PISTEBOUND Privacy Policy

Version 1.2. Effective 20 October 2026.

What changed in version 1.2. This version takes effect when it is published. It covers the App for Android phones as well as for iPhone: signing in, storage and backups on the phone, permissions, the map and notifications (sections 4, 5, 6.1, 6.3, 6.5, 6.6, 6.13 and 14). It adds Google as a recipient for the Android app (sections 7 and 8), the connection to Strava, which we have not switched on yet (section 6.16), and a separate page on deleting your account (section 13). For the iPhone app it only clarifies wording.

This policy explains what personal data we process when you use the PISTEBOUND app for iPhone, Apple Watch and Android phones (the "App") and the website pistebound.com (the "Website"): why we process it, on what legal basis, who receives it, how long we keep it and what your rights are. It gives the information required by Articles 13 and 14 of Regulation (EU) 2016/679 (the "GDPR"). The rules for using the App and the Website are set out in the PISTEBOUND Terms of Service (the "Terms of Service").

This English version is a translation of the Polish original. Section 17 explains which version prevails. Section 18 adds information for people in the United Kingdom, the United States and Canada.

1. Who we are

1. The controller of your personal data is Kornel Sowiński, a sole trader registered in Poland's Central Register and Information on Economic Activity (CEIDG) under the business name SOWINS Kornel Sowiński, Orchów 159, 98-100 Łask, Poland, tax identification number (NIP) 8311640361, REGON 386815540 ("we", "us").
2. We have not appointed a data protection officer, as the law does not require us to.

2. How to contact us

1. For anything concerning your personal data, email hello@owlet.studio or write to the postal address in section 1.1.
2. In the App, go to More and tap "Contact us".

3. Summary

1. The App works without an account. Without one, everything you record stays on your phone and we have no access to it.
2. An account is optional. You need one for crews, backing up your days, Find me links and piste leaderboards.
3. Once you sign in, backup of your days is on by default. You can switch it off at any time (section 6.2).
4. Your live position is sent to other people only when you choose to share it, and only for as long as you choose.
5. We do not sell your personal data. The App contains no advertising, analytics or tracking tools and never asks for permission to track you. The only exception is the map in the Android app, through which Google collects its own usage data (section 6.13.1). The Website uses no analytics, advertising pixels or tracking tools and sets a single cookie (section 6.12). If we advertise the App on other companies' platforms, we give them no data from the App or the Website (section 6.15).
6. Data from Apple Health is never used for advertising or marketing and is never sold.
7. The App's server is in the European Union, in Ireland.

4. What stays on your phone

1. Whether or not you have an account, the App keeps the following on your phone: the recordings of your days (GPS position, speed, direction of travel, altitude and barometer readings), your ski days, runs and lift rides, notes, stats, records, favourite resorts, runs saved for offline use, your language and your settings. We have no access to any of this unless you send it in one of the ways described in section 6.
2. The details you give about yourself (date of birth, sex, height, weight and skiing level) are kept in the phone's protected storage and, if you use an account, also on your account as described in section 6.3. On an iPhone this is the iOS Keychain; on Android it is storage encrypted with a key held in the Android Keystore. The Android app has no screen for these details: it only keeps a copy of the details already on your account, if you saved them there from an iPhone.
3. The App reads photos from a ski day in your photo library, including where and when they were taken, so that it can show them on that day at the spot where you took them. It does not copy or upload them.
4. Data read from Apple Health (iPhone only) is shown only on the phone, except as described in section 6.3.
5. The reminder to record when you arrive at a resort is available on iPhone only and runs entirely on the phone: the phone itself checks whether you are at one of up to 18 resorts it watches, and sends nothing. The Android app has no such reminder.
6. Share images, export files (GPX, FIT, CSV, full archive) and spoken run summaries (speech synthesis) are created on the phone. A file or image leaves the phone only when you hand it to another app or person yourself, and from then on the recipient you chose is responsible for it.
7. The Apple Watch app records the day on the watch and sends it to your iPhone as a GPX file (position, altitude and speed, no heart rate). It saves heart rate and active energy in a workout in Apple Health. It reads your date of birth from Health on the watch only, to set your heart-rate zones.
8. You remove the data kept in the App's storage by deleting days in the App or by deleting the App. On an iPhone, the iOS Keychain is the exception: the details about you and the sign-in data kept in it may stay on the phone after the App is deleted. To remove them, clear the details about you in the App and sign out, or delete your account, before you delete the App. On Android, deleting the App removes all of its data from the phone, including its protected storage.
9. Backups of your phone. If you back up your phone with iCloud Backup on an iPhone or with Google's backup on Android, the phone includes the App's files in that backup, including your ski days, under Apple's or Google's terms (on an iPhone, see also section 6.3.4). On Android, the protected storage described in section 4.2 (your sign-in and the details about you) is left out of that backup. A copy in your phone's backup stays there until the backup is replaced or deleted.

5. Phone permissions

1. The App asks for access to a phone feature only when a feature you use needs it. You can withdraw any permission at any time in your phone's settings. Refusing switches off only the feature that needs that access.
2. The App uses these permissions:

3. The App does not use the microphone, speech recognition, contacts, calendars, Bluetooth, the local network, Face ID or fingerprint unlock.
4. Storing and reading information on your phone as described in this section is strictly necessary to provide a feature you have expressly asked for, so it needs no separate consent (Article 399 of the Polish Electronic Communications Law of 12 July 2024, the "Electronic Communications Law"). Where data leaves the phone, the legal basis is given in section 6.
5. Android: recording with the screen off. On Android the App asks for location only while you use it and never for background location. When you start recording or share your position, Android runs this as a service in the foreground and shows an ongoing notification for as long as it runs, so the App can keep recording with the screen off. When you finish the day or the share ends, the service stops and the notification goes away.

6. Purposes, data, legal bases and retention

6.1 Account and sign-in

1. Purpose: creating and running your account, signing you in and performing the account agreement made under the Terms of Service.
2. Data: the email address we send your sign-in link to or, with Sign in with Apple (on iPhone only; the Android app signs in only with an email link), your Apple identifier and the email address Apple gives us (which may be a private relay address); your account ID; the name, colour, sport, home resort and profile photo you choose, if any; the version of the Terms of Service you accepted when signing in and when you accepted it; when you accepted the crew rules; your account settings (whether you show your days to your crews and whether you take part in leaderboards).
3. Legal basis: performance of a contract (Article 6(1)(b) GDPR) and, for recording which version of the Terms of Service you accepted and when, our legitimate interest in being able to show on what terms we made the agreement (Article 6(1)(f) GDPR).
4. Profile photo: you can take it with the camera or pick it from your photo library in the system picker; the App uploads only the photo you choose. Before uploading, it redraws the photo on the phone at 512 pixels, without what the camera recorded (place, time, phone model), and we keep it in a private store on our server.
5. Who sees it: your crews see your name, colour, photo, sport and home resort. No other user sees your email address or Apple identifier.
6. Sign-in emails are sent from noreply@pistebound.com through Resend.
7. Retention: until you delete your account (section 13).

6.2 Backup of your days

1. Purpose: keeping your days on your account so that they can be restored after reinstalling the App or on a new phone, and keeping the same days on all your phones.
2. Data: the full recording of each day (for each point: GPS position with accuracy, speed, direction of travel, altitude, time and, if the phone has one, the barometer reading); the day's summary (resort, runs, vertical, distance, speeds, time on skis); notes and answers about your days; days imported from files and from Apple Health; and a record that you deleted a day (its date and start time and when it was deleted, nothing else from the day). The day you are recording is backed up as it grows. Days brought in from Strava are never backed up (section 6.16).
3. Default: once you sign in, backup is on, and the sign-in screen says so. To switch it off, open your account screen, section "Backup", and turn off "Back up to my account". The App then asks whether to remove the copies already on your account too.
4. Legal basis: performance of a contract (Article 6(1)(b) GDPR). Backup is part of the account service and you can switch it off at any time.
5. Who sees it: only you. Access is restricted by the access rules on our server. The backup is not end-to-end encrypted (section 14.4).
6. Retention: a day's copy until you delete it or your account; a deletion record for one year after it is made, or less if you restore the day.

6.3 Details about you and Apple Health

1. Details about you. In the iPhone app you can give your date of birth, sex, height, weight and skiing level, typing them in or filling them in from Apple Health.
   1. Purpose: estimating the calories you burn and suggesting gentler ways down for beginners.
   2. Where: the App keeps these details in the phone's protected storage only (section 4.2); they are not synced through iCloud Keychain. The Android app does not ask for them; it keeps on the phone only a copy of the details already on your account. If you use an account, your date of birth, sex and skiing level are also kept on your account. Height and weight reach your account only if you agree to it in a window the App shows before either is first saved to your account. Without that consent they stay on the phone only. If you are under 16, height and weight stay on the phone only, even with consent (section 15.3). Other users cannot read any of these details.
   3. Legal basis: we keep your date of birth, sex and skiing level on your account because the features you use need them (Article 6(1)(b) GDPR). Height and weight are data concerning health, and combined with them the other details may be too. So we keep height and weight on your account only on the basis of your explicit consent and, once you save them there, we keep all the details about you on that same basis (Article 6(1)(a) and Article 9(2)(a) GDPR). You can withdraw consent at any time in the App, by clearing height and weight, or by writing to us. When you withdraw consent, we remove height and weight from your account; when you clear all the details about you, we remove all of them.
   4. Retention: on your account, until you clear the details or delete your account, and height and weight also until you withdraw consent; on the phone, until you clear them or delete your account (section 4.8).
2. Apple Health (iPhone only). The Android app reads and writes no health data and does not use Health Connect. If you allow it, the iPhone app saves each finished day in Apple Health as a workout (off by default). If you allow reading, the iPhone app reads: heart rate (including resting and walking heart rate), heart rate variability, cardio fitness (VO2 max), heart rate recovery, respiratory rate, blood oxygen, active and resting energy, steps, walking distance, flights climbed, exercise minutes, physical effort, time in daylight, the number of falls recorded by the watch, sleep, weight, height, date of birth, sex, and workouts with their routes.
3. These readings are shown on the phone only. The only things that reach our server are:
   1. the details about you, if you fill them in from Health, with height and weight only if you save them to your account with your consent (section 6.3.1);
   2. a ski workout imported from Health, which becomes a ski day (with its route, without heart rate) and is backed up like any other day (section 6.2).
4. Apple Health data is never used for advertising or marketing, never sold and never passed to anyone except as described above. We never send Apple Health data or the details about you to iCloud. However, if you have iCloud Backup turned on, iOS includes the App's files in the backup of your whole phone, under Apple's terms, including your ski days and among them days created from workouts imported from Apple Health.
5. The App is not a medical device. Health figures and calorie estimates are for information only.

6.4 Crews

A crew is a private group that people can join only by invitation. Crews need an account and acceptance of the crew rules.

1. Purpose: providing crew services: membership, chat, position sharing, places and meetups, trips, conditions reports, the crew's day board and showing who is in the App now.
2. Legal basis: performance of a contract (Article 6(1)(b) GDPR), unless stated otherwise below.
3. Membership and profile. Your crews see your name, colour, profile photo, sport and home resort. An invite code is valid for 7 days. A crew is deleted when its last member leaves.
4. Sharing your position. While you share your position with a crew, its members (those who were in the crew when you started sharing and whom you have not blocked) see, for the time you choose and at most 14 days: your last position with its accuracy and time, altitude, speed, direction of travel, whether you are skiing, on a lift, queuing, walking or stopped, and, while you are recording, the day's runs and vertical. With your position the App sends a random installation ID so that your phones can be told apart. You can stop sharing at any time.
   1. We keep only one, latest position: each new one replaces the last, so no history of where you have been is built up. We delete it as soon as neither a crew share nor a Find me link needs it (checked every 5 minutes). The record of the share itself (who, which crew, from when to when) is deleted a day after the share ends.
   2. Battery level. Each shared position carries your phone's battery level as a percentage, which crew members see beside it so that they know why you may drop off the map. We keep it with your latest position. If your battery runs low while you are recording and sharing, the App posts a message once that day in those crews' chats with your battery level as a percentage. Crew members also receive it as a notification (section 6.6), and it is deleted like other messages, after two days. Legal basis: our legitimate interest and that of your crew in the safety of people skiing together (Article 6(1)(f) GDPR). You can object to this processing (section 9.1.6); your battery level stops being sent when you stop sharing your position.
5. In the App now. Crew members see a green dot by your photo while the App is open on your screen. For this we pass on only your account ID over a live connection and store nothing. Someone you have blocked does not see the dot. It is on by default; turn it off with "Show when I'm in the app" in your account settings. Legal basis: our legitimate interest in letting a crew see who is available now (Article 6(1)(f) GDPR).
6. Messages. Messages, replies, reactions, shared places (name, location with altitude, opening hours, type of food) and requests for help are seen by the members of that crew. Messages are deleted after two days, together with their reactions.
7. Chat photos. You can take a photo with the camera or pick it from your photo library in the system picker; the App uploads only the photo you choose. Before a photo leaves the phone, the App makes a new JPEG of at most 1,600 pixels on its longer side, without what the camera recorded (place, time, phone model). We keep the photo (2 MB at most) in a private store. You and the crew members who can read the message see it, each time through a link valid for ten minutes. It is deleted with its message, after two days at most, unless the message has been reported: the photo is then kept until the report has been dealt with (section 6.9).
8. Meeting point. Seen by that crew. Deleted two days after it was last set or one day after it was cleared, whichever comes first.
9. Meetups. Type or name, place on the map, start time, reminder, the time zone of the phone of the person who planned it, and members' answers. Up to 14 days ahead. Deleted with its answers one day after it starts or is cancelled.
10. Trips. Resort, first and last day, a note of up to 200 characters, and "going", "maybe" or "not going" answers. A cancelled trip is deleted a day later and any other trip 15 days after its last day, together with its answers.
11. Conditions now. A conditions report (set phrases, a note of up to 120 characters, the resort's name, no coordinates) is seen by crew members until the end of the day in the sender's time zone, two days at most.
12. Crew days. If you turn on "Show my days to my crews", crew members see the date and start time, resort, runs, vertical, time on skis and distance of each day. Members who also show their days see, in addition, the day's outline (its shape drawn in a small square, with no coordinates) and your named runs in order, with grade, time and descent. For this the App also sends the name of each lift you rode, the minute you boarded and the length of the ride. These rides are never sent to anyone's phone; our server only compares them with a crew mate's rides on the same day and shows that person which lifts you rode together. Crews never see your GPS track. Crew days are kept until you stop showing them or delete the day or your account. While we keep a report one person made about another, neither of them sees the other's outlines or named runs.
13. Blocking. When you block someone, you no longer see their messages, photo, days or position, and they no longer see yours. They are not told. We keep the block until it is lifted or either account is deleted. Our moderators are emailed about every block, with both people's names and account IDs, so that they can act quickly on harassment. Legal basis for that email: our legitimate interest in keeping crew users safe (Article 6(1)(f) GDPR).
14. Other technical data. To protect crews from abuse we record attempts to join a crew (for one hour), when you add reactions to messages and how many messages to the moderators a person's actions have caused (for 30 days at most), and how many changes to rides a person has sent to the crew's day board (for 30 days after the day the rides are from). Legal basis: our legitimate interest in protecting the service from abuse (Article 6(1)(f) GDPR).

6.5 Safety: asking for help, the stop check and emergency numbers

1. "I need help". The request goes to your crews with your position. For the next 3 hours your crews can see where you are. It does not alert the emergency services.
2. "Are you OK?". Off by default. When you turn it on, while you are recording the phone asks whether you are all right if you have stood still for 20 minutes away from pistes, lifts and huts. If you choose to tell your crews and do not answer within another 10 minutes, the crews you share your position with receive a request for help with your position. Whether you are standing still is worked out on the phone. The phone cannot detect a fall or an injury.
3. Emergency numbers. The emergency numbers screen works on the phone. The App never calls anyone by itself: when you choose a number, it hands it to the phone, where you confirm the call (on Android, the phone's dialler opens with the number). On Apple Watch, holding the emergency button for 2 seconds calls the local emergency number (or 112) and asks your crews for help through your phone.
4. Legal basis: performance of a contract (Article 6(1)(b) GDPR), since you start these features yourself. If a request for help reveals anything about your health, in particular one sent because nobody answered "Are you OK?", we also rely on the protection of your vital interests where you are unable to give consent (Article 6(1)(d) and Article 9(2)(c) GDPR). Requests for help are crew messages and are deleted after two days.
5. These features do not replace the emergency services. See the Terms of Service.

6.6 Notifications

1. Purpose: delivering crew notifications (messages, requests for help, meetups, trips, crew mates' days, conditions reports).
2. Data: your device's notification token, your account ID, the App's language, your units (metric or imperial) and your phone's time zone. Up to 10 devices per account. We use the time zone only so that a meetup notification shows the start on your own clock, with its day when that is not today.
3. Content: a notification carries the sender's name and the crew's name and, depending on its kind: up to the first 180 characters of a message, a photo caption or a shared place's name; a crew mate's day with its resort and vertical; a conditions report with the resort's name; a meetup with its name and time; or a trip with its resort and dates. A message notification also carries the sender's account ID, so that the App can hide notifications from people you block. A notification never contains coordinates.
4. Recipients: notifications pass through Expo's push service and then, to an iPhone, the Apple Push Notification service or, to an Android phone, Google's Firebase Cloud Messaging.
5. Legal basis: performance of a contract (Article 6(1)(b) GDPR). You can turn notifications off in your phone's settings.
6. Retention: a token is deleted, together with the language, units and time zone kept with it, when you sign out, when the notification service reports that the device no longer uses it, when the account is banned or when it is deleted. The time zone is replaced when you open the App in another time zone.
7. Reminders to record, low-battery reminders and the "Are you OK?" question are local notifications created by the phone itself.

6.7 Find me links

1. Purpose: showing your position to people you choose who do not have the App, in a browser, at pistebound.com/f/.
2. Data and who sees it: anyone with the link sees, until it ends, the first word of your name, your last position with its accuracy and time, whether you are skiing, on a lift, queuing, walking or stopped, the resort's name while you are in it, and when the link ends. They do not see your battery level or anything else. Send the link only to people you trust.
3. Duration: two hours, four hours or until the end of the day, 24 hours at most. You can stop the link at any time; a new link stops the previous one.
4. What we keep: a one-way SHA-256 hash of the link (neither we nor anyone else can rebuild the link from it), who created it and when, when it ends or was stopped, and the resort with its area. The position is the same single record that crew sharing uses (section 6.4.4).
5. Legal basis: performance of a contract (Article 6(1)(b) GDPR).
6. Retention: the link's data is deleted a day after it ends or is stopped.
7. People who open a link. So that nobody can guess links or flood the page, each time a link is opened we record a salted SHA-256 hash of the visitor's IP address (never the address itself; for IPv6, a hash of its first 64 bits), which link was opened and when. We delete this within 15 minutes. Legal basis: our legitimate interest in protecting links from guessing and abuse (Article 6(1)(f) GDPR). The Find me page draws its map from the sources in section 6.12.

6.8 Piste leaderboards

1. Purpose: showing your times on piste leaderboards.
2. Your choice: leaderboards are off by default. You turn them on with "Show my times" on the More tab, after accepting the crew rules, and off with the same switch.
3. Data: for each piste with a leaderboard, from a day recorded live on the phone: resort, piste name, date, skis or snowboard, the day's quickest time on that piste with its distance and descent, 20 split times (clock readings, never a position) and, to check the time, the piste's grade and length from the map. The App never sends days imported from a file, another app, Apple Health, Strava or Apple Watch.
4. Who sees it:
   1. your crews: your name, colour, photo and the date of each time, straight away; if they show their own times, they can also race your quickest run by its splits;
   2. other signed-in users: only a short form of your name (for example "Anna K."), one of the standard colours and the month, never the day, and only once that day has ended everywhere on Earth; on the today, this week and regulars boards they see your result with no name; they never see your photo or account, because each of them gets a different code for you; if you hold a piste's all-time best, people who show their own times can race its splits.
5. Legal basis: your consent (Article 6(1)(a) GDPR), given with the switch. Turning it off withdraws consent and takes your times off every leaderboard at once.
6. Preventing abuse: we record when your phone sends times (removed after an hour) and who opened a new piste leaderboard. The server automatically rejects times nobody could achieve on that piste. Legal basis: our legitimate interest in fair leaderboards (Article 6(1)(f) GDPR).
7. Retention: your times are kept with your account. If you change or delete a day from the past year on the phone that sent its times, the App withdraws those times at its next send. If you want us to delete your times from the server without deleting your account, write to us.
8. Leaderboards are available only to people aged 16 or over.

6.9 Reports, moderation and bans

1. Reports. You can report a message, a person, a crew, a trip or a name on a leaderboard. We also accept reports by email at hello@owlet.studio, including from people without an account.
2. Data: who reported, whom and what the report is about, the reason, your note (up to 500 characters), and a copy of the reported content that the server takes itself, because the original may disappear before the report is reviewed: the crew's name, the message with its photo, and a trip's resort and note. The report is emailed to our moderators and never to the person reported.
3. Legal basis: our legal obligation to handle notices and give reasons for decisions (Article 6(1)(c) GDPR together with Articles 16 and 17 of Regulation (EU) 2022/2065, the "DSA") and our legitimate interest in user safety and in defending legal claims (Article 6(1)(f) GDPR).
4. Retention: a report is deleted, together with its copy of the reported content, 12 months after it has been dealt with, and at the latest 13 months after it was made. The photo of a reported message is kept only until the report has been dealt with or deleted. Reports of leaderboard names are deleted 13 months after they were made, or earlier with the account of either person. Any other report remains after either person deletes their account, with its copy of the reported content, but is no longer linked to that account. Emails about reports and blocks sent to our moderators are deleted 13 months after they were sent.
5. A reported leaderboard name disappears at once from the reporter's own leaderboards. When three credible people (who have accepted the rules, have had an account for at least 7 days and have their own time on that piste) report the same name, it is hidden from every leaderboard until a moderator has checked it.
6. Word filter. The server automatically rejects names, crew names, messages, meetup titles, trip notes and names, conditions reports and resort names in Find me links that contain words from a list of offensive terms. In crew days it leaves out a resort name that contains such a word, and leaves out of the shared list any run or lift ride whose name contains one. The filter checks content automatically, without anyone reading it. We do not otherwise look at crew messages unless one is reported to us or the law requires it.
7. Account bans. We may ban an account that breaks the Terms of Service. A ban removes the person from their crews, ends their position sharing and Find me link, deletes their messages, crew days and notification tokens, cancels their meetups and trips and excludes them from leaderboards. A person decides on every ban, and we give the reasons as described in the Terms of Service.
8. Fingerprints of a banned account. After a ban we keep fingerprints of the account's email address and Sign in with Apple identifier: SHA-256 hashes made with a secret key, from which neither the address nor the identifier can be read. A new account created with the same address or identifier is banned automatically. We keep the fingerprints for 5 years after the ban, also after the account is deleted, and remove them sooner if we lift the ban. A new ban of the same account, or the automatic ban of a new account created with the same address or identifier, starts the 5 years again. Legal basis: our legitimate interest in preventing a person banned for violations from returning (Article 6(1)(f) GDPR).
9. Pausing a piste leaderboard. We may pause the leaderboard of a busy or hazardous piste. This affects your data only in that a paused leaderboard does not show it.

6.10 Correspondence and exercising your rights

1. Purpose: answering messages, handling complaints and acting on your GDPR rights.
2. Data: your email address, the content of the correspondence and anything you give us in it.
3. Legal basis: our legal obligations (Article 6(1)(c) GDPR together with Articles 12 to 22 GDPR, the Polish Consumer Rights Act and the DSA) and our legitimate interest in replying and being able to show how we dealt with the matter (Article 6(1)(f) GDPR).
4. Retention: as long as needed to deal with the matter and then until claims connected with it are time-barred, no longer than 3 years after it is closed.

6.11 Service security and server logs

1. Purpose: keeping the services secure and running, detecting abuse and diagnosing faults.
2. Data: IP address, time and type of request, and your account ID if the request contains it; for a sign-in session, also the type of device or browser (section 6.11.4).
3. Legal basis: our legitimate interest in the security of the services (Article 6(1)(f) GDPR).
4. Where and for how long: in the short-lived logs of our server provider (Supabase) and of the Website's host (Vercel), kept for the period those providers set, no longer than 7 days. In addition, while you are signed in, the sign-in service keeps for each session the IP address and the type of device or browser it was last used from. We delete them when you sign out on that device or delete your account. We use this data for nothing else, including working out anyone's location.
5. The App's update service (Expo) receives a random installation ID so that it can deliver updates. We do not store it or link it to your account.

6.12 The Website

1. Hosting. The Website is hosted by Vercel. Vercel sees your IP address on each visit and keeps it in short-lived logs (section 6.11). When you open the home page, Vercel derives your country from your IP address and we use it, with your browser's language, to choose the regional version of the Website. We do not store it. Legal basis: our legitimate interest in showing the right version of the Website (Article 6(1)(f) GDPR).
2. Cookie. If you pick a country or region on the region page linked from the footer, the Website remembers your choice in one cookie, pb_region, for one year (SameSite=Lax). It is the Website's only cookie. It is strictly necessary for a function you asked for, so it needs no consent (Article 399 of the Electronic Communications Law). You can delete it in your browser settings.
3. No tracking. The Website uses no analytics, advertising pixels or other tracking tools.
4. Maps. The App demo, the resort pages and the Find me pages draw their maps from open map services. Your browser fetches the part of the map on screen directly from them, so each sees your IP address and the map area:
   1. satellite imagery: EOX IT Services (Austria, Sentinel-2) and, in three countries, national aerial photography: IGN (France), GUGiK (Poland), basemap.at (Austria);
   2. roads and place names: OpenFreeMap;
   3. terrain relief: Mapterhorn. In the United States, aerial photography comes from USGS (The National Map); the Website's server fetches it, so USGS does not see your IP address. A country's imagery server is asked only for map tiles inside a rectangle covering that country. The rectangle can include border areas of neighbouring countries. On a computer, the App demo on the home page of each regional version of the Website starts by itself, without a click, and at once fetches map tiles of the area it shows from these services. The rest of the demo's data comes from files on our Website, not from other services. Legal basis: our legitimate interest in showing maps (Article 6(1)(f) GDPR). OpenFreeMap and Mapterhorn deliver tiles through Cloudflare, Inc., which may process your IP address in the United States under the EU-US Data Privacy Framework (Article 45 GDPR).
5. Weather on resort pages comes from MET Norway, the Norwegian Meteorological Institute. The Website's server asks for the forecast, so MET Norway does not see your IP address.

6.13 Maps, pistes and weather in the App

1. The map in the iPhone app is Apple Maps (MapKit). Apple receives requests for the map tiles and satellite imagery you see on screen, with your IP address, under Apple's privacy policy. The map in the Android app is Google Maps (Maps SDK for Android). Google receives requests for the map you see on screen, with your IP address. According to Google, the Maps SDK also collects technical details of each request (such as the phone's model and system version), a pseudonymous identifier of the SDK on your phone, crash reports from the SDK and how you move and zoom the map, and uses them to run and improve its services, under Google's privacy policy. The App gives Google nothing from your account and does not send it your recordings.
2. Pistes and lifts come from OpenStreetMap. The App fetches them from our server and, for a resort our server does not have yet, from public Overpass servers (overpass-api.de and overpass.private.coffee), which receive the resort's area and your phone's IP address and nothing from your account.
3. To keep its own copy of the pistes up to date, our server queries overpass.private.coffee and a mirror run by VK in Russia. These queries are sent by our server, never by your phone, and contain only a resort's area and no personal data.
4. The App fetches forecasts, snow data, past days' weather and piste heights directly from Open-Meteo. Open-Meteo receives the coordinates of the resort or of points on a piste, the date for a past day's weather, and your phone's IP address. While you are recording, the App asks for the forecast of the resort you are at, so Open-Meteo can link your phone's IP address to that resort. It never receives the coordinates of your position or any account data.
5. Legal basis: our legitimate interest in providing the maps, pistes and forecasts you ask for without requiring an account (Article 6(1)(f) GDPR) and, for account holders, performance of a contract (Article 6(1)(b) GDPR). These services act as separate controllers of their own logs.

6.14 Data we receive from others

Some data about you does not come from you (Article 14 GDPR):

1. from Apple, when you sign in with Apple: your Apple identifier and email address (including a private relay address);
2. from other users: reports and blocks concerning you, crew messages and photos in which you appear, and answers to your meetups and trips;
3. from Apple Health, with the permission you give in iOS: the data described in section 6.3;
4. from Strava, if you connect it: the data described in section 6.16.

6.15 Our ads on other platforms

1. We may advertise the App on other companies' platforms, such as social networks, search engines and app stores. When you see or click one of our ads there, the platform processes your data as an independent controller, under its own privacy policy and your settings with it.
2. When we set up an ad, we choose who should see it using general criteria the platform offers, such as country, language, age range or interests, and the platform applies them to its own data. We do not upload lists of people or email addresses, and we give platforms no data from the App or the Website. We do not use interests or behaviour to target ads at people under 18.
3. From the platforms we receive only aggregated statistics about our campaigns, such as how many people saw or clicked an ad. These statistics do not identify you.
4. The App and the Website contain no advertising pixels, tags or advertising software kits, so they send these platforms nothing about you. If that changes, we will update this policy before the change takes effect and, where the law requires, ask for your consent first (section 16).
5. Legal basis for choosing the audience of our ads: our legitimate interest in promoting the App (Article 6(1)(f) GDPR). Where we and a platform are jointly responsible for that choice, you can exercise your rights with us or with the platform. To see or change how a platform uses your data for ads, use that platform's ad and privacy settings.

6.16 Strava

The App contains a connection to Strava, which we have not switched on yet. Until we do, the App shows no Strava option and sends nothing to Strava. This section describes how the connection works once we offer it. It needs an account.

1. Purpose: sending the days you choose to your Strava account and, if Strava allows it, bringing your ski days from Strava into the App.
2. Connecting: on the More tab, under Strava, you tap "Connect with Strava" and allow access on Strava's page. Strava then gives our server your Strava athlete ID, your name as Strava shows it, the permissions you granted, and the keys (access and refresh tokens, with their expiry) that let us act for you on Strava. We keep them on our server. The App on your phone sees only your Strava name, the permissions and since when you are connected, never the keys.
3. Sending days: a day goes to Strava only when you send it, or when you turn on "Send finished days to Strava" (off by default). The App sends our server the day's GPX file, the same file the export creates: for each point, position, altitude, time, speed and, if the phone has one, the barometer reading. Our server passes it to Strava straight away with your keys, named after the resort, with its sport and a reference to the day. We do not keep the file. Your phone notes which days it has sent.
4. Bringing days in: this works only if Strava allows it. The App then reads your ski, snowboard, cross-country and snowshoe activities on Strava, including private ones, and makes days of them that stay on that phone only, for you alone: they are never backed up, shown to your crews, put on leaderboards or exported.
5. Messages from Strava: if you remove PISTEBOUND's access on Strava or delete an activity there, Strava tells our server your athlete ID and, for a deleted activity, its ID. We keep this until your phone has acted on it, 30 days at most. To share Strava's limits fairly, we also count how many requests to Strava your phone makes in each quarter of an hour and each day.
6. Disconnecting: on the More tab, under Strava, tap "Disconnect Strava". Our server asks Strava to remove PISTEBOUND's access and deletes the keys and the connection, whatever Strava answers. The days brought in from Strava are removed from the phone. You can also remove PISTEBOUND in your settings on Strava; our server then deletes the connection as soon as Strava confirms it. Days already sent to Strava stay there until you delete them on Strava.
7. Legal basis: performance of a contract (Article 6(1)(b) GDPR), since you connect Strava and choose what to send.
8. Strava (Strava, Inc., United States) is a separate controller of the days you send it and of your Strava account, under its own terms and privacy policy.
9. Retention: the connection and its keys until you disconnect, remove access on Strava or delete your account; messages from Strava for 30 days at most; the request count until you delete your account.

7. Who receives your data

1. We pass data only to providers that help us run the services under data processing agreements (processors), and to others where you start the transfer. Our processors may use your data only on our instructions and must protect it at least to the standard described in this policy.

2. Moderation is carried out by us and by people acting on our instructions who are bound by confidentiality.

8. Transfers outside the European Economic Area

1. Our server and account data are in Ireland. Some recipients are based in the United States or may access data from there (for example for technical support). Transfers rely on:
   1. Supabase: the European Commission's standard contractual clauses (Article 46(2)(c) GDPR), included in the data processing agreement;
   2. Resend, Expo, Vercel and Google (for Firebase Cloud Messaging): the European Commission's adequacy decision of 10 July 2023 on the EU-US Data Privacy Framework (Article 45 GDPR), to the extent they are certified under it, and otherwise standard contractual clauses;
   3. Apple and Google as separate controllers: the mechanisms described in their privacy policies;
   4. Strava: your request to send your days there (Article 49(1)(b) GDPR).
2. We will send you a copy of the standard contractual clauses on request to the address in section 2.
3. People you share data with in a crew, through a Find me link or on leaderboards may be outside the European Economic Area.

9. Your rights

1. You have the right to:
   1. access your data and receive a copy (Article 15 GDPR);
   2. have it corrected (Article 16 GDPR);
   3. have it erased (Article 17 GDPR);
   4. restrict its processing (Article 18 GDPR);
   5. data portability for data processed on the basis of consent or contract (Article 20 GDPR);
   6. object at any time, on grounds relating to your particular situation, to processing based on our legitimate interest (Article 21 GDPR); once you object, we will stop processing that data unless we can show compelling legitimate grounds that override your interests, rights and freedoms, or the data is needed to establish, exercise or defend legal claims;
   7. withdraw consent at any time, without affecting the lawfulness of processing before withdrawal (Article 7(3) GDPR);
   8. lodge a complaint with the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych), ul. Stawki 2, 00-193 Warsaw, Poland (uodo.gov.pl), or with the supervisory authority of the EU or EEA country where you live or work or where the alleged infringement took place. If you are in the United Kingdom, see section 18.1.
2. You can do much of this yourself in the App: correct your profile and details on the account screen, delete a day, switch off backup, leaderboards, showing your days and showing when you are in the App, export your days (More, "Export data": GPX, FIT, CSV or a full archive) and delete your account.
3. For anything else, write to the address in section 2. We will send a copy of your account data on request. We reply without undue delay and within one month at the latest. Where necessary, given the complexity or number of requests, we may extend this by two further months and will tell you so within the first month.
4. If we are not sure a request comes from you, we may ask you to confirm it, for example by writing from the email address linked to your account.

10. Consent and withdrawing it

We rely on consent for:

1. details about you saved to your account (section 6.3.1): withdraw it in the App or by writing to us;
2. your times on piste leaderboards (section 6.8): withdraw it with the "Show my times" switch.

These consents are separate from the permissions you give the App on your phone (section 5), including access to Apple Health. A permission is not consent within the meaning of the GDPR but your decision whether the App may use a phone feature. You can withdraw any of them in your phone's settings.

11. Do you have to give us your data?

1. Giving us data is voluntary. You can use the App without an account.
2. To create an account you need an email address or, on an iPhone, Sign in with Apple. Without one we cannot enter into the account agreement.
3. You cannot join a crew without a name, or record a day without access to location. Everything else you give only if you want to use the feature that needs it.

12. Automated decision-making

1. We make no decisions about you based solely on automated processing that produce legal effects concerning you or similarly significantly affect you (Article 22 GDPR). We do not profile you.
2. We do use simple automated mechanisms, described in sections 6.8 and 6.9: the word filter, rejecting implausible leaderboard times, hiding a leaderboard name reported by three credible people until a person has checked it, limits on how often actions can be taken, and automatically banning a new account created with the email address or identifier of an account a moderator has already banned.
3. If you think one of these mechanisms has wrongly affected you, write to us and a person will review it.

13. Deleting your account

1. Delete your account in the App, on an iPhone or an Android phone: More, the account row at the top, "Delete account", then confirm. You can also ask us without the App, by email from the address you sign in with. Both ways are described step by step at https://pistebound.com/delete-account.
2. If you use Sign in with Apple on an iPhone, the App asks Apple to unlink PISTEBOUND from your Apple Account before deleting the account. If that fails, the App shows you how to do it in iOS Settings.
3. Deleting your account removes from our server: the account, profile, profile photo, details about you, crew memberships, the messages and reactions you sent, your answers to meetups and trips, crew days, your shared position, Find me link, leaderboard times, blocks, notification tokens, sign-in sessions, backed-up days, day deletion records and your Strava connection with its keys.
4. After deletion, the following remain:
   1. the days stored on your phone;
   2. crews you created, if they have other members;
   3. meetups, trips and meeting points you created, without your name, until they are deleted on the schedule in section 6.4;
   4. reports you made and reports concerning you, including the copy of a reported message of yours, no longer linked to your account, for the periods in section 6.9.4;
   5. fingerprints of your email address and Apple identifier, if the account was banned (section 6.9.8);
   6. emails already sent to the moderators, until they are deleted 13 months after they were sent (section 6.9.4);
   7. data in providers' logs and backups, until removed in those providers' cycles, no longer than 7 days.
5. The App also removes the details about you from the protected storage on that phone and, if you connected Strava, asks Strava to remove PISTEBOUND's access and removes the days brought in from Strava from that phone. Days already sent to Strava stay there.

14. Security

1. The App's and the Website's connections to our servers are encrypted (HTTPS).
2. Access to data on the server is restricted by access rules enforced on the server for each person and each record: for example, your position is visible only to the people you share it with and only for the time you choose.
3. We do not keep Find me links or fingerprints of banned accounts in readable form. Sign-in tokens and details about you are kept on the phone in its protected storage: the iOS Keychain on an iPhone, storage encrypted with an Android Keystore key on Android. Strava keys are kept only on our server, never on the phone.
4. Data on the server is not end-to-end encrypted: our server provider and we can technically access it, to the extent needed to provide the services and to moderate.

15. Children and young people

1. You may use the App without an account. Without an account, everything you record stays on the phone and does not reach us (section 3.1). The App is not designed for children under 13.
2. People aged 16 or over may create an account on their own.
3. People aged 13 to 15 may create and use an account only with the consent of a parent or other legal guardian (Article 8 GDPR). Leaderboards (section 6.8) and keeping height and weight on the account (section 6.3.1) are available only to people aged 16 or over, even with that consent. Children under 13 may not have an account (section 15.5).
4. Before you sign in, the App tells you that by signing in you declare that you are at least 16, or 13 to 15 with the consent of a parent or other legal guardian. A parent or other legal guardian can write to us at any time (section 2) to ask a question, withdraw consent or have the child's account deleted.
5. The App is not directed to children under 13. A child under 13 may not create an account, even with a parent's consent, but may use the App without one. We do not knowingly allow children under 13 to hold accounts. If we learn that an account belongs to a child under 13, we will delete it and its data.
6. Crews show a precise live position. We recommend that parents let a child share their position only with a family crew or with people the child knows.
7. If we learn that someone aged 13 to 15 created an account without the required consent, we will ask for the consent of a parent or other legal guardian and, if we do not receive it, delete the account.

16. Changes to this policy

1. We update this policy when features, providers or the law change, for example before we start using advertising tools or tools that measure our ads on the Website or in the App. We publish each new version on the Website before it takes effect. The date and version number at the top always show the version in force. Previous versions are available on request.
2. We will tell you about significant changes, such as a new purpose, a new category of data or a new recipient, in the App and on the Website and, if you have an account, by email, before they take effect.
3. We start processing that needs your consent only once you have given it, and we ask for that consent separately, together with information about the processing. In particular:
   1. tools on the Website that store or read information on your device and are not needed for the Website to work (such as tools that measure our ads) will be switched on only after we publish a new version of this policy, and only if you agree to them in the consent banner on the Website; refusing will not limit your access to the Website;
   2. if the App were ever to share data with other companies for tracking as Apple defines it (App Tracking Transparency), this would happen only after we publish a new version of this policy and update the App, and only with your consent given in the App and in the iOS system prompt; refusing will not limit any feature of the App.

17. Language versions

This policy is available in Polish and English. If they differ, the Polish version prevails, except that section 18 applies as written in English. Section 18 adds to the rest of this policy and does not reduce any right described in it.

18. Information for particular countries

18.1 United Kingdom

1. If you are in the United Kingdom, the UK GDPR and the Data Protection Act 2018, as amended by the Data (Use and Access) Act 2025, also apply to our processing of your data. References to the GDPR in this policy include the corresponding provisions of the UK GDPR, and you have the rights described in section 9.
2. You can complain to us by writing to the address in section 2. We acknowledge a complaint within 30 days, look into it and tell you the outcome without undue delay. You can also complain to the Information Commissioner's Office (ico.org.uk).
3. Your data is stored in Ireland, which UK law recognises as providing adequate protection. Transfers to the United States rely on UK adequacy regulations for organisations certified under the UK Extension to the EU-US Data Privacy Framework or on safeguards approved under UK law, such as the International Data Transfer Addendum to the standard contractual clauses.
4. Storing and reading information on your phone (section 5) and the pb_region cookie (section 6.12) are strictly necessary for features you ask for, so they need no consent under the Privacy and Electronic Communications Regulations 2003 either.

18.2 United States

1. Some US states give their residents rights over their personal information. This section describes our practices in the terms those laws use.
2. No sale, sharing or targeted advertising. We do not sell personal information, do not share it for "cross-context behavioral advertising" and do not process it for targeted advertising. If this ever changes, we will update this policy first, give you a way to opt out and treat a Global Privacy Control signal from your browser as a valid request to opt out.
3. What we collect. We collect the following categories of personal information, from the sources described in sections 6.1 to 6.16 (you, your device, Apple, Strava if you connect it, and other users), for the purposes described in section 6:

4. Sensitive personal information. Precise geolocation, the health-related details in section 6.3 and the contents of crew messages are sensitive personal information. We use them only to provide the features you ask for and for the other purposes the law permits, never to infer characteristics about you.
5. Who receives it. We disclose personal information only to the service providers in section 7, to Apple and Google for the services listed there, to Strava if you connect it, to other users when you choose to share with them, and to authorities where the law requires. We do not disclose personal information to anyone for their own direct marketing. We keep each category for the periods in section 6.
6. Your rights. Depending on where you live, you may have the right to know what personal information we hold about you and get a copy, to correct it, to delete it, to opt out of its sale, sharing or use for targeted advertising, and not to be treated differently for using these rights. We honour these requests from all US residents. Use the tools in the App (section 9.2) or write to the address in section 2. We may need to verify your identity (section 9.4). An authorized agent may make a request for you if they show us your signed permission. We reply within 45 days; if we need more time, we may extend this once by up to 45 days and will tell you why.
7. Appeals. If we decline your request, you can appeal by replying to our decision. Where possible, a person who did not take the original decision will decide the appeal, within 45 days. If you are not satisfied with the outcome, you can contact the attorney general of your state.
8. Consumer health data. Our Consumer Health Data Privacy Policy at https://pistebound.com/consumer-health-data describes how we handle consumer health data, as Washington's My Health My Data Act and similar laws in other states require; this paragraph summarises it. The only consumer health data we collect is height and weight, if you choose to save them to your account, and with them the other details about you (section 6.3.1): date of birth, sex and skiing level. Height and weight reach our server only with the explicit consent you give in the App before either is first saved to your account; they come from you or, at your request, from Apple Health on your iPhone. We use them only to estimate calories and suggest gentler ways down. We share them with no one except Supabase, which stores them for us as our processor, and we never sell them. You can see or clear them, or withdraw consent, at any time in the App or by writing to us, and you can appeal a refusal as described in paragraph 7.
9. Children. See section 15. The App is not directed to children under 13, and children under 13 may not create an account. We do not knowingly collect personal information from children under 13; a child who uses the App without an account keeps their recordings on the phone. If we learn that an account belongs to a child under 13, we delete it and its data. A parent or guardian who believes that their child under 13 has an account can write to us at the address in section 2.

18.3 Canada

1. If you are in Canada, we handle your personal information as described in this policy, in line with the Personal Information Protection and Electronic Documents Act and, in Quebec, the Act respecting the protection of personal information in the private sector.
2. Your information is stored in Ireland, and some of our providers are in the United States (sections 7 and 8). Courts and authorities in those countries may be able to access it under their laws.
3. The person responsible for protecting your personal information is Kornel Sowiński, whom you can reach at the address in section 2.
4. You can access and correct your information and withdraw consent as described in section 9. You can complain to the Office of the Privacy Commissioner of Canada (priv.gc.ca) or, in Quebec, to the Commission d'accès à l'information du Québec (cai.gouv.qc.ca).

Back to PISTEBOUND