Legal

Privacy Policy

Last updated 25 October 2026

The short version

There is no account. Your gear, lists and hikes are stored on your phone, not on our servers.
Nothing leaves your phone unless you use a feature that needs it: sharing a link, importing, searching for a place or connecting Strava.
When you share a hike or gear list, a copy goes on our server so anyone with the link can see it. Turn sharing off and the copy is deleted.
No ads, no analytics, no tracking and no cookies, in the app or on this website.

Who we are

HikeStash is the iPhone app for hiking gear and gear lists, the website at hikestash.app and the public pages for shared hikes and lists. It is run by Scott Lane ("we", "us"). If you have a question about this policy or your data, email support@hikestash.app.

What stays on your phone

Everything you put into HikeStash is saved in a database on your phone: your gear (names, brands, weights, prices, notes, website links), gear lists, hikes (names, places and map pins, dates, notes) and your settings. We don't have a copy and can't see it. You don't need to sign up or give us your name or email to use the app.

Because it's stored on your phone, it's part of your phone's own backups (iCloud or your computer), under Apple's terms. If you save a HikeStash backup file, it goes wherever you choose to put it.

Deleting the app deletes all of this. Turn off sharing on anything you've shared first (see Sharing a hike or gear list), because the app is the only thing that can remove its public copies.

Sharing is off until you turn on Public link on a hike's or list's Share page. When you do, the app sends a copy to our server, which gives it a link (hikestash.app/s/…) that anyone who has it can open without signing in.

What the copy includes

The hike's or list's name, and its gear: names, brands, quantities, weights, worn and consumable marks, website links and the totals and charts worked out from them.
Prices and cost totals, unless you turn off Show prices.
For a hike: its place, map pin, dates, length and website.
For a hike with linked Strava activities: a link to each activity on strava.com and the day it was on, nothing else from Strava. Only people Strava lets see that activity can open it.

It never includes your hike notes, packed ticks or anything else in the app.

Who can see it

Anyone with the link. The links are long and random, so they can't be guessed, but anyone you send one to can pass it on. Shared pages ask search engines not to list them (noindex), and they have no scripts or cookies. When someone pastes the link into the app's Import gear, their app downloads the same copy so they can add that gear to their own app.

Updating and removing it

While sharing is on, the app updates the copy when you change the hike or list. Turning Public link off, or deleting the hike or list, deletes the copy and its preview image from our server, and the link stops working within about a minute. If you're offline, the app tries again later. If you deleted the app before turning sharing off, email us the link and we'll remove it.

We can't take back copies other people have already made, such as gear they imported, screenshots, or the link preview a chat app saved when the link was sent.

Strava

Connecting Strava is optional, from Settings. You sign in on Strava's own page, and Strava asks whether to let HikeStash read your activities, including private ones, so they can be matched to your hikes.

Sign-in. Strava gives the app a one-time code. The app sends it, and later a refresh token, to our server, which adds HikeStash's Strava app key and passes the request on to Strava. Our server sends Strava's reply back to the app and doesn't keep the code or your tokens.
Your tokens and your Strava name are stored in your phone's secure storage (the iOS Keychain).
Your activities are fetched by the app straight from Strava. Their details (such as distance, time and elevation) are kept on your phone for up to 7 days to save asking again, along with which activities you linked to which hikes.
Disconnecting in Settings tells Strava to cancel HikeStash's access and deletes your tokens and the saved activity details from your phone. You can also cancel access on Strava's website under Settings, My Apps.

Your Strava data is only shown to you, as Strava's terms require. Shared hike pages show links to your activities, never their details. Strava's own privacy policy covers what Strava does.

Importing from LighterPack

When you import a LighterPack list, the app downloads that public list straight from lighterpack.com. LighterPack sees the request, as any website does, but we don't send it anything about you. HikeStash isn't connected with LighterPack.

Your location and maps

HikeStash asks to use your location only while you're using it, the first time you tap the locate button on the Hikes map or search for a place. You can say no and everything still works, or change it later in the iPhone's Settings.

On the map, it's used to show where you are and move the map there. The map is Apple Maps, so Apple supplies the map for the area you're looking at.
When you search for a place, the app sends what you type to Photon (photon.komoot.io), a free search service run by komoot over OpenStreetMap data, along with your rounded location (to about 10 metres) so nearby places come first. The phone's own place search (Apple's) is also used: to tell which state and country you're in, and to search instead when Photon finds nothing or can't be reached.
Opening directions or a place hands it to your maps app.

Your location is never stored by HikeStash and never sent to our server. A hike's map pin is only the place you picked for it, and it leaves your phone only if you share that hike.

App updates and crash reports

The app checks Expo's update service (expo.dev) for small updates when it opens. Like any download, that request includes your phone's address on the internet and the app's version and platform, but nothing you've put in the app.

HikeStash has no analytics, advertising or crash-reporting code of its own. If you've chosen in your iPhone's settings to share analytics with app developers, Apple may give us anonymous crash reports and usage numbers, under Apple's privacy policy.

This website and our server

The website, the shared pages and the server behind sharing and Strava sign-in run on Cloudflare. They use no cookies, analytics or third-party scripts or fonts. Like any web host, Cloudflare handles technical details of each visit, such as your IP address and browser, to deliver the page and protect against abuse. Our server uses your IP address only to limit how many requests one address can make each minute, and doesn't keep it. See Cloudflare's privacy policy.

Who we share data with

We don't sell or rent your data, and we don't share it with anyone for advertising. The only other services involved are the ones named above, each used only when you use the feature that needs it: Cloudflare (hosting and sharing), Strava (if you connect it), LighterPack (if you import from it), komoot's Photon and Apple (place search and maps) and Expo (app updates). We may disclose information if the law requires it.

Your choices and rights

Almost everything is on your phone and under your control: edit or delete it in the app, or delete the app. For anything on our server, which is only the shared copies you've turned on, turn sharing off or ask us to remove it. Depending on where you live, you may have the right to ask what we hold about you, to correct or delete it, or to complain to your privacy regulator. Email support@hikestash.app.

This policy is governed by the law of Victoria, Australia.

Children

HikeStash isn't aimed at children under 13 and we don't knowingly collect anything from them. As there's no account, the app doesn't ask anyone's age.

Changes to this policy

If HikeStash changes what it collects or shares, we'll update this page and the date at the top.

This policy describes how HikeStash works as of the date above.