Privacy Notice
Effective October 18, 2026 · applies to wildpass.club
The short version
- We collect what is needed to run the marketplace: your account, bookings, payments (through Stripe), messages, reviews and safety reports.
- Your location is used only in your browser when you tap “near me”; it is never sent to or stored on our server.
- We measure visits with our own first-party analytics (no ad trackers). In Europe it is off unless you accept; elsewhere you can opt out any time.
- We never sell your data. You can ask for a copy, a correction or deletion at any time.
1. Who we are
WildPass (wildpass.club) is a marketplace where US landowners (“hosts”) offer day passes and memberships for hunting, fishing, foraging and other outdoor activities on their land. It is run from Michigan, USA. We are the controller for the personal data described here.
For anything about your personal data, contact us at contact@wildpass.club. In this policy “we”, “us” and “our” mean WildPass.
2. What we collect, why, and on what legal basis
| What | Why we use it | Legal basis | How long we keep it |
|---|---|---|---|
| Account: name, email, password (stored only as a salted hash), optional phone, photo and bio, the terms version you accepted | To create and run your account | Contract: needed to provide what you asked for (GDPR Art. 6(1)(b)) | While your account is open; deleted within 30 days after you ask, except the records below |
| Date of birth and guardian link: asked at sign-up. Under-13 sign-ups are refused and nothing is stored; accounts aged 13–17 are linked to a parent or guardian account and cannot book | To check age and protect minors | Legal obligation, e.g. tax and accounting law (Art. 6(1)(c)); Legitimate interests (Art. 6(1)(f)) | While the account is open |
| Host details (hosts only): business type and name, US mailing address, phone, tax acknowledgment, and your listings (land location, photos, descriptions, rules, seasons) | To publish listings and pay hosts | Contract: needed to provide what you asked for (GDPR Art. 6(1)(b)); Legal obligation, e.g. tax and accounting law (Art. 6(1)(c)) | While you host, then as tax law requires |
| Payouts and identity (hosts): handled by Stripe Connect. Your SSN/EIN, bank details and ID documents go straight to Stripe; we never see them. Stripe issues tax forms such as the 1099-K | Paying hosts and meeting tax rules | Contract: needed to provide what you asked for (GDPR Art. 6(1)(b)); Legal obligation, e.g. tax and accounting law (Art. 6(1)(c)) | Kept by Stripe under its policy |
| Bookings and payments: passes, bookings, membership status, credits and referrals. Card details go to Stripe, never to us | To run bookings and memberships | Contract: needed to provide what you asked for (GDPR Art. 6(1)(b)); Legal obligation, e.g. tax and accounting law (Art. 6(1)(c)) | As long as tax law requires (usually 7 years) |
| Messages, reviews and ratings between guests and hosts | To arrange visits and keep the marketplace trustworthy | Contract: needed to provide what you asked for (GDPR Art. 6(1)(b)) | While both accounts are open |
| Trip posts and follows you choose to publish | To show them to your followers | Contract: needed to provide what you asked for (GDPR Art. 6(1)(b)) | Until you delete them or your account |
| Waiver acceptances and incident reports | Safety, insurance and resolving disputes | Contract: needed to provide what you asked for (GDPR Art. 6(1)(b)); Legitimate interests (Art. 6(1)(f)) | As long as needed for possible legal claims, even after an account is closed |
| Hunting or fishing licence (optional): licence number and state, shown to the host on hunt bookings | To let hosts check guests are licensed | Contract: needed to provide what you asked for (GDPR Art. 6(1)(b)) | Until you remove it |
| Location: only if you tap “near me” or type a place. It is used in your browser to sort results and never stored on our server. Drawings you make on maps stay in your browser | To show nearby land | Contract: needed to provide what you asked for (GDPR Art. 6(1)(b)) | Not stored by us |
| Emails to us | To answer you | Legitimate interests (Art. 6(1)(f)) | As long as needed to answer |
3. Analytics, cookies and similar storage
How we measure visits
Our pages load a small script from our own domain (/_hub/e.js) that reports to our own server. It is not Google Analytics or any other third-party analytics service, and nothing it collects is shared with advertisers. When it is allowed to run (see your choices below) it records:
- the page address (never the part after “?”), the website you came from (its domain only), how long the page was actively in view, how far you scrolled, and the order of pages within one visit;
- clicks and taps on links and buttons (the button or link text and where the link goes), taps on our phone, text or email links, file downloads, and video plays and how much was watched;
- when a form is started or sent and which fields your browser flagged as incomplete, but never anything you type;
- page-speed measurements (Core Web Vitals), JavaScript and loading errors, rapid repeated clicks, and whether text was copied or the page printed;
- device type, browser and operating system (from your browser’s User-Agent), screen width, touchscreen or not, language, time zone, dark-mode setting and connection type (such as 4G);
- campaign tags in the link you followed (
utm_source,utm_medium,utm_campaign) and whether an ad click ID was present (never the ID itself); - a random ID for the current browser tab and a random visitor ID kept in your browser for up to 12 months, so we can tell new visitors from returning ones.
These IDs are random numbers, not your name or email address, and our server scrambles them with a secret key (hashing) before saving them. Your IP address is used for a moment to block floods of fake requests and is not saved by this measurement. We use the results to learn which pages help people, to find errors and slow pages, and to decide what to improve. Detailed records are deleted after 400 days (about 13 months); a visitor record is deleted 400 days after its last visit.
Legal basis: if you are in the EU/EEA, the UK or Switzerland, your consent (GDPR Art. 6(1)(a) and the ePrivacy rules on storing information on your device). Elsewhere, our legitimate interest in understanding and improving the site (Art. 6(1)(f)), which you can switch off at any time.
Page counts
The site also keeps a simple count of views per page per day. It contains no identifier, IP address or cookie.
Your choices
The first time you visit, a small “Privacy choices” box explains this. If your device is set to a European time zone (EU/EEA, UK, Switzerland and neighbouring countries), nothing is stored and nothing is measured unless you click Accept. Elsewhere, measurement runs unless you click Opt out. If your browser sends a Global Privacy Control or Do Not Track signal, we treat it as an opt-out. You can change your mind at any time:
Opting out stops the script on this site, removes its storage from your browser, and deletes the visitor record linked to your random ID from our server. Your choice is saved in the hub_consent cookie for 12 months; if you clear your cookies we will ask again. You can also block or delete cookies and site storage in your browser settings and the site will still work.
Everything we store in your browser
| Name | Type | Purpose | How long | Category |
|---|---|---|---|---|
hub_consent | Cookie | Remembers your privacy choice (analytics on or off) | 12 months | Strictly necessary |
_hub_nb | Session storage | Notes that the privacy box has already been shown in this tab (outside Europe only) | Until you close the tab | Strictly necessary |
_hub_s, _hub_n, _hub_lp | Session storage | Random tab-session ID, page count and previous page, to link the pages of one visit | Until you close the tab | Analytics |
_hub_v | Local storage | Random visitor ID, date of first and last visit, number of visits, to tell new visitors from returning ones | 12 months | Analytics |
wp_session | Cookie | Keeps you signed in | Up to 30 days | Strictly necessary |
We do not use advertising cookies, tracking pixels or cross-site trackers.
4. Server logs and security
Like almost every website, our web server writes a line for each request it handles: your IP address, the date and time, the page or file requested, the result, the referring page and your browser’s User-Agent. We use these logs to keep WildPass running and secure: fixing errors, spotting attacks and abusive bots, and counting traffic. The log files roll over by size and are overwritten automatically, usually within a few days. Our traffic dashboard keeps only counts made from them. For daily unique-visitor counts it combines the IP address and browser with a random value that changes every day and is thrown away after three days, so the count cannot be traced back to you.
Legal basis: legitimate interests in security and in running the service (Art. 6(1)(f)).
5. Who we share it with
We do not sell personal information, and we do not share it for advertising. We share it only with:
| Who | What for | What they receive | Where |
|---|---|---|---|
| Hetzner Online GmbH | Server hosting (data centre in Helsinki, Finland) | Everything stored on our servers | Finland (EU) |
| Stripe, Inc. / Stripe Payments Europe | Card payments, memberships, host payouts and identity checks (Stripe Connect) | Name, email, payment details; for hosts, identity and bank details entered directly with Stripe | US / Ireland |
| Porkbun LLC | Domain names and forwarding of email sent to our addresses | Emails you send us | US |
| Other users | Running bookings | Hosts see a booking guest’s name, rating, messages and any licence info the guest added; guests see the host’s display name and listing; exact check-in details unlock only after booking | - |
Content loaded from other services. When a page shows a map, your browser fetches map tiles directly from the tile providers (Esri ArcGIS, OpenStreetMap and OpenTopoMap), and some pages load photos from Unsplash. Those services receive your IP address and browser details, as with any website you visit, under their own privacy policies.
We may also disclose information if the law requires it, to protect someone’s safety, or to defend legal claims. If the business is ever sold or reorganised, the buyer would take over this information under the same promises.
6. Where your data is stored
Our servers are rented from Hetzner Online GmbH and located in Helsinki, Finland, in the EU. We are based in Michigan, in the United States. Some of the providers above are based in the United States. Where the GDPR applies, transfers to the US rely on the EU–US Data Privacy Framework for providers certified under it, and otherwise on the European Commission’s Standard Contractual Clauses in the provider’s data-processing terms.
7. Your rights
Wherever you live, you can ask us to show you the personal data we hold about you, give you a copy (including in a machine-readable format), correct it, delete it, or stop using it for a particular purpose.
EU/EEA, UK and Switzerland: under the GDPR (and the UK GDPR and Swiss law) you have the rights of access, rectification, erasure, restriction, data portability and objection, including the right to object at any time to processing based on our legitimate interests and to any direct marketing. Where we rely on your consent you can withdraw it at any time; that does not affect what we did before. You can also complain to your data protection authority (list of EU authorities; in the UK, the ICO; in Switzerland, the FDPIC), though we would appreciate the chance to put things right first.
United States: residents of states with privacy laws (such as California, Colorado, Connecticut, Virginia and others) have similar rights to know, delete and correct their information and to opt out of its sale or use for targeted advertising. We do not sell or share personal information in that sense, and we honour Global Privacy Control signals.
We do not make decisions about you based solely on automated processing that have legal or similarly significant effects. The only automatic rule is that sign-ups giving an age under 13 are refused.
To use any of these rights, contact us at contact@wildpass.club. We reply within one month. For complex requests we may take up to two more months and will tell you if so. We may need to confirm that a request really comes from you, for example by replying from the email address on your account. Using your rights will never count against you.
8. Children
WildPass is not directed to children under 13 and, consistent with the US Children’s Online Privacy Protection Act (COPPA), we do not knowingly collect personal information from anyone under 13: sign-ups that state an age under 13 are refused and nothing from them is stored. Accounts for teens aged 13–17 collect the same basic details as adult accounts plus the linked parent or guardian, cannot book, and are visible to that guardian. Booking a pass or hosting land requires age 18+. If you believe a child under 13 has an account, email help@wildpass.club and we will delete it and its data promptly.
9. Security
Every page is served over HTTPS. Admin tools are password-protected, passwords are stored only as salted hashes, and card numbers never reach our servers (Stripe handles them). No system is perfectly secure; if a breach affects your data we will tell you and the authorities where the law requires.
10. Changes to this policy
We will post any changes here with a new effective date. If a change is significant we will also say so on the site and email account holders.