Privacy Policy

Version 1.0 · Effective 24 August 2026 · Information pursuant to Art. 13 and 14 GDPR.

1. Controller

John Uschold, Vohburgerstr. 2, 80687 München, Deutschland, is the controller responsible for the processing described below. For privacy questions and requests, contact support@snowline.club. Further provider details are available in our Legal Notice (Impressum).

2. What we process, why, and on what legal basis

2.1 Account data

• Data: account UUID, e-mail address, name and sign-in identifier received from Sign in with Apple or Google Sign-In; username; profile photo; home mountain, discipline, units, gear and other profile choices.
• Purpose & basis: creating and operating your account, showing your profile to friends, contacting you about your account — performance of a contract, Art. 6 (1) (b) GDPR.
• Source: you, your device and the identity provider you select. Apple may provide a relay e-mail address if you choose to hide your address.

2.2 Location and activity data

• Data: precise GPS positions and motion readings while recording, plus derived tracks, runs, lifts, speed, distance, duration, vertical, pistes, resorts and season statistics.
• Purpose & basis: recording and displaying your activities — this is the core service you signed up for — Art. 6 (1) (b) GDPR.
• Recording starts only after you grant the relevant iOS permissions. Detailed tracks are stored for your account and are not made available to friends. Connected friends can see day summaries and profile information. While you are actively recording, they can also receive your live position unless you enable Private Session; live-position messages are not stored as history.
• You control location permission in iOS Settings at any time; turning it off limits recording but nothing else.

2.3 Friends, invites and community features

• Data: friendships, invite relationships, public profile fields, friend-visible day summaries, leaderboard values and temporary live-presence data.
• Purpose & basis: providing the social features you choose to use — performance of a contract, Art. 6 (1) (b) GDPR.
• Snowline does not currently upload or match your iOS address book.

2.4 Usage analytics

• Data: account or installation identifier, app lifecycle, onboarding progress, feature and purchase-flow events, app environment and technical device/app information via PostHog. Event properties do not include your name, e-mail address, handle, mountain or GPS coordinates.
• Purpose & basis: improving the Service — our legitimate interest, Art. 6 (1) (f) GDPR, balanced against your right to object.
• You can object by switching off Profile → Settings → Share Usage Data. This stops collection and clears the local analytics queue.

2.5 Attribution and advertising measurement

• Data: device and installation identifiers, IP address, app-install/session information, campaign and deep-link data, and—only if you grant Apple's App Tracking Transparency permission—the advertising identifier (IDFA), processed through AppsFlyer.
• Purpose & basis: measuring which campaigns lead to installs, preventing attribution fraud and supporting deferred invite links. Access to the IDFA and cross-app tracking is based on your consent, Art. 6 (1) (a) GDPR; you may withdraw it in iOS Settings. Non-IDFA attribution is based on our legitimate interest in measuring acquisition, Art. 6 (1) (f) GDPR, subject to your right to object.
• Snowline does not send your GPS tracks to AppsFlyer.

2.6 Purchases

• Data: subscription status and transaction identifiers from Apple, processed through RevenueCat, plus anonymous identifiers that keep entitlements working across devices and app-environment attributes.
• Purpose & basis: providing paid features — Art. 6 (1) (b) GDPR. We never see your credit-card or Apple account data.

2.7 Map display

Maps are rendered with Mapbox. Loading a map transmits technical request data, including your IP address and the requested map area, to Mapbox. This is necessary to provide the map feature, Art. 6 (1) (b) GDPR. See Mapbox's privacy policy.

2.8 Website, backend and security logs

The website is hosted by Vercel and the app backend uses Supabase. Requests can create security and delivery logs containing IP address, timestamp, requested resource, response status and device/browser information. Processing is necessary to deliver and secure the Service, Art. 6 (1) (b) and (f) GDPR. The website does not set marketing cookies and does not run website analytics.

3. Storage period

We store personal data only as long as necessary for the purposes above:

• Account and profile data: until you delete your account.
• Tracks, statistics, friendships and content: until you delete the relevant data where that option is available, or delete your account.
• Live presence: transmitted in real time and not stored as location history.
• Analytics, attribution and technical logs: retained according to the shortest period required for the stated purpose, our configured provider settings, security needs and applicable legal obligations, then deleted or anonymised.
• Residual copies can remain temporarily in protected backups until overwritten. Data required for legal claims or statutory retention is kept only for the applicable period.

4. Recipients and processors

Depending on the feature you use, personal data may be received by:

• Supabase — authentication, database and storage (EU/US)
• Vercel Inc. — website hosting (US/EU)
• PostHog — product analytics (EU/US)
• AppsFlyer — acquisition attribution and deferred deep links (EU/US)
• RevenueCat, Inc. — subscription infrastructure (US)
• Mapbox — map rendering (US/EU)
• Apple and Google — sign-in, app distribution and platform services

Providers may process data outside the EU/EEA, particularly in the United States. Where required, transfers are protected by an applicable adequacy decision, including the EU–US Data Privacy Framework for certified recipients, or by the European Commission's Standard Contractual Clauses with supplementary safeguards. You can request information about the relevant mechanism from us.

5. Your rights

You have the right to:

• access your data (Art. 15), rectify it (Art. 16), erase it (Art. 17), restrict its processing (Art. 18), receive it in a portable format (Art. 20), and object to processing based on legitimate interests (Art. 21);
• withdraw any consent at any time with effect for the future (Art. 7 (3));
• lodge a complaint with a supervisory authority. Our competent authority is the Bayerisches Landesamt für Datenschutzaufsicht (BayLDA); you may also contact the authority of your habitual residence or workplace.

You can delete your account in Profile → Settings → Delete Account. For any other request, write to support@snowline.club.

6. Security and children

We use technical and organisational safeguards appropriate to the risk, including encrypted transport and access controls. The Service is not directed at children under 13. Users aged 13–15 may use it only with the involvement and consent of a parent or legal guardian (see our Terms of Service, § 2).

7. Changes

If this policy changes materially, we will announce it in the app before it takes effect. The version date above always reflects the current policy.