SkiPhoria Privacy Policy

What we collect, why, and what we deliberately don't.

Effective 3 November 2026 · Last updated 3 November 2026

The short version

You can use SkiPhoria without an account. Signing in is optional and only enables leaderboards, friends, clubs and cloud backup.
We run no analytics, no advertising and no third-party tracking. The exceptions: if the app crashes, or its connection to a live race fails, it sends a technical report to Sentry, with no name, email or account attached; and our live race relay keeps counts with no personal data at all, such as how many rooms opened and how long they were open.
We never sell or share your data for marketing.
You can report another athlete's name, race or course from inside the app, and send us feedback. A report is kept even if you delete your account, because it concerns someone else.
Heart rate never reaches us or any other athlete unless you explicitly turn it on — for Strava, or to show it on a TV you pair with the app — and a file you export yourself follows the Strava switch. It stays on your device and in your device's own backups; your maximum heart rate never goes anywhere else at all.
We never publish coordinates of routes you import — not to other users, and not to your own Strava account. The shape of a shared route can still be matched to a map; Hide start and finish helps.
You can delete your account and all its data from inside the app, at any time.

Who is responsible

The data controller is Anders Lassen Kamsvaag, an individual developer based in Norway, operating as SkiPhoria.

Contact for anything in this policy, including requests about your data: privacy@skiphoria.com.

What we collect, and why

Data	Why	Legal basis
Email address, and from Google also the name and profile-picture link on your Google account. Supabase Auth keeps them with your sign-in record; we never show or publish them.	To identify your account so your results follow you between devices	Performance of a contract
Racer name — a name you choose	Shown on leaderboards and to people who follow you	Performance of a contract
Category — man, woman or prefer not to say. Optional.	To split leaderboards, and to set the virtual skier's weight on a course. You can change it, within the limits the app shows.	Performance of a contract
Session data — times, distance, power, ascent, splits, and which type of machine you used. Since September 2026 this includes your workouts and free-ski sessions, stored in your account (without heart rate) so your history follows you between devices.	To show your history, rank leaderboards, and award trophies	Performance of a contract
Training settings — your FTP anchor, your goals (a performance goal, a weekly goal and your time goals for courses), training progress and XP	To set workout targets and track your progress, and so your goals follow you between devices	Performance of a contract
Your workouts — the workouts you build or adjust in the app: their names, steps and targets	So your workouts follow you to every device you sign in on	Performance of a contract
Who you follow	To show a friends leaderboard and activity feed, and the races and events your friends list for you	Performance of a contract
Blocked people — who you blocked, and when. Blocking someone removes any follow and any fist bump between you, in both directions; from then on a follow or fist bump between you is quietly dropped, as is any notification between you, and invites still waiting between you are closed as if you had withdrawn or declined them (an accepted one stays). Unblocking does not bring back the follows and fist bumps the block removed. The person you blocked is never told, and results and leaderboards are not changed. If someone blocks you, that is their record: you are not told, and it is not in your copy of your data. You can see and undo it under Profile → Settings → Privacy → Blocked people.	So you can stop someone contacting you, and to apply that in the app and in notifications	Performance of a contract. Kept until you unblock them or delete your account; it is also deleted if the person you blocked deletes theirs.
Clubs — for a club: its name, colour, crest and join code, whether joining needs approval, who created it and when. For each member of a club: the club, the account, their role (owner, admin or member), whether they are a member or still waiting for approval, and when they joined. For now only accounts on our list of accounts allowed to create a club can create one; that list holds the account and when it was added. And, to stop anyone trying club codes at random, how often your account looked up or joined a club by its code in the last minute. For a club's events and scheduled races: which club each one belongs to.	To run clubs: who is in each one, who manages it, whose times show on its leaderboards and records, and the club's own events and races (Clubs, below)	Performance of a contract
Team races — when a team races on one erg, the device that recorded it uploads the team's name and time, the recorded power-over-time trace, which type of machine it was, each leg's time, distance and average power (never heart rate), and which accounts it names for which legs, with their racer names. The uploader's own legs are confirmed by the upload itself. Every other named athlete is asked, by a notification if they have turned notifications on and in the app, to confirm their own legs, and their answer is stored. The XP for a leg you confirm is stored with your account. On your own erg — in a team race where each athlete skis on their own erg and device, the team's captain's device sends the team's roster (which accounts are on it, in leg order, with their racer names, and the team's name) as the race starts, and each athlete's device uploads each leg they ski as it finishes: its time, distance, average power, the power-over-time trace of that leg, which type of machine and whether the baton was taken (never heart rate). Your own upload confirms your place on the team — nobody is asked to confirm — and the team result is put together from everyone's legs and kept under the captain's account.	To give each athlete their own legs and XP, and to rank a team only when everyone on it has confirmed	Performance of a contract
Heart rate (special category — health data)	Shown live during a session and stored with it, on your device (and in your device's own backups)	Your explicit consent, only where it leaves the device
Courses you import from a GPX file, with the name and the description you give them	So you can ski and share your own routes	Performance of a contract
Courses you publish — your request to list a course you shared in Community, its place (a country and an area), the route's exact start point (for our review only), our decision and our reason	To review courses and list them in Community, and to tell you why if we decline or remove one	Performance of a contract
Strava tokens and your Strava athlete id, if you connect Strava	To upload your sessions to your Strava account, and to recognise it when you remove SkiPhoria in Strava's own settings	Your consent
Reports you file — what you reported (a racer, a race, a course or a lobby entry), the reason you chose, your optional note, and where in the app you were	To keep the service safe and fair: a person reads every report and may remove content or results	Legitimate interest — the reported person did not agree to it, and does not need to
Feedback you send — your words, and for a bug report the diagnostics you chose to attach: app version, device model, operating system, your erg's name and machine type, and the last 20 lines of the app's connection log (events like “connected” or “stream lost” — never the raw data and never your heart rate). Those lines include the name your erg and heart-rate strap advertise — for some machines this includes a serial number. A Bluetooth error line can also contain the address your phone uses for that device. If you raced through the live race relay since the app was last started, the diagnostics also carry the random trace ids of up to your last three relay rooms (never a room code, user id or name), so we can find those rooms in the relay's own records.	To fix what you report and build what you ask for	Your consent, given when you press Send
Races you schedule — the course, lap count, start time, countdown length and room code of a live race you schedule (and, for a team race, its format and team size), shown with your racer name and user id to anyone who has the code, and who can join it — only people with the code, your friends (people you follow who follow you back), or everyone signed in — or, for a club's race, the club's members (Clubs, below). At Friends and Open, the race is listed with your racer name, its course and start time for those people, and at Friends your friends get a notification about it — once per race or event, and only friends who aren't already invited or going and who have notifications for invites turned on. The same choice applies to an event you organise: at Friends or Open it is listed with your racer name, its name and dates, and at Friends your friends get a notification about it in the same way. We keep a record of when you listed a race or an event and when your friends were notified, for up to about two days, to apply the daily limits on listings and notifications (the race or event itself keeps when it was listed and when your friends were notified until it is deleted).	So the race starts by itself at the time you chose, friends with the code can find it, and the people you choose can find it and join it themselves	Performance of a contract
Races you join from the list, and live stages — when you join a listed race, or the start of a live stage of an event you entered, that you are going, which heat you are in, and your device's time zone (for reminders, and to show start times in your notifications at your local time); the host sees that you are going, never your time zone. When you enter an event that has a live stage, we also save your device's time zone on your entry, so its reminders show the start at your local time; the organiser never sees it, and it is removed when you leave the event or it ends. The host of a scheduled race can remove anyone from it, however they joined (with the code, an invite or from the list), and any invite to it is withdrawn; we keep that you were removed, so you can't join it again, until the race is deleted. Any signed-in athlete who has the race's code can see that you were removed (by your user id), so every lobby leaves you out. You can also join a club's race from the club's page; its owner and admins see that you are going, as the host does, and can remove you.	To hold your place (and your heat), to keep a removed racer out, and to remind you before it starts and show its times at your local time	Performance of a contract
Invites — who invited whom to a live race or an event, and the answer — including an invite to a race room, to join you in the lobby (we store who sent it, who it is for, the room code, the course and its name, and when it was sent, and it lapses after 30 minutes), which someone sends for a room's code to people they follow who follow them back; including an invite to a scheduled live race, which anyone going to it can send, not only its host; including an invite from a friend onto their team in a race where each athlete skis on their own erg, which only the race's host, someone who accepted an invite to it, or someone who joined it from the list can send; and your device's time zone (for example Europe/Oslo) when you schedule a race or accept an invite. The person who invited you never sees your time zone. The invite notification shows the start in your own local time when we know your time zone (the one your device last gave us when you scheduled a race, accepted an invite or joined a race), and otherwise in the race host's local time. The person who invited you sees your racer name and your answer; others invited to the same race see only how many are going. Members of a club you are in can also invite you to races (Clubs, below).	So people you follow, and who follow you back, and members of your clubs can invite you, and so we can remind you on the morning of the race and when its lobby opens, at your local time, and show start times in your notifications at your local time	Performance of a contract
TV pairing (TV view) — while a TV or computer screen is paired with the app: your account's random user id and the sign-in token your phone already holds, which includes your email address — checked, never kept; a hash of the screen's pass (the screen keeps the pass itself only in that browser tab), when the pairing started and when your phone was last connected; and, for your account, the list of your paired screens that are live — at most three at a time — and where each one runs. The code shown on the TV works once and for 5 minutes. Your IP address is used for two things only: hashed and only in memory, to limit repeated attempts for about a minute; and the country your connection comes from decides where the stream runs (from the European Economic Area, in Cloudflare's EU data centres). Your IP address is never stored.	To relay the session you are skiing to the screen you paired, and to stop one account holding more than three screens	Performance of a contract
Live race relay — while we test it, a live race room may run through our live race relay at Cloudflare instead of our own server; the app picks one of the two when you open the room, and keeps it for that room. While a relay room is open, the relay holds what the room needs: its room code, course, lap count and start time, who is in it (your account's random user id, racer name and category), who hosts it and who is ready, the teams and their lineups, and the time and distance at which each racer finished (in a team race on your own ergs, the moment each leg ended). Live power and positions pass through it in memory only. To let you in, your phone sends your sign-in token in its first message (and a fresh one before it expires), never in a web address. The relay checks the token against our server's public keys and reads only your user id and when the token expires from it (the token also carries the email address you sign in with, which the relay does not use). It keeps the token with your connection while you are connected, never with the room, and uses it before the race to ask our server for the room's details and whether you may join — which count as race look-ups, like the app's own (the race lookup counter below) — and, when you open a new room, whether your account may host one. Once the race has started, the relay asks our server nothing more about you or the room. Your IP address is used only hashed and only in memory, to limit how often one network connects, for about a minute; your user id is used only in memory too (not hashed), to limit how often one account joins, for about a minute. Neither is stored, and the relay writes no request logs. Each relay room also gets a random trace id, which contains no room code, user id or name.	To run a live race between your phones with one shared start and one shared clock, and to keep out anyone the room isn't for	Performance of a contract
Push token — an identifier for your device with Expo's notification service, only if you turn notifications on	To deliver the notifications you chose	Your consent; removed when you turn notifications off or sign out
Crash reports — when the app crashes or something fails it sends a technical report to Sentry (device model, operating system, app version and where it happened), with no name, email or account attached. Our servers also write access logs, which Supabase deletes after a few days.	To find and fix what breaks	Legitimate interest in a working app. You can object at privacy@skiphoria.com.
Your acceptance of the Terms of Use, including the health statement you ticked — the versions of the Terms and of this policy you accepted, and when	To know you have accepted the current documents, and to be able to show it	Your explicit consent to that statement, and our need to evidence acceptance. Stored on your account if you are signed in, otherwise only on your device; deleted with your account.

Apart from crash reports, the app's update check and the course catalogue and leaderboards it reads from our server (which leave access logs), if you never sign in, none of this is sent anywhere. The app records your sessions on your device and nothing else happens.

When you sign in and race in a live room, the app also remembers on your device the people you raced with: their account ids and when you raced with them, up to 10 from each room and 50 for each account, so you can invite them again. This stays on your device and in its backups and is never uploaded.

What is public

SkiPhoria is a competitive app, so some things are visible to other users by design:

Your racer name and the date you joined.
Your race results — time, distance, ascent, average power, and the recorded power-over-time trace, on the leaderboard for that course, unless you have chosen otherwise below.
Your category (man, woman, or none if you prefer not to say), shown on leaderboards, race results and tournament standings.
The trophies you have earned.
The courses you have published to Community, with your racer name as their author.
Who you follow, to the people involved.

Who can see your races

You choose who may follow you: anyone, by request only, or nobody. You choose separately whether your verified times appear on public course leaderboards under your racer name, and you can mark any individual race “Only me”, which keeps it off every leaderboard, out of your followers’ feeds and away from your clubs. Members of a club you are in see your verified times on that club's leaderboards and records whether or not you show them on public leaderboards — but never a race you mark “Only me” (see Clubs below). These settings are stored with your account and enforced by the database, not only by the app. Your racer name remains visible in search, in live-race lobbies and on any board you have chosen to appear on.

Live races. When you join a live race room, your racer name, your ready state, your live power and your progress along the course are shared several times a second with everyone in that room, together with your account's random user id and your category (man or woman, if you have set one) — and any signed-in athlete who has the room code can join it. A room runs either over our own server or through our live race relay (the Live race relay row above); it shares the same things with the room either way. In a team race room where each team shares one erg, each team's device also shares its team's name and the racer names of the athletes in its lineup — names only, never their user ids — with everyone in that room, and on a TV a device in that room has paired. In a room where each athlete skis on their own erg, every device in the room also shares which team you are on (by user id), whether you asked to join one, the team's lineup and name, and — during the race — the moment you finished each of your legs. Your heart rate stays on your own device: it is never shared with your teammates or the room, and never shown on a TV during a team race. Apart from the roster and legs of a team race on your own ergs (the Team races row above), and what the live race relay holds while a room is open (the Live race relay row above), nothing about you from a live room is stored on our servers, except a race you schedule: its course, lap count, start time, countdown length and room code are stored with your account's random user id until 30 days after the start, and any signed-in athlete who has the code can see them, your racer name and your user id. If you list it for Friends or Open, your friends or everyone signed in can also see it in Open races — its course, start time and your racer name, never the code or your user id — and join it from there; joining gives them the code, like anyone who has it. A club's race is shown, with its code, to the club's members on the club's page (Clubs, below). The host of a scheduled race can remove anyone from it, however they joined; any signed-in athlete who has the code can see who was removed (by user id), so every lobby leaves them out. Your finish time uploads the same way as any other race.

TV view. When you pair a TV or computer screen with the app (by scanning the code shown on skiphoria.com/tv), the session you are skiing — a race, a workout or a free-ski session — is streamed to that screen several times a second until you stop it, close the app, or leave it for 30 minutes: the course, or the workout with its name, steps and targets; your numbers and your recent power; your racer name; and, in a race, the racer names and positions of the field you are racing. Your heart rate and its zone are included only if you turn on Show heart rate on TV (off by default); your maximum heart rate never is. The stream passes through Cloudflare, which relays it and stores nothing of it; for athletes in the European Economic Area it runs in Cloudflare's EU data centres. Pairing needs a signed-in account. The screen itself holds no sign-in and can only show what your phone sends it.

Tournaments

When you enter a tournament, the app shows this notice under the Join button: Entering shows your racer name, stage times, start times and average power to everyone who can see this event, whatever your profile visibility. Races marked “Only me” never count. For a club's event, that is the club's members and anyone else who entered it (Clubs, below).

In a knockout bracket, everyone who can see the event also sees who you were drawn against and how each match ended, including a walkover when you did not ride your match. If you delete your account, your name is removed from those matches.

When you enter an event that has a live stage, we save your device's time zone with your entry, so the stage reminders show its start at your local time. The organiser never sees your time zone, and it is deleted when the event ends, when it is cancelled, or when you leave or are removed from it.

Team races

A team result is visible to the account that uploaded it and to the athletes it names. Once every athlete on the team has confirmed their own legs, the team's name, time and recorded power-over-time trace, which type of machine it was, its legs and the confirmed racer names become visible to other users like a race result — unless any of those athletes has chosen to stay off public leaderboards. Nobody can confirm a leg for you: only your own signed-in account can. A leg you do not confirm keeps your racer name on that team's result but adds nothing to your account, and after 14 days the link to your account is removed and only the name stays. In a team race on your own ergs, your teammates and the captain see your legs' times as the race goes; the captain's copy of the team result, and Download my data for the captain, include every leg of the team.

Clubs

A club is a group of signed-in athletes. You join it with its code, or with a link or QR code that carries the code. Anyone signed in who has the code can see the club's name, colour and crest and how many members it has, and can join it — or ask to join, if the club approves its members first. You can be in up to 25 clubs, counting requests still waiting.

Before you join, the app shows: Your verified times will show on this club's boards and records, even if you keep them off public boards. In full: while you and another athlete are both members of the same club, your verified race results show to them as rows on the club's leaderboards and records, and theirs show to you. A row shows what a row on a public leaderboard shows — your racer name, the course and number of laps, your time and lap times, the distance, your average power, when you raced and your category. That holds even if you keep your times off public leaderboards, and even if your profile is private. Being in a club shows your clubmates nothing more than those rows: it does not let them open your races' details or power-over-time trace, race against you as a ghost, see your races in their activity feed, or see totals worked out from your races, and your heart rate is never shown. Races you mark “Only me”, and races that were not verified (Demo races among them), never appear on a club's leaderboards or records. Public and friends leaderboards don't change: if you keep your times off public leaderboards, you stay off them. A request still waiting for approval shares nothing, in either direction.

Members of a club see who else is in it — their racer names, roles and when each joined — and who has asked to join. The owner and admins approve or decline requests, remove members, change the club's name, colour, crest and whether it needs approval, and can give the club a new code (the old one stops working at once). Only the owner names admins, hands the club to an admin, or deletes it.

You can leave a club at any time (an owner first hands it to an admin, or deletes it), and an admin can remove you. Either way the sharing ends at once: your times leave the club's leaderboards and records, and you no longer see theirs. What their app had already loaded can stay on their phone until it next refreshes. If the owner deletes their account, the club passes to the admin who has been in it longest; if it has no admin, the club is deleted, with every membership in it. Your results stay yours whatever happens to a club.

Club events and races. A club's owner and admins can post events (tournaments) and scheduled live races for the club. Only the club's members find them in the app: on the club's page, never in Open races or listed to friends, and a club's event doesn't open from its link for anyone outside the club who hasn't entered it. Whoever is the club's owner or an admin at the time runs them — changes, moves, cancels or deletes one, and removes an athlete or lets them back in — so an admin who steps down or leaves the club stops running them at once (the admin who created a race stays its host in the race room, and the admin who created an event stays host of its live-stage heats). When an event or race is posted, every other member of the club gets one notification about it — the club's name with the event's name, or with the race's course and laps — under the Tournaments notification switch, if they have turned notifications on. A member who has blocked the admin who posted it, or whom that admin has blocked, gets none. A notification that a club's race was moved or cancelled names the admin who did it.

Entering a club's event is like entering any event (Tournaments, above): the app shows the same notice under the Join button, and entering shows your racer name, stage times, start times and average power to everyone who can see the event — the club's members, and anyone else who entered it. That is your choice, event by event, and it shows more than the leaderboard rows above. Joining a club's race puts you in its lobby and the race like any live race (Live races, above), and the club's owner and admins can see that you are going. A club race's code works like any race code: anyone signed in who has it — someone a member passed it to, for example — can see the race and join it, even if they are not in the club.

Members of a club can invite each other to a live race, a race room or onto their team in a race on their own ergs, even if they don't follow each other, unless either has blocked the other; the list you invite from shows the racer names of the other members of your clubs. Only the club's members can be invited to a club's race. An invite to an event still needs you to follow each other.

Leaving a club, or being removed from it, doesn't withdraw you from an event you entered or a race you joined: you can still see it and race it, its other entrants still see your entry, and you can withdraw yourself; the club's owner and admins can still remove you. The club's events and races you haven't entered or joined leave your app. If a club is deleted, its events and races carry on without it: the athletes who entered or joined keep them, and the athlete who created each one runs it again. Club events and races store nothing more about you than any event or live race does; they add only which club each one belongs to.

Who can see your training

Since September 2026 the people you have accepted as followers also see your workouts and free-ski sessions in their Recent activity feed — distance, time, average power, never heart rate — unless you mark a session “Only me” or your profile is private. Training sessions never appear on a leaderboard and are never shown to anyone who does not follow you.

The workouts you build or adjust, and your goals, are visible only to you. When a follower sees a session you did with one of your own workouts, it shows as a workout, without its name or steps.

Anyone who can see one of your sessions can leave a fist bump on it, and everyone who can see that session can see who bumped it — your name appears on their screen the same way theirs appears on yours. We store who bumped what and when, so that you can see it and they can take it back. That is the whole of it: there are no comments, and nobody outside your accepted followers can react to anything of yours.

Your heart rate is not part of that. It is removed from every result before it is uploaded, so it cannot appear on a leaderboard even in principle. Your email address is never public. Neither is anything else in your private profile.

Your racer name is a name you choose, and nothing is pre-filled from your Google or Apple account — deliberately, so you are never nudged into publishing your real name.

Heart rate and health data

Heart rate is special-category data under Article 9 GDPR, and we treat it that way:

It is recorded and stored on your device with the session — and, like everything the app keeps, in your device's own backups (iCloud or your computer, on an iPhone).
It is stripped from every result uploaded to our servers, so it never reaches a leaderboard.
It is included in a Strava upload only if you explicitly switch that on in Settings → Privacy. This is off by default, and you can turn it off again at any time.
It is shown on a TV you pair with the app, with its zone, only if you switch on Show heart rate on TV on the Show on TV screen. This is off by default; while it is on, your heart rate is relayed to that screen as you ski and is not stored anywhere on the way.
A session file you export yourself (CSV) follows the same switch: heart rate is written into it only while that setting is on.
Your maximum heart rate is stored only on your device and in your device's own backups, and we never upload it anywhere. It is not attached to any result. This is also why the app estimates it from your own sessions instead of asking for your date of birth — a birth date is personal data we would then be collecting.

Location and routes

SkiPhoria does not request or use your device's location. It is an indoor app.

You can import a GPX route, which does contain real-world coordinates. A GPX file that starts at your front door reveals where you live, so:

When you share a course with someone, the exact start point is removed entirely and the route's approximate centre is rounded to about a 1 km area. Your device keeps its own full copy. The course's name and the description you wrote for it (up to 200 characters) go with it. If you edit the description later, the shared copy on our servers is updated: anyone who adds the course by its code sees the new text, and friends who already have it see it the next time they open the course.
When you import a GPX file you can turn on Hide start and finish. The route is then cut so that it starts and ends at least 200 m, 500 m or 1 km (your choice) from where it really starts and ends, before the course is saved; the cut part is never stored, on your device or ours. It is off unless you turn it on.
When you publish a course to Community and we list it, everyone using SkiPhoria can see what anyone with its code could see before — its shape and elevation, name and description — and also the place (a country and an area, such as “Nordmarka · Norway”) and your racer name as its author. We suggest the place by looking up the course's approximate centre, which we already hold rounded to about 1 km, against public map boundaries kept in our own database, and you can change it. A published course never shows coordinates. When you ask us to publish a course, your device also sends us the route's exact start point, so we can see where the route really runs and check that it doesn't start at someone's home. Only we see it, in our own review tool; it is never shown in the app, in Community or to anyone else. We keep it while the course is in review or listed (so we can look again if someone reports it) and delete it when we decline or remove the course, when you withdraw it, and when you delete your account.
When a session is uploaded to Strava, the coordinates written into the file are not the real ones. Every course is anchored to a deterministic point in the Southern Ocean, far from any land, so the activity gets a map and an elevation profile without publishing where you actually train — and without our efforts appearing on real-world segment leaderboards.
If you delete your account, the location data and the description are removed from any courses you shared before the account is erased. Courses you published stay listed in Community, without your racer name, description or place.

We never publish coordinates. The shape of a route you share or publish can still be matched to a map, so turn on Hide start and finish when you import it if it starts at a home.

Who else processes your data

Service	What it does	Where
Supabase	Our database, authentication and backend. Our processor — they hold the data on our behalf. Supabase Auth keeps the name and profile-picture link Google gives us with your sign-in record.	European Union
Google / Apple	Sign-in only, if you choose that option. We receive your email address, and from Google also the name and profile-picture link on your Google account; Supabase Auth keeps them with your sign-in record and we never show or publish them. We do not receive your contacts, calendar or anything else.	Google and Apple are US companies; sign-in is a transfer you direct (see Transfers outside the EEA below)
Strava	Only if you connect it. We send your sessions to your account. The permission we request includes reading your public activities, because Strava only lets an app set the sport type of an activity it can see; the only thing we ever read is whether a session we uploaded already exists. An uploaded workout's description starts with the workout's name, which may be one you chose yourself. From Strava we keep only your athlete id and, for up to 7 days, the ids of the activities we uploaded. Strava also collects usage data about how our app uses its API, under Strava's own privacy policy. If you remove SkiPhoria in your Strava settings, Strava tells us and we delete the stored connection.	United States (Strava), a transfer you direct. Their own terms apply
Expo	Delivers app updates and, if you turn notifications on, the notifications themselves: it receives your device's push token, your account's random user id (in each push) and the text of each message — a racer name, a course or event name, a race time and what happened (including our decision on a course you asked us to publish, and the club's name for a club's new event or race), never session numbers and never heart rate. When you send us feedback, the first 120 characters of your text are delivered to the operator's own device the same way, so we see it arrives, and when you ask us to publish a course, its name is delivered there so we know to review it. Notifications are delivered through Apple Push Notification service (APNs) on iPhone and Firebase Cloud Messaging (FCM) on Android. On every launch, signed in or not, the update check sends an install id and your IP address to Expo.	United States (see Transfers outside the EEA below)
Sentry	Crash and error reporting. When the app crashes it sends the error and where in the app it happened, the device model, operating system and app version, and the addresses of the last few requests to our server — without their contents, so never what you searched for or who you looked at. When its connection to the live race relay is refused because something is wrong, or drops, it sends a short warning with the same details as a crash report (device model, operating system, app version and the addresses of the last few requests), plus the reason and that room's random trace id; other relay events are only noted in the trail that goes with a later report. No name, email or account id is attached, and IP addresses are not stored. The live race relay itself may also report a room that got stuck: what kind of room it was, how far it had got, roughly how many people were in it, the reason and its trace id — never an account id, room code, name or IP address.	European Union
Cloudflare	Hosts this website, routes email sent to support@ and privacy@skiphoria.com to us, relays a session you choose to show on a TV (TV view) to that screen without storing it, and runs our live race relay, which holds a live room only while it is open (the Live race relay row above). The relay also keeps counts with no personal data — how many rooms opened and closed and why, how long they were open, how many racers and messages they had, why any messages were refused, and how often something went wrong (a reconnect, a late start, a stuck room), by kind of room — in Cloudflare's Analytics Engine, which keeps them for about 3 months. The contents of an email you send us pass through it.	TV view: European Union for athletes in the European Economic Area — the stream, its pairing record and your account's short list of live screens; the one-minute rate-limit counters, held in memory only, are not pinned to a region. Live race relay: European Union for everyone, wherever you are — every relay room and what it holds; its one-minute rate-limit counters, held in memory only, and its counts, which hold no personal data, are not pinned to a region. Otherwise their own terms apply

Your Strava access tokens are stored on our server and are never readable by any other user or sent to your device. You can disconnect Strava at any time in the app, or remove SkiPhoria in Strava's own settings; either way we delete the stored tokens.

Transfers outside the EEA

Some of these services are in the United States, so your data can leave the European Economic Area. Expo (US) delivers app updates and notifications, under the EU–US Data Privacy Framework and standard contractual clauses. Apple Push Notification service and Firebase Cloud Messaging carry each notification to your phone. Strava (US) receives your sessions only when you connect it: that is a transfer you direct. Signing in with Google or Apple is a transfer you direct too. Cloudflare is a US company; the TV view and the live race relay are pinned to the EU where the table above says so. Ask privacy@skiphoria.com for a copy of the safeguards.

What we do not do

No analytics or usage tracking: nothing records what you do in the app. Crash and error reports (Sentry, above) carry no name, email or account id, and the live race relay's counts (Cloudflare, above) hold no personal data at all.
No advertising, and no advertising identifiers.
No selling or sharing of personal data with anyone for their own purposes.
No profiling, and no automated decision-making with legal effects.
No access to your device's location, contacts, photos, microphone or camera.

Bluetooth is used for one thing only: connecting to your ergometer and your heart-rate strap.

How long we keep things

Your account and results — until you delete your account, or we close it for inactivity (below).
Data on your device — until you delete the session, or uninstall the app.
TV view — nothing is kept of the stream. The stream to a paired screen is relayed as you ski and gone. The pairing record (your user id, the hash of the screen's pass and its two times) and its entry in your account's list of live screens are deleted when the pairing ends — when you stop showing on the TV, or 30 minutes after your phone was last connected (2 minutes if your phone never connected). A TV code nobody used expires after 5 minutes.
Live race relay — kept only while the room is open. What the relay holds about a room (its code, who is in it, who is ready, the teams, the start time and the finishes) is deleted when the room closes: within about 10 minutes after the race ends, and at the latest 6 hours after its start; before the race, when it is cancelled, 30 seconds after the host leaves a room that wasn't scheduled, or 5 minutes after everyone has left it. After that, at most why and when the room closed is kept, for 6 hours, with nothing about who was in it, so that a late arrival is told the race is over. Live positions are never stored. The relay's counts, which hold no personal data, are kept for about 3 months at Cloudflare.
Courses you shared — these outlive your account so other people's races don't break, but the link to you, the location data and the description are removed when you delete your account. This includes courses listed in Community, which stay listed after you delete your account, without your name, description or place.
Your request to publish a course — kept while the course exists once it has been listed (the record is what keeps a course other athletes race on from being deleted); for a course that was never listed — one we declined, or that you withdrew while it was in review — deleted 12 months after the decision. The place and the start point are removed when you delete your account.
Your goals and your workouts — until you change or delete them, or delete your account. Sessions you already recorded with a workout you delete stay in your history.
Scheduled races — deleted automatically 30 days after their start time, and straight away with your account.
Races you joined from the list — a place in a race you joined goes with the race, 30 days after its start; the time zone saved with it is deleted once the race is over. A record that the host removed you from a race is kept, so you can't join it again, until the race is deleted. All of it goes straight away with your account.
Listing record — when you listed a race or an event, and when your friends were notified about one: up to about two days, and deleted with your account.
Invites — an invite to a live race is deleted with the race, 30 days after its start; an invite to an event you have not answered expires after 30 days, and any invite to an event is deleted 30 days after it was answered or ran out. A room invite is deleted a day after it lapses. The time zone saved with an invite or a scheduled race is deleted once the race is over. All of it goes straight away with your account.
Tournaments — an event, its stages, entries and results are kept until the organiser deletes it, which they cannot do once anyone has a result. If the organiser deletes their account, the event stays, without the link to them. Your entry, your stage times and your name in bracket matches go with your account. The time zone saved with an entry is deleted when the event ends.
Team results — until the account that uploaded them is deleted, or the uploader discards them. A leg nobody confirmed loses its link to the named account after 14 days. The XP you earned for a confirmed leg stays with your account even if the team result is later deleted. An own-erg team result is kept under its captain's account: it is deleted with the captain's account, every teammate's legs included, and nobody can discard it; a team whose roster was sent but who never uploaded a leg is deleted after a day.
Clubs — a club is kept until its owner deletes it. Your membership, or your request to join, is kept until you leave, are removed or declined, the club is deleted, or you delete your account. If you delete your account, a club you created stays without the link to you; a club you own passes to its longest-standing admin, or is deleted if it has none. An account stays on the list of accounts allowed to create a club until we take it off, or it is deleted. A club's events and races are kept like any other event or scheduled race; if the club is deleted, they stay, without the link to the club.
Club lookup counter — how often your account looked up or joined a club by its code in the last minute, kept to stop anyone trying codes at random: up to about two days, and deleted with your account.
Race lookup counter — how often your account looked up a scheduled race by its code in the last minute, kept to stop anyone trying codes at random: up to about two days, and deleted with your account.
Open races counter — how often your account read the list of Open races in the last minute, kept to stop the list being read in bulk: up to about two days, and deleted with your account.
Reports — until we have acted on them, then deleted automatically 12 months after they are resolved. If you delete your account, reports you filed are kept without your name: they concern someone else, and the record of what we did about them has to survive.
Feedback — until we have dealt with it, then deleted automatically 90 days after it is marked done.
Strava upload record — which sessions we have sent to your Strava account, deleted automatically 30 days after the upload; the Strava upload and activity ids in it are removed within 7 days. A record whose reply from Strava was lost is kept (without Strava's ids), because it exists to stop a retry sending the session twice. It is always deleted with your account.
Push tokens — until you turn notifications off, sign out, or delete your account.
Inactive accounts — we may close an account that has not been signed in to for 24 months, and we email the address on it 30 days before.
Backups — routine backups may hold deleted data for a short period before they expire.
Crash and error reports — 90 days at Sentry, then deleted automatically.
Server access logs — kept by Supabase for a few days.
Upload and invite counters — kept to stop abuse, for up to about two days, and deleted with your account.
Training-save counter — kept to stop abuse, for up to about three days, and deleted with your account.

Your rights

Under the GDPR you have the right to access, correct, delete, restrict and object to the processing of your data, and the right to receive a copy of it in a portable format.

Deletion is built into the app: Profile → Settings → Delete account. This erases your account, your results, your trophies, who you follow, your club memberships and your Strava connection, and clears the data on that device. It cannot be undone. Your racer name is removed from team results that still link to your account — a leg that lapsed after 14 days keeps only the name, with no link to you. Legs you uploaded yourself in a team race on your own ergs stay in that team's result, with your racer name and the link to your account removed. A club you own passes to its longest-standing admin, or is deleted if it has none. Reports you filed and courses you shared or published survive it, as described above. If you signed in with Apple, we also ask Apple to revoke the Sign in with Apple authorisation for SkiPhoria; if that does not go through, the app tells you to remove SkiPhoria in your Apple ID settings yourself. Can't open the app? See Deleting your account without the app.
A copy of your data is built into the app too: Profile → Settings → Privacy → Download my data saves the data your account holds about you as one JSON file: your profile (including your category) and private settings (including your goals), races, workouts and free-ski sessions, the workouts you built or adjusted, who you follow and who follows you, the people you blocked, the fist bumps you gave, reports and feedback you sent, the courses you asked to publish (with their place, the start point your device sent and our decisions), courses you shared and their descriptions, live races you scheduled, invites you sent and received, the team races you uploaded or captained (with their legs and who they name) and the team slots that name you, the listed races and live-stage heats you joined, or were removed from, trophies, the XP from team legs you confirmed, your Strava upload records, your Strava athlete id, your push tokens, the tournaments you organised or entered (with the time zone saved on your entry), your stage times within them, and the bracket matches that name you, plus your club memberships and requests to join (with your role, status and when you joined), and the clubs you created and are still in (with their name, colour, crest, code and whether they need approval); a club's event you created is in it only while you are still in that club or entered it. Fist bumps other athletes gave you are shown in the app instead. The file leaves out your Strava access tokens, the internal notification queue, a short-lived lookup counter used to prevent abuse, and your email address, which is the one you sign in with, and the name and profile-picture link Google may have given us; the email address, name and picture link come on request by email to privacy@skiphoria.com. It also leaves out the short-lived upload and invite counters, the training-save counter, the trophy catalogue, public map boundaries and tournament stage settings (none describe you), and a short-lived value used while connecting Strava, a short-lived counter that limits how often the list is read, and the short-lived listing record that applies the daily limits. The list of accounts allowed to create a club is not in the file either; ask privacy@skiphoria.com if you want to know whether you are on it. Nor does it include a TV pairing, which the TV hub at Cloudflare holds only while a screen is paired, or a live room the live race relay holds, which it keeps only while the room is open. Data kept on your device (and its backups), such as your maximum heart rate and the heart rate recorded with your sessions, is not on our server and so is not in that file. You can export a workout or free-ski session (not a race) from History as a CSV file, which includes heart rate only if you have turned on Share heart rate with Strava in Settings → Privacy — the same switch.
Any other request, by email to privacy@skiphoria.com. We will respond within one month.
Where processing relies on your consent — heart rate leaving the device, the Strava connection, and notifications — you can withdraw it at any time in Settings — or, for the TV, on the Show on TV screen — without affecting anything done before you withdrew it. Feedback you have already sent cannot be un-sent, but you can ask us to delete it at privacy@skiphoria.com.

If you believe we have handled your data wrongly, you can complain to your national supervisory authority. In Norway that is Datatilsynet.

Deleting your account without the app

If you can't open SkiPhoria, email privacy@skiphoria.com from the address you sign in with and ask us to delete your SkiPhoria account. We confirm by replying to that address, and we delete the account and its data within 30 days. What survives is what the Deletion bullet above describes, for example: reports you filed and courses you shared or published, without your name; legs you uploaded in a team race on your own ergs, with your racer name and the link to your account removed; and, in team results, a leg that lapsed after 14 days, which keeps only the name.

Data on your phone stays on your phone until you delete the app or its data. An email request can't revoke Sign in with Apple, so if you use it, remove SkiPhoria in your Apple ID settings.

Children

SkiPhoria is not intended for children under 16, and we do not knowingly collect data from them. If you believe a child has created an account, contact us and we will remove it.

Security

All traffic is encrypted in transit. Access to your data is enforced at the database level, so one user cannot read another user's private data. Sign-in tokens are held in your device's secure keystore, not in ordinary app storage. Strava credentials never leave our server.

Changes to this policy

If we change this policy we will update the date at the top, and for any significant change we will tell you in the app before it takes effect.