Privacy policy

Be Outside is a product of ASHER LABS LTD, a company registered in England and Wales under number 17085554. We are the data controller for the personal data described below.

Contact us at privacy@be-outside.app. We will give our registered office address on request.

Account — name, email address, username and date of birth. Date of birth confirms you meet the minimum age; it is never shown to anyone else. If you sign in with Google or Apple we also record which provider you used.

Profile— your home area as a place name and coordinates, your interests, difficulty preference, and your distance and currency units. The home area is what puts “trips near you” in the right part of the country. If you choose “use my location”, your device’s position is sent once, through our server, to our place-search provider to find the nearest town, and that becomes your home area; we don’t track where you are.

Trips — itineraries, the places and dates in them, packing lists, shared costs, and the crew on each trip. Costs are amounts and descriptions you type; we never see a bank account.

Hotel bookings— if you book a stay, we keep the hotel, dates, number of guests and rooms (and children’s ages, which hotels price by), the price and the booking reference. A stay booked from a trip belongs to the trip; one booked on the Hotels page while signed in belongs to your account. The lead guest’s name, email and phone number go to LiteAPI and the hotel to make the booking. We don’t keep the name or phone number. We keep the email only for a booking made on the Hotels page without an account, so we can find that booking if you contact us about it.

Flight bookings— where flight booking is available and you book a flight on a trip, we keep the flights, times, fare, status and booking reference, and the passengers’ names so the trip page can show who is flying. Dates of birth, passport or other travel-document details, and contact details go to LiteAPI and the airline to make the booking; we don’t keep them. If you book for other people, please make sure they are happy for you to share their details.

Year planner— if you use it, your leave allowance, the month your leave year starts, the country and region whose public holidays you get, whether optional holidays count, and, if you tell us how many days you have left, the leave that works out you’ve used elsewhere.

Calendar on your phone— only if you turn it on in the app’s year planner and allow calendar access. The app reads the calendars you choose on your phoneto spot leave you’ve already booked and plans that clash with a suggested break. What it sends us is a date and one word for each day that matters, “leave” or “busy”, and when it last did so. The names, times, places and attendees of your events never leave your phone, and nor does the list of calendars you picked. Stopping it in the year planner deletes what we hold straight away.

Calendar link— if you set up “Sync trips to your calendar”, we create a private link to a calendar of your trips, the flights you booked and your hotel check-in and check-out days, and record roughly when a calendar app last fetched it. It shows trip names, dates and places, flight numbers, routes and times, and hotel names and addresses. It leaves out booking references, passenger names and prices, so the link can’t be used to change a booking.

Reviews — if you review a trip you went on, the rating and what you wrote, published on the trip page under your username. Before a review goes live its text is checked automatically for abuse and personal details, and it may be held for a person to look at.

Organiser page— only if you turn one on. The page name, bio, home base (a place name you type, not coordinates), trip styles, the links you add. While it’s public, anyone can see it at be-outside.app/@yourusername and search engines can list it, with your public group trips, how many trips you’ve run, the year you joined, and how many followers you have. It never names the people on your trips or who follows you. Turning it off hides it straight away.

Following — if you follow an organiser, we keep that you follow them and when, so we can tell you by email and, in the app, by notification when they post a new public trip. The organiser sees how many followers they have, not who they are. Each alert has its own setting, and every email has an unsubscribe link.

Old usernames— when you change your username we keep the old one, linked to your account, so a link to your organiser page that someone shared still reaches it. An old username only leads anywhere while your organiser page is public, and it’s deleted with your account.

Date polls— the dates on offer, who suggested each, and each person’s votes. People on the trip can see who voted for which date. Before someone joins, a public trip’s page shows only the dates and how many votes each has.

Reports— if you report a trip, a review, an organiser page or a person, we keep who sent it, the reason, anything you added, when, and the trip or review it was about, so a moderator can act on it and one person can’t report the same thing twice. The person you report isn’t told who you are. Reports are deleted with the account that sent them, or with the account they were about.

Invitations — when you invite someone, we store the email address you gave us so we can send the invitation and remind them once. That address belongs to them, not to you, so please only invite people who expect to hear from you.

Billing — if you buy Pluson the web, Stripe processes the payment, and we store your Stripe customer and subscription identifiers, the plan, and when the period ends. If you buy in the app, Apple or Google takes the payment under your App Store or Google Play account, and RevenueCat tells us what you bought: we store which store, the product, when it renews or ends, and whether there’s a payment problem. We never receive or store card details.

Technical — a record of when you last signed in, and errors your browser or the app reports to us. Error reports are configured to exclude personal data. If you allow notifications in the mobile app, we store a push token for your device so we can send them.

Analytics — only if you accept analytics cookies. Nothing is loaded and no request is made until you do. See the cookie policy.

Support chat— what you write to us in the chat, and, if you’re signed in, your name and email so we know who we’re talking to. On the website, only if you allow chat cookies; in the app, only once you tap “Start a chat”. If you’re signed in, the same conversation appears in both.

To provide the service (contract) — your account, your trips, the plans we build, the year planner and the calendar features you turn on, hotel and flight bookings you make (including a hotel booked without an account), invitations you send, the organiser page you publish, the organisers you follow and the alerts you asked for when they post a trip, date polls, and the emails that carry them.

To take payment (contract) — Plus subscriptions, through Stripe on the web, or Apple or Google in the app.

To keep the service working and secure (legitimate interests) — error monitoring, abuse prevention and review moderation, and the emails and notifications about your own trips — a reminder about an unfinished plan, trips near you, and a prompt to review a trip you went on. You can switch each of those off in Settings or unsubscribe from any email footer.

Analytics and support chat (consent)— only after you accept, and withdrawable at any time in Settings. What you tell us in a chat we use to help you (contract, or legitimate interests if you don’t have an account).

Your calendar link works without signing in, because Google, Apple and Microsoft fetch it from their own servers. Anyone you give it to, or who sees a calendar you share it into, can see what it shows. Once your calendar app has fetched it, that app’s provider holds a copy under its own privacy policy. You can reset the link (the old one stops working) or turn it off in Settings.

People on a trip can see its itinerary, packing list, costs and crew. If you make a trip public, its plan and kit list become readable by anyone with the link and can appear in Explore, and its destination can be listed among the trips recently planned on our homepage — the costs and the crew list stay private. Anyone can join a public trip before it starts, and once they have, they’re on the trip and see what everyone on it sees.

These processors act on our instructions only:

• DigitalOcean — runs our API, the server every app and website request goes through.
• Railway — hosts our database, where everything described above is stored, and the service that ranks activities for AI-assisted plans.
• Vercel — hosts the website and the parts of it that run on a server.
• Clerk — accounts, sign-in and passwords. Clerk holds your credentials; we never see them.
• Stripe — payments made on the web, and the card details for them.
• RevenueCat— keeps track of purchases made in the app. It receives your Be Outside account id and the store’s record of what you bought, never your name, email or card details.
• LiteAPI (Nuitée)— hotel and flight bookings and their payments, if you book a stay or a flight. The card details you enter, and passengers’ travel-document details, go to them, not to us.
• Resend — sending the emails described above.
• Sentry — error reports, with personal data switched off.
• Google— Places and Routes, to look up activity details and travel times; Firebase Cloud Messaging, to deliver the app’s push notifications; and Analytics if you accepted it.
• Crisp— the support chat, on the website if you allowed it and in the app when you start a chat. Crisp holds the conversation, and your name and email if you’re signed in.
• OpenAI — the automatic abuse check on review text, before a review is published. It receives the text of the review only.
• Geoapify — place search, turning a location into a place name, travel-time estimates, and part of the activity catalogue. It receives what you type into a place search and, if you use your location, your coordinates. Requests go through our server, so it never learns who you are.
• Photon (Komoot) — a backup for place search when Geoapify is unavailable. It receives the same as Geoapify would.
• WeatherAPI.com — forecasts for the places on a trip. It receives coordinates and dates, never who is going.
• CARTO — the map tiles behind trip maps. Like any image host, it sees the request your browser or the app makes for them.
• Unsplash— the destination photo at the top of each trip, public or private. We send it the trip's destination region (a place name such as “Lake District”) and nothing else — not the trip's name, dates or crew, and nothing about you. The photo itself loads from Unsplash's servers, which see your browser's or app's request as they would for any image.

Activity information also comes from open datasets — OpenStreetMap (through OpenTripMap and Geoapify), Overture Maps, Foursquare Open Source Places and Wikidata, and public holiday dates from Nager.Date, which we ask for by country and year. We download or look these up; nothing about you is sent to them.

If you buy in the app, Apple or Google processes that payment as its own controller, under its own privacy policy — they hold your card and billing details, and we never see them.

We do not sell personal data, and we do not share it with advertisers.

Account and trip data is kept while your account is open. Deleting your account cancels any Plus subscription billed through Stripe and removes your Stripe customer record, then your Clerk identity, then your profile, trips (with the hotel and flight bookings on them), the stays you booked on the Hotels page,reviews, your organiser page, who you follow and who follows you, your old usernames, your date poll votes, invitations, notifications, device push tokens, what your phone’s calendar told the year planner and your calendar link (which stops working), and asks RevenueCat to delete its record of your purchases and Crisp to delete your support conversations. A subscription bought in the app is billed by Apple or Google, so we can’t cancel it for you — cancel it in your App Store or Google Play settings.

What your phone’s calendar tells the year planner is replaced each time the app reads it, so a day you’ve since cleared stops counting.

Some records are held by others and follow their rules: a hotel or flight booking you made stays with LiteAPI and the hotel or airline, and Stripe keeps payment records as financial law requires, as do Apple and Google for purchases made in the app.

A hotel booking made without an account has no account to delete it with. We keep our record of it, with the email it was booked under, for 12 months after check-out, or until you ask us to remove it at privacy@be-outside.app if that’s sooner. The booking itself stays with LiteAPI and the hotel.

One thing survives deletion on purpose: if an email address has unsubscribed, we keep that address on a suppression list. Otherwise deleting an account would quietly make somebody eligible for email again — from a trip invitation sent by a different person, for example. That list holds the address and nothing else.

We also keep a log of the reminder emails we have sent — the address, which kind of email and when — so the same reminder is never sent twice. It is not linked to your account, contains nothing else, and each entry is deleted after 12 months.

An invitation sent to someone who never answered it is deleted 6 months after it lapsed, with the address it was sent to.

You can ask us to give you a copy of your data, correct it, delete it, restrict or object to how we use it, or move it to another service. You can also withdraw consent at any time where we relied on it.

Deleting your account is self-service — on the web in Profile, under Danger zone; in the app on the You tab — and takes effect immediately. If you can’t sign in, you can ask us to delete it from our delete your account page. Notification and email preferences are in Settings, and so is your calendar link. To stop the app reading your phone’s calendar, tap Stop on the calendar card in the year planner, which also deletes what it sent us. Removing Be Outside’s calendar access in your phone’s settings stops the reading too, but not the deletion. For anything else — including a copy of your data, which we do not yet offer as a download — email privacy@be-outside.app and we will respond within one month.

If you think we have handled your data badly, you can complain to the Information Commissioner’s Office at ico.org.uk. We would rather you told us first.

Sign-in is handled by Clerk, so Be Outside never receives or stores your password. Your session is a short-lived signed token that Clerk renews every minute or so, sent over HTTPS only, and every request to our API checks that token’s signature before it touches your data. In the app, sign-in is kept in your phone’s secure storage.

Requests to the site carry a content security policy and the usual protective headers. No system is perfectly secure, but we would rather tell you what we actually do than list reassuring words.

You need to be at least 18 to hold an account, which is why we ask for your date of birth during setup and check it server-side. Be Outside is for adults: you can join trips with people you may not know, and hotel and flight bookings need an adult.

If someone gives a date of birth under the minimum age, we don’t keep that date. We record only that the check failed and when, and the account can then do nothing but be deleted. If you believe someone under the minimum age has created an account, tell us and we will remove it.

Some of the processors above are based, or store data, outside the UK. This is where each is based and what protects your data when it goes there:

• European Union — LiteAPI (Nuitée, Ireland), Crisp (France), Geoapify and Photon (Germany) and CARTO (Spain). The UK recognises EU data protection as adequate, so no further safeguard is needed.
• Canada— Unsplash. Covered by the UK’s adequacy regulations for Canadian businesses.
• United States— DigitalOcean, Railway, Vercel, Clerk, Stripe, RevenueCat, Resend, Sentry, Google and OpenAI. For a company certified under the UK Extension to the EU–US Data Privacy Framework (the “UK–US data bridge”), we rely on that; for any that isn’t, on the International Data Transfer Addendum to the EU Standard Contractual Clauses in its data processing terms.
• United Kingdom — WeatherAPI.com (Zoomash Ltd). No transfer.

Ask us at privacy@be-outside.app for a copy of the safeguard that applies to any of them.

If we change how we use personal data in a way that affects you, we will say so here and update the date at the top. Material changes will also be emailed to you.