This policy explains which personal data is processed when you use the Alpin Club mobile app and the alpinclub.militaryapp.net server (together “Alpin Club”), why, who it is shared with, and what your rights are.
1. Controller and contact
Controller: Alpin Club, Istanbul, Türkiye.
Contact: alpinclub@militaryapp.net
2. Data we process
| Data | Purpose |
|---|---|
| Account: email address, username, display name; optional password (only a hash is stored), profile photo, bio, favourite sports, language and unit settings | Creating your account, sending sign-in codes, showing your profile |
| Location and tours: GPS points while you record (latitude, longitude, elevation, time) and the distance, time, speed and climb derived from them; routes you plan | Recording and showing your tours, statistics, records, challenges and summits; navigation |
| Photos you add to tours | Showing them on your tour. Location and device metadata (EXIF) are removed on your phone before upload; the location is kept separately only for the map pin |
| Community activity: who you follow, likes, comments, collections, challenges and events you join, summits you reached, badges | Running the feed, notifications, leaderboards and the Community tab |
| Reports and blocks: content you report and why, people you block | Preventing abuse and moderating content |
| Push token (Firebase Cloud Messaging) and platform (iOS/Android) | Sending notifications to your phone |
| Crash reports (Firebase Crashlytics): app version, device model, OS version, technical error details, a random installation ID | Finding and fixing bugs |
| Technical logs: IP address, request time and path | Server security and operation |
Your location is only used after you start a recording (recording continues with the screen off) and when you ask the map to show where you are. We don't collect your location in the background when you're not recording.
3. Who can see what
- You choose each tour's visibility: only me, my followers (default) or everyone.
- You can hide part of the start and end of your tours (200 m–1 km) from others, so your home stays private.
- Your username, display name, profile photo and bio are visible to other users.
- Monthly leaderboards only count tours that aren't “only me”, and you can opt out of leaderboards.
- If you create an event, its details and the names of participants are visible to anyone who can see the event. A route you attach is shown to participants.
4. Who we share data with
Your data is stored on our own server at our hosting provider in Türkiye. We don't sell your data or share it for advertising. To provide the service we use:
| Service | What is sent | Where |
|---|---|---|
| Google Firebase Cloud Messaging | Push token and notification text | USA and other countries |
| Google Firebase Crashlytics | Crash reports (see above) | USA and other countries |
| Map tiles: OpenFreeMap, OpenTopoMap, CyclOSM, Waymarked Trails, Esri (satellite and hillshade), Amazon Web Services (elevation data) | Your phone's IP address and the area you look at | Europe, USA |
| BRouter (brouter.de) | Coordinates of the points you pick when planning a route | Germany |
| Photon (komoot) place search | The text you search for and the approximate map position | Germany |
| OpenStreetMap Overpass servers | The area for which peak data is requested | Europe, Russia |
No account details (email, name) are sent to map, routing or search services; only the requested area or points. If you ask your phone's maps app for directions, that app's own policy applies. We may disclose information to authorities where required by law.
5. Legal bases
We process your data to perform our contract with you (account, recording, sharing, notifications), for our legitimate interests in keeping the service secure and improving it (crash reports, moderation, technical logs), and to meet legal obligations. Where processing is based on consent, you can withdraw it at any time.
6. Retention
- Account, tour, photo and community data: while your account exists. When you delete a tour or photo, it is deleted.
- Sign-in codes: valid for a few minutes, then invalid.
- Crash reports: up to 90 days in Firebase.
- Push token: deleted when you sign out or uninstall the app.
7. Deleting your account
Delete your account in the app under Profile → Delete my account, or without the app on the account deletion page. This deletes your email address, name, profile photo, tours and tracks, photos, likes, follows, collections, badges, summits, challenges, events you created and the text of your comments. Copies in server backups are removed within the backup cycle.
8. Your rights
You have the right to access, correct, delete and receive a copy of your data, to object to processing and to complain to a supervisory authority (GDPR for users in the EU/EEA; KVKK art. 11 in Türkiye). You can do most of this yourself in the app (edit profile, delete tours and photos, delete account). For anything else, email alpinclub@militaryapp.net from your registered address; we reply within 30 days.
9. Security
Connections are encrypted (HTTPS). Passwords and sign-in codes are stored only as hashes. Photos and tracks are served only to people allowed to see them. No system is perfectly secure; if a breach happens we will inform you and the authorities as the law requires.
10. Children
Alpin Club is not for children under 13. If we learn that an account belongs to a child under 13, we delete it.
11. Changes
We may update this policy. If a change is significant we will tell you in the app; the date at the top shows the latest update.