Legal
Privacy Policy
This Policy explains how YourSummit handles personal information when you use the Service.
Last updated: August 21, 2026
1. Information We Collect
| Category | Examples | Source |
|---|---|---|
| Account information | Name, email, password (hashed), profile details | Provided by you |
| Ascent & verification data | Climb details, dates, routes, GPS/location data, photos, descriptions | Provided by you |
| Payment information | Billing name, payment method (card details tokenized), transaction history | Collected via Stripe, our payment processor |
| Usage data | Log data, device/browser type, IP address, pages visited | Automatically collected |
| Communications | Emails, support requests, feedback you send us | Provided by you; sent via Resend |
2. How We Use Information
- To create and maintain your account and provide the Service;
- To review and process ascent verification requests, once verification is available;
- To process payments for paid verification services, once available;
- To send transactional communications (confirmations, verification status, security notices);
- To send optional marketing or product updates, where you have consented;
- To feature your public content (such as photos, videos, or ascent records) in YourSummit's marketing, social media, hall-of-fame, or trend/footprint features, where you have made that content public;
- To maintain security, prevent fraud, and enforce our Terms of Use;
- To improve the Service, including analyzing aggregate usage patterns.
3. Legal Basis for Processing (EEA/UK Users)
Where the General Data Protection Regulation (GDPR) applies, our legal bases for processing include: performance of a contract (providing the Service you signed up for), legitimate interests (security, fraud prevention, service improvement), consent (marketing communications, featuring public content in our own marketing, optional data), and legal obligation (tax and payment records).
4. Third-Party Service Providers
We use the following categories of service providers ("processors") to operate YourSummit. Each processes data only as necessary to provide their service to us and under contractual data protection obligations:
| Provider / Category | Purpose | Data Involved |
|---|---|---|
| Hosting & infrastructure (e.g., Vercel, Cloudflare) | Website hosting, content delivery, security/DDoS protection | IP address, usage logs |
| Database service | Storage of account, ascent, and verification data | Account data, ascent records, uploaded content |
| Payments (Stripe) | Payment processing for paid verifications, once available | Billing information, payment method, transaction history |
| Email delivery (Resend) | Transactional and account-related emails | Email address, message content |
| Timestamping (OpenTimestamps) | Independent, cryptographic timestamping of verified records — upcoming, not yet in use | Cryptographic hash of record data (not personal data itself) |
We do not sell your personal information to third parties.
5. Public Profile & Ascent Records
If you choose to make your profile or ascent records public, that information (including your name, climbing history, and any photos or videos you attach) will be visible to other users and, depending on your settings, to the public internet. You control this visibility through your account settings. See Section 2 above regarding YourSummit's own use of public content in marketing and features such as hall-of-fame or trend/footprint pages.
6. International Data Transfers
YourSummit is based in the United States, and your information may be processed and stored in the U.S. or other countries where our service providers operate. Where required, we rely on appropriate safeguards (such as Standard Contractual Clauses) for transfers of personal data from the EEA/UK to the U.S.
7. Data Retention
We retain personal information for as long as your account is active or as needed to provide the Service, comply with legal obligations, resolve disputes, and enforce agreements. Once verification and independent timestamping are available, verified ascent records with timestamps may persist in timestamping infrastructure outside our direct control even after account deletion, as this is inherent to the verification method.
8. Your Rights
Depending on your location, you may have the right to:
- Access, correct, or delete your personal information;
- Object to or restrict certain processing;
- Request a portable copy of your data;
- Withdraw consent for marketing communications at any time;
- Lodge a complaint with your local data protection authority (EEA/UK users).
To exercise these rights, contact us at hello@yoursummit.org.
9. Additional Notice for California Residents (CCPA/CPRA)
California residents have the right to know what personal information we collect, request deletion, opt out of "sale" or "sharing" of personal information (we do not sell personal information), and not be discriminated against for exercising these rights. To submit a request, contact us at hello@yoursummit.org.
10. Children's Privacy
The Service is not directed to individuals under 18. We do not knowingly collect personal information from children. If you believe a child has provided us information, contact us so we can delete it.
11. Security
We use commercially reasonable technical and organizational measures to protect personal information, including encryption in transit and access controls. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.
12. Changes to This Policy
We may update this Privacy Policy from time to time. Material changes will be communicated via the Service or by email. The "Last updated" date at the top reflects the most recent revision.
13. Contact Us
For questions about this Privacy Policy or to exercise your privacy rights, contact: hello@yoursummit.org, Assure eServices, Inc., Bedford, MA.