PisteBuddyPisteBuddy Privacy Policy
Last updated: 11 October 2026
PisteBuddy Limited understands that your privacy is important to you and that you care about how your personal data is used. We respect and value the privacy of everyone who uses the PisteBuddy mobile application (the "App") and will only collect and use personal data in ways that are described here, and in a way that is consistent with our obligations and your rights under the law.
In summary, we do not sell your personal data, we do not use it for advertising, and the App contains no advertising, analytics or tracking tools. Your position is shared with other users only if you turn on location sharing, and only with your friends.
1. Information about us
PisteBuddy Limited ("we", "us" or "our") is a limited company registered in England and Wales under company number 16831451.
Registered address: 52a-52d Fortess Road, London, England, NW5 2HG
Email address: contact@pistebuddyapp.com
We are registered with the Information Commissioner's Office under registration reference ZC264629.
2. What does this Privacy Policy cover?
This Privacy Policy explains how we use your personal data when you use the App: how it is collected, how it is held, and how it is processed. It also explains your rights under the law relating to your personal data and how to raise any concerns or complaints about our use of it. It should be read together with our Terms of Use, available at https://pistebuddy.online/terms. In this Privacy Policy, "App Store" means the Apple App Store or Google Play, as the case may be, and "Pro" (our subscription) and "Resort Pack" (a purchase for a single resort) have the meanings given to them in our Terms of Use.
3. What is personal data?
In this Privacy Policy, "Data Protection Legislation" means the UK GDPR and the Data Protection Act 2018, as amended by the Data (Use and Access) Act 2025, and any other applicable legislation relating to data protection and privacy. The Data Protection Legislation defines personal data as "any information relating to an identified or identifiable natural person". An identifiable person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data or an online identifier.
Put simply, personal data is any information about you that enables you to be identified. It covers obvious information such as your name and contact details, but it also covers less obvious information such as identification numbers, electronic location data and other online identifiers. The personal data that we use is set out in Part 5.
4. What are my rights?
Under the Data Protection Legislation, you have the following rights, which we will always work to uphold:
(a) the right to be informed about our collection and use of your personal data. This Privacy Policy should tell you everything you need to know, but you can always contact us to find out more using the details in Part 11;
(b) the right to access the personal data we hold about you. Part 10 explains how to do this;
(c) the right to have your personal data rectified if any of it is inaccurate or incomplete. You can change your display name and profile photograph yourself in the App under Settings > Profile;
(d) the right to be forgotten, that is, the right to ask us to delete any of your personal data that we hold. You can delete your account yourself at any time in the App under Settings > Profile > Delete Account, or ask us to delete it by emailing us from the address that you use to sign in, in which case we will delete it within one month. Part 7 explains what is deleted and what is kept;
(e) the right to restrict (that is, prevent) the processing of your personal data;
(f) the right to object to our using your personal data for a particular purpose or purposes (see "Your right to object" below);
(g) the right to withdraw consent. Where we rely on your consent as the legal basis for using your personal data, you are free to withdraw that consent at any time. For example, you can turn off location sharing in the App; you can turn off notifications of meet-up invitations in the App under Settings > System Notifications; and you can turn off all notifications in the settings of your device;
(h) the right to data portability. Where you have provided personal data to us directly, we are using it with your consent or for the performance of a contract, and that data is processed using automated means, you can, in many cases, ask us for a copy of that personal data to re-use with another service or business; and
(i) rights relating to automated decision-making and profiling. We do not use your personal data in this way.
Your right to object. Where we use your personal data on the basis of our legitimate interests (see Part 6), you have the right to object to that use at any time, on grounds relating to your particular situation. If you object, we will stop unless we can show compelling legitimate grounds that override your interests, rights and freedoms, or we need the data to establish, exercise or defend legal claims.
For more information about our use of your personal data or about exercising your rights, please contact us using the details in Part 11. Further information about your rights can also be obtained from the Information Commissioner's Office or Citizens Advice.
If you have any cause for complaint about our use of your personal data, you have the right to complain to us using the details in Part 11. We will acknowledge your complaint within 30 days and will respond to it without undue delay. You also have the right to lodge a complaint with the Information Commissioner's Office, the United Kingdom's supervisory authority for data protection: by telephone on 0303 123 1113, online at ico.org.uk, or by post to Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF. If you live in the European Economic Area, you may also complain to the data protection authority in the country in which you live. You may wish to raise your concerns with us first, so that we can try to resolve them.
5. What personal data do you collect, and how?
We may collect and hold some or all of the personal data set out in the table below. We do not collect any "special category" or "sensitive" personal data, or data relating to criminal convictions or offences. The App is intended for adults; we do not knowingly collect personal data relating to children (see Part 13).
| Data collected | How we collect it |
|---|---|
| Account information: your email address; the display name that you choose; a profile photograph, if you add one; and an account identifier that we generate. | From you, when you create your account and edit your profile. If you sign in with Apple or with Google, we receive from that provider your email address (which, with Apple, may be a private relay address), the identifier of your account with that provider and, where the provider supplies them, your name and, with Google, the web address of your Google profile picture. |
| Shared location: your position, the battery level of your device and the time of the reading, together with the piste or ski area in which that position lies, which we derive from that position. | From your device, only while you have turned on location sharing. Your device sends an updated position each time you move about 25 metres or more, and about every 5 minutes while you are stationary, including while the App is in the background if the permissions on your device allow it. We hold only your most recent position; we do not keep a history of where you have been. |
| Location sent with a request: your position, or the part of the map that you are looking at. | From your device, when the App needs a place to answer something: a route (including when the App re-plans a route as you move), a search, the weather, nearby webcams, an avalanche danger rating or the details of a peak. While the map is following your position, this happens automatically for the weather, avalanche information and search results around you. We use it to answer the request and do not store it against your account. It may also be recorded in our technical logs (see Technical information below). |
| Friends, groups and meet-ups: who your friends are; the invitation code or link that lets another person add you; the groups that you create or join, including the group name and any group photograph, its members and invitations; a record of the people with whom you have previously been in a group; and the meet-ups that you arrange or are invited to, including the place, the time, the people invited and their responses. | From you and from other users, when you or they use these features. |
| Notification information: a token that identifies your device for push notifications, and whether it is an iPhone or an Android device. | From your device, if you allow notifications. The App asks for this permission the first time that you arrange a meet-up or accept a meet-up invitation. |
| Purchase information: whether you hold Pro, the plan, the App Store through which you bought it and the date on which it ends; and, for each Resort Pack, the resort, the dates of purchase and expiry and the App Store's transaction reference. We do not receive or hold your payment card details. | From Apple or Google, through our payment service provider RevenueCat, when you make or restore a purchase. |
| App settings: which of the App's introductory tips you have already seen; your preference for notifications of meet-up invitations; and when your Pro status was last checked with our payment service provider. | From the App, as you use it. |
| Technical information: the internet (IP) address of your device and a record of the requests that the App makes to our servers; and, for each session in which you are signed in, the IP address and the type of device or browser from which you signed in. | Automatically, when the App communicates with our servers. |
| Correspondence: your email address and the content of any message that you send to us. | From you, when you contact us. |
Information that stays on your device. Places that you save as favourites, places that you have recently opened from search and the resorts that you have downloaded are stored on your device and are not sent to us. They remain on the device after you sign out or delete your account. When you download a resort, the request is recorded in our technical logs in the same way as any other request (see Technical information above), and your ownership of any Resort Pack that you have bought is held as purchase information.
Permissions on your device. The App asks for access to your location while you are using it, in order to show your position on the map. It asks for permission to use your location in the background only if you turn on location sharing and, on iPhone, it never asks for access to your location at all times. The App uses your camera only to scan another user's QR code, and does not store or send the camera image. It uses your photographs only when you choose one as a profile or group photograph.
Whether you have to give us your personal data. You must give us an email address, or sign in with Apple or with Google, in order to create an account, because the App cannot be used without one (see our Terms of Use). Everything else is optional: if you do not turn on location sharing, your friends will not see your position; if you do not allow notifications, you will not be notified of meet-ups; and you need not add a profile photograph. You are not required by law to give us any personal data.
6. How do you use my personal data?
Under the Data Protection Legislation, we must always have a lawful basis for using personal data. The following table describes how we use your personal data and our lawful bases for doing so:
| What we do | What data we use | Our lawful basis |
|---|---|---|
| Creating and administering your account, and signing you in. | Account information. | Performance of our contract with you (the Terms of Use). |
| Providing the map, routes, search, weather, webcams and avalanche information. | Location sent with a request; technical information. | Performance of our contract with you. |
| Showing your position to your friends, and theirs to you. | Shared location; account information. | Your consent, which you give by turning on location sharing and may withdraw at any time by turning it off. |
| Providing the friends, groups and meet-up features. | Friends, groups and meet-ups; account information. | Performance of our contract with you. |
| Sending you notifications of meet-up invitations, reminders and cancellations. | Notification information; the name of the person inviting you and the place of the meet-up. | Your consent, which you give by allowing notifications and may withdraw at any time in the settings of your device or, for meet-up invitations, in the App under Settings > System Notifications. |
| Remembering your preferences and which introductory tips you have seen, and limiting how often your Pro status is checked. | App settings. | Performance of our contract with you. |
| Providing Pro and Resort Packs, and ensuring that one payment cannot be used twice. | Purchase information. | Performance of our contract with you. |
| Keeping records of purchases after an account has been deleted. | Purchase information. | Compliance with our legal obligations to keep accounting records, and our legitimate interests in being able to deal with refunds, disputes and misuse. |
| Keeping the App secure and working, and investigating faults and misuse. | Technical information. | Our legitimate interests in operating a secure and reliable service. |
| Replying to you when you contact us. | Correspondence. | Our legitimate interests in responding to our users. |
We do not use your personal data for marketing, and we will not send you marketing communications without your express consent. We do not use your personal data for automated decision-making or profiling.
We will only use your personal data for the purpose or purposes for which it was originally collected unless we reasonably believe that another purpose is compatible with that purpose and need to use your personal data for it. If we need to use your personal data for a purpose that is unrelated to, or incompatible with, the purpose for which it was originally collected, we will inform you and explain the legal basis that allows us to do so. In some circumstances, where permitted or required by law, we may process your personal data without your knowledge or consent. This will only be done within the bounds of the Data Protection Legislation and your legal rights.
7. How long will you keep my personal data?
We will not keep your personal data for any longer than is necessary in light of the reason or reasons for which it was first collected. Your personal data will therefore be kept for the following periods:
| Type of data | How long we keep it |
|---|---|
| Account information. | Until you delete your account. A profile photograph is deleted when you replace it (or, if it cannot be deleted at that moment, within about a day) or when you delete your account, although it may continue to be displayed on another user's device for up to one hour. |
| An email address entered at sign-up that is never verified. | Deleted 30 days after it was entered. |
| Sign-in emails. | Our email service provider, Resend, keeps a record of each email sent, including the address to which it was sent, for 30 days. |
| Shared location. | Only your most recent position is held. It is deleted when you turn off location sharing or when you delete your account. Signing out of the App stops your device from sending its position but does not delete the position already held. If no position has been received from your device for 30 days, the position is deleted from our servers and location sharing is turned off. |
| Location sent with a request. | Not stored against your account. Weather forecasts and webcam results are stored by area of the map, without any record of who requested them. |
| Friends and invitation codes. | A friendship is kept until either of you removes it or deletes their account. An invitation code is valid for 7 days from when it is issued, after which a new code is issued when you next open your QR code. |
| Groups. | Until the group ends: at the end of the day, if the group is set to expire; or otherwise when its last member leaves or its creator deletes it. The record of the people with whom you have previously been in a group is kept until you delete your account. A group photograph is deleted within about a day of the group ending or of the photograph being replaced. |
| Meet-ups. | Deleted approximately one day after the time of the meet-up, or after it is cancelled. |
| Notification information. | Until you delete your account, or until the same device is registered for notifications by another account. |
| Purchase information. | For 6 years from the end of the financial year in which the purchase was made, as the law requires for accounting records, including after your account has been deleted. We delete these records 7 years after the subscription or Resort Pack concerned ends. After deletion these records are held against an account identifier and not against your name or email address. The corresponding record held by our payment service provider RevenueCat is deleted when you delete your account. |
| App settings. | Until you delete your account. |
| Technical information. | Records of requests: approximately 7 days. The details recorded with a signed-in session: until you sign out of that session or delete your account. |
| Correspondence. | For 2 years from the date of our last reply to you. |
Deleting your account. When you delete your account we delete your email address, display name and profile photograph, your friends, your shared location, your group memberships and the record of the people with whom you have been in a group, your meet-ups and invitations, your notification information and your App settings. Any group that you created, and any meet-up that you organised, will end for all of its members, and the photograph of a group that you created is deleted within about a day. Purchase information and correspondence are kept for the periods set out above. Deleting your account does not cancel a subscription, which must be cancelled through the App Store from which you bought it.
8. How and where do you store or transfer my personal data?
Our database, file storage and sign-in service are provided by Supabase and are located in the European Union (Ireland). Some of our server functions, such as those that answer requests for the weather, webcams and resort downloads, may run at the Supabase location nearest to the device making the request, which may be outside the United Kingdom and the European Economic Area. The United Kingdom has recognised the European Economic Area as providing adequate protection for personal data, so no additional safeguards are needed for this transfer.
Some of the service providers listed in Part 9 are based in, or may process personal data in, countries outside the United Kingdom and the European Economic Area, in particular the United States and, for Supabase's contracting entity, Singapore. Where your personal data is transferred to such a country, we rely on one of two safeguards. Google, Expo, Mapbox, Cloudflare, GitHub and Resend are certified under the UK Extension to the EU-US Data Privacy Framework, which the United Kingdom has recognised as providing adequate protection. Supabase and RevenueCat are not so certified; transfers to them are made under standard contractual clauses approved under the Data Protection Legislation, including the International Data Transfer Addendum issued by the Information Commissioner. Apple uses the personal data that it receives as an independent controller, under its own privacy policy and its own arrangements for international transfers. Please contact us using the details in Part 11 if you would like further information about the safeguard used for a particular provider, or a copy of it.
The security of your personal data is essential to us. To protect it, we take a number of measures, including the following:
(a) personal data is encrypted in transit between the App and our servers;
(b) personal data held in our database and file storage is encrypted at rest;
(c) access controls in our database ensure that each user can see only the data that the App is designed to show to that user;
(d) access to our systems is limited to those with a legitimate need, and is protected by credentials that are not held in the App; and
(e) we have procedures for dealing with data breaches, including notifying you and the Information Commissioner's Office where we are legally required to do so.
9. Do you share my personal data?
Other users. The App shares certain of your personal data with other users, as follows:
(a) your friends are able to see your display name and profile photograph and, where both of you have turned on location sharing, your position, the piste or ski area in which it lies, the battery level of your device and how long ago your position was last updated. If you are sharing your location when a person adds you as a friend using your QR code or invitation link, that person is shown your position once, at that moment;
(b) a person who holds your QR code or invitation link is able to see your display name and profile photograph before adding you as a friend;
(c) the members of a group to which you belong are able to see your display name and profile photograph, and so may people invited to it; membership of a group does not by itself allow any person to see your position; and
(d) every person invited to a meet-up is able to see the display name and profile photograph of each other person invited, and each person's response.
Profile photographs and group photographs can be viewed by any person who has their web address.
Service providers. We use the following third parties to provide parts of the App. Each receives only the personal data that it needs for the purpose shown.
| Recipient | Activity carried out | Personal data received | Location |
|---|---|---|---|
| Supabase | Hosting of our database, servers, file storage and sign-in service. | All of the personal data described in Part 5, other than correspondence. | Ireland (database, storage and sign-in); nearest Supabase location (server functions); Singapore (contracting entity); United States (parent company) |
| Apple | Sign in with Apple; payments made through the App Store; delivery of notifications to iPhones. | Sign-in details; purchases; notification token and content. | Ireland (Apple Distribution International Limited); United States |
| Sign in with Google; payments made through Google Play; delivery of notifications to Android devices; hosting of the mailbox to which messages sent to us are delivered. | Sign-in details; purchases; notification token and content; correspondence. | United States | |
| RevenueCat | Verifying purchases with the App Stores and telling us what you have bought. | Your account identifier, your purchase history from the App Stores, and the language, region and currency settings of your device. | United States |
| Expo | Passing notifications to Apple and Google for delivery. | Notification token; the content of the notification, which includes the display name of the person inviting you and the place of the meet-up. | United States |
| Resend | Sending the email that contains your sign-in code. | Your email address and the email containing the code. | Ireland (sending region); United States (company) |
| Mapbox | Providing the base map and terrain, which your device downloads directly from Mapbox. Mapbox's own collection of location and usage data from your device is switched off in the App. | The IP address of your device, the areas of the map that it requests, and an identifier that Mapbox uses to count map loads for billing. On iPhone, when the map is first opened after the App is installed, Mapbox may also receive a single notice that the map has loaded, which includes the model and operating system of your device and an identifier for the App on that device. | United States |
| Cloudflare | Delivering the piste and lift map data that your device requests from our servers, and hosting our website, on which these documents are published. | The IP address of your device and the areas of the map that it requests. | United States (served from the data centre nearest to you) |
| Windy | Providing webcam images, which your device downloads directly from Windy. | The IP address of your device and the images that it requests. | Czech Republic |
| OpenWeather | Providing weather forecasts to our servers. | None. Our servers request forecasts for an area of the map and do not identify you. | United Kingdom |
| GitHub | Hosting the web page that opens when an invitation link is followed on a device on which the App is not installed. | The IP address of the device and the invitation code contained in the link. | United States |
We do not sell your personal data, and we do not share it with any third party for advertising or marketing purposes.
If we sell, transfer or merge parts of our business or assets, your personal data may be transferred to a third party. Any new owner of our business may continue to use your personal data in the same ways that we have used it, as specified in this Privacy Policy.
In some limited circumstances, we may be legally required to share certain personal data, which might include yours, if we are involved in legal proceedings or complying with legal obligations, a court order or the instructions of a government authority.
10. How can I access my personal data?
If you want to know what personal data we have about you, you can ask us for details of that personal data and for a copy of it. This is known as a "subject access request". All subject access requests should be made in writing and sent to the email or postal address shown in Part 11.
When responding to a subject access request, we will carry out reasonable and proportionate searches for the personal data covered by your request. There is not normally any charge for a subject access request. If your request is "manifestly unfounded or excessive" (for example, if you make repetitive requests), a fee may be charged to cover our administrative costs in responding.
We will respond to your subject access request within one month of receiving it. Normally, we aim to provide a complete response, including a copy of your personal data, within that time. In some cases, however, particularly if your request is more complex, more time may be required, up to a maximum of three months from the date on which we receive your request. You will be kept fully informed of our progress.
11. How do I contact you?
To contact us about anything to do with your personal data and data protection, including to make a subject access request or a data protection complaint, please use the following details:
Email address: contact@pistebuddyapp.com
Postal address: PisteBuddy Limited, 52a-52d Fortess Road, London, England, NW5 2HG
12. Changes to this Privacy Policy
We may change this Privacy Policy from time to time. This may be necessary, for example, if the law changes, or if we change the App in a way that affects personal data protection. Any changes will be made available in the App and at https://pistebuddy.online/privacy, and the date on which this Privacy Policy was last updated appears at the top of this document. Where a change is material, we will give you notice of it within the App or by email.
13. Children
The App is intended for adults aged 18 or over, or the age of majority where they live if that is higher, as set out in our Terms of Use. We do not knowingly collect personal data from any person under that age. If we become aware that an account belongs to a person under that age, we may close it and delete the personal data associated with it. If you believe that a child has provided personal data to us, please contact us using the details in Part 11.