Privacy Policy

Booking information. When you book a trek: your name, preferred name, email, phone number, and city/state/country. We also record how you heard about us (if you tell us) and basic campaign/referral information about how you reached the site (see "Cookies" below), and whether you checked the marketing-consent box on the booking form — a separate, explicit choice from the booking itself.

Payment information. We never receive or store your card number. Stripe, our payment processor, handles that entirely. We do share your email with Stripe so it can send a receipt and so we can match your payment to your booking — see "Third-Party Service Providers" below.

Participant forms. Before your trip we ask you to complete participant forms through a secure personal link. These collect information needed to run your trip safely: your signed liability waiver; emergency-contact details (names, relationships, phone numbers, email); and health information you provide on the medical form — which may include your date of birth, allergies, medications, medical conditions, dietary restrictions, and physical limitations. We treat this health and emergency information as sensitive and use it only to prepare for and respond to situations on your trip.

Contact form. Your name, email, the category of your message, and the message itself.

Newsletter signup. Your email address. Signing up for the newsletter is itself your consent to receive it — there's no separate checkbox for this specific form.

Waitlist signup. Your name, email, phone number, and (separately from joining the waitlist) whether you opted into marketing emails.

Merchandise orders. If you buy merch, your order — including your name, email, and shipping address — is handled by our merchandise partner, Fourthwall (see "Third-Party Service Providers" below). We receive order notifications so we can provide support.

Analytics. We do not currently run third-party web analytics (such as Google Analytics) on the site. If we add analytics in the future, we will update this policy first and describe what is collected. See "Cookies" below for the cookies the site does use today.

• To create and manage your booking, and to process payment through Stripe.
• To communicate with you about your trip — confirmations, packing lists, pre-trip logistics, balance-payment reminders, and trip updates.
• To run your trip safely — using your participant-form health and emergency-contact information to prepare for and respond to medical or emergency situations on trail.
• To use your phone number for important trip communications and group-chat coordination (never for marketing).
• To respond to questions submitted through the contact form.
• To notify you when a spot opens on a trek you've waitlisted for.
• To fulfill and support merchandise orders.
• To send marketing email (newsletter, trip announcements) — only to people who signed up for the newsletter directly, or who explicitly checked the marketing-consent box on a booking or waitlist form.

We do not sell your personal information, and we do not share it with third parties for their own marketing purposes.

We use the following services to run TCT's booking, communication, and website:

• Supabase — hosts our database (bookings, customer records, participant forms, contact/waitlist/newsletter submissions) and manages secure admin and guide login. Supabase stores this data on its own infrastructure.
• Stripe — processes all payments. Your card details go directly to Stripe; TCT never receives or stores them. We provide Stripe your email to issue receipts and reconcile payments.
• Brevo — sends transactional email (booking confirmations, balance reminders, contact-form acknowledgments) and, if you opted in, marketing email (our newsletter).
• Fourthwall — hosts our merchandise store and processes merch orders, including the name, email, and shipping address you provide at checkout.
• Vercel — hosts and serves this website.

We keep personal information only as long as we need it for the purposes above and to meet legal, tax, and business-record obligations. The periods below are the targets we apply through periodic manual review — not an automated deletion system. We also delete or anonymize your data on request whenever we are not legally required to keep it.

• Booking, customer, and payment records: retained up to about 7 years after a trip, to meet U.S. tax and business-record requirements.
• Signed liability waivers: retained for several years after a trip for legal-recordkeeping reasons.
• Participant health and emergency-contact information: we aim to delete or anonymize this within about 12 months after your trip, since we only need it to run the trip.
• Contact-form inquiries: retained up to about 2 years.
• Newsletter and waitlist leads: retained until you unsubscribe or ask us to remove you.

We only send marketing email to people who've affirmatively opted in: by signing up for the newsletter directly, or by checking the separate marketing-consent checkbox on the booking or waitlist form. Booking a trek or joining a waitlist does not, on its own, sign you up for marketing email. Transactional email about your own booking (confirmations, reminders) is sent regardless of marketing consent, since it's about a trip you've already booked, not marketing.

You can unsubscribe from marketing email at any time using the link in any marketing email, or by emailing hello@triplecrowntreks.com.

The site uses a small number of first-party cookies and does not show a cookie banner:

• Attribution cookie. When you arrive from a link or campaign, we store basic referral information (such as the campaign that referred you) in a first-party cookie for up to 90 days, so that if you book we understand how you found us. It does not identify you to any outside advertiser.
• Login/session cookies. Our admin and guide logins use secure session cookies. These apply only to TCT staff and guides, not to ordinary visitors.

We do not currently use third-party advertising or analytics cookies, and we do not run cross-site ad tracking. If that changes, we will update this policy and add any consent controls that then apply.

Payment data never touches TCT's systems — Stripe handles it under its own PCI-compliant infrastructure. Our database (Supabase) uses row-level security so that customer, booking, and participant-form data is only accessible to authenticated TCT administrators, never to the public. Participant forms are reached through a private per-person link. The site is served entirely over HTTPS.

You can ask us what personal information we hold about you, ask us to correct it, or ask us to delete it, by emailing hello@triplecrowntreks.com. We'll honor your request except where we're legally required to keep certain records (for example, tax or liability records).

TCT trips are for adults. You must be at least 18 years old to book or participate (see our Terms & Conditions, Eligibility), and the site and its forms are not directed to children. We do not knowingly collect personal information from anyone under 18.

We may update this policy as TCT's tools or practices change. Material changes will be reflected with an updated effective date at the top of this page.

Questions about this policy or your data: hello@triplecrowntreks.com.