Privacy Policy

Information We Collect

We collect only the information needed to run the site, the community feed, and the installable Hidden Norway app. That falls into three categories: account data you give us at signup, profile data you choose to share, and activity data generated as you use the platform.

What We Collect

The specific data we collect includes:

• Account data — email address, name, and password (encrypted). If you sign up via Google, we receive your Google display name, email, and public avatar URL.
• Profile data (optional) — bio, home country and city, favourite region, profile photo, banner image, website and social links you choose to add
• Community content — posts, comments, private messages, itineraries, photos and videos you upload, likes/saves, and reports you submit
• Activity data — pages viewed, hikes saved for offline use, search terms, and post history, used to improve the site
• Technical data — browser type, IP address (for rate limiting and abuse prevention), device type, and preferred language
• Push notification subscriptions — if you opt in to notifications, we store your browser's push endpoint and cryptographic keys so we can send you message alerts

How We Use Your Data

We use your data to provide the service, keep it safe, and improve it. Specifically: to display your profile and posts to other users, to deliver messages between users, to send you notifications you have opted into, to enforce our Terms via automated content filters and manual moderation, to prevent spam and abuse via rate limiting, to translate stories into your preferred language, and to keep the app working offline. We never sell your data, and we do not run behavioural advertising.

Who Sees Your Data

Your profile (name, avatar, bio, home country) is public by default so other travellers can find you — you can tick 'Private profile' on your profile page to hide it from search and the 'Travellers near you' carousel. Anything you post to the community feed is public. Private messages are only visible to you and the recipient. Reports you submit are visible only to Hidden Norway moderators. We share data with a small number of infrastructure providers: Supabase (database and authentication), Vercel (hosting), Stripe (for optional paid business listings only — the community feed is free), and web push services operated by Google, Apple, and Mozilla when you enable notifications. None of these providers sell your data.

Security

All data is transmitted over HTTPS and stored in encrypted databases. Passwords are hashed with industry-standard algorithms. Row-Level Security policies in our database ensure private messages, blocks, and moderation reports are only readable by the users and moderators they belong to. If we become aware of a data breach that affects you, we will notify you promptly.

Cookies and Local Storage

We use cookies to keep you signed in, remember your language preference, and support the installable app. The site's optional analytics helps us understand which features people use. We do not use third-party advertising or cross-site tracking cookies.

Your Rights

You can view and edit your profile at any time from your profile page. You can edit or delete your posts and comments, block or unblock other users, tick 'Private profile' or 'Don't allow contact', turn off notifications, download a copy of your data, or delete your account. Under GDPR you have the right to access, correct, port, and erase your personal data — email us at contact@hiddennorway.com to exercise these rights.

How Long We Keep Data

We keep account data for as long as your account is active. Posts and comments you delete or archive are removed from the live site immediately and permanently deleted from our database within 30 days. Private messages are retained while both participants have active accounts. Moderation reports and audit logs are kept for 12 months for legal and safety reasons. Deleted accounts are fully purged within 30 days.

Age Restrictions

Hidden Norway is intended for users aged 16 and over. We do not knowingly collect personal information from children under 16. If you believe a child has created an account, please email contact@hiddennorway.com and we will remove it.

International Users

Hidden Norway is operated from Norway. If you are visiting from the EU/EEA, UK, or elsewhere, your data may be processed on servers in the EU. By using Hidden Norway you consent to this cross-border processing where applicable.