Privacy Policy
Controller
Philipp Gleich, Faunastraße 51, 40239 Düsseldorf, Germany, email: support@skigator.com
In short
Your current location stays on your device. Everything you save in the app stays there too, unless you sign in to an account: then your settings, favourites, saved trips (for a trip saved from “Your location”, including that position) and recent searches are also kept in the account so that your devices share them (section 3). The app contains no advertising and no tracking. Only the data listed below is processed.
1. Map and search (Mapbox)
Maps, place search and offline maps are provided by Mapbox, Inc., Washington, DC, USA. Mapbox receives your IP address and the request itself, i.e. the map area shown or the search text you typed. Legal basis: Art. 6(1)(b) GDPR. The transfer to the USA is based on the EU Standard Contractual Clauses.
Mapbox Telemetry, the sending of anonymised location and usage data to Mapbox, is switched off. You can turn it on and off again in the map-info dialog (ⓘ). Legal basis: your consent, Art. 6(1)(a) GDPR and § 25(1) TDDDG. See the Mapbox Privacy Policy.
2. App content and abuse protection (Google Firebase)
Resort data and live status are loaded from servers of Google Ireland Limited, Dublin; Google processes your IP address in server logs. Firebase App Check uses Google Play Integrity or Apple App Attest to verify that requests come from a genuine installation of the app; integrity data about your device and the app is sent to Google or Apple for this. Legal basis: Art. 6(1)(b) and (f) GDPR. Transfers to the USA rely on the EU-US Data Privacy Framework (Google LLC) and the EU Standard Contractual Clauses.
3. Account (optional)
Firebase Authentication (Google) stores your email address, your password as a hash, a user ID and sign-in times in the USA. Legal basis: Art. 6(1)(b) GDPR. The data is kept until you delete the account: in the app under Account → “Delete account”, or by email to us (instructions). Minimum age: 16.
Sync. While you are signed in, the app stores your settings, favourites (name, resort and type), saved trips (resort; start, stops and destination as coordinates — for “Your location”, the position at the time of saving — and the names of the points and the trip) and recent searches (search term, resort, where you tapped the map, and when you last used each resort) under your account ID, so that they are the same on all your devices. Each item carries the time it was saved, last used or last changed. Legal basis: Art. 6(1)(b) GDPR. Storage: Google Cloud Firestore, region europe-west3. The data is kept until you delete the items or the account. When you delete an item, a marker with its identifier (for favourites and recent searches this contains the resort and the name or search term) is kept so that the item also disappears from your other devices; it is removed after 180 days the next time one of your devices syncs, and at the latest together with the account.
4. Reports, feedback and support
When you send a map correction, a status report, feedback or a support request, we store your input together with the time, platform, app language and, if you are signed in, your account ID; for support requests also your email address. Purposes: improving map data, answering your requests, detecting abuse. Legal basis: Art. 6(1)(b) GDPR for support requests, otherwise Art. 6(1)(f). Storage: Google Cloud Firestore, region europe-west3. Deletion: status reports after 90 days, map corrections and support requests after 12 months, feedback after 24 months. If you delete your account, your account ID and email address are removed from your submissions immediately; the content is kept anonymously.
5. Offline passes (purchases)
Downloading offline maps and using them offline require a paid pass. The purchase itself is made with Apple or Google — we never receive your name, address, card or any other payment details.
So that a pass works without you having to create an account, the app generates a random identifier for your installation and stores it on your device (in the iOS Keychain, or derived from the Android device ID; on Android the device ID itself never leaves the phone). This identifier is a pseudonym: it contains nothing about you or your device and is meaningless outside this app. It is sent to RevenueCat, Inc. (USA), which verifies the store receipt and records which pass runs until when. Legal basis: Art. 6(1)(b) GDPR — without it a purchased pass could not be delivered or restored. The transfer to the USA is based on the EU standard contractual clauses. RevenueCat keeps this record for as long as the pass could still be restored: we note, under the same identifier, when your last pass ended (Google Cloud Firestore, region europe-west3) and delete the record at RevenueCat together with that note 12 months after that date. You can also request deletion at any time using the contact address above.
Before each resort download we additionally store, under the same identifier, the times of the last downloads, which pass is running and, after abuse, a block (Google Cloud Firestore, region europe-west3). Which resorts you download is not stored. Purpose: keeping the service stable by limiting how many downloads can be started per day. Legal basis: Art. 6(1)(b) and (f) GDPR. Deletion: 30 days after the pass expires.
For each pass we store a reference to the purchase, when the pass ends, which account it belongs to (if any) and the installation identifiers of the devices that used it (normally at most two, or five for the season pass), with the time the record was created and last changed. Purpose: delivering the pass to your devices and applying the device limit. Legal basis: Art. 6(1)(b) GDPR. Storage: Google Cloud Firestore, region europe-west3. The link to your account is removed when you delete the account; the record itself is deleted 12 months after the pass ended.
6. Website
skigator.com runs on Firebase Hosting (Google). Google briefly stores server logs with IP address, time and requested address (Art. 6(1)(f) GDPR). No cookies, no tracking. If you pick a language in the menu, your browser remembers that choice (local storage, § 25(2) no. 2 TDDDG); nothing else is stored on your device.
Contact form. If you write to us through the contact form, we store the topic, your email address, your message, the time and the language of the page, just like a support request from the app (section 4: Art. 6(1)(b) GDPR, Google Cloud Firestore, region europe-west3, deleted after 12 months). To limit abuse, the number of messages from each IP address is counted for one hour in the server's memory; the address itself is not stored (Art. 6(1)(f) GDPR).
7. Your rights
You have the right of access, to rectification, to erasure, to restriction of processing, to data portability and to object (Art. 15–21 GDPR). You may withdraw consent at any time. You may lodge a complaint with a data protection supervisory authority. Contact the email address above. We make no automated decisions.
8. Changes
The current version is always available at this address.