Privacy Policy (GDPR & CCPA)

1. Introduction & Commitment to Privacy

Welcome to CavingClub.org (“we,” “our,” or “us”). We are dedicated to providing science-based hiking calculators, documented trail topography, and subterranean speleology conservation resources. We respect your privacy and are committed to protecting personal data in strict compliance with applicable global privacy laws, including the European Union and United Kingdom General Data Protection Regulation (“GDPR”), the California Consumer Privacy Act as amended by the California Privacy Rights Act (“CCPA/CPRA”), and related regional frameworks.

2. Information We Collect

We believe in strict data minimization. We collect information only when genuinely necessary for platform utility and security:

Voluntarily Provided Contact Information: When you send inquiries through our contact form at /contact, submit trail or cave data corrections, or email us at cavingcluborg@gmail.com, we collect your name, email address, topic of inquiry, subject, and message content. When submitted via our web form (`POST /api/contact`), your message is validated for length (up to 5,000 characters), logged with a timestamp on our server runtime, and—when third-party email forwarding keys are configured—forwarded to cavingcluborg@gmail.com via Web3Forms (`api.web3forms.com`) or Resend (`api.resend.com`), or prepared for direct dispatch through your local mail client.
Client-Side Calculator & GPX Data (Zero Server Transmission): All calculations performed across our ten outdoor calculators and tools (Naismith hiking time, hiking pace, elevation gain, Pandolf/Santee calories burned, trail difficulty, Interactive Trail Finder, GPX Route Analyzer, backpack weight ratio, trekking pole sizing, and hydration planning) execute 100% locally in your browser memory. We do not transmit, upload, log, or store your personal body weight, height, uploaded .gpx tracks, or calculator inputs on our servers.
AI Explorer Chat Assistant (`POST /api/ai/chat`): When you use the floating AI Explorer assistant, your conversation history is stored locally in your browser's localStorage under cavingclub-ai-chat-v1 (capped at the 24 most recent messages; cleared anytime via the chat header trash icon). When you submit a question (limited to 600 characters), the prompt and up to the 6 most recent messages in your active conversation are sent to /api/ai/chat:
- No Persistent Chat Database: We do not store a persistent database of chat transcripts on our servers.
- AI Provider vs. Local RAG Processing: If an OpenAI API key is configured on the server and enabled (`provider: "auto"` or `"openai"`), the prompt and recent conversation context (up to 6 messages) are transmitted over HTTPS to OpenAI (`api.openai.com`, model `gpt-4o-mini`) to stream the response. When no external API key is configured, responses are generated entirely by our built-in server-side Retrieval-Augmented Generation (RAG) knowledge engine using CavingClub.org's published dataset without external third-party transmission. Do not submit sensitive personal information in chat prompts.
Automated Edge Infrastructure & Region Detection Logs: Technical edge logs are generated by our hosting infrastructure (Vercel) to protect against DDoS attacks and deliver pages. In addition, our consent manager queries `/api/geo`, which reads coarse country and state/region headers provided by the edge network (such as `x-vercel-ip-country` or `cf-ipcountry`, falling back to your browser's timezone setting if unavailable) solely to determine whether GDPR (EU/UK) or CCPA (California/US) consent defaults apply. Coarse geo lookups are cached privately in your browser for up to 1 hour and are never stored in a user profile.

3. How We Use Collected Data & Legal Bases (GDPR Art. 6)

We process personal data only under documented lawful bases:

Consent (GDPR Art. 6(1)(a)): For optional site analytics (Google Analytics / Google Tag Manager). You have the right to withdraw your consent at any time.
Legitimate Interests (GDPR Art. 6(1)(f)): To maintain website security, prevent fraudulent bot traffic, debug performance bottlenecks, and respond directly to communications you initiate.
Performance of a Contract / Service Request (GDPR Art. 6(1)(b)): To process and respond to specific editorial, correction, or contact requests you send to cavingcluborg@gmail.com.

Affirmative Declaration: We do NOT sell, rent, lease, or monetize your personal contact information to third-party data brokers, marketers, or advertisers.

4. Cookies, LocalStorage Keys, Analytics & Google Consent Mode v2

We implement Google Consent Mode v2 alongside Google Tag Manager (`GTM-M5CXMSQ6`). Before any analytics script loads, our inline consent initializer sets `ad_storage`, `ad_user_data`, and `ad_personalization` to denied by default for all visitors, and sets `analytics_storage` to denied unless you have granted analytics consent in your saved preferences (`cavingclub_consent_v1`).

Strictly Necessary Storage: Ephemeral administrative session tokens for authorized staff (`/admin`) and your saved privacy consent record (`localStorage` key `cavingclub_consent_v1`, which records your boolean category choices, coarse jurisdiction, and timestamp).
Functional & Local Preference Keys (`localStorage`): Stored exclusively on your device so features work without an account: `cavingclub-ai-chat-v1` (AI chat history, up to 24 messages), `cavingclub-read-notifs` (read notification IDs), `cavingclub-notif-prefs` (notification category/frequency preferences), and `cavingclub-popup-dismissed-at` (7-day dismissal timer for the announcement toast). You can clear these at any time through your browser settings or the in-app controls.
Site Analytics (`analytics_storage`): Aggregated page visit and Core Web Vitals performance metrics via Google Tag Manager (`GTM-M5CXMSQ6`). Loaded with `lazyOnload` priority and governed by your `analytics` consent toggle.
Advertising & Marketing (`ad_storage` / `marketing`): Display advertising slots (Google AdSense) are disabled by default unless explicitly enabled in site configuration (`adSenseEnabled: false` by default, showing internal CavingClub safety bulletins instead). When enabled, ad personalization tags remain blocked unless you grant `marketing` consent.

5. European Union & United Kingdom GDPR Notice

If you are a resident of the European Union (EU), the European Economic Area (EEA), the United Kingdom (UK), or Switzerland, you are entitled to comprehensive data subject rights under Articles 15 through 22 of the General Data Protection Regulation:

Right of Access (Art. 15 GDPR): You have the right to request a copy of the personal data we hold about you.
Right to Rectification (Art. 16 GDPR): You have the right to request correction of inaccurate or incomplete personal records.
Right to Erasure / “Right to be Forgotten” (Art. 17 GDPR): You may request the permanent deletion of your messages or email records.
Right to Restriction of Processing (Art. 18 GDPR): You may request that we suspend processing your data under certain conditions.
Right to Data Portability (Art. 20 GDPR): You have the right to receive your personal data in a structured, commonly used, and machine-readable format.
Right to Object (Art. 21 GDPR): You have the right to object to any data processing based on legitimate interests.
Right to Withdraw Consent: Where processing is based on consent, you may withdraw it at any moment using our interactive cookie manager.
Right to Lodge a Complaint: You have the right to lodge a complaint with your local supervisory authority (e.g., the Information Commissioner's Office in the UK, or the respective national Data Protection Authority in your EU Member State).

To submit an official GDPR Data Subject Request, please email our compliance team at cavingcluborg@gmail.com. We respond to all verified requests within 30 days without charge.

6. California Consumer Privacy Act (CCPA / CPRA) Notice

This section applies solely to California residents under the California Consumer Privacy Act of 2018, as amended by the California Privacy Rights Act of 2020 (“CCPA/CPRA”):

A. Categories of Personal Information Collected (Past 12 Months):

Identifiers: Name and email address when you voluntarily communicate with us; IP address in technical edge logs.
Internet & Electronic Network Activity: Anonymized page interaction analytics and performance metrics.
Geolocation Data: Non-precise, country- and state-level geographic location derived from IP headers.

B. Sale and Sharing of Personal Information:

We do NOT sell personal information. We do NOT share personal information with third parties for cross-context behavioral advertising. We have not sold or shared personal information of consumers in the preceding 12 months.

C. Your California Consumer Rights:

Right to Know & Access: You may request disclosure of the specific pieces and categories of personal information we have collected.
Right to Delete: You may request that we delete personal information collected from you, subject to legal exceptions.
Right to Correct: You may request the correction of inaccurate personal records.
Right to Non-Discrimination: We will never discriminate against you (in pricing, access, or calculator availability) for exercising any CCPA rights.
Right to Limit Sensitive Data: We do not collect or process sensitive personal information for the purpose of inferring characteristics.

D. How to Exercise CCPA Rights:

California residents may submit verifiable consumer requests by emailing cavingcluborg@gmail.com with the subject line “CCPA Consumer Request.” Please specify the right you wish to exercise. You may also click the button below to update your preference immediately:

7. Other US State Privacy Rights (Virginia, Colorado, Connecticut, Utah)

Residents of Virginia (VCDPA), Colorado (CPA), Connecticut (CTDPA), Utah (UCPA), and other states with comprehensive consumer privacy statutes enjoy similar rights regarding personal data access, deletion, correction, and opt-out of targeted advertising. We apply our strict non-sale standards universally to all US visitors.

8. Children's Online Privacy Protection Act (COPPA)

CavingClub.org is an educational and outdoor recreational platform designed for general audiences. We do not knowingly collect personal identifiable information from children under the age of 13 (or under 16 in the European Union). If you believe a child has provided us with personal contact data, please notify us immediately at cavingcluborg@gmail.com and we will securely purge the records.

9. Data Retention, Third-Party Processors & Security Standards

We implement administrative, technical, and cryptographic safeguards and maintain strict retention windows matching our actual system architecture:

Transport Encryption: All web and API communications are encrypted in transit using Transport Layer Security (TLS 1.3 / HTTPS).
Calculator & GPX Inputs (0 Seconds Server Retention): Calculator inputs and uploaded .gpx files are processed exclusively in your browser memory and are never transmitted to or retained on our servers.
AI Chat Session Retention & Processing: On your device, `cavingclub-ai-chat-v1` retains up to 24 messages in `localStorage` until you click the clear-history button or clear browser storage. We do not store a persistent database of chat transcripts on our servers. When an OpenAI API key is configured, prompts sent to OpenAI (`api.openai.com`) are subject to OpenAI's API data processing policies (API payloads are not used to train OpenAI models by default).
Contact Correspondence: Messages sent via `/api/contact` (forwarded through Web3Forms or Resend when configured, or emailed directly to cavingcluborg@gmail.com) are retained in our editorial inbox only as long as needed to resolve your inquiry or verify a route correction (maximum 24 months), after which they are deleted.

10. Privacy Compliance & Contacting Us

For any questions, requests, or privacy compliance inquiries, please contact our team:

CavingClub.org Privacy & Data Compliance Team

Official Privacy Email: cavingcluborg@gmail.com

Website: CavingClub.org • Terms of Service & Safety Disclaimers • Contact Us

Response Time: Within 30 days for all verified GDPR and CCPA requests

Privacy Policy

Interactive Privacy Controls