Privacy Policy

Last updated: November 8, 2026

HWTUTU is a free collection of outdoor calculators, guides and games. This page explains exactly what happens to your information. The short version: the tools run in your browser, we do not run accounts, our page-view statistics are first-party, cookieless and pseudonymous, and we show advertisements through Google AdSense.

Information We Collect

We do not require an account and we do not ask for your name, email address or payment details to use the site. We do not run Google Analytics. We do use Google AdSense to display advertisements, and Google may collect information as described in the Advertising section below. We also collect the first-party page-view statistics described below.

If you email us at liuxihope@gmail.com, we receive your email address and whatever you write. We use it only to reply to you.

Page-View Analytics

We use a small first-party analytics system to understand which tools, guides and games visitors find useful. When you open a page, your browser sends a background request to our own server. It sets no cookies and is not used for advertising, profiling or cross-site tracking.

For each page view we store:

  • the page path and page type (for example /tools/hiking-time-calculator)
  • the external website hostname that referred you, if any (for example google.com; never the full referring URL)
  • the internal page path you came from when you move between pages on this site
  • a coarse device category (desktop, mobile or tablet), plus the browser and operating system derived from your browser's user agent
  • your browser language, timezone and screen resolution, used to understand which regions and languages to support
  • your IP address and an approximate location derived from it (country or region and city)
  • a pseudonymous visitor hash that changes every day
  • the time of the visit

The visitor hash is calculated on our server from your IP address and browser user agent using a secret-keyed HMAC-SHA256 function with a salt that rotates daily. The hash is designed not to be reversible. It is used only to estimate unique visitors and cannot follow you across days, websites or devices.

We do not store full user-agent strings, cookies, query strings, form inputs or account details in this analytics system. To estimate your country and city we send your IP address to a third-party lookup service, ipwho.is; no other information is sent, and the result is cached on our server for 24 hours. IP addresses and approximate locations are kept only for aggregate reporting and are deleted together with the analytics records after 90 days.

We honour the browser's Do Not Track signal and Global Privacy Control: if either is enabled, no page-view request is sent. Where data-protection law requires a legal basis, we consider this processing to be in our legitimate interest in understanding aggregate site usage so we can improve the site. You can object by enabling Do Not Track or Global Privacy Control, or by emailing us.

Analytics records are kept for 90 days and then deleted automatically by a scheduled cleanup job.

Advertising (Google AdSense)

We use Google AdSense to display advertisements. Google and its partners may use cookies, web beacons, IP addresses, device information and information about your visits to this and other websites to serve, measure and personalize ads. This may include personalized advertising based on your prior browsing activity.

Where consent is required, we use Google's Privacy & Messaging consent tool, a Google-certified consent management platform, to ask for and record your advertising consent choices. Visitors in the EEA, UK and Switzerland can consent, decline or manage options when the message appears. You can review or change your choice at any time using the “Privacy & cookie settings” link in the footer. If you decline personalized advertising, Google may still show non-personalized or limited ads.

Learn how Google uses information from sites that use its services at policies.google.com/technologies/partner-sites. You can opt out of personalized advertising in Google Ads Settings or at optout.aboutads.info.

Where required by law, personalized advertising is served only after you have given consent through the consent message. You can also review or change your advertising choices through Google Ads Settings at any time. If you believe a consent message should have appeared and did not, please contact us so we can investigate.

Data Stored in Your Browser

Calculators, quiz progress and game scores are saved with your browser's localStorage. This data stays on your device and is never sent to us. It is grouped under these keys:

  • hwtutu-trail-iq — quiz best score and daily results
  • hwtutu-trail-iq-sound — your quiz sound preference
  • hwtutu-daily-challenge — dates you completed the daily challenge
  • hwtutu-gear-match — Gear Match best result
  • hwtutu-gear-match-sound — your sound on/off preference
  • hwtutu-morse-best — Morse Practice best score
  • hwtutu-pack-smart — your best Pack Smart score
  • hwtutu-profile — Trail XP, rank, quests and badges
  • hwtutu-saved-results — calculator results you chose to save
  • hwtutu-pack-weight — your pack weight inputs
  • hwtutu-camping-checklist — your checklist state

You can delete all of it at any time from My Progress, or by clearing site data in your browser settings.

Cookies

Our first-party analytics sets no cookies. Google AdSense may set third-party advertising and measurement cookies as described in the Advertising section. The only first-party browser storage used for the tools and games is the localStorage listed above, which is required to remember your own inputs.

If you sign in to the administrator console, the server sets one necessary session cookie named HWTUTU_ADMIN_SESSION. It is HttpOnly, SameSite=Lax, marked Secure in production, scoped to /api, and expires after 30 minutes of inactivity. It is never set for ordinary visitors.

Server Logs

Like most web servers, our server keeps standard request logs for security, abuse prevention and troubleshooting. These logs may include IP addresses and user-agent strings and are kept separately from the analytics database. We do not use them to build visitor profiles, and we keep them only as long as needed for those operational purposes. Page-view analytics requests are excluded from the access log.

Third-Party Links

Some pages link to outside websites, for example official park authorities or manufacturer documentation. Once you follow an external link, that site's own privacy policy applies. HWTUTU does not sell products and does not currently use affiliate links. See our Affiliate Disclosure for details.

Your Rights

The analytics system keeps IP addresses and approximate locations for 90 days; we use them only for aggregate reporting and never to build individual profiles. It stores no cookies and no full user-agent strings, and its daily-rotating visitor hash is not designed to identify you. If you are in the EU, UK or California and believe we hold information about you — for example an email you sent us — you can ask us to access, correct or delete it by emailing the address below. You can also object to analytics by enabling Do Not Track or Global Privacy Control in your browser. For advertising cookies, use the Google Ads Settings and opt-out links in the Advertising section. We do not sell personal information for money.

International Visitors

Our server is located in Malaysia and our analytics database is hosted with it. If you are in the EEA, UK, Switzerland or another region with data-protection laws, your information may be transferred to and processed in Malaysia. We use the safeguards described on this page — data minimisation, short retention and a daily-rotating hash — and we do not sell personal information.

Where Malaysian law applies, we handle personal data in line with the Personal Data Protection Act 2010 and its amendments. That includes using data only for the purposes described here, keeping it secure, retaining it no longer than necessary, and giving you a way to access or correct it. If you are in Malaysia and have a request, email us at the address below.

Children's Privacy

The site is not directed at children under 13, and we do not knowingly collect personal information from them.

Changes to This Policy

We may update this policy as the site or applicable law changes. If we add new third-party analytics or tracking, we will update this page and show a consent notice where the law requires one before those scripts run.

Contact

Questions about this policy? Email liuxihope@gmail.com.