SkiMap by Skipedia app privacy policy

The app is owned by Bons Websistemes SL, a company registered in Andorra at Carrera Mas de Ribafeta 3B, Arinsal, AD400, Andorra.

The contact person for data matters is Ana Pujal, email [email protected].

• Account: your email address. You sign in with a one-time code sent by email; we have no passwords.
• Profile details you add if you wish: name, profile photo, date of birth, gender. Settings: auto-stop of recording, ghost mode, time zone.
• Precise location (GPS) while the app is open: to show you on the resort map, keep the map following you and build routes. Unless ski tracking is on, your coordinates are not stored on our server; for a route only the start and end points are sent, and they are not saved.
• Ski tracking. After you tap "Start skiing", the app records track points: coordinates, altitude, accuracy, speed, heading and time, including in the background with the screen off. Tracking continues until you stop it or until it stops by itself: at night, after a long period without movement or when you are driving. The track is used to count runs, vertical, distance, speed and time on runs and lifts.
• Position for friends: while tracking, the server keeps your latest point, your status (skiing down, on a lift, taking a break) and the resort.
• Friends: your friends list, invitation links and the "hide my location" setting for an individual friend.
• Device: the push notification token, the platform (Android or iOS) and the app language.
• Technical data: IP address and server logs; if an error occurs in the app, the error text, page address and browser string are written to the server log.
• Usage statistics (Google Analytics for Firebase): app instance identifier, device model, OS version, country and events such as first open, sessions and sign-up. This data is not linked to your email.

The app does not read your contacts, messages, microphone or files. The only photo it uses is the one you choose for your profile. There are no ads in the app and we do not use advertising identifiers.

• Running the app: your position on the map, routes, ski tracking and stats, friends on the map. Basis: performance of a contract with you (you use the app for these features).
• Notifications: friend requests, an accepted invitation, a friend asking you to meet. Basis: your consent, given by allowing notifications and withdrawable in your phone settings.
• Usage statistics, so we know what works and what does not. Basis: our legitimate interest; the data is pseudonymous.
• Preventing abuse and investigating failures. Basis: legitimate interest in the security of the service.

We do not sell data, do not pass it to advertising networks and do not track you across other apps or websites.

• Only friends you added yourself or whose invitation you accepted. Your location is never shown publicly.
• Friends see you only while ski tracking is on, and for no longer than 24 hours after your latest point.
• You can hide your location from an individual friend, and ghost mode hides it from everyone at once. You can remove a friend at any time.

The "while using the app" permission is needed for the map and routes. Location is used in the background only for ski tracking: tracking you started in the app keeps going when you turn the screen off. While tracking, Android shows a persistent notification and iOS shows the location indicator.

You can revoke the permission in your phone settings at any time. The map and everything else keep working, just without your position and without tracking.

Only with services the app cannot work without. All of them process data on our instructions.

• The hosting provider of our server in the European Union, where the server and database run.
• Google Firebase (Google Ireland Ltd. and Google LLC): Cloud Messaging delivers notifications (receives the device token and the notification text), Analytics produces usage statistics.
• Apple Push Notification service - notification delivery to iPhones.
• Mailjet (Sinch, France) - emails with sign-in codes and invitations; receives the address and the message text.
• Cloudflare - delivery and protection; processes the IP address and technical request data.

The base map and terrain load directly from OpenTopoMap, Amazon Web Services (elevation tiles) and OpenFreeMap (fonts), and webcam images from Windy. They learn your IP address and the map area, but not your account. Weather and routes are calculated on our server.

We disclose data to public authorities only where and to the extent the law requires it.

• Tracks and ski days - until you delete your account, as they make up your season stats.
• Your latest position is overwritten by each new point; friends stop seeing it after 24 hours.
• A friend invitation is valid for 60 days.
• A notification token - until you sign out, Firebase reports it as invalid or you delete your account.
• Google Analytics for Firebase statistics - no longer than 14 months.
• Database backups are rotated within 30 days.

In the app: "Profile" - "Delete account". You can also ask for deletion by writing to [email protected] from the address your account is registered to; we do it within three working days. More on the account deletion page.

We delete your profile and profile photo, all tracks and ski days, your position, your friends list (you also disappear from your friends' lists), invitations and device tokens. Backups drop the data within 30 days. Uninstalling the app does not delete your account.

The server is located in the European Union. Google, Apple and Cloudflare may process data outside the European Economic Area; such transfers rely on the European Commission's standard contractual clauses or on an adequacy decision.

• obtain a copy of your data and learn what exactly we hold;
• have inaccurate data corrected;
• have your data erased;
• restrict processing or object to it;
• receive your data in a machine-readable form;
• withdraw consent; this does not affect the lawfulness of processing before withdrawal.

Write to [email protected] and we will reply within 30 days. You may lodge a complaint with the Agència Andorrana de Protecció de Dades; residents of the EEA may also contact the data protection authority of their own country.

The app talks to our server over HTTPS only, and access to the database is restricted and password protected. We collect the minimum and keep nothing we do not need.

The app is not intended for children under 16 without parental consent, and we do not knowingly collect their data. If a child has signed up without your knowledge, write to [email protected] and we will delete the account.

If the app starts processing data differently, we will update this page and the date at the top. If a change requires your consent, we will ask for it separately.

Bons Websistemes SL, Carrera Mas de Ribafeta 3B, Arinsal, AD400, Andorra. Contact person: Ana Pujal. Email: [email protected].