Privacy policy
Last updated: 5 November 2026. Effective from that date.
This policy explains what personal data FindTrekkingPartner ("we", "us") collects, why, who can see it and the choices you have. We designed the platform to be private by default.
The short version
- We do not sell or share your data with agencies, advertisers or anyone else, and we do not show ads that use your personal data.
- Nothing personal is public unless you choose to make it public.
- Your contact details are never shown to anyone unless you explicitly share them, and you can revoke a share at any time.
- Analytics run only after you accept cookies, and we never send your name or email to our analytics provider.
- You can download your data or delete your account at any time.
- You must be 18 or older to use FindTrekkingPartner.
Who is responsible for your data
The data controller is the operator of FindTrekkingPartner: Nep Gem Private Limited, a company registered with the Office of the Company Registrar, Nepal, under the Companies Act, 2063 (2006) (Company Registration No. 391994/82/83, incorporated on 12 May 2026), registered at Budhanilkantha, Kathmandu, Nepal. For every privacy question or request, write to privacy@findtrekkingpartner.com (we answer within 30 days). Safety reports go to safety@findtrekkingpartner.com.
What we collect
- Account data: handled by Clerk (our sign-in provider): email address, sign-in method, and optionally a phone number. We never store passwords.
- Profile data: display name, username, date of birth, gender (optional), nationality, where you are coming from, the area you are currently staying in (chosen from a fixed list, never an address or GPS), languages, bio, travel style, trek history, certifications and availability.
- Private contacts: the email, phone and messaging IDs you choose to add (WhatsApp, Instagram, Telegram, Signal, WeChat, LINE, KakaoTalk, Zalo, Viber). These are stored in a separate, protected table.
- Activity: trips you post, join requests, saved trips, messages, reports and blocks.
- Uploads: photos you upload. We re-encode every image and strip all metadata, including GPS location.
- Approximate country: when you first visit, we use the country from your connection (a two-letter code, never your IP address) to suggest a language and currency. We do not store or log your IP address.
Who can see what
Every profile field has a visibility setting:
- Public: anyone, including visitors (who only ever see a blurred photo).
- Community: signed-in trekkers (the default for most fields).
- Matched members: people who share a trip or group with you, or whom you have connected with.
- Nobody.
Your date of birth is never shown, only an age range (or your exact age if you opt in). "Currently staying in" defaults to matched members only. Your profile as a whole can be Public, Community or Hidden. Visitors see trip cards without the host's name, photo or exact dates.
Contact sharing
Contact details are shared only when you choose a person or group and the channels to share. Anyone you share with can see those channels until you revoke the share. Revoking hides them immediately, but people may already have saved them, so share only with people you trust.
Messages
Chat messages are visible only to members of that conversation. If you leave a group, you lose access to it. Notification emails never contain message text, contact details, your age or location.
Reviews
If you review a point of interest along a route (a teahouse, a medical post, a viewpoint…), other users can see your display name, your level and whether you've "Trekked here" — based on a trip you completed or trek history you added for that region. Review text is public to anyone who can see that point's map and may not contain links, emails or phone numbers. Reviews can include up to 3 photos. Like other photo uploads, we re-encode them and strip all metadata, including GPS location, and remove them automatically if the review they belong to is hidden or removed.
Route maps and uploaded GPX files
Itinerary and region maps are built from public map data (OpenStreetMap, open elevation data) and show no personal information. If you upload a GPX file for your trip's own route, we remove all timestamps and device or waypoint metadata before storing it, and delete the first and last 500 metres of the track so your exact starting point (such as your guesthouse) is not shown. That uploaded route is visible only to confirmed members of that trip, never to visitors or the public.
Point of interest photos and contact details
Photos shown on a point of interest (a teahouse, viewpoint, medical post…) come from Wikimedia Commons under an open licence with the photographer credited, from our admin team, or from members' review photos above. A phone number, website or "Open in Google Maps" link shown on a point of interest is business information from public sources or from an accommodation provider we have permission to list — it is never personal data about you or other members. Clicking a website link or "Open in Google Maps" takes you to that third party's own site, outside FindTrekkingPartner, governed by its own privacy policy.
Your itineraries, gear and share links
Itinerary plans you build — day-by-day routes, notes and booking status — are private to you. Your gear list and packing checklists always stay private, even after you post a plan as a trip. If you create a share link for a plan, anyone with that link can view a read-only copy with no owner name attached; you can revoke the link at any time. If you post a plan as a trip, confirmed members of that trip can see its full day-by-day details; visitors and the public only ever see village-level stop names, with no dates, lodge names, notes or booking status.
Analytics and cookies
We use PostHog for product analytics, only after you accept the cookie banner. We identify you only by an internal random ID, never your name or email. Session recordings mask all text and inputs and are disabled on chat and settings pages. IP capture is turned off.
Google Analytics 4 (Google) counts page views, landing pages, referrers (for example Google search), approximate country and device type, and a few events (sign-up, posting a trip, sending a join request, using the cost calculator). We do not enable advertising features: ad storage, ad personalisation and ad user data are denied, we send no user ID, names, emails or message text, and we strip query strings (except campaign utm_ tags) and private link tokens from page addresses.
Microsoft Clarity (Microsoft) records anonymised heatmaps and session replays of public marketing pages to show us where visitors click and scroll. All text is masked by default, and it never runs on chat, settings, onboarding, sign-in, shared itinerary links or admin pages.
PostHog, Google Analytics and Clarity run only after you accept analytics; if you decline or withdraw, they do not load and stop recording. You can withdraw consent at any time from the cookie settings link in the footer.
Recommendations and marketing emails
Recommendations are off by default for new accounts. We ask you in onboarding (the box is unticked) and you can change it any time under Settings → Privacy → Use my activity to recommend trips. Only if it is on do we note which regions, trips and guides you look at, save or ask to join while you are signed in. This activity stays in our database, is never shared or sold, and is only used to rank trips for you and to send occasional recommendation emails — for example, "a trip you saved has one spot left". Switching it off deletes the activity we stored, stops recording it and stops recommendation emails. Accounts created before 5 November 2026 keep the setting they already have.
Promotional emails (trip ideas, route guides and offers) are opt-in only. We send them only if you ticked the box when setting up your profile or turned them on under Settings → Notifications. Every recommendation or promotional email has a one-click unsubscribe link, and we send at most two of them a week.
Trips on our social media
We may feature public trips on our Facebook Page, Instagram account and the Facebook groups we run, to help hosts find partners. These posts only show the route, month, trip length, level, spots left and estimated cost — never the host's name, photo, profile, trip title or exact dates. Follow-up comments only mention counts (for example "2 more trekkers joined") and the trip's status. Featuring is off by default for new trips: we only post a trip if its host switches on Feature this trip on our Facebook and Instagram when posting or under Edit trip. Hosts can switch it off again at any time; hidden, invite-only or opted-out trips are removed from our Page and Instagram automatically. Trips posted before 5 November 2026 keep the choice their host made.
Legal bases
- Contract (GDPR Art. 6(1)(b)): account, profile, trips, join requests, chat and contact sharing, which are the service you ask for.
- Consent (Art. 6(1)(a), and your consent under the Nepal Individual Privacy Act, 2075): analytics and replay cookies (PostHog, Google Analytics, Clarity), promotional emails, activity-based recommendations, featuring your trip on social media and optional profile fields. You can withdraw consent at any time without affecting what happened before.
- Legitimate interests (Art. 6(1)(f)): security, abuse and spam prevention, rate limiting, handling reports and keeping the community safe.
- Legal obligation (Art. 6(1)(c)): where Nepali or other applicable law requires us to keep or hand over data.
Service providers
We use these processors to run the service:
- Clerk: authentication
- Supabase: database and realtime chat
- Cloudflare R2: image and file storage
- Resend: transactional emails
- PostHog: analytics (only after consent)
- Google Analytics 4 (Google): analytics (only after consent)
- Microsoft Clarity (Microsoft): heatmaps and masked session replay (only after consent)
- Vercel: hosting
They process data only on our instructions.
International transfers
Our providers process data on servers outside Nepal and outside your country: Clerk (sign-in), Supabase (database; hosted on AWS in Singapore), AWS (hosting), Cloudflare (file storage), Google (Analytics) and Microsoft (Clarity) mostly in the United States and Europe, and PostHog on its US cloud. Where EU, EEA or UK law applies, we rely on the providers' data processing terms and standard contractual clauses that apply to us: our providers (Clerk, Supabase, AWS, PostHog, Google, Cloudflare, Microsoft) publish data-processing terms and standard contractual clauses. Contact details you share and chat messages are never sent to analytics providers.
How long we keep data
| Data | How long |
|---|---|
| Account and profile | Until you delete your account; then hidden at once and deleted after 30 days |
| Chat messages | Kept so other members' conversations stay readable; shown as from a "Deleted user" after you delete your account |
| Uploaded files and private contacts | Deleted with your account (after 30 days) |
| Reports | Open reports are kept until we resolve them; resolved reports are deleted 12 months after resolution, and reports about an account, trip or message that no longer exists are deleted automatically |
| Blocks | Kept until you unblock the person or delete your account |
| Read notifications | Deleted 90 days after you read them; unread notifications are kept until you read them |
| Recommendation activity | Only recorded while the setting is on; deleted as soon as you switch it off; the last 180 days are used for ranking |
| Rate-limit and abuse logs | 2 days |
| Server and hosting logs | Kept only as long as needed for security and operation, in line with the hosting provider's published retention |
| Analytics (PostHog, Google Analytics, Clarity) | Only with your consent; kept only as long as needed, in line with each provider's published retention |
| Encrypted backups | Up to 6 months, then destroyed |
Deleting your account
You can delete your account in Settings → Account. Your profile is hidden immediately and your messages are shown as from a "Deleted user". After 30 days your account, profile, contacts, trips and uploaded files are permanently deleted, and your sign-in account is removed from Clerk. Encrypted database backups may still contain your data for up to 6 months before they expire and are destroyed.
Downloading your data
In Settings → Account you can download a JSON file of your profile, trips, requests, your own messages, point-of-interest reviews and photos, and your itinerary plans and gear list.
Age
FindTrekkingPartner is for people aged 18 and over. We check your date of birth during onboarding.
Your rights and how to complain
You can ask us to access your data (Settings → Account → Download), correct it (edit your profile), delete it (Settings → Account → Delete account), restrict or port it, and withdraw consent at any time. You can also object to processing based on legitimate interests and to analytics, recommendations, marketing emails and social featuring: switch the setting off (cookie settings in the footer, Settings → Privacy, Settings → Notifications, Edit trip) or email privacy@findtrekkingpartner.com, and we stop.
Rights under the Nepal Individual Privacy Act, 2075 (2018) apply to everyone we process data about in Nepal. If you are in the EU, EEA or UK, the GDPR (or UK GDPR) also gives you these rights. If you are not satisfied with our answer, you may complain to the competent authority in Nepal and, if you are in the EU, EEA or UK, to your local data protection authority.
Changes and contact
We will post any changes to this policy here and update the "Last updated" date above. For privacy questions or requests, email privacy@findtrekkingpartner.com.