Privacy Policy

Who runs Campfire

Campfire is a hiking-trip planner built and run by Illia Kharchuk in Ukraine — one person, not a company. They are the controller of the data described below, and the support address at the foot of this page reaches them directly.

What is stored

Only what the app needs to work.

• Your name, username, and email. A password is stored only as a hash, never as itself; a Google sign-in stores the identifier Google returns and no password at all.
• Everything you type into a trip: name, dates, destination, travel notes, gear and weights, meals, tents, checklists, crew roles, and your weight coefficient.
• A profile picture, if you upload one, stored on the app’s own server rather than an image host.
• Your language and theme, the trip you had open last, and the server’s own log, which can include your IP address, the time, and the path requested.

Cookies

Four, each doing a job you asked for: staying signed in, your language, light or dark, and reopening your last trip. No advertising cookie, no analytics script, no third-party tag.

Why it is stored

To run the trip you are on: show a roster, add up a pack, keep you signed in. The basis is the agreement between you and Campfire, since the app cannot do the one thing it exists for without this; the logs rest on keeping the service running and secure.

Who else sees it

Three, and nobody beyond them: no advertiser, no data broker, no analytics company, no sale. The one exception is a legally binding order from an authority, checked before it is answered.

• The people on a trip with you see your name, picture, gear, weights, and roles on that trip. Treat a trip as visible to everyone holding its invite code.
• If you sign in with Google, Google learns that you signed in. Nothing else is sent.
• The rented server the app and its database run on. It is in Helsinki, Finland, so your data is stored inside the EU; the person running Campfire administers that server from Ukraine and can read what is on it.

How long it is kept

Account data stays while the account does. Ask at the support address to delete it — there is no delete button in the app yet — and the deletion runs at once: everything that was only yours goes. A trip where you were the only participant is deleted whole; in a shared trip your group gear returns to the pool and the trip stays with the others. Sessions expire on their own. Logs are kept only while they are useful for running and debugging the service.

What you can ask for

Ukrainian data protection law gives you these, and the GDPR too if you are in the EU. Ask at the support address; the answer comes within thirty days.

• A copy of everything stored about you.
• A correction — name, username, and email you can already edit in the app.
• Your account and trip data in a machine-readable file.
• Deletion of your account and its data. If you are the last owner of a trip others are still on, hand ownership over first.
• To object to a use, restrict processing while a dispute is settled, or withdraw a consent you gave.
• To complain — to the Ukrainian Parliament Commissioner for Human Rights, or your own supervisory authority if you are in the EU.

How it is protected

Passwords are stored only as hashes, never in the clear and never written to a log. Everything travels over HTTPS. None of that makes a breach impossible; if one happens that puts you at risk, you will be told.

Age

Campfire is not built for children. Do not create an account if you are under 16, or under the age your own country sets for agreeing to this yourself.

Changes to this page

A change to what happens to your data is announced in the app, not slipped in quietly.

Questions about any of this

Write to the address below. It reaches a person, not a ticket queue.