Effective July 18, 2026.

Privacy Policy

1. Introduction

List Hiker LLC, a New Hampshire Limited Liability Corporation (“we,” “us,” or “our”), operates List Hiker, a service that helps hikers and outdoor enthusiasts track their progress on peak bagging and trail lists such as the New Hampshire 4000-Footers or Colorado 14ers. This Privacy Policy explains how we collect, use, store, and protect your personal information when you use our website at listhiker.com or the List Hiker mobile app.

By creating an account or using List Hiker, you acknowledge that you have read and understood this Privacy Policy. This policy should be read alongside our Terms of Service.

2. Data Controller

List Hiker LLC, a New Hampshire Limited Liability Corporation, 1 Hardy Rd #1227, Bedford NH 03110, is the data controller responsible for your personal data. For privacy-related inquiries, contact us at privacy@listhiker.com or through our contact page.

Strava is an independent data controller for data on their own platform. When you connect your Strava account, we become the data controller for the copy of your Strava data that we store and process on our systems.

3. Information We Collect

3.1 Account Information

When you create an account, we collect:

  • Email address - required for account creation and communication
  • Password - securely hashed; we never store or have access to your plaintext password

You may optionally provide additional profile information through your Settings page:

  • Name
  • Phone number
  • Date of birth
  • Gender
  • Mailing address
  • Profile photo
  • Time zone, measurement units (imperial or metric), and other personal preferences

We use this optional data to improve security on your account and to enable certain features of the List Hiker service. For example, we use birth date to track age-related lists.

3.2 Strava Sync

When you choose to connect and sync your Strava account, we collect the following data through Strava's API with your explicit authorization:

  • Strava athlete ID and name
  • Activity metadata: name, description, sport type, workout type, distance, elevation gain and loss, elevation high and low, duration, moving time, maximum and average speed, device name, gear, and steps
  • Your activity track, timing, and elevation
  • Activity privacy status and visibility

We only have read-only access to your Strava activities, and we do not update or write to your Strava account. You can control which activity types are shown by default via the Default Activity Display setting on your Settings page. We encrypt and store the access token from Strava on your behalf in encrypted cloud storage.

In some cases Strava may send us data that we do not use, such as heart rate data. We do not store or process this data.

Strava automatically notifies us in real time on certain changes to your Strava data, including but not limited to adding a new activity, changing an activity title, or changing privacy status. List Hiker updates your data based on these notifications. If you request Strava to delete List Hiker authorization or delete your activities, List Hiker will permanently delete your Strava API activities, including any modifications or updates you have made in List Hiker, to comply with Strava's guidelines. These updates take place even if you are not connected to List Hiker at the time.

This section only applies to data that List Hiker acquires directly through the Strava API, and not to any data you provide us separately from Strava or other services.

3.3 Activity Uploads

You can import activities into List Hiker by uploading files such as GPX, FIT, or TCX files, activity exports from other services, spreadsheets, or other documents. When you provide these files, we strip information from them that we do not use such as photos and health information, extract the route and metadata information from the file, and store the stripped file in encrypted cloud storage. You can view and delete the files you have uploaded on the My Data page.

We currently have tested uploading data exports from AllTrails, COROS, Gaia GPS, Garmin Connect, Outdooractive, Runkeeper, Peakbagger, and Strava, as well as Apple Health via the List Hiker mobile app.

3.4 Derived Data

We generate the following data from your activities to provide the core service:

  • We match your activities to peaks and trail segments in our database.
  • We monitor and record progress against your lists, including creating completion records.
  • We create aggregated activity statistics such as total distance, elevation gain, and activity counts.
  • We analyze data to improve its accuracy and utility for tracking list progress, for example combining adjacent activities, or removing/replacing erroneous data.

You can also update your own activity data on List Hiker to enhance it or correct inaccuracies.

3.5 Technical Data

We use a single authentication cookie (see Cookies below). We do not use third-party tracking cookies or advertising pixels. We collect technical request data for operational, security, and service-improvement purposes, including your IP address, browser/user-agent string, referring URL, HTTP method, request path and query string, response size, status code, and request timing. These logs are retained per Data Retention.

3.6 Health, Wellness, and Photographic Data

List Hiker processes activity metrics such as tracks, times, distances, and steps. We do not process or use health or wellness data such as heart rate, blood oxygen levels, or calorie counts.

Files you upload, such as activity exports, GPS tracks, photos, and spreadsheets, are retained in your My Data area where you can review, download, and delete them at any time. With your permission, we allow you to use your profile photo (if included) as your List Hiker profile photo. Where possible, we remove other photos, health data, and other information not relevant to our service before storing these files. Some uploaded files may contain health, wellness or photographic data that cannot be easily separated from the activity data - in these cases we retain the file for your benefit but do not process or use the health or wellness data. Some activity exports include photo metadata such as location and time separately from the photos themselves. We may use this metadata to help match activities to your lists, even when the associated photos are not uploaded.

Photographs and other images displayed on List Hiker itself (for example, peak photographs and list imagery) are List Hiker's own content rather than your personal data, and their use is governed by Section 7 of our Terms of Service rather than this Privacy Policy.

3.7 Photos on Your Device

The List Hiker mobile app can access photos on your device, with your authorization, to create photo albums and help identify and organize your activities. This processing is only on your device with your authorization, and photos are never uploaded to our servers or the web. This means that the photo albums in the mobile app are not accessible on listhiker.com.

3.8 List Hiker Mobile App

The List Hiker mobile app collects and uses some information that the website does not. You control these capabilities through the permissions you grant the app, and you can change them at any time in your device's settings.

  • Location. When you record a hike, the app records your device's GPS location, including while the app is in the background. The app also offers an optional Peak Locator to assist in locating peak markers.
  • Motion and barometer. While recording, the app reads your device's motion and barometric pressure sensors to measure elevation. This processing happens on your device.
  • Photos. With your authorization, the app matches photos on your device to your hikes. As described in Photos on Your Device, this matching happens on your device and the contents of your photos are not uploaded by this feature.
  • Apple Health. With your authorization, the app reads your workouts and routes from Apple Health to import them as activities.
  • Push notifications. You may enable notifications for activity completion and peak proximity.
  • On-device processing and no third-party analytics. Proximity monitoring, photo matching, and diagnostic performance measurements are performed on your device. The app does not include third-party analytics or advertising software.

4. How We Use Your Data

We use the information we collect to:

  • Provide the core service - match your activities against our database of peaks and trails, track your progress on hiking lists, and display your completions
  • Authenticate you - verify your identity, maintain your session, and secure your data
  • Sync activities - import activities from Strava and other connected services on your behalf
  • Communicate with you - send transactional messages (account verification, password reset, deletion confirmation) via email, SMS, or app notifications. We may also send service notifications such as sync status alerts and progress milestones. You can opt out of non-transactional communications at any time in your Settings. We track message delivery and engagement for security and operational purposes.
  • Improve the service - we analyze how the service is used to improve data accuracy (such as exact trail routes as they change over time), reliability, and the user experience. In the short term (within our log retention period) this may use identifiable request data under our legitimate interest; longer term we use only aggregated, anonymized data
  • Support - we may access your data on your behalf when you request support, in order to assist you with using the service

We do not use your data for:

  • Advertising or behavioral profiling
  • Selling or renting to third parties

Affiliate links - our content may include affiliate links to third-party products and services such as books, maps, or gear. These links contain a referral code identifying List Hiker but do not contain any personal information about you. If you follow an affiliate link, the third party (such as Amazon) will know the referral came from List Hiker, and if you are logged in to that service, they may associate the referral with your account under their own privacy policy. We may receive a commission on purchases made through these links.

5. Artificial Intelligence

At List Hiker, our philosophy is that artificial intelligence should be used only on your behalf, and never to exploit you.

List Hiker uses state-of-the-art technologies including large language models to help import, interpret, and clean up data that you provide to us. For example, a language model may be used to determine the format of a spreadsheet you upload, or to suggest how best to resolve data inconsistencies. We also use these technologies to improve your experience, for example by selecting the most accurate data source for your activities or identifying potential duplicate activities.

We may use anonymized data and interaction history to train and improve self-hosted models and algorithms solely for the purpose of improving the List Hiker service. Data acquired through the Strava API is excluded from all model training to comply with Strava policies.

When you import activities from a spreadsheet or photo, we may use xAI's Grok models, through the xAI API, to interpret the file. We send only the contents of the file and any clarifying answers you give during the import. Our xAI account uses xAI's Zero Data Retention mode, so xAI does not store or train on this data.

6. Your Privacy Choices

You have control over your data. Here are the key actions you can take at any time:

  • Disconnect from Strava - disconnects your Strava account and revokes our API access. At your option, you may also delete all data acquired through the Strava API, including any derived data or edits you have made to that data in List Hiker; deleted data cannot be recovered from List Hiker, though you can reconnect and resync to restore activities that still exist on Strava. For clarity, List Hiker never modifies or deletes data held by Strava.
  • Delete your account - visit your My Data page to delete your account. Account deletion is immediate and cannot be undone, although you can create a new account whenever you wish.
  • Delete your data - you can delete all or part of your data at any time on the My Data page. Data deletion is immediate and cannot be undone, although you can re-upload or resync data whenever you wish.
  • Export your data - you can download all your data on the My Data page. Note that List Hiker does not directly store GPX/FIT/TCX track data, only route information for matching, so you cannot use List Hiker data to load into applications or services that expect track data in those formats.
  • Edit your profile - update or remove any optional profile information through your My Profile page.
  • Edit your preferences and settings - you can update your preferences, including which activity types are shown by default, on your Settings page.
  • Account security - you can change your password, account email, and log out all devices from your account on the Settings page.
  • Progress Sharing - you can publicly share progress against your lists by creating Progress Sharing pages. You have complete control over what lists you share, and you can revoke sharing at any time. Your Progress Sharing pages will show updates to your lists as they happen. The pages include your name and, if you have one, your profile photo. You can specify that your progress be shared only to List Hiker authenticated users, be shared publicly but excluded from search engines, or be shared publicly and included in search engines. You can change sharing level or revoke sharing at any time. If your page was indexed by a search engine it may take some time for the page to be removed from the search engine depending on the search engine's policies.

For users in the European Economic Area (EEA) and the United Kingdom, we process your personal data under the following legal bases of the GDPR and UK GDPR:

  • Performance of a contract (Article 6(1)(b) GDPR) - account creation, activity processing, progress tracking, and the core matching service are necessary to provide the service you signed up for.
  • Consent (Article 6(1)(a) GDPR) - connecting your Strava account, uploading activity files, and providing optional profile information are actions you explicitly choose to take. You may withdraw consent at any time by disconnecting integrations or deleting data as described in Your Privacy Choices.
  • Legitimate interest (Article 6(1)(f) GDPR) - service security, fraud prevention, and aggregated analytics to improve our reference data quality. We balance these interests against your rights and do not use this basis for marketing.

8. Third-Party Services and Data Sharing

We use the following third-party services to operate List Hiker. We do not sell, rent, or trade your personal data to any third party. We do not use Google Analytics or any third-party analytics service, and we do not track your behavior across other websites or apps. We do analyze how you use List Hiker itself, from our own server logs and without third-party cookies or trackers, to operate, secure, and improve the service (see How We Use Your Data).

Strava

When you connect your Strava account, we access your activity data through Strava's API in read-only mode. We do not share your data back to Strava or any other Strava user. Strava's own Privacy Policy governs how Strava handles your data on their platform. See the Strava-Specific Data Practices section for details.

Amazon Web Services (AWS)

Our infrastructure runs on Amazon Web Services, and is processed under the AWS Data Processing Addendum. All data is stored in the US East (Ohio) region.

MapTiler

We use MapTiler to display interactive maps. Map tile requests contain geographic coordinates for the area being viewed but no personal data or user identifiers.

xAI

Photos and unrecognized spreadsheets you import may be processed by xAI's Grok models through the xAI API, under xAI's Zero Data Retention mode — xAI does not store or train on this data. See Artificial Intelligence.

OpenStreetMap

Our peak and trail reference data is sourced from OpenStreetMap. No user data is shared with OpenStreetMap.

Business Transfers

In the event of a merger, acquisition, or sale of assets, your personal data may be transferred to the acquiring entity. We will notify you by email and/or by posting a prominent notice on our website before your personal data becomes subject to a different privacy policy.

9. Strava-Specific Data Practices

This section addresses our handling of data received through the Strava API, in compliance with the Strava API Agreement and the Strava API Policy (each as updated June 1, 2026).

What We Collect from Strava

Your Strava athlete ID and name; activity metadata (name, description, sport type, workout type, distance, elevation gain and loss, elevation high and low, duration, moving time, maximum and average speed, device name, gear, steps); your activity track, timing, elevation, privacy status, and visibility.

How We Use Strava Data

We use Strava data solely to identify and track progress against your hiking lists, using deterministic algorithms, and to display your progress against these lists.

Who Can See Your Strava Data

Strava-sourced data is displayed only to you, the authenticated user who authorized the connection. It is never shown to other List Hiker users or made publicly accessible. Completion records shown on shared views (if you choose to share your progress) are List Hiker's own derived data and do not include Strava activity metadata.

Retention and Deletion

When you disconnect from Strava, we revoke our API access and remove your stored Strava OAuth tokens. At your option, we also delete all activity data acquired through the Strava API, including activity metadata, data derived from Strava activities, and any edits you have made to Strava-sourced activities. Your list progress is recalculated based on any remaining non-Strava activities.

If you revoke List Hiker's access directly through your account on Strava, we will process the deauthorization request immediately and permanently delete all data acquired through the Strava API, to comply with Strava's guidelines. If our access to the Strava API is terminated or discontinued for any reason, we will cease using and permanently delete all data acquired through the Strava API.

You may also delete individual Strava-sourced activities or bulk-delete all Strava API activities from the My Data page at any time without disconnecting from Strava. You can re-sync deleted activities from Strava later if you wish to regain access to them.

Artificial Intelligence and Machine Learning

Data acquired through the Strava API is not used, directly or indirectly, for any model training related to artificial intelligence, machine learning, or similar applications. List Hiker may use artificial intelligence features elsewhere in the service, for example to assist with data import and cleanup, but these features never use data acquired through the Strava API for model training. For more detail on how List Hiker uses artificial intelligence, see Artificial Intelligence.

No Cross-Platform Data Merging

We do not combine Strava data with third-party data sources for profiling or enrichment. When a single user connects multiple activity sources (e.g., Strava and manual activity uploads), data from each source is identified and can be managed independently.

10. Data Retention

  • Active account - your data is retained for as long as your account is active.
  • Dormant accounts - accounts that have been inactive for 3 years may be flagged for deletion. We will notify you by email at least 30 days before any deletion.
  • Strava disconnect - Strava tokens are revoked and removed immediately upon disconnect. Activity data acquired through the Strava API is deleted unless you choose to retain it.
  • Account deletion - when you delete your account, all your data is immediately and permanently purged from our databases and file storage, including profile data, activities, progress records, GPS files, photos, and authentication credentials.
  • Mobile app - the notification token registered by the mobile app is deleted from our systems when you sign out. Data the app stores locally on your device (such as proximity-monitoring and photo-matching state) stays on your device and is removed when you use the app's “Clear Local Data” option or uninstall the app.
  • Anonymized data - we may anonymize and aggregate your data for statistical purposes (e.g., peak popularity, matching accuracy improvement, photo album optimization). Anonymized data that can no longer be associated with you may be retained indefinitely.
  • Server logs - retained for 90 days for operational purposes, then automatically deleted. Logs do not contain full email addresses, passwords, or OAuth tokens.
  • Encrypted backups - retained for up to 90 days for operational purposes, then automatically deleted.
  • Lawful requests - we may be required to preserve or disclose your data in response to valid legal process such as court orders, subpoenas, or government requests. We will notify you of such requests where legally permitted to do so.

11. Your Rights

All Users

Regardless of your location, you can:

  • Access your data - view your profile, activities, and progress within the app. You can download all your data on the My Data page at any time.
  • Correct your data - update your profile information and edit activity data on the My Data page. In the case of data synced from Strava you also have the option to correct the data on Strava and re-sync activities with corrected data to List Hiker.
  • Delete your data - delete individual data or your entire account from the My Data page, which immediately and permanently removes the selected data.
  • Disconnect Strava - disconnect Strava from the My Data page at any time, which revokes the associated tokens. At your option, you may also delete all data acquired through the Strava API.

European Economic Area and United Kingdom (GDPR / UK GDPR)

If you are in the EEA or UK, you additionally have the right to:

  • Data portability - receive your data in a machine-readable format on the My Data page.
  • Restrict processing - request that we limit how your data is processed in certain circumstances. We will honor valid restriction requests by suspending processing of the affected data while the request is evaluated. In some cases the only way to fully restrict processing may be to delete the relevant data or your account.
  • Object to processing - object to processing based on legitimate interest. If you object, we will stop processing your data for that purpose unless we have compelling legitimate grounds that override your interests.
  • Withdraw consent - withdraw consent for optional processing at any time without affecting the lawfulness of processing performed before withdrawal.
  • Lodge a complaint - file a complaint with your local data protection supervisory authority (in the UK, the Information Commissioner's Office).

California (CCPA / CPRA)

If you are a California resident, you have the right to:

  • Know what personal information we collect and how it is used (described in this policy).
  • Delete your personal information.
  • Opt out of sale - we do not sell your personal information to third parties.
  • Non-discrimination - we will not discriminate against you for exercising your privacy rights.

Canada (PIPEDA)

If you are a Canadian resident, you have the right to:

  • Access your personal information held by us, either through the self-service tools on the My Data page or by contacting us at privacy@listhiker.com.
  • Correct inaccurate personal information through the My Data page or by contacting us.
  • Challenge compliance - contact us or the Office of the Privacy Commissioner of Canada if you believe we are not complying with PIPEDA.

Exercising Your Rights

To exercise any of these rights, contact us at privacy@listhiker.com or use the self-service options on the My Data page. We will respond to verifiable requests within 30 days (or within the timeframe required by applicable law).

12. Automated Decision-Making

We do not make decisions based solely on automated data processing, including profiling, that produce legal or similarly significant effects concerning you. Our GPS matching algorithms are deterministic spatial computations and do not constitute profiling under GDPR Article 22. You can review all matched peaks, segments, and list progress through the My Activities page, and delete individual activities or all your data at any time.

13. Data Security

We protect your data using industry-standard security practices including encryption of data in transit and at rest, secure password hashing, encrypted storage of third-party access tokens, and strict access controls that scope each user to their own data. Authentication cookies are configured to prevent unauthorized access. We scan uploaded files and user input for incorrect or malicious content.

While we take reasonable measures to protect your information, no method of electronic transmission or storage is 100% secure. If we become aware of a security breach affecting your personal data, we will notify affected users and, when required by applicable law (such as the GDPR 72-hour notification requirement), the relevant supervisory authorities. If you discover evidence of exploits or other security issues with List Hiker, you agree to notify us promptly at support@listhiker.com.

14. International Data Transfers

List Hiker's infrastructure is hosted on Amazon Web Services in the US East (Ohio) region. If you are located in the European Economic Area, United Kingdom, Canada, or another jurisdiction with data transfer restrictions, your personal data will be transferred to and processed in the United States.

These transfers are governed by the AWS Data Processing Addendum, which includes Standard Contractual Clauses (SCCs) approved by the European Commission for the transfer of personal data to countries outside the EEA.

15. Children's Privacy

List Hiker is not directed at children under the age of 16. We do not knowingly collect personal information from children under 16. If you believe that a child under 16 has provided us with personal information, please contact us at privacy@listhiker.com and we will delete it.

16. Cookies

List Hiker uses a single, essential authentication cookie that keeps you signed in while you are logged into the service.

We do not use third-party tracking cookies, advertising cookies, or analytics cookies.

17. Changes to This Policy

We may update this Privacy Policy from time to time. When we make material changes, we will notify you by email (if you have an account) and/or by posting a notice on our website. The “last updated” date at the top of this page indicates when the policy was most recently revised.

Your continued use of List Hiker after the effective date of any revised policy constitutes your acceptance of the revisions.

18. Contact

If you have questions about this Privacy Policy or wish to exercise your data rights, contact us: