Privacy policy

Last updated 4 October 2026

Who we are

Munro Planner is developed and operated by Simon Grogan, who is the data controller responsible for the personal data described in this policy. For anything in this policy, contact Simon via the contact page.

The short version

• You can use most of the app without creating an account.
• With your permission, the app accesses approximate location, or precise GPS location when you grant it, while you use location features. It can also access location in the background only while you have deliberately started walk recording, live location sharing, or phone takeover of an active watch recording.
• On Wear OS, with your permission, the app reads heart rate, step count, calories burned and floors climbed to show watch statistics and add fitness details to recorded walks.
• Your current position normally stays on your device. Location or route coordinates leave your device only for the specific app functions explained below, such as live sharing, naming a recorded walk, loading location-based map or terrain data, or a Strava upload you choose.
• If you create an account, we store your email address, a securely hashed password, and your logbook so it can sync between devices.
• App subscriptions are paid through Apple or Google, and website gifts are paid through Stripe. We never see your full card details.
• There are no ads, no third-party analytics or tracking SDKs, and we never sell or share your data for marketing.

What the app collects, and why

Using the app without an account

The app fetches forecasts, route scores, map tiles and similar data from our server. Like almost every internet service, those requests include standard technical information (your IP address and device type) in short-lived server logs used for security and to keep the service running. We don't use this to identify or profile you.

Approximate and precise location data

Munro Planner accesses approximate location, and precise GPS location when you grant that permission, to provide its mapping, navigation, recording and safety features. While you are using the app, it uses location to show your position on the map, find nearby routes, guide you along a route, calculate progress and distance, warn when you move off route, record a walk, and optionally log a Munro when you reach its summit. If you grant only approximate location, features that need an accurate position may be less reliable or unavailable.

Location in the background. If you deliberately start phone walk recording, live location sharing, or phone takeover of an active watch recording, Munro Planner can continue to access precise location in the background, including while the phone or watch screen is off, the screen is locked, or the app is closed or not in use. Background access is needed to keep the active track or live position up to date. It is used only for those active features and stops when you end the walk, stop recording or turn live sharing off. Android and iOS require you to grant the relevant location permission, and you can withdraw it at any time in your device settings. The app does not access background location for advertising or marketing. Private live-sharing fixes may later be reviewed to improve routes and time estimates, as explained below.

Current map and navigation positions are primarily processed on your device. GPS points from a recorded walk are stored on your device so you can view the route and walk statistics; you can delete a recorded walk in the app. They are not included in account logbook sync. If you deliberately use “Sync with phone” in the signed-in website route planner, that planned GPX route is held in your account's delivery inbox for up to 30 days so each signed-in phone can receive it. Location is not sold or shared with advertisers.

When location or route coordinates leave your device. Precise fixes are transmitted to Munro Planner's server while live sharing is active. To suggest a useful name for a recorded walk, the app can send up to seven representative points from that track to our place-name service; they are used to return nearby feature names and are not added to your account. Online map, elevation, terrain and route-weather requests send the viewed area or relevant route coordinates to Munro Planner's service or the mapping/data provider needed to return that content. Those requests are not labelled with your Munro Planner account or an advertising identifier, although the receiving service also sees standard request information such as IP address. When you choose to upload a walk to Strava, its GPX track and the details shown in the confirmation screen pass through our server to Strava. When you export or share a GPX, it is sent only to the app or person you choose. A paired phone and watch also exchange location and recorded-track points to provide navigation, recovery and a single saved walk.

Location access is optional. You can decline the permission and continue using features that do not need your position. You can stop an active recording or live-sharing session in the app, and you can change or remove location permission at any time in your device settings.

Live location sharing

If you deliberately enable live sharing, the app transmits timestamped, precise location fixes to Munro Planner's server, including in the background while the sharing session is active. It may also send the planned route you are following. People with your link can see your latest known position and, if you choose, the breadcrumb track and available device status. We keep a separate, private history of the fixes and any planned route sent to us, even if your link shows only the latest position. This history can help us reconstruct a walk if you ask us to, respond to a specific safety enquiry, and review where walkers actually went to improve route guidance and walking-time estimates. Where necessary and lawful in an actual incident, we may share relevant records with mountain rescue or emergency services.

A permanent link is memorable and may be guessed or forwarded, so treat it as public while sharing is active. The private credential used by the app to update your position is separate from the public link. Your setting for keeping a finished walk visible controls the public link only. Stopping sharing or hiding the finished walk from that link does not erase the private history. Live sharing depends on GPS, battery and data coverage and is not an emergency or rescue service.

Live sharing also has an on-by-default performance option that helps improve battery life and reliability. If left on, we keep a separate account-free summary containing the device family, whether a phone or watch supplied and uploaded the last fix, session duration, number of shared points, and available start/end battery readings. It contains no account identifier, email, link token, route, coordinate, network provider or exact walk time. You can turn this summary option off in More sharing settings. It does not control private track history. We use these summaries only to compare reliability and battery performance across app and device types.

Separately, to operate and troubleshoot live sharing, we keep restricted operational summaries linked to your account for up to 90 days. These record session and upload times, upload and point counts (including retries), the longest upload gaps and delays, phone or watch source, and route-update successes or failures. They do not contain coordinates, route geometry, route names, private link credentials or the uploaded request contents. Only authorised administrators can inspect them. They are removed sooner if you delete your account. The private track history has the different retention rule described below.

Wear OS health and fitness data

On a Wear OS watch, with your permission, Munro Planner uses Android Health Services and the watch's sensors to read heart rate, daily step count, daily calories burned and daily floors climbed. Passive readings can be received in the background, including when no walk is being recorded, so the watch's statistics pages stay current. During a walk you start, current readings are added to recorded GPS points and used for live watch statistics and the saved walk summary, including steps and average and maximum heart rate. An optional Continuous heart rate setting reads the heart-rate sensor more frequently during an active recording.

Wear OS asks separately for foreground health permissions and, on supported versions, permission to read health data in the background. You can decline or revoke these permissions in the watch's app or health-permission settings. Without them, the related statistics are unavailable, but mapping, route guidance and other features continue to work.

Health and fitness readings are stored locally on the watch and mirrored to your paired phone while a walk is being recorded so the app can preserve the track and show its summary. Munro Planner's live-location service does not receive heart rate, steps, calories or floors; it receives only the location-derived walk progress and optional device status described above. Health and fitness data is not used for advertising, profiling or sale. It is shared with another service only when you deliberately export or share a recorded GPX file, or choose to upload that recording to Strava; exported GPX data may include heart-rate, step, calorie and floor readings.

Recorded health and fitness readings remain part of the locally stored walk until you delete that walk in the app. They are not included in account logbook sync and are not retained on Munro Planner's server.

Apple Watch health and fitness data

On Apple Watch, with your permission, Munro Planner uses Apple's HealthKit to read heart rate, steps, active energy and flights climbed. These readings provide watch statistics and fitness details for a walk you record. When enabled, the map can also display a recent heart-rate reading already available in HealthKit, without starting continuous heart-rate collection. The optional Continuous heart rate setting enables live heart-rate collection during recording.

A recording uses a HealthKit workout session to support continued watch recording in the background. With your permission to write workouts, the finished activity is saved to Apple Health. You can decline or revoke access in your Apple Health or device privacy settings. Missing health readings do not prevent you from using the map or route-planning features.

Recorded fitness readings are kept with your walk on the watch and paired phone. They are not included in account logbook sync or sent to Munro Planner's live-location server. You can delete the recorded walk in Munro Planner and manage its separate Apple Health workout in Apple Health. Health and fitness data is not used for advertising or sold. It is shared outside your devices only when you deliberately export or share a recording, or choose a supported Strava upload; exported recordings may include fitness readings.

Drive times

If you use drive times, the departure point you type in (a postcode, town or city) is sent to our server to calculate journey times to route start points. Results are cached by place, not by person, and your departure point is not linked to your identity or account.

Accounts and logbook sync

Creating an account is optional, and exists so your logbook can sync across devices. If you create one, we store:

• Your email address and a hashed password (we can't read your password).
• Your logbook data: completed Munros, dates, notes and related settings.
• When your walking profile has enough evidence, a derived profile containing aggregate speeds, terrain factors, break allowance and sample counts, so a signed-in web planner can use the same walking pace as the app. It does not contain raw GPS tracks, walk dates, heart rate or Strava activity records.
• Website-planned GPX routes that you explicitly send to your phone, retained for up to 30 days.
• Session tokens so you stay signed in, stored hashed.

Your derived walking profile is included only while you are using a signed-in account. You can delete your account at any time from inside the app (More → Account). This removes your account, sessions, private live-sharing track history, derived walking profile and synced logbook from our active database. You can also follow the account deletion instructions if you cannot access the app.

Sharing Munro progress with friends

Sharing is off until you deliberately create a link. The link shows the selected person's display name and their ticked and remaining Munros from the latest synced logbook. You can separately opt in to include Munro ascent dates and notes. This does not share other people under your account, recorded GPX tracks, health data, walking-pace profiles or live location.

Anyone who has the link can read the information you chose to share, so only give it to people you trust and only share someone else's list with their permission. No account is needed to view it. You can revoke individual links in the app; revocation stops future access but cannot recall screenshots or copies already made. Removing the selected profile from your synced account or deleting your account also stops access. We store a hash of each link credential with its owner, selected profile, label and sharing choice, not a separate public copy of the logbook. Links remain active until revoked or their account/profile is removed. Revoked link metadata is removed when your account is deleted. Saved friend links stay on the recipient's phone, separated by signed-in account, and are not included in cloud backup.

Subscriptions and gifts

Subscriptions are purchased through the Apple App Store or Google Play. Apple or Google handle the payment; we never receive your card details. We receive confirmation of your subscription status so the app can unlock supporter features. Website gift purchases are processed by Stripe. We store the purchaser and recipient details needed to fulfil and manage the gift, including names, email addresses, delivery choice, message and payment status, but Stripe handles the card details. The redemption database stores gift codes as secure hashes.

To fulfil gifts reliably and investigate payment or delivery problems, we keep a private payment and email timeline for up to 12 months. It records payment references, status, amounts, email recipients, subjects, attempts and provider delivery results, but not card details or complete payment-provider request bodies. We also retain an encrypted copy of each gift email for up to 90 days, including its instructions, gift code and management link. Only the authorised administrator can view these copies. Mailgun delivers the messages; acceptance by the recipient's email service does not prove the email was read. These records are used for fulfilment and support, not marketing or open/click tracking.

Feedback and logbook imports

If you send feedback through the app, we keep the message (and your email, if you choose to include it) so we can read and act on it. If you use the logbook import feature, the content you upload is processed to build your logbook entries. Where automatic interpretation is needed, the uploaded content may be processed by an AI service (Google Gemini) solely for that purpose; it isn't used for anything else. To identify failed or incorrect imports, a signed-in import also creates a limited diagnostic record linked to your account: the app or website used, parser route and stage, file size and format, counts matched, added, duplicated or unmatched, any short error message, and the identifiers of entries added to the shared logbook. This ordinary diagnostic record does not include the uploaded file, its filename or ascent notes.

To investigate import problems, we retain a private copy of failed uploads, including their filenames, for up to 14 days. Assisted imports also retain the submitted text, Gemini model, response status and output, extraction counts and subsequent results reported by the app or website for up to 14 days. This can include walk dates and notes contained in your file. Only the authorised Munro Planner administrator can access these copies and outputs. Source copies are limited to 400 KB and Gemini responses to 1 MB. Records linked to your account are removed when that account is deleted; anonymous diagnostic traces expire after 14 days. They are not used by Munro Planner for AI training or sent as email attachments. Operational failure emails contain only the time, platform, import method, reference number and an admin link.

After a failure, you can separately choose Email me if you fix this import issue. This is off by default. We use your saved account email or the address you enter only to contact you about that import issue, not for marketing. Your contact preference and address are retained with the diagnostic trace for up to 14 days. You can untick the option and save again to withdraw that permission.

Strava

If you choose Connect Strava, Strava sends Munro Planner the activities, route coordinates, dates, notes and activity statistics you authorised so the app can identify Munros and show those walks back to you. This data is displayed only to the connected Strava user. It is cached on your device for no longer than seven days, refreshed only when you request an import, and removed when it expires or when you disconnect Strava. We do not keep a server copy of imported Strava walks or use their tracks and timings for route analysis, advertising, AI or model training. We log whether a Strava connection, import or upload completed, with a limited error code and account reference where available. These operational logs contain no Strava activity, route, GPS points, athlete name or token.

You can withdraw access in the app with Disconnect Strava or from your Strava account. Disconnecting revokes the connection and removes the cached Strava walks from the app. Strava may collect API usage data when Munro Planner uses its service, as described in Strava's own privacy and API policies.

What the website collects

munroplanner.com doesn't use analytics or marketing cookies. The site is served through Cloudflare, which may set strictly necessary cookies for security. If you use the contact form, your name, email address and message are emailed to us (delivered via Mailgun) so we can reply — they're not stored in a database.

Third parties we rely on

Most weather, wildlife and route data is gathered and processed on our own server. Where an online map, place-name, elevation or fallback weather request needs an area or route coordinate, it is handled as described in the location section and table above.

How long we keep things

Account and logbook data are kept while your account exists and removed from our active database when you delete it. Private live-sharing history in our active database, including timestamped location fixes and any planned route sent with the session, can be stored for up to 12 months after the walk ends. You can ask us to remove a particular finished walk sooner through the contact page, or delete your account to remove its history from our active database. Deleting a recorded walk on your phone or watch does not by itself remove a separate live-sharing history on our server. Public link visibility does not determine private retention.

Logbook-import diagnostic records and Strava operation logs are removed after 90 days, or sooner if the account is deleted. Recorded GPS walks, including any associated heart-rate, step, calorie and floor readings, are stored on your devices until you delete the walk in the app. Strava activity data is cached for no longer than seven days and is removed sooner if you disconnect. Public live-sharing session records without precise location are removed after 30 days. Account-free performance summaries are removed after 90 days. Server logs are short-lived and rotate automatically. Feedback is kept as long as it's useful for improving the app.

Our lawful basis for service improvement

We rely on legitimate interests to review private live-sharing histories to improve route guidance and walking-time estimates. Access is restricted, the active database history is kept for up to 12 months, and you can object or ask us to delete a walk through the contact page. We also rely on legitimate interests to create the limited, account-free performance summaries described above so we can improve live-sharing reliability and battery life. We minimise and separate the fields in those summaries, exclude locations and identifiers, retain them for 90 days, and provide an easy opt-out in the same sharing settings.

Security

All traffic between the app, the website and our server is encrypted (HTTPS). Passwords and session tokens are stored hashed. No method of storage is perfectly secure, but we deliberately keep the amount of personal data we hold small.

Your rights

Under UK data protection law (UK GDPR) you can ask for a copy of the personal data we hold about you, ask us to correct it, or ask us to delete it. To delete a particular server-stored live-sharing walk while keeping your account, use the contact page. To delete the whole account, use More → Account → delete account in the app; the account deletion page explains how to request this without the app. You also have the right to complain to the Information Commissioner's Office.

Children

The app is not directed at children under 13, and we don't knowingly collect personal data from them.

Changes to this policy

If this policy changes in any meaningful way, we'll update this page and the date at the top. Nothing in a future version will quietly start selling your data — that isn't what this app is for.