Last updated: 29 July 2026
This Privacy Policy explains how Rtrosenberg ApS ("we", "us") handles information when you use DirtbagMaps (the "Service"), an interactive 3D/2D map for exploring long-distance hiking trails and ultra-marathon routes.
The data controller for the Service is:
Rtrosenberg ApS (CVR 38871250)
Solskrænten 2, 8400 Ebeltoft, Denmark
Email: rr@rtrosenberg.dk
We do not sell your personal data, and we do not share it with third parties for their own marketing. We only share data with the service providers (processors) described in this policy, who act on our behalf.
When you load the Service, our hosting provider and our servers automatically receive standard technical data: your IP address, browser type and version (user-agent), the pages and resources you request, and timestamps. This is used to deliver the site, keep it secure, apply rate limits, and diagnose faults.
If a script error occurs in your browser, the Service may send a diagnostic report to us containing the error message, a stack trace, the page URL, your browser user-agent, and your IP address. These reports are used solely to detect and fix bugs. We do not use them to identify or profile you.
The Service can centre the map on your current location. This only happens if your browser asks you and you grant permission. Your coordinates are used in your browser to position the map and are not stored on our servers.
Browsing trails does not require an account, and the logged-out experience is fully functional. You may optionally create a free account — with an email address and password, or by signing in with Google — to save favorite trails and stages, sync your "we sleep here" markers across devices, and keep a private "My Gear" locker for trip planning. For account holders we process, via Google Firebase Authentication, your email address, an authentication token, and the profile data you create (your saved favorites, stages, markers, saved places, notes, collections, and gear items/specifications you add or import from product links). A small number of trusted editors additionally hold an administrator permission to manage trail content.
You can export all of this data or delete your account at any time from the account section of the site (this erases your profile data and your authentication record).
The Service stores small amounts of data in your browser's local storage — for example your display preferences, your cookie-consent choice, and a local cache of your saved markers and trip planning. This data stays on your device. For signed-in users, saved favorites, stages, markers, and My Gear items are also stored in your account so they sync across devices.
The Service also keeps an anonymous acquisition channel and campaign label in browser session storage while you browse in the current tab. This first-touch label is discarded when the session ends and contains no visitor, account or device identifier.
If you write to us through the contact form, we store your name, email address, and message (and company name, if you provide one) so we can read and answer it, together with a truncated browser user-agent string and a salted hash of your IP address used for spam control. Messages are kept for as long as needed to handle your inquiry and are never used for marketing.
When you click an outbound partner link, the Service logs an anonymous click event: the partner, the page context, the trail, a timestamp, and salted hashes of your IP address and browser user-agent (the originals are not stored and cannot be recovered by us). No name, email, or account ID is attached — click logging is anonymous by design and happens regardless of your cookie choice, because it identifies no one. We use these counts to see which placements are useful and to report aggregate traffic to affiliate networks; aged click logs are further anonymized on a schedule. Affiliate-network tracking (cookies/parameters that credit a purchase) is separate and only happens with your consent — see section 3.
Outbound partner links can also carry the trip details needed to prefill the partner's search — for example the check-in/check-out dates, destination area, or gateway airport you set in the planner. These parameters describe the trip, not you, and are sent to the partner only when you choose to click the link.
We do not use advertising profiling, and the Service does not run Google Analytics or any comparable profiling tool. We do use Vercel Web Analytics — a cookieless, same-origin measurement tool that counts page views and a small allowlist of product interactions (for example opening the planner, building a plan, saving a trail or exporting GPX) in aggregate. It also receives normalized campaign labels so we can compare channels such as search, Pinterest and Instagram. It sets no cookies, performs no cross-site tracking, and does not build a profile of individual visitors. We do not send names, account IDs, email addresses, coordinates, notes or shared-plan payloads in these events. Affiliate-network tracking cookies are only set after you click Accept on the consent banner.
See our Cookie Policy for the full breakdown — which cookies are set, by whom, why, and how to control them.
Some links on the Service are affiliate links. If you buy something through one of them, we may earn a commission at no extra cost to you. This helps keep DirtbagMaps free. We only recommend products and services we believe are relevant to long-distance hikers and trail runners.
The Service relies on the following providers. Each receives at least your IP address and request data when their components load, and processes it under their own privacy terms:
| Provider | Purpose | Privacy terms |
|---|---|---|
| Vercel | Website hosting and serverless functions | vercel.com/legal/privacy-policy |
| Google Maps Platform & Places | 2D maps, place details, opening hours and reviews | policies.google.com/privacy |
| Google Firebase | Trail database, file storage, editor authentication | firebase.google.com/support/privacy |
| Mapbox | Interactive 2D/3D maps, terrain tiles and map telemetry necessary to render the map | mapbox.com/legal/privacy |
| Google reCAPTCHA (Firebase App Check) | Abuse and bot protection — verifies requests to our servers come from a real browser session | policies.google.com/privacy |
| Cloudflare | Delivery of downloadable offline map packs (R2 storage) | cloudflare.com/privacypolicy |
| Unsplash / Wikimedia / Mapillary image CDNs | Trail and place images selected by editors or shown in enrichment workflows | unsplash.com/privacy |
| Awin | Affiliate network (only after you accept tracking) | awin.com/.../privacy-policy |
| Impact | Affiliate network — incl. Booking.com, Omio, Skyscanner (only after you accept tracking) | impact.com/privacy-policy |
| CJ Affiliate | Affiliate network — incl. World Nomads, Garmin (only after you accept tracking) | cj.com/.../privacy |
| SafetyWing | Insurance affiliate partner (only after you accept tracking) | safetywing.com/privacy-policy |
| Stay22 | Accommodation affiliate links — redirects your click to the booking site (only after you accept tracking) | stay22.com/privacy |
Affiliate-network components are only contacted when you click an affiliate link and you have accepted tracking. If you decline, these networks do not receive your data through the Service.
Trail photos and descriptions are prepared in advance by our editors using image and text services (Wikimedia Commons, Unsplash, Mapillary and Anthropic). Some selected trail images are served directly from third-party image CDNs such as Unsplash Images, Wikimedia, or Mapillary, so your browser may contact those providers to download the image. Anthropic is only called from our servers during content authoring and is not contacted by your browser as a visitor.
Where the EU/UK General Data Protection Regulation applies, we rely on:
The providers listed above may process data outside your country, including in the United States. Where required, such transfers are covered by the providers' own safeguards, such as the EU Standard Contractual Clauses.
Server and hosting logs are retained for a limited period for security and debugging, then deleted, in line with our hosting provider's defaults. Error reports are kept only as long as needed to investigate the underlying issue. Editor account data is kept for as long as the person remains an editor.
Depending on where you live, you may have the right to access, correct, delete, or restrict the processing of your personal data, to object to processing, and to data portability. You may also lodge a complaint with your local data protection authority. To exercise any of these rights, contact us at rr@rtrosenberg.dk.
The Service is not directed at children and we do not knowingly collect personal data from children under 16.
We may update this Privacy Policy from time to time. Material changes will be reflected by the "Last updated" date above.
You can change or withdraw your affiliate-tracking consent at any time by opening Cookie preferences. Withdrawing consent is as easy as giving it; declining does not affect the map or any planning features.
Questions about this policy or your data? Email rr@rtrosenberg.dk.