HutScanner Privacy Policy

Last updated: 29 August 2026

HutScanner is operated by Robert McLeod, based in the United Kingdom. Contact: [email protected]. For the purposes of UK and EU data protection law, Robert McLeod is the data controller for the limited analytics described below, for the purchase email address, for the newsletter list and for availability alerts.

This policy covers the HutScanner app and the pages on hutscanner.com.

HutScanner is built to need as little of your data as possible. There are no accounts and no sign-in, almost everything happens on your device, and the only data we gather is anonymous, opt-out usage analytics - plus, if you buy a subscription on the web, the email address needed to deliver your access (see Payments and subscriptions below), and, if you choose to ask for it, the email address you give us for our newsletter (see The newsletter below) or for an availability alert (see Availability alerts below).

No accounts, no sign-in

HutScanner has no user accounts and no login. We do not ask for your name, email address or any other personal information to use the app, and we never receive anything that identifies you. There are three exceptions, all of which you choose: buying a subscription on the web, where the payment step collects an email address (see Payments and subscriptions), signing up for our newsletter (see The newsletter), and asking to be emailed when a hut has space (see Availability alerts). None of them creates an account, a password or a profile.

If you enter your email address in a newsletter signup form on our website, we use it to send you our monthly email about hut availability and new regions. That is the only thing it is used for.

Nothing else is collected. We ask for an email address and nothing more. No name, no account, no password, no profile. We do not track which links you click in the emails.
We confirm before adding you. When you submit the form we send you a single email with a confirmation link. You are added to the list only when you click it. Until then your address sits in temporary storage on Cloudflare for up to 24 hours and is then deleted automatically. If you never confirm, we keep nothing.
Who processes it. Once confirmed, your address is stored by Resend, the email provider that sends the newsletter on our behalf as our processor. Resend also handles the unsubscribe link and stops sending to addresses that bounce.
Leaving. Every issue carries a one-click unsubscribe link. You can also ask us to delete your address at any time by emailing [email protected], and we will remove it from the list.
How long we keep it. Until you unsubscribe or ask us to delete it. We do not sell, rent or share the list with anyone.

Our lawful basis for sending you the newsletter is your consent, which you give by confirming the link and can withdraw at any time.

Availability alerts

If you ask the app to tell you when a sold-out hut has space, we ask for an email address and nothing more. The alert sends you an email when the nights you chose become bookable. That is the only thing it is used for.

What we store. Your email address, the huts and nights you asked about, your party size and any label you gave the watch. No name, no account, no password, no profile. We do not track which links you click in the emails.
We confirm before we start. The first time you use an address we send you a single email with a confirmation link, and the watch only starts when you click it. Until then it sits in temporary storage on Cloudflare for up to 24 hours and is then deleted automatically. If you never confirm, we keep nothing. Once an address has been confirmed, further watches from the same address start straight away.
Where it lives. Unlike the newsletter, an active watch is stored by us, on Cloudflare's infrastructure, because we have to compare it against each morning's availability check. Resend, our email provider and processor, sees your address each time we send you a confirmation or an alert. Nobody else does.
How many emails. At most one alert email a week, listing everything that opened up across your watches, and nothing else. Every email carries a one-click link to stop that watch or all of them.
How long we keep it. A watch deletes itself automatically the day after the last night it covers, so nothing outlives the trip it was about. You can stop it earlier from the link in any email, or ask us to delete it by emailing [email protected]. After a watch has gone we keep a one-way fingerprint of the address (not the address itself) so that you do not have to confirm again next time, and to limit how many emails any one address can trigger.

Our lawful basis for sending you alerts is your consent, which you give by confirming the link and can withdraw at any time by stopping the watch.

What stays on your device

Everything you create in the app - routes you build, saved itineraries, terrain preferences, region selections and any availability notes you enter by hand - is stored locally on your device only. It is not sent to us and is not synced anywhere. Removing the app removes this data.

Network connections the app makes

Map tiles are loaded from OpenFreeMap (openfreemap.org). Like any web request, this shares your device's IP address with that service so it can deliver the map imagery.
Hut availability updates are fetched from our content delivery network (cdn.hutscanner.com, hosted on Cloudflare). This downloads availability data to your device; it shares your IP address with the CDN to deliver the file, and sends no personal data.
App updates are checked through Expo's update service (expo.dev), which lets us ship bug fixes without a full app-store release. When the app starts it asks that service whether a newer version is available; like any web request this shares your device's IP address and basic technical details (such as the app and operating-system version), and sends no personal data.

These are standard requests needed to show the map and keep availability current. We do not use them to identify or track you.

Anonymous usage analytics

To understand which features and regions are useful and to find bugs, the app sends anonymous product-usage events to PostHog, our analytics provider. These events are processed on PostHog's European Union infrastructure on our behalf.

This data is not linked to your identity. The app generates a random identifier the first time you open it, stored only on your device, so that events from one install can be counted together. It is not your name, email, device serial or advertising ID, and it is reset if you reinstall the app.

What an event records:

The action taken - for example opening the app, selecting a region or hut, running a route search, exporting a GPX or booking list, viewing the subscription screen, or changing a setting.
Non-identifying context: the region and hut identifiers involved, the coarse shape of a route (such as how many nights), the app version, your platform (iOS, Android or web) and a per-session number.
On the web only, your browser's user-agent string - the standard description of browser and operating system that every browser already sends with every request it makes. We pass it on for one reason: it is what lets our analytics provider recognise and discard automated traffic (search-engine crawlers and the like), which would otherwise be counted as visitors. We do not use it to identify you.

What an event never contains: your name or email, the precise coordinates of your location, or any free text you type. As with any internet request, your device's IP address is visible to PostHog in transit and may be used to derive an approximate (city-level) location; we do not use it to identify you and do not store it as part of your profile.

You can turn this off. Open Settings → Privacy and switch off “Share anonymous usage data”. Once off, the app stops sending any analytics. Our lawful basis for this limited processing is our legitimate interest in maintaining and improving the app, balanced by keeping the data anonymous and giving you a one-tap opt-out.

Anonymous analytics on hutscanner.com

A small number of pages on hutscanner.com - currently the daily Tour du Mont Blanc availability page and its partner-linked variants - send one anonymous event to PostHog when you click through to a hut's own booking page: which hut, which night, and which page sent you. Nothing else on the page is tracked; there is no page-view event and no cookie.

Each page load generates a random id, used only to attach that one click event - it is not stored after you leave the page and is not the same id the app uses. We cannot link this to you, to any other visit, or to the app's analytics. The request is not sent if your browser sends Do Not Track. Because nothing is tied to a person, there is no per-visitor setting to switch off; withholding Do Not Track, or an ad-blocker that blocks PostHog, has the same effect.

Our lawful basis is the same legitimate interest as the app's analytics above - knowing whether these pages are actually sending people to book a hut - balanced by sending the minimum needed to answer that and nothing that identifies you.

Payments and subscriptions

HutScanner's core map and routing are free. Some features require a paid subscription. We do not run our own payment system and we never see or store your card details - payments are handled entirely by the platform you buy through:

In the mobile apps, payments are processed by the Apple App Store or Google Play. We receive only a pseudonymous purchase identifier confirming your entitlement - not your name, email or card details.
On the web, payments are processed by Stripe. Stripe collects your email address and card details to take the payment, under Stripe's privacy policy. We receive your email address so we can send your access key and let you restore or recover your purchase, and we store it for that purpose only. We do not receive or store your card details.

Our lawful basis for this limited processing is performance of our contract with you - providing the subscription you purchased. You can ask us to delete your purchase email by emailing [email protected], subject to any records we are required to keep for tax or accounting.

What we don't do

No advertising and no advertising trackers.
No analytics that identify you, and no cross-app or cross-site tracking.
No selling or sharing of your data with advertisers or data brokers.
No location tracking. The app does not request your device's location.
No cookies, on the app or on hutscanner.com.

Hut availability data

Bed availability shown in the app is gathered from hut booking platforms' public pages. It describes huts, not people, and contains no personal data. It is indicative only - always confirm directly with the hut.

Children

HutScanner is not directed at children under 13 and we do not knowingly collect their data (beyond the limited purchase email described above, which is only provided by paying customers).

If this changes

If we later add optional features such as accounts or a subscription, we will update this policy and explain what those features collect before you use them. The latest version always lives at this page.

Your rights and contact

For the anonymous analytics, because it is not linked to your identity we cannot single out your records to retrieve or delete them - but you can stop all collection at any time from Settings → Privacy, and uninstalling the app removes the on-device identifier entirely. You have the right to object to this processing, which the opt-out gives effect to immediately. If you bought a subscription on the web, we also hold the email address you provided at checkout; you can ask us to access or delete it (subject to tax/accounting retention) by emailing [email protected]. If you signed up for the newsletter, you can unsubscribe from the link in any issue, or ask us to access or delete your address at the same address. If you set an availability alert, the stop link in any alert email deletes it, or ask us at the same address.

If you have any question about your privacy, email [email protected] and we will respond within one month. You can also contact the UK Information Commissioner's Office (ico.org.uk) or your local data protection authority.