Privacy in the app

Last updated: 12 October 2026

This is about the Powdium app. The website has its own notice, which covers one email box and nothing else.

The app is a different matter, and the website's notice says so: "it will record where you ski, which is a great deal more personal than an email address, and it will have its own privacy notice written with the same care as this one." This is that notice.

It is written to be read rather than to be legally survivable, because a privacy notice nobody reads protects nobody. Where a promise here is enforced by something other than my good intentions, it says what. If anything is unclear, support@powdium.app and a person will answer.

Who this is

Powdium is made by James Morris, a sole developer in the United Kingdom, and it is me rather than a company that decides what happens to your data. In the law's language I am the data controller, which matters mainly because it tells you who to argue with: there is no department, and nobody else to be passed to.

Write to support@powdium.app about anything on this page. It reaches me.

The first thing to know

A day records, scores and keeps itself with no account at all. You can install Powdium, never sign in, ride all season, and nothing whatsoever leaves your phone. Everything in the next section is the consequence of choosing to sign in.

What an account buys is that a day can leave the phone. That is the whole feature, and it exists because the app this one replaces switched its servers off with no notice and took tens of thousands of people's ski histories with it. A lost phone should not be a lost season.

What leaves your phone, once you sign in

Your email address. Signing in is a six-digit code sent to an address. There is no password, so the address is the account. It is not used for marketing — there is no newsletter to be added to.

A name and a username. Both optional. Until you change them you are given an animal and a mountain feature — Powder Fox, Glacier Marmot — and nothing is ever derived from your email address.

Where you rode. The recorded track of each day: your position roughly once a second, with height. This is the most personal thing here by a long way, and I would rather say so plainly than bury it. It is what makes your vertical, your runs and your map real rather than estimated, and it is what you get back when you export.

The day's figures. Vertical, distance, runs, moving time, the runs you named.

Photographs you attach to a day. Private to you. No other account can read them, and that is enforced by two separate rules in the database rather than by a setting somebody could get wrong. The location and camera details are stripped out of the picture before it leaves your phone.

A profile picture, if you add one. Your party sees it. Strangers see it only if you switch on the resort ladder.

Anything you write. A post on a resort board, a taunt you wrote yourself, or a report you file about somebody else's.

Your age band, but only if you ask for something that needs it. The resort ladder and the resort board are both 18 and over. Leave both alone and you are never asked your age at all. "Not saying" is a real answer, and it means those two features stay shut.

What you have bought. Apple takes the money and I never see a card. What I store is the identifier Apple gives a purchase, so a pass belongs to your account rather than to the phone in your hand.

What never leaves your phone

This list matters more than it looks, because in most apps these things would be on a server.

Where everybody is, right now. When you ride in a party, your position is passed to the others through my server and is never written down — not to a database, not to a file, not by me. It exists in memory for as long as a phone is connected and is gone the moment it is not. There is no table it could be stored in, which is what makes this a fact about how it is built rather than a policy I am promising to keep. When the party closes at the end of the day, the day's movements are genuinely gone, including from me.

Your birthday. One trophy needs to know when to congratulate you, so the app asks for a month and a day. It never asks for a year, there is no column for it on any server, and a server that does not hold something cannot lose it.

Who you rode with. The app counts the different people you have ridden with over a season. It does that by storing scrambled values it cannot reverse, made with a key that is generated on your phone and never sent anywhere. The same person is recognisable to your phone and is meaningless to anybody else's.

How each day's race went, minute by minute. Kept beside the recording while the day is running, and thrown away when it ends.

Your settings. Kilometres or miles, which theme, whether the day starts itself. Facts about a phone, not about a person.

Apple Health

The watch files your day as a workout, if you allow it, so it counts towards your rings. That is the only involvement Health has, and it goes one way: the app asks for permission to write a workout and asks for no permission to read anything at all, so it cannot see the rest of your health data even by accident.

It needs no account and none of it comes to me — a workout in Health stays on your own devices under Apple's rules.

Who else is involved

Your phone talks to a small number of other companies. Here is all of it.

The database and file storage are run by Supabase, on servers in London. That is where a day goes when it leaves your phone.

The map is Mapbox. Drawing a map means asking them for the squares of it you are looking at, so they receive your device's address and, by implication, roughly where on the map you are looking. They do not receive your account, your name or your day. The steepness layer is mine and comes from my own storage.

The forecast is Open-Meteo. They are told which mountain, never where you are on it — the request carries the resort's own centre point, because a forecast is about a mountain rather than about a person.

The sign-in email is delivered by Resend, who necessarily handle your address in order to send you a code.

Purchases go through Apple, as all App Store purchases do.

Advertising measurement is TikTok's, and only if you say yes — see below.

Some of these are outside the UK. Where they are, the transfer relies on the standard safeguards in UK data protection law.

There is no analytics. No Firebase, no Amplitude, no Mixpanel, no crash-reporting service of my own. Nothing counts which screens you open or how long you spend on them. This is not "no third-party analytics" — there is none at all, which is why nothing in the app asks you about it.

Advertising, and how little of it there is

Nothing is sent to an advertising network unless you agree, and today nothing is sent at all. The app can tell TikTok that an advert worked, so money goes on the adverts that bring people in rather than the ones that do not. That is the only purpose.

• iOS asks you once, in the standard system box. Until you answer, nothing is sent. If you decline, nothing is sent and nothing is kept waiting in case you change your mind.
• What could be sent is that a step happened — an account was made, a party joined, a clip posted, a pass bought and for how much. Not where you rode, not how far, not how fast, not when. Those are not on the list because there is nowhere in the code to put them: the list of things it can say is a fixed set of names with no room for anything else.
• Never for anybody who has told me they are under 18, whatever they tap. That is checked before the consent is.
• As it stands, the app ships without the keys that would switch any of this on, so the box is never even shown. When that changes, this notice and the App Store's own privacy summary change with it, before the version ships.

Children

Roughly a quarter of the people this app is built for are children — the whole point of Level Play is that an eleven-year-old can race her dad and win. So this is not an afterthought.

Nothing about a child goes in front of strangers: not their face, not their username, not their writing.

• The resort ladder is 18 and over. Not a default a child can change — it is not offered. A public board carrying a child's picture, username, resort and date is precisely what the rules protecting children online were written to prevent.
• The resort board is 18 and over too, for reading as well as writing. It is the one place in Powdium where strangers write to each other, and a child's own words in front of strangers is the same risk as their photograph.
• Both are enforced in the database, not on a screen, so there is no version of the app that gets it wrong.
• A child loses none of the app itself. The day, the score, Level Play, a party with their family, the trophies, the Passport, the map — all of it works exactly the same.
• Your real name never appears on a public board, at any age. Only the username you chose, and there is no way to put contact details on one.

How long things are kept

Your days: until you delete them. They are the point of the app, and nothing quietly expires.

A party: until the end of that day. It deletes itself, and the positions in it were never stored in the first place.

A board post: until the end of tomorrow. A board is people who are there, not a museum of last season's lift queues.

A report about a post or a taunt: kept. There is no record of taunts at all otherwise, so a report has to carry its own evidence or it cannot be looked into.

Your account: until you delete it, and then properly.

Getting everything out, and deleting everything

The export is free, needs no account, and includes everything. GPX for anything that reads GPX, the raw recordings, a summary of each day, and documentation of the file format so somebody could write their own reader. It is not a paid feature and it never will be — the commitment to wind the app down without taking anybody's history with it is worth nothing if you cannot act on it.

Deleting your account deletes the days, the photographs, the passes, the parties, the record of who you rode with for the Belt, and the raw recordings, including the files rather than only the rows that point at them. The export sits on the same screen as the delete button, above it, because that is the moment it matters most.

The days on your phone stay. They never needed an account and they still do not.

Your rights

Under UK and EU data protection law you can ask for a copy of what I hold about you, ask me to correct it, or ask me to delete it. Two of those three are buttons in the app, and you do not have to ask anybody: the export is the copy, and account deletion is the deletion.

For anything else, write to support@powdium.app. No form, no identity verification theatre.

If you think I have handled your data badly you can complain to the Information Commissioner's Office at ico.org.uk.

Changes

If this notice changes, the date at the top changes with it. If a version of the app starts collecting something that is not on this page, this page changes before that version ships, not after.