Who this covers
It covers people who read Hike2China, people who create an account, and people who send a message.
What you give us
If you create an account, we store:
- the name you choose, which is shown on your discussion posts,
- the email address, which is not shown on comments,
- a hash of the password, not the password itself, and
- the time the account was created.
That email is also the route-notes list. Creating an account subscribes it. There is no separate subscribe list.
A discussion post stores the text, the route it is on, the time, your account id, and the post it replies to when it is a reply. A useful or not-useful mark stores which post you marked. A hidden field on the account, discussion, and contact forms is there to catch automated signups; a normal submission leaves it empty, and we do not keep it.
If you send a message from the contact page, we store:
- the message,
- the email address you enter,
- the WhatsApp number you enter, and
- the time it was sent.
That email and number are not shown on the site, and they are not added to the route-notes list. The site does not publish a mailbox of its own.
While you are logged in, the browser keeps a first-party cookie named hike_session. It is httpOnly, lasts 30 days, and is cleared when you log out or delete the account. It is not an advertising cookie.
What is collected while you browse
The site is delivered through Cloudflare. Like most hosts, that network can see technical data needed to serve a page: IP address, browser type, and the address of the page requested. We do not use those logs to build a file on individual hikers.
Pages load Google Tag Manager. Tags configured there — typically Google measurement products — may set cookies and read device and browser data to count visits and see which pages are used. Those tools are operated by Google, under Google’s own terms. The pages still open if you block third-party scripts.
The homepage, each province page, and each route page also load Google AdSense. Google may set an advertising cookie there to choose and measure an ad. Other pages do not carry an ad slot.
Route pages also embed Trip.com search boxes for flights, trains, and hotels. Trip.com loads inside those boxes and may set its own cookies when you search or book. The booking is completed on Trip.com, not on this site.
Why
- Account, discussion posts, and useful or not-useful marks: so you can write under a name, and so other readers can see that discussion.
- Session cookie: to keep you logged in.
- Email on an account: creating an account is the request to hear about routes.
- A contact message: so a reply can be sent to the email or WhatsApp number you left.
- Hosting logs: to deliver the site and to limit abuse of the forms.
- Measurement: to see which routes are being read.
We do not sell email addresses. We do not send them to advertisers.
Who else handles it
- Cloudflare stores the site, accounts, comments, and contact messages (Cloudflare Pages and D1).
- Google may process measurement data when Tag Manager loads a Google tag, and advertising data when an AdSense unit loads.
- Trip.com handles a search or booking started in a route-page search box.
Those providers can process data outside your country. We do not pass your email to them as part of a route page view.
How long
An account stays until you delete it from the account page, or until you ask us to delete it. Deleting the account removes the name, email, password hash, sessions, discussion posts, replies, and useful or not-useful marks, and takes that email off the route notes. A contact message stays until it is no longer needed for a reply, or until you ask for it to be deleted.
Your choices
- You can read the site without an account.
- You can delete the account yourself. That asks for the password again, and it stops the route notes.
- You can block or delete cookies in your browser. Measurement may then be incomplete; the routes still load.
- To be removed from the list, or to ask what we hold for your address, send a message from the contact page using that same email. Say that you want the email, the WhatsApp number, or the account deleted.
Children
The site is written for adults planning a trip. We do not knowingly collect an email, or open an account, for a child.
Changes
If we start collecting something new, such as payments, we will update this page and the date at the top before that collection applies.