Hikezilla

Hikezilla Privacy Policy

Last updated: 20 October 2026

1. Who we are

Hikezilla is a registered Australian business name, ABN 37 383 210 662. This policy describes how we handle personal information when you use hikezilla.com and related services. Contact hello@hikezilla.com for privacy questions and requests.

We aim to handle personal information transparently and in line with applicable Australian privacy law. The exact application of the Privacy Act and Australian Privacy Principles depends on our legal circumstances; this policy also sets out commitments we choose to make to members.

2. Information we collect

Depending on what you use, we may collect:

  • Account and profile: name or trail name, username, email, avatar, biography, location, outdoor interests, experience and goals, login/provider identifiers. Passwords are managed through our authentication system; we do not need your plain-text password.
  • Community content: posts, replies, messages, photographs, stories, project submissions, moderation reports, reactions and public attribution.
  • Events: RSVP status, communications with organisers, attendance and any details you voluntarily submit to a host.
  • Activities and location: adventure logs, saved places, GPX tracks, routes, GPS coordinates and, if you connect Strava, authorised activity metadata, timestamps, polylines and potentially fitness metrics such as heart rate/cadence according to permissions and implementation.
  • Challenges and volunteering: evidence, photos, links, volunteer organisation and activity descriptions, completion decisions and related records.
  • Rewards and gear: Trail Points ledger, redemptions, delivery name/address for physical rewards, borrowing requests, pickup arrangements, condition and return records. We do not currently operate a fiat checkout or collect card details through Hikezilla.
  • Network, projects and jobs: optional career/profile details, introductions, saved jobs, submitted dashboards/datasets and related attribution.
  • Rex AI: messages, responses and relevant account context used to respond, such as profile preferences, goals, points or upcoming RSVPs.
  • Technical and analytics: IP addresses, browser/device data, page views, events, cookies, identifiers and potentially masked session replay through PostHog, alongside Google Analytics 4 page-view analytics. IP addresses and pseudonymous identifiers can be personal information.

Avoid entering another person's contact, health or location information into public content or Rex without appropriate authority.

3. How we collect and use information

We collect information directly from you, automatically from your use of the service, from authorised integrations such as Strava or Google sign-in, and from permitted member/organiser interactions. We use it to operate accounts and security; show content in accordance with visibility settings; manage RSVPs and host communication; verify challenges and volunteering; administer points, rewards and gear loans; deliver messages and newsletters according to preferences; power maps, dashboards and Rex; moderate misuse; analyse and improve performance; and meet legal obligations.

Marketing communications are separate from necessary service messages. You can unsubscribe from marketing using the provided link or settings where available.

4. Public content and visibility

Profile fields, stories, community posts, achievements, photos, routes or activity milestones may be visible publicly or to other members depending on the feature and its settings. Forum and Journal publications may be indexed by search engines. Approved event RSVPs are visible to event hosts for administration but are not exposed to anonymous visitors with any private notes you add. Private messages, private challenge evidence, reward delivery details and unpublished drafts are not public. We do not promise that other people cannot copy or screenshot material already published.

5. Strava and precise location

If you choose to connect Strava, we request permissions displayed during authorisation and import permitted activity information to support features such as challenge verification. The integration can receive route polylines, start/end locations, timestamps and fitness metrics. These can reveal sensitive routines, homes or workplaces. Check your privacy settings and avoid publishing precise start/end points or sensitive locations.

You can disconnect Strava in Settings > Integrations. Disconnection stops future syncing, but previously synced activity rows are currently kept until deleted on request. Contact us to request deletion of retained imports, subject to lawful retention and technical limitations. We do not assume that Strava authorisation permits public sharing of another athlete's data.

Borrowing a Personal Locator Beacon (PLB)

If you borrow a PLB from the Gear Library, we ask for your full name and mobile number, your destination, planned route, start location and expected return time, optional group size, exit point and notes, and an emergency contact's name, phone number and (optionally) their relationship to you. We do not ask for ID, medical information or your home address.

We collect this because our PLBs are registered with the Australian Maritime Safety Authority (AMSA). Before handover, a Gear Library admin manually enters the relevant trip and emergency contact details into AMSA's beacon registration system for that specific beacon, so emergency services know who may be carrying it and where they planned to go if it is activated. Hikezilla is not automatically connected to AMSA. Once entered, AMSA handles that information under its own privacy practices.

Only you and authorised Gear Library admins can see these details. They are not shown on profiles, member lists, feeds or gear pages, are not shared with Rex, and are not included in analytics or notification content. Please tell your emergency contact that you are sharing their details.

We clear the personal trip and emergency contact details about 90 days after the beacon is returned (or soon after a request is declined or cancelled), keeping a basic borrowing record — such as dates, the beacon unit and admin checks — for equipment accountability.

6. Rex and AI processing

When you use Rex, your message and selected relevant account context are sent to Google's Gemini model service so it can generate a reply. This can include display name, experience, town, goals, Trail Points and RSVPs. Rex conversations may be stored for continuity. Do not enter secrets, health details or third-party personal information unnecessarily. Rex may produce inaccurate answers.

7. Analytics, cookies and embedded services

We use essential technologies for sign-in, security and site operation. We use PostHog analytics routed through an /ingest proxy, including page/activity events and masked session replay. Mapbox maps, Strava embeds and other third-party media may process IP/device and interaction data when loaded. Browser settings can restrict some technologies, but essential features may be affected.

We also use Google Analytics 4 (GA4) on hikezilla.com to understand page visits and browser/device usage. Our GA4 page-view tracking does not send member names, email addresses, account IDs, search terms or URL query parameters. Member-specific paths are grouped rather than sending usernames or private dataset paths. Google may process technical information and analytics cookies under its own privacy practices. Advertising personalisation and Google signals are disabled in our configuration.

8. Who receives information

Information may be accessible to authorised organisers where needed to administer events; other members/public users according to visibility settings; and service providers that operate our infrastructure. Providers include Lovable Cloud (hosting, database, authentication), Google (sign-in and Gemini), Strava, PostHog, Mapbox and managed email delivery. Physical reward delivery details may be supplied to a postal/courier provider. PLB trip and emergency contact details are entered into AMSA's beacon registration system as described above. We may disclose information where legally required, to address serious safety/security concerns or in a lawful business transition. We do not currently sell member personal information to advertisers.

Some providers process data outside Australia, potentially including the United States and other regions.

9. Storage, security and retention

We use authentication, access controls and other safeguards appropriate to the service, but no system is completely secure. Information is retained for as long as reasonably needed for the stated purposes, legal obligations, dispute resolution and system integrity.

Deleting content or closing an account may not immediately erase backups, copies retained by recipients or records we are legally required to keep. We will explain practical limits when processing a request.

10. Your choices and requests

You may update profile details and available visibility settings; unsubscribe from marketing; leave the opt-in Network; disconnect Strava; and request access, correction or deletion of personal information by emailing hello@hikezilla.com. There is currently no self-service account deletion or export tool; requests are handled manually. We will verify your identity where appropriate and respond within a reasonable time, explaining any lawful limitations.

11. Children and guardians

Hikezilla permits under-18s to attend suitable events when accompanied by their parent or legal guardian, subject to event rules. Accounts are for people aged 18 and over, so we do not create accounts for minors. We do not intend to collect children's information beyond what is reasonably necessary for permitted participation. Guardians should avoid publicly disclosing children's precise locations and personal details.

12. Changes and contact

We may update this policy as features or practices change. Material changes will be explained through appropriate notices, with a new date. Contact hello@hikezilla.com. Operator: Hikezilla, ABN 37 383 210 662.