Lifty — Privacy Policy
Effective date: [DATE] Version: 0.1 (draft)
The short version
- You don't need an account. Without one, your location, routes, ski days and heart rate stay on your phone and watch. We never see them.
- Routing and conditions work on your device, offline. Downloading maps and forecasts sends nothing about you except what any internet request does (your IP address).
- Crash reports are on by default; usage analytics are off unless you say yes. Neither ever contains your location. Both go to PostHog's EU servers under a random ID.
- Sharing ride data to improve the map is off unless you turn it on, and is designed so we can't tell who it came from.
- If you sign in, we store your email address and a backup of your ski days — including your GPS tracks and, only if you turn it on, your heart rate. We can read that backup. We only use it to improve the map if you separately allow it.
- If you join the waitlist on lifty.ski, we keep your email address to tell you when Lifty launches, until you leave the list. The website sets no cookies and runs no analytics.
- No ads, no selling data, no tracking across apps. You can delete your account and backups at any time in the app.
The rest of this policy gives the detail the law requires.
1. Who is responsible for your data
The data controller is:
[YOUR FULL LEGAL NAME], an individual developer, [postal address], Barcelona, Spain Privacy contact: privacy@lifty.ski
Lifty is a free, non-commercial project run by one person. We have not appointed a Data Protection Officer because the law does not require one for an activity of this size. Write to the address above with any privacy question.
2. What stays on your device
The following is processed only on your phone or watch. We do not receive it unless you choose one of the options in section 3 (sharing, or an account backup):
- your live location, used to show you on the map, compute routes and give turn-by-turn directions;
- recorded ski days: GPS tracks, the lifts and pistes you rode, speeds, times and statistics, your piste passport, notes and trips;
- heart rate and energy read from Apple Health, Health Connect, Apple Watch or Wear OS (only if you allow it);
- files you import (for example from Strava, Slopes, GPX, FIT or TCX files). When you import a Strava export, Lifty reads only the skiing and snowboarding activities and never opens the others;
- your settings and preferences, such as maximum difficulty and favourite resorts.
Location permission. Lifty asks for location "While Using the App". When you record a ski day, iOS shows a location indicator and Android shows a notification while recording continues in the background; recording stops when you stop it. Lifty never asks for "Always" location access.
Apple Health and Health Connect. Lifty only reads or writes the data types you allow, only when you ask (for example to save a ski day as a workout, or to import a past ski day). Health data is never used for advertising or marketing, never sold, and never given to data brokers.
Device backups. Your phone's own backup (iCloud or Google) may include Lifty's on-device data. That backup is controlled by Apple or Google under your agreement with them, not by us.
3. What we process, why, and on what legal basis
| What | Data | Why | Legal basis (GDPR) | How long |
|---|---|---|---|---|
| 3.1 Downloading maps, conditions and app data | IP address, device/app type in standard request logs | To deliver resort maps, forecasts, lift status and webcam pictures to your device, and to keep our servers secure | Legitimate interests (Art. 6(1)(f)) — running a secure service | Server logs: up to [7] days |
| 3.2 Base map tiles | IP address and the map area your device requests | To show the base map | Legitimate interests (Art. 6(1)(f)) | Under Mapbox's policy. Mapbox's own usage telemetry is switched off in Lifty |
| 3.3 Crash reports (on by default — switch off in Settings → Privacy) | Where in the code the app crashed, app version, device model, OS version, a random ID created by Lifty. Never location; IP-based location is disabled | To find and fix crashes | Legitimate interests (Art. 6(1)(f)) — keeping the app working. You can object at any time with the switch | Up to [12] months |
| 3.4 Usage analytics (off unless you say yes) | Which screens and features are used (for example "directions started", or the name of a lift or piste whose card you opened), app version, device model, OS version, language, the same random ID. Never location, routes, ski-day content or account details | To understand which features are useful | Consent (Art. 6(1)(a)) | Up to [12] months |
| 3.5 Reports and feedback | What you write, the lift/piste/POI/route the report is about (by name, never a position), the app language, a daily rate-limit key that can't be linked across days, and — only if you type one — your email address | To fix map and data errors, and to reply if you asked | Legitimate interests (Art. 6(1)(f)) — accurate maps; your email: consent (Art. 6(1)(a)) | Reports: 12 months after we handle them. Your email: deleted after 12 months at the latest |
| 3.6 Ride stats (off unless you turn it on) | How long lifts, queues and pistes took, identified by lift/piste and by day and half-hour; unlinked transitions between pistes | To measure lift and piste times for everyone's routes | Consent (Art. 6(1)(a)) | Individual records: 48 hours, then only anonymous totals are kept |
| 3.7 Map gaps (off unless you turn it on; needs ride stats) | Rough lines (snapped to ~20 m, 200 m removed at each end, nothing near villages, hotels or car parks, no times) where you skied somewhere the map has no piste | To find missing pistes | Consent (Art. 6(1)(a)) | Individual records: 30 days, then only anonymous clusters are kept |
| 3.8 Live crowd estimates (only while recording, if enabled with ride stats) | Which lift/piste you are on and its state, every 5 minutes, with a random one-off code | To estimate how busy lifts are | Consent (Art. 6(1)(a)) | 1 hour |
| 3.9 Push notifications (only if you allow notifications) | Device push token, platform, a scrambled (hashed) version of a random install ID, the resorts you follow, notification preferences | To send the conditions notifications you asked for | Consent (Art. 6(1)(a) — your OS permission) and performance of the service (Art. 6(1)(b)) | Until you turn notifications off, then deleted within 30 days |
| 3.10 Account (optional) | Email address, sign-in method (Apple/Google identifier, or a securely hashed password), account ID, badges such as "Founding member", app language, your map-improvement and heart-rate settings | To let you sign in, restore your data on a new device, and show badges | Performance of a contract (Art. 6(1)(b)) | Until you delete your account, or after 3 years without using your account (we email you 30 days before) |
| 3.11 Backup of ski days (when signed in) | Each day's statistics, titles, notes, trips, the lifts and pistes you rode, your piste passport, and your GPS tracks | To restore your ski days, including replaying runs, on a new or reset phone | Performance of a contract (Art. 6(1)(b)) | Until you delete the day or your account, or after 3 years without using your account (we email you 30 days before). The summary keeps 5 earlier versions |
| 3.12 Heart rate in your backup (off unless you turn it on — Settings → Account) | Heart-rate samples recorded during your ski days | To show your heart rate after restoring | Explicit consent (Art. 9(2)(a)) — heart rate is health data | Until you switch it off (deleted from every backed-up day), delete your account, or your account is deleted after 3 years without use |
| 3.13 Map improvement from backups (off unless you turn it on) | Your backed-up GPS tracks and ride times — never heart rate. The link to your account is removed before analysis | To measure lifts and find missing pistes | Consent (Art. 6(1)(a)) | Results are kept only as anonymous totals. A list of which days were analysed is deleted with your account |
| 3.14 Emails you send us | Your email address and message | To answer you | Legitimate interests (Art. 6(1)(f)) | Up to [2 years] after the conversation ends |
| 3.15 Waitlist (only if you join it on lifty.ski) | Your email address, the site language you used, your share code, who invited you (if you came through a friend's link), how many friends joined with yours, and when you joined and confirmed | To confirm your email, show your place on the list and whether you're a founding rider, and email you when Lifty launches. Nothing else: no newsletter, no marketing from others | Consent (Art. 6(1)(a)) — given by joining and confirming the link we email you | Unconfirmed emails: deleted after 30 days. Confirmed: until you leave the list (the link in your email), or [6 months] after the public launch at the latest |
| 3.16 Visiting lifty.ski | IP address, browser type and the page requested, in our host's standard request logs. To limit abuse of the waitlist and resort-request forms we count requests per day under a scrambled (keyed hash) form of your IP address that can't be reversed or linked across days | To deliver and secure the website | Legitimate interests (Art. 6(1)(f)) — running a secure service | Host logs: under Vercel's policy. Request counters: 2 days |
| 3.17 Photos you add to a place (only if you send one; needs an account) | The photo, its size, the place it is of, the app language, the version of the photo terms you accepted, and your account ID. Before we store it we delete everything inside the file except the picture, including any location or camera details | To check the photo, then show it on that place in Lifty | Performance of a contract (Art. 6(1)(b)) for the upload; legitimate interests (Art. 6(1)(f)) — a safe, accurate map — for review | Waiting for review: until we review it or you delete your account. Rejected: the photo is deleted at once, the record after 12 months. Approved: the photo stays public in Lifty; the link to your account is removed after 12 months, or when you delete your account |
How sharing (3.6–3.8) is kept anonymous. These records carry no account, no install ID and no device ID. Each record has a code that changes per day and per lift or piste, created from a secret that never leaves your phone, so records from one day can't be joined back into a path. We don't store IP addresses with these records, though the request briefly passes through our hosting provider's logs (3.1). We only use results once at least 5 rider-days (3 for map gaps) agree. Under Settings → Contribute → What I've shared you can see exactly what was sent in the last 30 days and withdraw it; records still within their storage period are deleted. Anonymous totals that have already been calculated can't be taken out, because no one can tell whose they were.
Webcams. Webcam pictures are downloaded through our servers. On iPhone, if a provider's video cannot be played directly, Lifty may open the provider's own viewer (for example Feratel), which loads content from that provider. Lifty tells you this before the player opens the first time. The provider may then receive your IP address and set its own cookies, under its own privacy policy.
The website. lifty.ski sets no cookies, uses no analytics or tracking, and loads its fonts and images from our own domain, so your browser contacts no one else. If you ask for a resort on the site, we store only the resort's name and the site language.
What we never do: sell your data; show ads; use your data for advertising or profiling; track you across other apps or websites; link your account to analytics, reports, push notifications or shared ride data; make decisions about you by automated means that have legal or similarly significant effects.
4. Who we share data with
We use the following service providers ("processors"). They process data only on our instructions and under data processing agreements:
| Provider | What for | Where |
|---|---|---|
| Supabase Inc. | Database, file storage, sign-in, server functions (everything in 3.1, 3.5–3.13, the waitlist in 3.15 and photos in 3.17) | EU |
| PostHog Inc. | Crash reports and usage analytics (3.3, 3.4) | EU (Frankfurt) |
| Resend Inc. | Sending sign-in and password codes to your email address, the one warning before an unused account is deleted, waitlist emails (3.15), and the email that tells us a photo is waiting for review (3.17: the photo and the place, never who sent it) | USA |
| Vercel Inc. | Hosting the lifty.ski website (3.15, 3.16) | USA / global |
| Mapbox Inc. | Base map tiles (3.2) | USA / global |
| Apple Inc. (APNs) and Google LLC (Firebase Cloud Messaging) | Delivering push notifications (3.9) | USA / global |
When you sign in with Apple or Google, that company processes your data as a separate controller under its own privacy policy. If you choose Hide My Email, we only receive Apple's relay address.
Our weather supplier (Open-Meteo) and our text-generation service (used to write the daily conditions summary) receive no data about you: our servers request forecasts for each resort's position, not yours.
We may also disclose data if the law requires it, or to protect the rights, safety or property of our users or others. If Lifty is ever transferred to another organisation, your data would move with it under this policy, and we would tell you first.
5. Transfers outside the EU
Some providers above are based in the USA or may process data there. Where that happens, we rely on the EU–US Data Privacy Framework (where the provider is certified) or on the European Commission's Standard Contractual Clauses, with additional safeguards where needed. You can ask us for a copy of the relevant safeguards.
6. Your rights
You have the right to:
- access the personal data we hold about you and get a copy;
- correct inaccurate data;
- delete your data (Settings → Account → Delete account deletes your account, email and every backup immediately);
- restrict or object to processing based on legitimate interests (for crash reports, use the switch in Settings → Privacy);
- data portability — receive the data you gave us in a machine-readable format;
- withdraw consent at any time, without affecting processing before you withdrew it:
- usage analytics and crash reports: Settings → Privacy
- ride stats, map gaps, live crowd: Settings → Contribute
- heart-rate backup and map improvement: Settings → Account
- notifications: in the app or your phone's settings
- the waitlist: the "Leave the waitlist" button on the page your waitlist email links to
- Apple Health / Health Connect / location: your phone's settings.
Most data in sections 3.3–3.8 is not linked to you, so we may be unable to find it for an access or deletion request; in that case we will tell you why.
To exercise a right, email privacy@lifty.ski. We may ask you to confirm your identity (for example, by emailing from your account address). We reply within one month.
You also have the right to complain to a data protection authority. In Spain this is the Agencia Española de Protección de Datos (www.aepd.es, C/ Jorge Juan 6, 28001 Madrid). You can also complain to the authority in the EU country where you live or work.
7. Children
Lifty is not directed at children. You must be at least 14 (or the age of digital consent in your country, if higher) to create an account or turn on analytics or data sharing. If you believe a child under that age has given us personal data, contact us and we will delete it.
8. Security
We protect data with encryption in transit (HTTPS) and at rest, access controls that let each account read only its own data, and by keeping as little as possible. Backups can be read by us, for example to provide support or when allowed for map improvement; they are not end-to-end encrypted. No system is perfectly secure; if a breach affects your data and puts you at risk, we will tell you and the authority as the law requires.
9. Changes to this policy
We will update this policy when Lifty changes how it uses data. The date at the top shows the latest version. We will tell you in the app before any change that matters to you takes effect, and ask for your consent again where the law requires it.
10. Contact
[YOUR FULL LEGAL NAME], [postal address], Barcelona, Spain · privacy@lifty.ski