Privacy Policy

Last updated: 2026-10-18

SkiNav ("we", "us", "the app") is a mobile application for navigating ski resorts. This policy explains what data we collect about you, how we use it, who it is shared with, and the choices you have.

By using SkiNav you agree to this policy. If you don't agree, please don't use the app.

1. What we collect

When you create an account or sign in

• Email address. You can sign in with an email and password, or with Google Sign-In. If you use Google, we receive your email address and basic Google profile (name, profile picture) from Google. Passwords (for email sign-in) are handled entirely by our authentication provider (Supabase) and are never visible to us.
• A display name and an optional profile picture — either a photo you upload or a preset avatar you pick from a built-in set.
• A randomly generated invite code that lets friends add you.

While you use the app

• Your GPS location. While the app is open, your position places you on the map and is broadcast roughly every 10 seconds so accepted friends can see you on the mountain. While turn-by-turn navigation is running this continues with the screen off or the phone in your pocket — otherwise guidance and arrival would stop the moment you locked the screen. On Android that is a foreground service, so a persistent notification is shown for as long as it runs, and it ends when you stop navigating. We do not collect your location when the app is closed, or when it is in the background and you are not navigating. For live sharing we store only the single most-recent point per user — not a location history.
• The resort you are currently in (selected by you).
• Recorded ski "runs" when you tap Record — the full GPS polyline of the run plus stats such as distance, speed, vertical, and time. Each point in the polyline also carries the altitude your device reported, where it reported one. Besides showing you your own run, we use these altitude readings to improve the elevation data in our resort maps for everyone — our maps come from OpenStreetMap, which has a real height for only a small fraction of points, and a wrong height can route a skier uphill.
• SOS alerts you trigger, including the coordinates at the time, an optional message, and a resolved / unresolved flag.
• Hazard reports you file — the kind of hazard (for example ice, poor visibility, strong wind or an accident), where it is, and when you saw it, plus your confirmations or dismissals of other people's reports. Reports are a fixed set of types; there is no free text.
• Feedback and route reports you send from the app — your message (if you write one), whether a route worked, the resort and destination, the app version, and basic device details (model, operating system and version, text size, screen size). A route report also carries the inputs needed to re-run that route, including the junction or lift you set off from.
• Product / usage events — to understand how the app is used, diagnose problems, and improve our maps and routing, we record events such as starting, completing, abandoning, or failing to find a route, rerouting, and triggering or receiving an SOS, as well as search terms that return no matching place (so we can add places people look for). These include limited context — e.g. the resort, destination, route length, number of steps, and the start/end points within the trail network. We do not use them for advertising.
• A device push-notification token, so we can deliver friend requests and SOS alerts to your device.

Stored only on your device (never sent to us)

• Personal pins you drop on the map (name, optional note, coordinates, resort) live only on your device. They are never uploaded to us — though you can choose to share a pin with someone via your phone's share sheet.
• App preferences — difficulty preference, units (metric / imperial), voice settings, map style, and developer-only mock-location settings.

2. How we use this data

• To show you the map, route you between points, and record your runs.
• To let you find and add friends by invite code, and to let mutual friends see each other's most recent location.
• To deliver push notifications for friend requests and SOS alerts.
• To improve the app — diagnosing problems and improving routing and map accuracy, including using the altitude readings from recorded runs to correct the elevation data in our maps.
• To keep the app functioning (signing you in, restoring your profile, syncing across devices).

We do not sell your data, and we do not use it for targeted advertising.

3. Who sees what

• Display name, avatar, and invite code — visible to anyone who has your invite code (you choose who to share it with).
• Live location — visible only to users you have accepted as friends. Pending requests don't see your location. You can pause sharing entirely, or hide it from individual friends, at any time.
• Hazard reports — the type, place and time are shown to everyone using the app at that resort, without your name: who filed a report is never shown to other users.
• Feedback and route reports — seen only by us. We may reply to you in the app.
• Runs, app preferences, and personal pins — visible only to you (pins unless you explicitly share one).
• SOS alerts — when you trigger SOS, your accepted friends receive a notification including your coordinates and any optional message. SOS can additionally open the phone dialler with the local ski patrol's number; you still place the call yourself — we never auto-dial.
• Usage events and the altitude readings in your runs — used internally by us to improve the app; not shown to other users. Any map corrections we derive from altitude readings are aggregated across users and carry no identifying information.

Your data is hosted in Australia (Sydney region) by Supabase.

4. Third-party services

We rely on the following services to run the app. Each has its own privacy practices:

• Supabase (data storage, authentication, realtime sync) — <https://supabase.com/privacy>
• Google (Google Sign-In, and Firebase Cloud Messaging for push delivery) — <https://policies.google.com/privacy>
• Apple APNs (push delivery on iOS) — <https://www.apple.com/legal/privacy/>
• Expo Push Notifications (push routing) — <https://expo.dev/privacy>
• Cloudflare (serves our map tiles and this website) — <https://www.cloudflare.com/privacypolicy/>
• Resend (sends account emails: your sign-up confirmation code and password-reset codes, so it receives your email address) — <https://resend.com/legal/privacy-policy>
• Open-Meteo (weather forecasts shown on the map) — <https://open-meteo.com/>

Map-tile and weather requests are made directly from your device to those services using your device's IP address and the map area you are viewing.

5. Data retention

• Your account and the data associated with it remain until you delete the account.
• You can delete your account at any time from Account → Delete account. This permanently removes your profile, friendships, live location, runs (including their altitude readings), SOS history, usage events, and device tokens. Deletion is irreversible.
• Personal pins and preferences live on your device and are removed when you delete the app or clear its data.
• An account whose email address is never confirmed is deleted automatically after 7 days.
• The route inputs attached to a route report (including where you set off from) are removed when we resolve the report, and after 90 days at the latest. The rest of the report stays until you delete your account.
• Hazard reports stop being shown to anyone once they expire — from about two hours for crowds to two days for a closed run, depending on the type.
• Encrypted database backups are retained for up to 30 days for disaster recovery and are purged thereafter on a rolling basis.

6. Your rights

You can at any time:

• Access your data from inside the app.
• Update your display name, avatar, and preferences from the Account tab.
• Pause location sharing, or hide your location from specific friends.
• Delete your account and all associated data from Account → Delete account.
• Reset your password from the Sign-in screen → Forgot password.
• Withdraw consent to our processing by deleting your account, and revoke location access at any time in your device settings.

If you are in the EU / EEA, the GDPR also gives you the right to data portability and to lodge a complaint with your local data protection authority. For data portability or any request not covered by the in-app controls, email us at the address below.

7. Children

SkiNav is intended for users aged 13 and older. We do not knowingly collect data from children under 13. If you believe a child has created an account, contact us and we will delete it.

8. Security

• Passwords are never stored or transmitted in plaintext; they are handled by Supabase Auth.
• All network traffic between your device and our backend uses TLS.
• Access to data in the database is restricted by row-level security policies — you can only read or write your own data and your accepted friends' broadcast location.
• No system is 100% secure. If you suspect your account has been compromised, change your password and contact us.

9. Changes to this policy

We may update this policy as the app changes. The "Last updated" date at the top reflects the latest revision. Material changes will be surfaced in the app before they take effect.

10. Contact

For privacy questions, requests, or complaints:

support@skinav.app