Privacy Policy

Your account.Your email address and password. The password is stored only as a strong one-way hash — we can't read it. If you turn on two-factor authentication, its secret is stored encrypted.

Your profile.Whatever you choose to add: display name, tagline, about text, and a photo. Your city and what you're looking for are collected only if you opt into the Antler Network directory, and shown only while you stay opted in.

Your activity. Goals, challenge check-ins, competition logs and the short notes on them (those notes appear on the public leaderboards), badges, Foundation votes, pod membership, expedition requests, and fireside RSVPs.

Community content.Messages you post in chat rooms and direct messages, forum questions and answers, who you've blocked, and reports you make. When a message is reported, we keep a snapshot of it so moderators can act even after it's deleted.

Purchases. Your orders and membership status. Card details never touch our servers — payment is handled entirely by Stripe.

Technical records. Security logs (sign-in attempts, moderation actions and similar) include your IP address and browser type. Error reports are scrubbed of personal data before they leave the app.

• Running the service you signed up for — profiles, chat, leaderboards, orders
• Processing membership and store payments, and sending receipts
• Transactional email only: verification, password resets, payment and security alerts — no marketing without asking you first
• Keeping the community safe: moderation, blocking, report handling
• Security: spotting abuse, rate-limiting, account protection

Under UK GDPR our legal bases are: performing our contract with you, our legitimate interest in keeping the service safe, your consent for optional things like the directory listing, and legal obligation for financial records.

We use a small set of service providers, each seeing only what their job needs: Vercel (hosting), Neon (database, hosted in London), Stripe (payments), Resend (email delivery), Cloudflare (profile photo storage), Upstash (rate limiting, hosted in Ireland), Sentry (error monitoring, personal data scrubbed) and Better Stack (server logs). We never sell your data, and there are no advertising or analytics trackers on the site.

• Chat messages delete themselves after 7 days — public rooms and direct messages alike
• Forum questions and answers stay up — the archive is the point — until you delete them yourself or a moderator removes them
• Your account data is kept while your account exists
• If you delete your account, your personal data is removed. Payment and order records are kept for legal and accounting reasons, with your identity detached
• Reported-message snapshots are kept for moderation purposes

You can ask us for a copy of your data, ask us to correct or delete it, restrict or object to how we use it, or ask for it in a portable format. Use the contact page and we'll respond within a month. If you're not happy with our answer, you can complain to the UK Information Commissioner's Office (ico.org.uk).

STAG is for people aged 16 and over. Paid membership requires you to be 18, or have a parent or guardian's permission.

If we change this policy in a way that matters, we'll say so on the site before it takes effect. Questions? Use the contact page.