Last updated: 2026-09-23
1. Who We Are
Back in Pack ("we", "us", "our") is operated by Mark Goodlad, Switzerland. We publish the Back in Pack application ("the App"), available on iOS, Android and the web.
Privacy contact: privacy@backinpack.com
Data controller (GDPR): Mark Goodlad, Switzerland
2. What Data We Collect
2.1 Account Data
- Email address
- Display name (optional)
- Profile photo (optional)
- Authentication provider (email/password, Google, Apple)
When you sign in with Apple and choose to hide your email, Apple provides a relay address. We store only what Apple provides.
If you choose a display name, we reserve it so no one else can use it, and keep a history of your previous names. Your display name and profile photo are visible to other signed-in users.
2.2 App Content Data
Data you create inside the App:
- Gear: names, descriptions, notes, weights, links, photos, and optionally purchase price, currency, purchase date, warranty and receipt photos
- Packs and pack contents, including photos
- Trips: dates, sections, routes, waypoints, shot plans, tasks, notes, and weather fetched for your locations
- Community posts and replies, with their automatic translations
- Imported data (XML/ZIP backups, GPX files, LighterPack lists). LighterPack pages are fetched by your device or, on the web, by our server.
- Shared packs: when you share a pack, anyone with the link can view it without an account, including its notes, item links and photos. Stop sharing at any time to remove it.
2.3 Location Data
This data is collected only with your explicit permission.
- Precise GPS location - used when you record a trip route or use the live tracking feature. You must grant location permission ("While Using" or "Always") before this is collected. Precision can be set to approximate in your device OS settings. Recording continues in the background while a hike is being recorded (Android shows a "Recording your hike…" notification; iOS shows the location indicator), and points are uploaded to your trip in batches while you record.
- Trip route / GPX data - GPS coordinates recorded during a trip, stored as part of your trip record in the cloud.
- Trip planning coordinates - location you enter or select when planning a trip (used to fetch weather, maps, elevation and routes; some of these services are contacted directly by your device, see 2.7).
You can withdraw location permission at any time in your device's Settings app. Revoking location access stops new location data being collected; previously recorded trip routes remain stored unless you delete them.
2.4 Health & Fitness Data
- We do not read from Apple Health, Google Fit, or any other fitness platform.
- Body measurements (optional) — only if you want the hiking analysis, you can enter your height, weight, gender, year of birth, stride length, resting energy use (BMR) and fitness level under My Measurements. They are used only to estimate hiking times, energy use and food needs for your trips, and are visible only to you. The analysis needs at least your height and weight; if you leave them blank, it is simply not available.
- You can change or clear your measurements at any time, and they are deleted when you delete your data or your account.
2.5 Device & Technical Data
- Device type, OS version, and app version (for compatibility and to check for app updates)
- Push notification token (FCM) — only if you grant notification permission
- App Check attestation token — a platform-level integrity signal (AppAttest on iOS, Play Integrity on Android, reCAPTCHA v3 on web). This token does not identify you individually.
2.6 Usage Data
- We do not use third-party analytics SDKs (e.g. Firebase Analytics, Mixpanel).
- Server logs may capture IP addresses and request metadata for security and quota management. These are retained per Google's default Firebase log retention settings.
2.7 Weather & Map Queries
Weather forecasts are fetched on your behalf by our service, so the weather provider never sees your device.
Maps, place search, elevation, hiking routes and exchange rates are loaded directly by your device from the providers listed in section 5. Those providers see your IP address and the map area or locations involved, but never your name or account details.
When you view a forecast, the location name and forecast figures are used to generate a short AI summary.
3. How We Use Your Data
| Purpose | Legal basis (GDPR) | Legal basis (other) |
|---|---|---|
| Provide and sync the App | Contract performance | Necessary for service |
| Store and display your gear, packs, and trips | Contract performance | Necessary for service |
| Estimate hiking times, energy use and food needs from the body measurements you choose to enter | Consent (you choose to enter them; clear them at any time) | Consent |
| Route planning and weather fetching | Contract performance | Necessary for service |
| Push notifications for followed threads and moderation notices | Consent (notification permission) | Consent |
| Moderate community posts for prohibited content | Legitimate interests (platform safety) | Legitimate interests |
| Translate community posts so members can read them in their language | Legitimate interests (accessible community) | Legitimate interests |
| Share a pack publicly when you ask us to | Contract performance | Necessary for service |
| Maintain the shared gear catalogue and handle deletion requests | Legitimate interests / Legal obligation | Legitimate interests / Legal obligation |
| Detect and prevent fraud / abuse | Legitimate interests (security) | Legitimate interests |
| Respond to your support requests | Contract performance / Legal obligation | Necessary for service |
| Comply with legal obligations | Legal obligation | Legal obligation |
We do not use your data for advertising, profiling for marketing, or sale to third parties.
4. Data Storage & Location
Your data is stored on Google Firebase infrastructure.
| Data | Where stored |
|---|---|
| Account, gear, packs, trips, community | EU (Belgium, Netherlands) |
| Photos and files | EU |
| Sign-in records | Global (Google-managed) |
| Server logs | Global, kept 30 days |
| Backups | EU, kept up to 28 days |
Data at rest is encrypted by Google using AES-256.
Data in transit is encrypted via TLS 1.2 or higher.
Your data is stored in the EU. Some processing runs on Google servers in the USA, including post moderation and translation, weather requests, notifications and account deletion. For this, and for Google's global sign-in infrastructure, we rely on Google's Standard Contractual Clauses (SCCs) as the legal transfer mechanism. You can review Google's data transfer commitments at firebase.google.com/support/privacy.
Australian users: Your data is stored primarily in the EU. We take reasonable steps to ensure Google LLC provides privacy protections equivalent to the Australian Privacy Principles (APPs).
5. Subprocessors
We share data with the following third-party processors:
| Subprocessor | Purpose | Data shared | Region |
|---|---|---|---|
| Google LLC - Firebase | App backend, database, sign-in, storage, push notifications | All user data | EU / USA |
| Google LLC - Gemini AI | Community post moderation and translation; weather summaries | Post text and translations (no account details); location name and forecast figures | USA |
| OpenWeather | Weather forecasts and history | Locations (no personal data) | EU |
| MapTiler AG | Maps, terrain and elevation | Map area, IP address | Switzerland / CDN |
| MapLibre | Open-source map software | None (on the web, the library is loaded from the unpkg.com CDN) | - |
| Open-Meteo | Place search and elevation | Search text, coordinates, IP address | EU |
| BRouter | Hiking route planning | Route points, IP address | Germany (EU) |
| GraphHopper | Alternative route planner (if enabled) | Route points (no personal data) | EU |
| Frankfurter API | Currency exchange rates | Currency code only | EU |
| Google LLC - Fonts | App font | IP address | Global |
| Google LLC - reCAPTCHA | Abuse protection for the web app | Browser signals | Global |
| Apple App Store / Google Play | Checking for app updates | App ID, country | Global |
| Google LLC - Forms | Data deletion request form on our website | What you enter in the form | Global |
| LighterPack | Gear list import (only if you use it) | The list URL | USA |
| Apple Inc. | Sign in with Apple | Email / relay email | USA |
| Google LLC - Sign-In | Google sign-in | Google account email and profile | USA |
We do not use advertising networks, data brokers, or social media trackers.
We will update this list when we add new subprocessors and notify users where required by applicable law.
6. Your Rights
6.1 Rights Under GDPR (EU/EEA and UK)
You have the right to:
- Access — request a copy of the personal data we hold about you
- Rectification — correct inaccurate data
- Erasure ("Right to be Forgotten") — request deletion of your personal data (see Section 7)
- Restriction — ask us to limit processing while a dispute is resolved
- Portability — receive your data in a structured, machine-readable format
- Object — object to processing based on legitimate interests
- Withdraw consent — where processing is based on consent (e.g. push notifications, location access), withdraw it at any time without affecting lawfulness of prior processing
To exercise any of these rights, email privacy@backinpack.com. We will respond within 30 days (extendable to 90 days for complex requests, with notice).
You also have the right to lodge a complaint with your local supervisory authority. UK users may contact the ICO at ico.org.uk. EU users may contact their national DPA.
6.2 Rights Under CCPA/CPRA (California, USA)
California residents have the right to:
- Know what personal information we collect and how it is used
- Delete personal information (see Section 7)
- Correct inaccurate personal information
- Opt out of the sale or sharing of personal information — we do not sell or share your personal information
- Non-discrimination for exercising your rights
To submit a California rights request, email privacy@backinpack.com or use the in-app account deletion feature.
6.3 Rights Under PIPEDA (Canada)
Canadian residents may request access to their personal data and challenge its accuracy. Contact privacy@backinpack.com.
6.4 Rights Under the Australian Privacy Act
Australian residents may request access to or correction of their personal information held by us, and may complain to the Office of the Australian Information Commissioner (OAIC) if unsatisfied with our response.
7. Account Deletion & Right to Be Forgotten
You can delete your account and all associated data at any time:
In-app: Profile → Utilities → Delete all data and profile. You can delete your data only (keeping your account and subscription), or your data and your account. For your protection, you may be asked to sign in again first.
This will permanently delete:
- Your account credentials and profile
- All gear lists, packs, and trip data
- All stored images and GPX files
Community posts and replies are shown under your display name and linked to your account by an internal user ID (never your email address). When you delete your account, your posts and replies are anonymised: the link to your account is removed and they are shown as “Deleted user”. The post content stays in the community so that discussions remain readable. If you want specific posts removed as well, contact privacy@backinpack.com.
What happens after deletion:
- Your data is deleted from our database and file storage straight away, and your sign-in record is deleted in the same step.
- Copies in encrypted backups expire within 28 days; deleted files are recoverable for 7 days before they are erased.
- Your community posts remain, shown as “Deleted user”, with no link to you.
- A regular clean-up removes anything the deletion may have missed.
If you cannot access the app, you can request deletion by emailing privacy@backinpack.com or using the form at backinpack.com/data-deletion-request. We will process the request within 30 days.
8. Data Retention
| Data type | Retention period |
|---|---|
| Active account data | Retained while your account is active |
| Community posts | Kept while your account is active. On account deletion they are anonymised (shown as “Deleted user”, no link to your account); the content remains visible |
| Posts removed by moderators | Deleted when the moderator removes them; the author is notified of the reason |
| Push notification tokens | Deleted when you sign out or delete your account |
| Shared packs | Removed when you stop sharing, or after 2 years without changes |
| Post images not attached to a post | Removed automatically within a week |
| Server logs | 30 days |
| Backups | Up to 28 days |
9. Children's Privacy
The App is not directed at children under the age of 13 (or 16 in the EU/EEA). We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, contact privacy@backinpack.com and we will delete it promptly.
10. Push Notifications
If you grant notification permission, we use your Firebase Cloud Messaging (FCM) token to send push notifications for:
- New posts in threads you follow (premium accounts; you can turn these off in the Discuss settings)
- Notice that a moderator removed one of your posts, with the reason
- For community moderators only: posts waiting for review
You can disable notifications at any time in your device Settings. Your FCM token is removed from your account when you sign out or delete your account, and from any other account when it is registered on a new sign-in.
11. Community Content & AI Moderation
Every community post and reply is checked by AI before it appears. We use Google Gemini to:
- Check it against our community guidelines: offensive, abusive, hateful or sexually explicit language, religious content and political content are not allowed
- Detect the language it is written in
- Translate it into English, French, German and Spanish, and check the translations as well
Only the post text is sent to Gemini; no account identifiers are included. Posts the AI flags stay hidden until our community moderators review them and approve or remove them. Members can also report posts; the reporter's identity is not recorded. A removed post is deleted, and its author is notified of the reason if notifications are enabled. If the AI service is unavailable, posts wait and are checked again automatically. You agree to this moderation when you accept the Community Guidelines before posting.
Community posts are shown under your display name and linked to your account only by an internal user ID. Your email address, sign-in provider and profile data are not attached to or retrievable from your posts. If you delete your account, the link and your display name are removed and your posts show as “Deleted user”.
Our community moderators can see all community content, including posts awaiting review. For administration they can also see your app settings, subscription tier and display-name history. They cannot see your body measurements, gear, packs or trips.
12. Security
We implement the following security measures:
- Firebase App Check (AppAttest / Play Integrity / reCAPTCHA) validates that requests come from genuine app instances
- All data in transit uses TLS 1.2+
- All data at rest is encrypted (AES-256, Google-managed)
- Access to Firebase project console is restricted to authorised personnel with MFA
Despite these measures, no system is completely secure. In the event of a data breach affecting your rights and freedoms, we will notify affected users and relevant authorities as required by applicable law (within 72 hours under GDPR).
13. Changes to This Policy
We may update this policy from time to time. When we make material changes, we will:
- Update the "Last updated" date at the top of this page
- Notify you via in-app notification or email if the change materially affects how your data is used
Continued use of the App after changes are posted constitutes acceptance of the updated policy.
14. Contact Us
For privacy questions, rights requests, or complaints:
Email: privacy@backinpack.com
Response time: Within 30 days
Data controller:
Mark Goodlad
Switzerland
Back in Pack — Train hard. Fuel right. Pack smart. Go further.