Privacy Policy

Last updated: 27 October 2026

This page explains which personal data alpventurer.com processes when you visit it, why, and what rights you have. alpventurer is my personal blog about hiking and travel photography.

Who is responsible

The person responsible for this site under the GDPR is Granit Temaj. You can reach me at hello@alpventurer.com.

In short

You can read everything on this site without an account.
Visitors from Europe (and wherever the country cannot be told) are asked first: Google Analytics and Microsoft Clarity only run if you agree in the cookie banner.
The forms (newsletter, trail alerts, comments and licence requests) are protected from spam bots by Cloudflare Turnstile, which only loads when you use a form.
Maps load their map images from OpenStreetMap or OpenTopoMap (the 3D views also load mountain heights from Amazon Web Services).
Fonts, scripts and the map software are served from this site itself, not from Google or other content networks.

Hosting and server log files

This site is hosted by Hostinger International Ltd., 61 Lordou Vironos Street, 6023 Larnaca, Cyprus, which processes data on my behalf under a data processing agreement (Art. 28 GDPR).

When you open a page, your browser automatically sends technical information to the server: your IP address, the date and time, the page requested, the page you came from, and your browser and operating system. The server stores this in log files so that it can deliver the site, keep it secure and find errors. The legal basis is my legitimate interest in a secure, working website (Art. 6(1)(f) GDPR). The logs are deleted as soon as they are no longer needed for these purposes.

Security

The site is protected by the Wordfence firewall (Defiant, Inc., USA). It runs on this site's server and checks requests, including IP addresses, to block attacks and stop people guessing passwords. To do that it may exchange the IP addresses of suspected attackers with Defiant. The legal basis is my legitimate interest in protecting the site and its visitors (Art. 6(1)(f) GDPR). Details: wordfence.com/privacy-policy.

The forms on this site (newsletter, trail alerts, comments and licence requests) are protected by Cloudflare Turnstile, a service of Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA. It loads only when you start using a form. To tell people from bots, Turnstile looks at technical information from your browser and device (such as your IP address, browser details and how the page is used) and gives the form a token, which this site checks with Cloudflare when you send the form. Usually you see nothing; only if Turnstile is unsure does it show a short check. Cloudflare, Inc. is certified under the EU–US Data Privacy Framework. The legal basis is my legitimate interest in keeping the forms free of spam and fake sign-ups (Art. 6(1)(f) GDPR); reading information from your device is strictly necessary for what you asked for (§ 25(2) no. 2 TDDDG). Details: cloudflare.com/turnstile-privacy-policy.

If you visit from the European Union, the European Economic Area, the United Kingdom, Switzerland, the Western Balkans or Turkey, or if your country cannot be told, a cookie banner asks for your permission first. Nothing that is not strictly necessary is loaded or stored before you click “Accept”. Elsewhere, the statistics run straight away, with a notice and a button to turn them off. If your browser sends a Global Privacy Control signal, they do not run at all.

Necessary: the cookie alp_consent remembers your choice for 12 months, so you are not asked again on every page. Legal basis: § 25(2) no. 2 TDDDG and Art. 6(1)(f) GDPR.
Statistics: Google Analytics and Microsoft Clarity, described below. Legal basis: your consent, § 25(1) TDDDG and Art. 6(1)(a) GDPR.

You can change or withdraw your choice at any time with “Cookie settings” at the bottom of every page. If you withdraw, the statistics cookies on this site are deleted. Withdrawing does not affect anything that happened before.

Which country you visit from. To know which of these rules applies, the site looks up the country of your IP address once per visit, on its own server, in the free “IP to Country Lite” database by DB-IP (licensed under CC BY 4.0). Your IP address is not stored and not sent anywhere for this; only the result (“ask first” or “notice”) is kept in your browser until you close the tab. The legal basis is my legitimate interest in asking for consent wherever the law requires it (Art. 6(1)(f) GDPR) and the legal obligation to do so (Art. 6(1)(c) GDPR).

Google Analytics

If you agree, this site uses Google Analytics 4, a service of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. It tells me how the site is used: which pages are read, for how long, which device and browser are used, the approximate location (country or city), and how visitors found the site. It also counts a few actions on the site: signing up for the newsletter, saving a guide to My list, marking a hike as walked, printing a guide, downloading a GPX file, opening a partner link and sending a photo licence request (only that it happened and on which page, never what you typed). Google Analytics 4 does not store full IP addresses.

Google signals and ad personalisation are switched off, and the data is not used for advertising. Google Analytics sets the cookies _ga and _ga_<ID>, which last up to two years. Data may be transferred to Google LLC in the USA. Google LLC is certified under the EU–US Data Privacy Framework, for which the European Commission has issued an adequacy decision (Art. 45 GDPR). Google keeps the data for the retention period set in Google Analytics, at most 14 months.

Legal basis: your consent (Art. 6(1)(a) GDPR, § 25(1) TDDDG), which you can withdraw at any time in the cookie settings. Google's privacy policy: policies.google.com/privacy.

Microsoft Clarity

If you agree, this site also uses Microsoft Clarity, a service of Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland. Clarity shows me how pages are used, so I can find what is confusing or broken: where people click and tap, how far they scroll, and anonymised recordings of page visits (what you type into forms is masked and not recorded). It also records your device, browser, screen size and approximate location.

Clarity sets the cookies _clck (12 months) and _clsk (1 day) on this site, and Microsoft may set its own cookies, such as MUID, on clarity.ms. Data may be transferred to Microsoft Corporation in the USA, which is certified under the EU–US Data Privacy Framework. Microsoft keeps recordings for 30 days and other usage data for up to 13 months.

Legal basis: your consent (Art. 6(1)(a) GDPR, § 25(1) TDDDG), which you can withdraw at any time in the cookie settings. Microsoft's privacy statement: privacy.microsoft.com/privacystatement.

If you subscribe to my newsletter, the form sends your email address to Brevo (Brevo SAS, 106 boulevard Haussmann, 75008 Paris, France), which I use to send it. Brevo then emails you a link to confirm (double opt-in), and you only join the list after you click it. Brevo records when you signed up and confirmed, so your subscription can be proven. This site does not keep your address. To stop the form being misused, it keeps only a scrambled (hashed) form of your IP address and email address, for at most one day.

The emails contain a small tracking image and tracked links, so Brevo can tell me whether an email was opened and which links were clicked. Brevo processes the data on my behalf under a data processing agreement (Art. 28 GDPR).

Legal basis: your consent (Art. 6(1)(a) GDPR). You can unsubscribe at any time with the link in every email, or by writing to hello@alpventurer.com. Your address is then removed from the list. Brevo's privacy policy: brevo.com/legal/privacypolicy.

Contacting me

If you write to me by email or through a contact form, I use what you send me (usually your name, email address and message) only to answer you. The legal basis is my legitimate interest in answering you (Art. 6(1)(f) GDPR), or the steps before a collaboration you asked about (Art. 6(1)(b) GDPR). I delete the messages when the conversation is over, unless the law requires me to keep them.

Licence requests

When you ask to license a photograph with the form on the Photography page, I receive your name, your email address, what the photograph is for and your message, by email and in the site's admin. I use them only to answer you and, if we agree, for the licence. The legal basis is the steps before a contract you asked for (Art. 6(1)(b) GDPR). The request is protected by Cloudflare Turnstile (see Security). I delete requests that did not lead to a licence after two years; a licence and its correspondence are kept as long as the law requires for business records.

My list

The guides you save with the heart are kept only in your own browser (local storage), not on the server, and are not sent anywhere. Clearing the list or your browser data removes them. A link you share to a list contains only the guides' numbers.

The same goes for the hiking passport: the guides you mark with “I walked this one” are kept only in your browser, and the passport page adds them up there. A link you share to your passport contains only the guides' numbers; an image of it is made in your browser and saved or shared by you.

The same goes for Save for the trail: a guide you save for the trail (its page, photos and GPX file, and the map tiles you looked at) is kept only in your browser's storage on your device, so it opens without a signal. Nothing about it is sent to the server or to anyone else. You remove it on the My list page, or by clearing your browser's data.

Trail alerts

If you ask for trail alerts on a guide, I keep your email address, what you follow (the guide, and if you tick it, new hikes in its country), and when you signed up and confirmed. You first get an email with a link to confirm (double opt-in); without it nothing is sent, and the address is deleted after a week. After that you get an email when a trail report is published on the guide, when I tell followers about an update, or when I publish a new hike in that country, and nothing else. The emails are sent through Brevo (see Newsletter), which processes them on my behalf under a data processing agreement (Art. 28 GDPR). The form is protected by Cloudflare Turnstile (see Security). Legal basis: your consent (Art. 6(1)(a) GDPR). Every email has a link to stop those alerts or all of them; what you stop is deleted at once. You can also write to hello@alpventurer.com.

Comments

If you leave a comment, the site stores your name, email address, the comment, its time, your IP address and your browser's user agent. The form asks for no website, and none is shown. A trail report adds the day you walked and what the path was like, shown with your comment. These are kept to show the comment and to fight spam and abuse. Your email address is never published. The form is protected by Cloudflare Turnstile (see Security). The legal basis is my legitimate interest in running a comment section free of spam (Art. 6(1)(f) GDPR). Comments are kept as long as they are on the site. Write to me and I will delete yours.

If you add photos to a trail report, they are stored with the report and shown with it, with your name, once it is approved. Before they are stored, they are made smaller and saved again, which removes the location and camera details inside them; the files as you sent them are not kept. With the tick box you confirm that you took them and agree that they are shown. The legal basis is your consent (Art. 6(1)(a) GDPR). Write to me and I will delete them, with the report or on their own.

Maps

Pages about destinations, guides and photographs show maps. The map software (Leaflet) and the routes are served from this site, but the map images come from the servers of the OpenStreetMap Foundation, St John's Innovation Centre, Cowley Road, Cambridge, CB4 0WS, United Kingdom. To load them, your browser sends your IP address and browser details to those servers. The European Commission has issued an adequacy decision for the United Kingdom. The legal basis is my legitimate interest in showing where the places I write about are (Art. 6(1)(f) GDPR). Privacy policy: osmfoundation.org/wiki/Privacy_Policy.

If you switch a route map to Topo, the map images come from OpenTopoMap (opentopomap.org, run from Germany) instead; your browser then sends your IP address and browser details to their servers. The legal basis is the same.

The globe on the Summits page and Fly over in 3D on a route use the OpenTopoMap images too, and for the shape of the mountains, height tiles (the free Mapzen terrain tiles) stored with Amazon Web Services, Inc., 410 Terry Avenue North, Seattle, WA 98109, USA. The globe loads them when you scroll to it, the 3D view only when you open it; your browser then sends your IP address and browser details to those servers. The 3D map software (MapLibre) is served from this site. Amazon Web Services, Inc. is certified under the EU–US Data Privacy Framework. The legal basis is the same. Privacy notice: aws.amazon.com/privacy.

The weather forecast on a guide comes from the Norwegian Meteorological Institute (MET Norway). This site asks for it itself, about once an hour per place, so nothing about you is sent to them.

Read counts

To show which guides are read the most, the site counts how often each post is opened. Only the count per post is stored, not who read it.

Partner links

Under the guides, "Plan the trip" links to Booking.com, GetYourGuide and Amazon. When such a link carries my partner ID, the partner may pay me a small commission if you book or buy, at no cost to you; the box says so. Nothing is sent to these partners when you read the page. Only when you click a link does the partner's site open and learn, through the link, that you came from alpventurer; from then on its own privacy policy applies.

Links to other sites

Links to Instagram, Facebook, LinkedIn and other sites, and the share buttons on each guide, are plain links. Nothing is sent to these services until you click. After that, their own privacy policies apply.

Your rights

You have the right to:

access the data I hold about you (Art. 15 GDPR),
have it corrected (Art. 16) or deleted (Art. 17),
restrict its processing (Art. 18),
receive it in a portable format (Art. 20),
object to processing based on legitimate interests (Art. 21),
withdraw any consent at any time, with effect for the future (Art. 7(3)).

Write to hello@alpventurer.com.

You can also complain to a data protection supervisory authority (Art. 77 GDPR), in particular in the country where you live or work, or where you think the breach happened.

Changes

I update this page when the site changes. The date at the top shows the latest version.