Privacy Policy

This Privacy Policy explains what personal data Upfell collects, how and why we use it, who we share it with, how long we keep it and the rights you have. It applies to the Upfell mobile application and related services (the “App”). Please read it alongside our Terms and Conditions.

1. Who we are

• Upfell is an app made and run in the United Kingdom. It isn’t a registered company: in this policy “Upfell”, “we” and “us” mean the people who build and run it, and together we are the controller of the personal data described here.
• For any privacy question, or to exercise your rights, contact us at support@upfell.app. If you need a postal address for a formal request, ask and we will give you one.

2. The data we collect

Data you give us

• Account details: name, email address and date of birth. We sign you in with a one-time code sent to your email, so we don't hold a password.
• Profile information you choose to add, such as a username, photo or bio.
• Content you create: summit captures, photos, posts, comments and direct messages.
• Anything you send us, for example when you contact us or report content.

Data we collect automatically when you use the App

• Precise location (GPS), collected while the App is open, to confirm you are within range of a summit, to show where you are on the map and to show your coordinates on the emergency screen. See section 4.
• Device and technical data: device model, operating system, app version and a push notification token.
• Diagnostic data: crash reports and performance data.

3. How we use your data and our lawful basis

Under UK data protection law we must have a lawful basis for each use of your personal data. The list below sets these out.

• Why: Creating and running your account. Data: Name, email, date of birth. Lawful basis: Performance of our contract with you.
• Why: Verifying summit captures. Data: Precise location, capture time. Lawful basis: Our contract with you, and our legitimate interest in accurate scoring.
• Why: Community features for walkers aged 18 and over (feed, friends, leaderboards, teams, messages). Data: Profile, captures, posts, messages. Lawful basis: Our contract with you, and your consent where you choose to share.
• Why: Keeping the community safe and moderating content, including automatic checks on photos and text. Data: Posts, photos, messages, reports, account data. Lawful basis: Our legitimate interest in a safe service, and legal obligations.
• Why: The emergency feature. Data: Precise location. Lawful basis: Our legitimate interest, and your vital interests in an emergency.
• Why: Fixing crashes and problems. Data: Device data, crash reports, performance data, your user ID. Lawful basis: Our legitimate interest in keeping the App working.
• Why: Service emails such as sign-in codes, and marketing emails if you opt in. Data: Email, your marketing choice. Lawful basis: Our contract with you for service emails, and your consent for marketing.
• Why: Meeting legal and regulatory duties. Data: Relevant account data. Lawful basis: Compliance with a legal obligation.
• Why: Protecting against cheating and misuse. Data: Account, device and capture data. Lawful basis: Our legitimate interest in protecting the service.
• Where we rely on your consent, for example for marketing emails, you can withdraw it at any time without affecting earlier processing. You can turn marketing emails on or off in the App's settings.
• Where we rely on legitimate interests, we have balanced those interests against your rights, and you can object at any time (see section 8).

4. Location data

Location is central to how Upfell works, so we treat it with particular care.

• We collect precise location only while you are actively using the App, to confirm you are within range of a summit when you live capture, to show where you are on the map, and to show your coordinates on the emergency screen. We do not track your location in the background. Directions to a trailhead open in your own maps app, which handles your location under its own privacy policy.
• You control location permission through your device settings and can turn it off at any time. If you do, live capture and some features will not work, but you can still use manual logging and other parts of the App.
• For users under 18, location is not used to build a profile of them or for marketing, in line with the ICO Children’s code.
• The emergency screen may display your coordinates for you to share with the emergency services. Coordinates depend on your device and signal and may be inaccurate. This is not a tracking or rescue service.

5. Direct messages and your content

• Direct messages are private between the people in the conversation. We do not read them routinely, but we may access content, including messages, where we reasonably need to for safety, to investigate a report, to comply with the law, or to respond to a lawful request.
• Content you share is visible to others in line with your privacy settings and the feature you use, for example a leaderboard, a team or the community feed.

6. Who we share your data with

• Service providers who process data on our behalf under contract. They may only use the data to provide their service to us, and must protect it to the standard this policy and the law require.
• Neon hosts our database.
• Cloudflare stores photos and runs automatic checks on uploaded photos for harmful content.
• Sentry receives crash reports and performance data.
• Expo sends push notifications and app updates. A notification can include the text of a message sent to you.
• Mapbox provides the maps. Its software sends Mapbox limited technical data when the map loads.
• Plunk sends sign-in codes and, if you opt in, marketing emails.
• OpenWeatherMap provides fell forecasts. It receives the fell's location, not yours.
• Other users, to the extent your profile, captures, posts and rankings are shared through the features you use and your privacy settings.
• Local businesses, in future, only where you choose to redeem a reward, and only the information needed to do so.
• Authorities, regulators or advisers, where we are required to share data by law, or to establish, exercise or defend legal claims, or to protect the safety of our users or others.
• We do not sell your personal data.

7. Storing and transferring your data

• We keep your data for as long as your account is active. If you delete your account, we delete your personal data straight away. If a provider is unavailable when you delete your account, we keep retrying until your photos and email address are removed from their systems.
• We keep reports about content and the moderation decisions taken on them after an account is deleted, including a copy of the reported content and the names involved. We need these to deal with repeat abuse and keep the community safe.
• Some of our providers may process data outside the UK. This includes the United States. Where they do, we make sure an appropriate safeguard is in place, such as UK adequacy regulations or the International Data Transfer Agreement.
• We use appropriate technical and organisational measures to protect your data, including encryption in transit, access controls and secure hosting. No system is completely secure, but we work to protect your information and to respond properly if something goes wrong.

8. Your rights

Under UK data protection law you have the right to:

• be informed about how we use your data, which is the purpose of this policy;
• access a copy of the data we hold about you;
• have inaccurate data corrected;
• have your data erased, in certain circumstances;
• restrict or object to how we use your data, including profiling based on legitimate interests;
• data portability, to receive certain data in a portable format;
• withdraw consent at any time, where we rely on consent.
• To exercise any right, contact support@upfell.app. We will respond within one month, and there is normally no charge. We may need to verify your identity first.
• If you are unhappy with how we handle your data, you can complain to the ICO at ico.org.uk, or by post to Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF. We would ask you to contact us first so we can try to put things right.

9. Deleting your account and data

• You can delete your account and personal data at any time from within the App: open Settings and tap Delete Account. This removes your personal data, except the moderation records described in section 7 and anything we are required by law to keep.

10. Children

• The App is for people aged 13 and over. We ask for your date of birth when you sign up, and we do not create accounts for children under 13.
• If you are under 18, you should have the involvement of a parent or guardian. In line with the ICO Children’s code, community features (the feed, friends, messages, teams and leaderboards) are switched off, and other walkers can't find or view your profile.
• If we learn that we hold data about a child under 13, we will delete it. If you believe a child under 13 has given us their data, contact support@upfell.app.

11. Tracking and analytics

• We don't use analytics or advertising tools in the App, and we don't track you across other companies' apps or websites.
• We use Sentry to collect crash reports and performance data so we can fix problems. These are linked to your user ID, but not your name or email address.

12. Changes to this policy

• We may update this policy from time to time. If we make significant changes, we will take reasonable steps to tell you, for example within the App. The date at the top shows when it was last updated.

13. Contact us

• For any question about this policy or your data, contact support@upfell.app.