Privacy policy

Last updated 23 September 2026

This policy explains what Walk Finder does with your personal data, why, and what you can ask us to do about it. It covers walk-finder.co.uk.

Who we are

Walk Finder is run by Walk Finder, the data controller for the personal data described here. You can reach us at support@walk-finder.co.uk.

What we collect

Data	Why	Lawful basis
Your name, email address and a hashed password - only if you create an account	To sign you in and keep your saved places attached to you	Contract - we can't give you an account without it
The places you save, the lists and groups you make, and any notes you add	It's the point of having an account	Contract
Your IP address, briefly, when the map loads data	Rate limiting, so one visitor can't overload the free map services we rely on	Legitimate interests - keeping the site up
Server error logs, which may include an IP address	Finding and fixing faults	Legitimate interests - running the site securely

Analytics

We keep our own count of how the site is used - how many visits there are, what people search for and roughly where, which pages get used and which sites send people here. It is built to tell us about the site, not about you:

No cookies and no third-party analytics. No Google Analytics, no advertising pixel, nothing loaded from anyone else.
Your IP address is never stored. It's used only to work out a visitor code, then discarded.
That visitor code can't be traced back to you and can't follow you. It's a one-way hash of your IP address, browser and a secret that changes every day, so the same person is a different code tomorrow. It lets us count visitors without knowing who they are.
Nothing is linked to your account, even when you're signed in.
Referrers are stored as a domain only - “google.com”, never the page or the search you typed.
We honour Global Privacy Control and Do Not Track: if your browser sends either, nothing at all is recorded.

The lawful basis is legitimate interests - understanding whether the site is useful and where to improve it - and the data is not personal data we could use to identify you. Records are deleted after 400 days.

Your location

If you press Use my location, your browser asks your permission and then gives the page your coordinates. They are used in your browser to centre the map, and the rough area is sent to our server to fetch the paths around you. We never store your location and it is never linked to your account. You can refuse, or change your mind in your browser settings, and the rest of the site still works - just search for a place instead.

Who else sees your data

Using the map means your browser or our server contacts these third parties:

OpenStreetMap Foundation - map tiles load directly from their servers, so they receive your IP address and which part of the map you're looking at. (their privacy policy)
OpenTopoMap - same, but only if you switch to the Topographic layer.
Overpass API, Nominatim, the National Trust and Natural England - path, place-search and land data. These are requested by our server, not your browser, so they see our IP address rather than yours.
Google - only if you click Street View or Google Maps on a dropped pin. That opens Google in a new tab and hands them the coordinates of that pin; nothing is sent to Google until you click. (their privacy policy)
Our hosting provider, which stores the database and logs on our behalf.

We do not sell your data, and we don't share it with anyone else unless the law requires it.

How long we keep it

Your account and saved places - until you ask us to delete them.
Rate-limiting records - minutes.
Error logs - up to 14 days.
Analytics records - 400 days.
Map data we've cached - kept so the site keeps working when the upstream services are busy. This is data about paths and land, not about you.

Where your data is held

Our servers are in the UK or the European Economic Area. The third parties above may process data outside the UK; where they do, they rely on the UK's adequacy regulations or on standard contractual clauses.

Your rights

Under UK GDPR you can ask us to:

give you a copy of the personal data we hold about you;
correct anything that's wrong;
delete your account and everything saved to it;
restrict or object to how we use it;
send your data to you, or another service, in a portable format.

Email support@walk-finder.co.uk and we'll respond within one month. If you think we've got it wrong, you can complain to the Information Commissioner's Office.

Children

This site isn't aimed at children under 13, and we don't knowingly collect their data. If you believe a child has given us personal data, email us and we'll remove it.

Changes

If we change this policy we'll update the date at the top. Material changes will be announced on the site.