Privacy Policy

This Privacy Policy describes how Rextrake collects, uses and protects personal data, in accordance with the applicable data protection legislation.

Last updated: 24 October 2026.

This is a translation: in case of doubt, the binding text is the Italian version.

Data controller

The controller of the personal data processed through the Rextrake platform is Bluix Group LTD (United Kingdom), which operates the platform. For any privacy-related request, users can use the contact details given in the Contact section.

Personal data collected

Rextrake collects only the personal data strictly necessary for the operation of the platform. This may include:

• basic technical data (IP address, browser type, device information)
• usage and interaction data (pages visited, browsing paths, searches made)
• contact information voluntarily provided by users (e.g. through contact forms)
• account data (email, name, password — in encrypted/hashed form) for registered users
• date of birth and country of residence, requested at registration: they are used to know whether a person is a minor and which age of digital consent applies to them; the date of birth is never shown to other users
• for minors' profiles created by a parent or guardian: the link between parent and minor and the parent's consent (text accepted, version, date and time, IP address and browser)
• authentication data (2FA secrets and recovery codes — encrypted) for users with 2FA enabled
• social profile information (optional: Facebook, Instagram, Twitter/X username, website, bio, location)
• phone number (optional, for OTP authentication and password recovery)
• premium subscription data (subscription status, billing data through the payment provider)
• wishlist and price alert data (for premium users)
• public profile settings (visibility preferences for profile, wishlists and collections)
• GPS tracks and activity data uploaded by the user — private by default; publication happens only by explicit choice and is recorded (version of the terms accepted, date, IP address and browser)
• browser location (optional) — used only at the time of the request to calculate travel time to an access point; it is never stored
• photos, images and documents uploaded by users
• second-hand marketplace data (listings, orders, shipping address, shipment tracking data, disputes)
• support requests (tickets) and related communications
• emergency contacts and emergency card (ICE), optional — they may include health information provided voluntarily (e.g. blood type, allergies)
• mobile app — precise GPS location recorded as a track while the user records an activity, including with the screen off or the app in the background; recording is started and stopped by the user, and is preceded by an in-app notice before the system permission request
• mobile app — photos, voice notes and files (GPX, KML, FIT) attached to tracks by the user; messages in event and marketplace chats
• safety features — when the user activates SOS, when a check-in set by the user expires, or during a group outing activated by the user, the location is sent to the emergency contacts chosen by the user (by SMS and email) or shown to the outing companions; never in other cases

Rextrake does not intentionally collect sensitive personal data. The exception is the health information that the user may voluntarily enter in the emergency card (ICE), processed solely for safety and rescue features.

Purposes of processing

Personal data are processed for the following purposes:

• operating and maintaining the platform
• improving the relevance of content and the user experience
• responding to user requests and communications
• ensuring the security and integrity of the platform (including 2FA authentication)
• complying with legal and regulatory obligations
• providing premium services (wishlists, price alerts, early notifications)
• managing user accounts and authentication (email, social login, OTP)
• managing premium subscriptions and billing
• enabling public profile features (at the user's choice)
• sending newsletters and promotional communications (subject to consent)
• tracking affiliate clicks and conversions (in anonymised form where possible)
• managing the second-hand marketplace (orders, escrow payments, shipping, disputes and transactional emails)
• providing safety features (emergency contacts, SOS, check-in)
• publishing tracks and content at the user's choice, recording the related consent

Legal basis for processing

Personal data are processed on the basis of:

• legitimate interest in operating and improving the platform
• the user's consent, where applicable
• compliance with legal obligations

Data retention

Personal data are kept only for as long as necessary to achieve the purposes for which they were collected, unless a longer retention period is required by law.

Disclosure and transfer of data

Rextrake does not sell personal data and does not share it with third parties for commercial purposes.

Data may be shared with trusted service providers solely for technical, operational or legal reasons, and only where necessary, including:

• Payment service providers — Stripe (marketplace transactions, including escrow holding of funds, and premium subscriptions) and Creem (premium subscriptions) — billing and payment data only
• Social login providers (Google, Apple, Facebook) — authentication data only
• SMS gateway (BulkGate) — phone numbers and, for safety alerts activated by the user (SOS, expired check-in, cave exit timer), the text of the alert with the location; the provider acts on behalf of Rextrake and does not use the data for its own purposes
• Affiliate networks (Awin, CJ, Rakuten, Impact) — anonymised click/conversion data
• Email service providers (for newsletters, notifications and transactional emails)
• Hosting and storage infrastructure — the database resides on the platform's servers; media content is stored on infrastructure in the European Union (Hetzner)

All data sharing is governed by strict agreements that ensure compliance with data protection legislation.

User rights

Users have the right to:

• access their personal data
• request its rectification or erasure
• object to processing or request its restriction
• withdraw consent, where applicable
• lodge a complaint with a supervisory authority

Account deletion. Users can delete their account and the associated data on their own, from the app (Settings → Delete account) or from the page rextrake.com/account/delete, confirming with a code sent by email. Only the tax documents of marketplace orders are retained, for the period required by law.

Minors

Rextrake is also open to minors. Anyone who has reached at least the age of digital consent of their country (in Italy 14, art. 2-quinquies of the Italian Personal Data Protection Code, Codice in materia di protezione dei dati personali, D.lgs. 196/2003; in the other countries of the European Union between 13 and 16 according to national law, art. 8 of Regulation (EU) 2016/679 (GDPR); elsewhere 16) registers on their own. For younger users, from the age of 13, processing is based on the consent of the parent or guardian, who creates the profile from their own account: the consent remains recorded and the parent withdraws it by deleting the profile. Under the age of 13 Rextrake does not collect data: no profile is created, not even by a parent.

For minors, Rextrake collects the same data as for other users, but with more protective settings: profile, wishlist, collections, tracks, photos and ascents are non-public by default; the starting point of tracks stays hidden and live location is not shared; minors do not appear in leaderboards, suggestions or public lists and do not receive newsletters, digests with offers or promotional notifications. Below the age of digital consent, these settings can be changed only by the parent. A profile created by a parent does not require an email address for the minor. Safety features (SOS, check-in, group outings) remain active.

The parent or guardian can view and correct the data of the profile they created, change its visibility, end the minor's sessions and delete the profile, with all its data, at any time. When the minor turns 18, the parent no longer has any power over the profile.

In plain words, if you are under 18: your profile is private until you (or, if you are younger than the age of digital consent, your parent) decide otherwise; nobody sends you advertising; you don't appear in leaderboards; you can ask at any time to see or delete your data, on your own or with your parent.

Cookies

Rextrake only uses technical cookies needed for the site to work: the session, form protection, the chosen language and sign-in with a social account. It does not use profiling cookies or third-party analytics tools.

When you open a link to a partner shop, the affiliate network (for example Awin) may store a cookie on its own domain to recognise a possible purchase. That cookie is governed by the privacy notices of the network and the shop; Rextrake only receives anonymised data about the click and any sale.

Data security

Rextrake adopts appropriate technical and organisational measures to protect personal data against unauthorised access, alteration, disclosure or destruction.

Changes to this Privacy Policy

Rextrake reserves the right to update this Privacy Policy at any time. Changes take effect upon publication on the platform.