Privacy Policy

Last updated: December 1, 2025

In plain language:

TrekList stores the information it needs to run your account and gear lists, keeps some logs to protect the service, and uses optional analytics (only with your consent) to understand how people use the app. If you choose, we may also email you occasional updates about new TrekList features and tips. We don't sell your personal data, and you can ask what we store or request deletion at any time. You can change your email preferences at any time in your account settings or by using unsubscribe links in emails.

This Privacy Policy explains how TrekList.co ("TrekList", "we", "us") collects, uses, and protects your personal data when you use our website and services.

TrekList.co is a gear list planning tool for hikers and travelers. We also operate the content brand Tall Joe Hikes.

We are committed to handling your data carefully, transparently, and in line with applicable data protection laws such as the General Data Protection Regulation (GDPR).

1. Who is responsible for your data?

The data controller for TrekList.co is:

Tall Joe Hikes
Eenmanszaak registered in the Netherlands
KvK: 98785419
Email: support@treklist.co

If you have questions about this Privacy Policy or your data, you can contact us at support@treklist.co.

We currently do not have a Data Protection Officer (DPO). If that changes, we will update this page.

2. What personal data do we collect?

We collect and process the following categories of personal data:

2.1 Information you provide directly

  • Account details – email address, password (stored in hashed form only), and optional trail name or display name.
  • Profile & settings – preferred language, weight units, theme, email communication preferences, and other app settings.
  • Gear lists & content – names of your lists and categories, items you add (e.g. item names, weights, notes) and background images you select or upload.
  • Support communication – messages you send us via email or contact forms, and information you provide when reporting a bug or asking for help.

You can choose not to provide certain information, but this may limit your ability to use some features.

2.2 Information we collect automatically

  • Usage data – pages and screens you visit, buttons or features you interact with, timestamps of your visits.
  • Device & technical data – IP address, browser type and version, operating system, approximate location (country / region based on IP).
  • Cookies – essential cookies required for login, security, and preferences, and optional analytics cookies (only if you consent). See our Cookie Policy for more details.

2.3 Information from third parties

  • Analytics providers (if enabled) – aggregated usage statistics.
  • Payment providers (if we add paid plans in the future) – basic billing and transaction details, but not full card numbers.
  • Affiliate networks – aggregated statistics on clicks and purchases from affiliate links (we do not receive your full payment details on other sites).

We do not purchase or sell marketing lists.

3. For what purposes and on which legal bases do we process your data?

Under the GDPR, we must have a legal basis for each use of your personal data. We rely on the following:

3.1 Performance of a contract (Art. 6(1)(b) GDPR)

We use your data to:

  • Create and manage your TrekList account.
  • Let you log in securely.
  • Store and display your gear lists, categories, and items.
  • Provide features like packing checklists, printable views, and public share links.
  • Provide support when you contact us.

Without this data, TrekList would not function as a gear list planning tool.

3.2 Legitimate interests (Art. 6(1)(f) GDPR)

We use your data (in a way that respects your privacy) to:

  • Keep TrekList secure and prevent abuse, spam, or attacks.
  • Monitor capacity and performance to keep the service stable.
  • Improve our product based on aggregated usage patterns.
  • Communicate important service-related updates (e.g. downtime, security issues).

Where we rely on legitimate interests, we balance our interests against your rights and expectations. You can object to such processing (see Section 8).

3.3 Consent (Art. 6(1)(a) GDPR)

We rely on your consent to:

  • Use analytics cookies or similar technologies that are not strictly necessary.
  • Send optional product updates, feature tips, and occasional offers about TrekList, but only if you explicitly opt in (for example during registration or in your account settings).

You can withdraw your consent at any time. For cookies and similar technologies, you can use the Cookie Settings page/tab. For optional emails, you can update your preferences in your account settings or use the unsubscribe links in those emails. Withdrawing consent does not affect the lawfulness of processing before withdrawal.

3.4 Legal obligation (Art. 6(1)(c) GDPR)

We may process and retain certain data where required to comply with tax, accounting, or other legal obligations, or to respond to lawful requests from authorities.

4. How do we use cookies and similar technologies?

We use cookies and similar technologies to keep you logged in securely, remember your preferences, and understand how TrekList is used so we can improve it. Some cookies are essential for the service to function; others (analytics) are optional and only used with your consent.

For more details, including how to manage your preferences, please see our Cookie Policy and the Cookie Settings page/tab.

5. Who do we share your data with?

We do not sell your personal data.

We may share your data with the following categories of recipients:

5.1 Service providers (processors)

We use trusted third-party providers to operate TrekList, such as:

  • Hosting and infrastructure providers (cloud hosting, database).
  • Analytics providers (if enabled).
  • Email service providers (for transactional emails).
  • Payment processors (if we introduce paid plans).

These providers process personal data only on our instructions, under data processing agreements that include appropriate safeguards.

5.2 Legal and compliance

We may disclose your data if required by law, court order, or legal process, or if we reasonably believe it is necessary to:

  • Detect, prevent, or address fraud, security issues, or technical problems.
  • Protect the rights, property, or safety of TrekList or others.

5.3 Business changes

If TrekList or Tall Joe Hikes is involved in a merger, acquisition, or other business transaction, your data may be transferred as part of that transaction. If this happens, we will inform you where appropriate.

6. International data transfers

Some of our service providers may be located outside the European Economic Area (EEA), for example in the United States.

Where data is transferred outside the EEA, we will ensure that an adequate level of protection is in place, for example by using Standard Contractual Clauses (SCCs) approved by the European Commission or relying on other appropriate safeguards, and take additional measures where necessary.

7. How long do we keep your data?

We keep your personal data only for as long as necessary for the purposes described in this policy or to comply with legal obligations. In general:

  • Account data – kept while your account is active. If you close your account, we will delete or anonymise your data within a reasonable period, unless we must keep it longer for legal reasons.
  • Gear lists and content – kept while your account is active; deleted when your account and lists are deleted.
  • Log and security data – kept for a limited period (typically up to 12 months) for security and troubleshooting.
  • Support communication – kept for as long as necessary to handle your request and for a reasonable period afterwards (e.g. 12 months), unless required longer for legal reasons.
  • Billing and tax records – kept for the period required by Dutch tax law (usually 7 years).

Where we no longer need personal data, we will delete or irreversibly anonymise it.

8. Your rights under the GDPR

As a data subject, you have the following rights, subject to certain conditions and exceptions:

  • Right of access – to know whether we process your data and, if so, to receive a copy.
  • Right to rectification – to correct inaccurate or incomplete data.
  • Right to erasure ("right to be forgotten") – to request deletion of your data, for example when it is no longer needed or if you withdraw consent.
  • Right to restriction of processing – to ask us to limit how we use your data in certain cases.
  • Right to data portability – to receive certain data in a structured, commonly used, machine-readable format and to transmit it to another controller.
  • Right to object – to object to processing based on our legitimate interests or to direct marketing.
  • Right to withdraw consent – at any time, where we rely on consent.

To exercise these rights, contact us at support@treklist.co. We may need to verify your identity before responding.

You also have the right to lodge a complaint with the Dutch supervisory authority:

Autoriteit Persoonsgegevens
Website: https://autoriteitpersoonsgegevens.nl/

We encourage you to contact us first so we can try to resolve your concerns.

9. Children

TrekList is not directed at children under 16 years of age. We do not knowingly collect personal data from children under 16. If you believe we have collected such data, please contact us at support@treklist.co, and we will take steps to delete it.

10. Changes to this Privacy Policy

We may update this Privacy Policy from time to time, for example to reflect changes in our service or in applicable laws.

When we make material changes, we will update the "Last updated" date at the top of this page and, where appropriate, notify you by email or through the app.

Please review this page regularly to stay informed.