report has no account id or email address, so we cannot reply to it. Only we read reports, and we keep them for up to a year.
Email sent to [email protected] is forwarded to the person who runs Ridgeflow. It is also stored in our support system, on Cloudflare, with any reply we send, so we can follow up.
An AI assistant reads each message to help answer it. It is Claude, made by Anthropic, and it sees your message and the facts it needs about your account (such as whether you are in a trial). For a simple question about using the app it may send the reply itself, signed Eve, our assistant. A person always answers questions about payments, refunds, deleting an account, legal matters and safety on a trail. Anthropic uses your message only to write the reply, not to train its models.
We keep support email until you ask us to delete it.
You can delete your account and all associated cloud data at any time from the app (Account → Delete account). Any subscription is cancelled first, so you are not charged again. If you ask us by email instead, we delete it for you and keep a copy for 30 days in case the deletion was a mistake, then delete that copy. Payment records stay without the link to your account, as above.
We do not sell your data, and we do not share it with other companies, apart from what our server tells Meta when a Ridgeflow ad brought you here (see Measuring our ads, below).
Friends are optional. Other people see only what you choose:
The app keeps these in your browser or app storage: offline map packs, cached map tiles, trail and place data, weather, your settings, saved routes and spots (also synced if you are signed in), trips while they are being recorded, your sign-in session, problem reports and usage reports waiting to be sent, and a random device id. Clearing the site's data removes all of it from the device.
Track, hut and campsite data from OpenStreetMap (ODbL), park agencies and, in New Zealand, the Department of Conservation (CC-BY 4.0) is published with the app. These services may log your IP address and the places or queries you request. Their own policies apply.
To find and fix problems quickly, the app and website may record a replay of how you use them: the screens you see, where you tap and scroll, and any errors. A recording also carries the same named steps as our usage reports, such as "sign-in card shown" or "checkout started", so we can see where people stop. The map is never recorded, because it shows where you are. Anything you type is hidden before it leaves your device, including your email address. If you are signed in, a recording is linked to your account number, never your email, so we can match it to a problem you report. We use PostHog to store recordings, on its servers in Frankfurt, Germany. PostHog processes them only for us. Requests go through our own servers, so PostHog does not receive your IP address. Page addresses are cut back to the page itself before anything is sent, because the map writes its position into the address. We keep recordings for 30 days. In Europe and the UK we ask before recording anything. You can turn recordings off on the Help page.
Ridgeflow advertises on Facebook and Instagram. To learn whether those ads bring people who sign up, our server tells Meta about two steps: when you create an account, and when you start a trial. It does this only if a Ridgeflow ad on Facebook or Instagram brought you here. It sends Meta a one-way hash of your email address (a scrambled code that Meta can match to its own accounts but cannot turn back into your address), the ad click id that Meta added to the link you tapped, the time, and, for a new account, the kind of browser you used. For a trial it also says the trial costs 0. Nothing else is sent: no name, no location, no routes and no IP address. The click id is kept in your browser and on your account for this purpose only. If you switch off usage reports on the Help page, the click id is deleted from your browser and is not sent with a later sign-up. Meta's own privacy policy covers what it receives.
The Meta Pixel. If a Ridgeflow ad on Facebook or Instagram brought you here, the welcome and pricing pages also load the Meta Pixel, a small script from Meta. It tells Meta when you open one of those pages, read half of the welcome page, or tap a button to start. Meta uses this to show our ads to people more likely to sign up. The pixel sets a Meta cookie (_fbp) and sends Meta the page address, your IP address and browser details, as any script from Meta does. It does not run in the app, so it never sees your map, your routes, your location or anything you type. It does not load for anyone who did not come from a Meta ad, and it does not load in Europe or the UK. If you switch off usage reports on the Help page, it no longer loads.
Ridgeflow shows no ads inside the app. Apart from the Meta Pixel for visitors from our ads and the ad measurement described above, we measure the app in three ways: our own usage and error reports and the screen recordings, described above, and Cloudflare Web Analytics, which Cloudflare adds to every page we serve. Cloudflare Web Analytics sets no cookies and does not follow you to other websites. For each page view it records the page, the website that sent you, your browser and device type, your country, and how fast the page loaded. We use both to find and fix problems quickly. Supabase stores a sign-in token in your browser so that you stay signed in.
Pages for campgrounds and holiday parks. We make a page and a poster for each park we work with (at ridgeflow.camp/kit/), and an email we send a park carries one small picture from that page. When the page or the poster opens, or a mail app loads that picture, we record which park it was, when, the kind of browser or mail app in one word, and a scrambled id made from the network address and the day, so one visit counts once a day. We never store the network address itself. We use this to learn whether a park got our email and looked at its page.
The app is not directed at children under 13 and does not knowingly collect data from children.
You can ask to see, correct or delete the data we hold about you at any time, from the app (Account → Delete account) or by emailing [email protected].
We will update this page when what the app collects changes. The date at the top shows the last change.
Questions about this policy: [email protected]