Privacy Policy
This policy explains what personal data Capture Studio Ltd collects when you use Capture Ski and the other Capture Studio products, why we collect it, who we share it with, how long we keep it, and the rights you have over it. It covers the mobile app, the on-mountain camera network, and this website.
Where we are in our lifecycle
Capture Ski is in pilot. Some features described here are live only at participating resorts, and the platform's scale is small. We will update this policy as the product grows — see section 11 for how you will hear about changes.1.Who we are
Capture Studio Ltd (“Capture Studio”, “we”, “us”) is the data controller for the personal data described in this policy. We operate Capture Ski and the wider Capture Studio platform.
| Controller | Capture Studio Ltd |
| Company number | 17042219 |
| Registered address | 71–75 Shelton Street, Covent Garden, London, WC2H 9JQ, United Kingdom |
| Privacy contact | info@capture-studio.app |
We have not appointed a Data Protection Officer. We are not required to at our current size; privacy questions go to the address above and are handled by the founder.
Ski resorts that host our cameras are separate organisations. For the rider data described in this policy we are the controller. An administrator at a resort you have ridden at sees anonymous totals for the resort as a whole — how many sessions, runs and riders on each day, with anything describing the riding itself left out on days with fewer than three riders — and the clips its own cameras captured, so they can manage that footage. If you switch on leaderboards, the resort also sees you in its rider list with the same totals a leaderboard shows — days, runs and vertical at that resort, counted from the day you switched leaderboards on — under your public profile name and photo, or as “Rider” if you have no public profile. Switching leaderboards off removes you. They do not see your individual rides, your route, your heart rate, your email or your session statistics, and they cannot see anything about rides you took at a different resort. Section 4 sets out exactly what a resort receives. Where a resort processes personal data for its own purposes — its own ticketing, marketing or CCTV — that is the resort's responsibility under its own privacy notice, not ours.
2.What data we collect and why
The lawful basis is shown for each category. Where the basis is consent you can withdraw it at any time (section 7) without affecting processing that already happened.
| Data | Why we process it | Lawful basis | Retention |
|---|---|---|---|
| Identity — name, email address, phone number, rider handle, profile photo | Create and run your account, sign you in, contact you about your account. | Art. 6(1)(b) performance of a contract | While your account is active. If you ask us to delete your account, a 30-day grace period runs first; erasure starts when it ends (section 6) |
| Precise location — GPS position sampled once per second during an active ski session, stored as a time-series in one-minute blocks, plus the ski-trail polylines and per-run statistics derived from it | Trigger captures as you pass a camera zone, draw your run trace, calculate speed, distance and vertical drop, and show you on your crew’s map when you choose to share. | Art. 6(1)(a) consent — you grant location permission and start a session; Art. 6(1)(b) for the capture feature itself | Kept for as long as the ski session it belongs to, and deleted when you delete that session or your account. We do not yet run an automatic 12-month expiry on these samples — see section 6 |
| Health data — heart rate and active calories burned, read from Android Health Connect. NOT COLLECTED by the current app: the wearable connection was removed in app version 0.1.2, so the app cannot read Health Connect. This row stays so you know what earlier versions read and what happens to it; if we bring wearables back you will be asked first and this row will change | Show heart-rate and effort overlays on your ride replay and session stats. | Art. 9(2)(a) explicit consent (special category data), with Art. 6(1)(a) consent | Stored as session averages on the ski session it belongs to, and deleted when you delete that session or your account. Revoking Health Connect access stops any further reading immediately; ask us and we will erase what we already hold |
| Motion data — accelerometer and gyroscope samples at 50 Hz, G-force at 10 Hz, and the body-mechanics derived from them (rotation degrees, air time, landing impact G, peak air height, pose skeleton tracks) | Detect and score tricks, measure air time and landing impact, and generate the wireframe overlay and coaching tips. | Art. 6(1)(b) performance of a contract | Raw samples are kept in ten-second blocks for as long as the ski session they belong to; the derived body-mechanics stay attached to the clip. Both are deleted when you delete the session, the clip, or your account. We do not yet run an automatic 12-month expiry on the raw samples — see section 6 |
| Video — clips of you recorded by fixed on-mountain cameras, thumbnails, and share-renders that include sponsor overlays | Deliver the product: the clip of your run is the thing you signed up for. | Art. 6(1)(b) performance of a contract | Until you delete the clip or your account. Section 6 explains the 12-month expiry we are putting in place for the video files, and what happens to the clip’s score and coaching tips |
| Gear-colour signature — a handful of dominant colour values for your jacket and your trousers, measured from the pixels inside your torso and legs in clips we have already recorded, and averaged across up to ten of your recent captures | Today this is only shown back to you, as the colour swatches on your profile in the app. We derive and keep it so that we can also use it to tell riders apart when several people trigger the same camera within seconds of each other — that matching step is built into the data but is not yet switched on. | Art. 6(1)(f) legitimate interests — attaching each clip to the correct rider | Recalculated nightly from your captures in the last 30 days (we need at least three), and held on your account for as long as the account exists |
| Crash reports (Android app) — when the app crashes or shows its error screen, or a ride fails to start or save: device model, Android version, app version, a random install identifier and the technical error. Sent to Google Firebase Crashlytics. We do not attach your account ID, name, email or location to the report. From app version 0.1.3 the text of app (JavaScript) errors is also cleaned before it is sent: email addresses, account identifiers, phone numbers and precise map coordinates are removed. This is automatic pattern matching, so it can miss something, and it does not apply to crashes inside Android itself, whose reports carry the device details and technical trace listed here. Earlier app versions did not clean error text, so an error message could contain your account identifier | Find and fix crashes, and rides that failed to save. | Art. 6(1)(f) legitimate interests — keeping the app working and your rides safe | Firebase keeps crash stack traces and the identifiers attached to them for 90 days and then deletes them; we keep no copies |
| Contacts — SHA-256 hashes of the phone numbers and email addresses in your address book, computed on your device (up to 500 of each per search). We do not send names or any other contact field | Find which of your existing contacts already use Capture Ski, so you can add them as friends. | Art. 6(1)(a) consent — you must grant contacts permission and start the friend-finder | The hashes you send are used for the lookup and are not stored. Separately, hashes of your own phone number (if you added one) and verified email address are stored on your account so people who already have them can find you — only while you leave “Let friends find me” switched on |
| Bluetooth proximity — identifiers of the Capture Studio beacons your phone detects on the mountain | Work out which capture zone you are entering so the right camera fires. | Art. 6(1)(b) performance of a contract | 48 hours. A scheduled job deletes every beacon observation older than that, and a deletion request removes yours straight away |
| Device identifiers — push notification tokens (FCM / Expo), the Firebase app instance ID, and a random installation identifier that the app sends to Expo’s update service (EAS Update) each time it checks for an app update | Send you a notification when your clip is ready, keep your app session working, and deliver app updates. | Art. 6(1)(f) legitimate interests — delivering the notifications you enabled and keeping the app up to date | Push tokens: until you sign out, uninstall, or disable notifications. The update-check identifier is held by Expo under its own retention terms |
| App usage log — only if you are 18 or over and have “Share usage stats” switched on. The name of the action you took in the app, from a fixed list; for some actions one or two details from a fixed set; the app version and build; whether the phone is Android or iPhone; the time on your phone and the time we received it; and your account identifier. The full list is under “The app usage log” below. It never contains your location, the content of your clips or messages, any text you type, your contacts, your name or email, or any advertising or device identifier | To see which parts of the app people use and where they give up, so we can fix and improve it — for example how many new riders finish a first ride, and how many come back a day, a week and a month later. We look at it only as daily totals; nobody at Capture Studio browses an individual’s log. | Riders aged 18 and over: Art. 6(1)(f) legitimate interests — improving the app we provide. It is on by default for a new adult rider and you can switch it off at any time (Settings › Privacy & GDPR › Share usage stats; section 7). Riders aged 16–17: not collected | Each event is deleted automatically 90 days after we receive it. A short summary per rider is kept while your account is active and the switch is on. Switching “Share usage stats” off, or deleting your account, deletes your events and your summary (section 6) |
| Server-side operational logs — records our own servers write when the app talks to them, such as which account called which function and when, and any error the server raised. We do not run any third-party analytics or advertising SDK inside the app, and we do not collect advertising identifiers. The app’s own usage log — which features you use, if you are 18 or over and “Share usage stats” is on — is the separate row above. Crash reports are a separate row too | Keep the service running, investigate faults, and detect abuse of features such as the friend-finder. | Art. 6(1)(f) legitimate interests — operating and securing the service | Google Cloud operational logs: 30 days. Our own audit-log records: kept while your account is active, and kept after you delete your account in pseudonymised form — we remove your name and email address and leave an account identifier, the action and the time (section 6) |
| Anti-abuse counters — a count of how many times your account has used a rate-limited feature (friend-finder searches, rider searches, data export and deletion requests), stored against your account identifier and the name of the feature | Stop the friend-finder and other lookups being used to test large lists of numbers or accounts. | Art. 6(1)(f) legitimate interests — protecting the service and other people’s data | The count stops applying to you within an hour to a day. The counter row itself is currently kept until you delete your account, at which point it is deleted outright |
| Sponsor impressions — a count of how many times a sponsor overlay was shown and how many sponsored clips their riders have shared (each clip counted once, with no rider identity in the count), and, on each of your clips that carries a sponsor overlay, which sponsor it was and when the clip was made | Report accurate impression counts to the resort and its sponsors, and show you on your clip which sponsor it carries. | Art. 6(1)(f) legitimate interests — running the resort’s sponsorship, reported in aggregate | The count is a running total on the sponsor’s own record, and sponsors only ever see totals. The note on a clip is part of that clip: you and the resort’s staff can see it, and it is deleted with the clip or your account |
| Invites — your own invite link’s code and how many times it has been used; and, if you joined through someone’s invite, which account invited you, with the code and the date. On Android, if you install the app from an invite link, the app reads the invite code Google Play hands to the newly installed app | Send the friend request you asked for when you used the invite, show the inviter that their link worked, and count how many people join through invites. | Art. 6(1)(b) performance of a contract for the friend request; Art. 6(1)(f) legitimate interests for counting how people join | While your account is active. You can switch your invite link off at any time, which stops new use of it |
| Emergency contact — only if you switch on the safety check-in: the name, phone number and email address of the person you choose | If you have a ride running and have not moved for longer than the time you chose, we email that person your name and your last known position so they can check on you. We do not send text messages yet, so a contact with only a phone number cannot be reached. Please tell the person you add. | Art. 6(1)(a) consent — you switch the check-in on; Art. 6(1)(d) vital interests when an alert is sent | Until you remove the contact, switch the check-in off, or delete your account |
| Safety and incident records | Respond to an incident on the mountain, run the end-of-day safety check-in, and pass a serious incident to resort staff. | Art. 6(1)(d) vital interests, and Art. 6(1)(f) legitimate interests in rider safety | While your account is active. An escalation you raised is kept afterwards with your name and contact details removed, for the same accountability reason as the audit log (section 6), then per the resort’s own incident-record obligations |
| Data export bundles — the zip file we build when you exercise your right of access, containing a copy of everything in this table that is linked to you | Answer your Article 15 request, and let us re-send the link if the first one expires before you download it. | Art. 6(1)(c) legal obligation — responding to a data subject access request | The download link in the email expires after 7 days. We intend to delete the bundle itself after 30 days; that automatic deletion is not switched on yet, so for now it is removed when you delete your account. See section 6 |
| Business enquiries — name, work email, resort, country, role and any message you send us through a demo-request or waitlist form on this website | Reply to your enquiry, and let you know when a product launches. | Art. 6(1)(f) legitimate interests — responding to a business enquiry you initiated; Art. 6(1)(a) consent for launch-notification emails | Until the enquiry is closed, or you ask us to remove you |
What we do not do
- We do not sell personal data. Not to sponsors, not to resorts, not to anyone.
- We do not use your data for behavioural advertising or build advertising profiles.
- We do not use your clips or data to train third-party AI models. Our AI provider is contractually barred from training on what we send them (section 4).
- We do not use facial recognition, and we do not measure faces, bodies or gait to identify riders.
- We do not track you across other websites.
- We do not send any analytics to third parties. If you are 18 or over and “Share usage stats” is on, the app sends us which features you use (the usage-log row above), never where you are or what you film. Separately, the app’s feature tips keep a small record on your phone — which parts of the app you have opened and a few actions, such as sharing a clip — to pick a tip and to track your Explorer cards. That record is never sent to us (your phone’s own backup can include it, if you use one). Switching tips off in the app, under Settings › App preferences, stops the record and deletes what it holds; the cards you have collected stay. Asking to delete your account in the app deletes it from that phone, and nothing more is recorded there.
A note on the gear-colour signature
We want to be clear about what this is, because “we recognise you from your clips” deserves an explanation. The signature is a handful of colour values — the dominant colours of your jacket and your trousers. It is a description of your clothing, not a measurement of your face or your body, and it cannot identify you on its own: plenty of riders own the same red jacket. Its intended use is narrow: a tie-break, when the system already knows a small set of riders were at a particular camera at a particular moment and has to decide which clip belongs to whom. We should be straight with you that this tie-break is not running yet — at the moment the signature is calculated and stored, and the only place it is used is the swatch display on your own profile. We are telling you about it now rather than after we switch it on.
Because it describes what you were wearing rather than a physical characteristic of your body, we treat it as ordinary personal data under Art. 6, not as biometric data under Art. 9. It stays inside our systems: it is never shown on your public profile, never shared with resorts or sponsors, and never sent to our AI provider. You can see your own swatches on your profile in the app, and they are deleted with the rest of your account.
The app usage log
If you are 18 or over and have Share usage stats on (Settings › Privacy & GDPR), the app tells us when you take one of the actions below. Our server accepts only these actions, only the details listed for each, and only from an account confirmed as 18 or over with the switch on — anything else is refused.
| Action | Details it may carry |
|---|---|
| Opening the app | — |
| Switching tab | Which tab: home, stats, media, scores or games |
| Starting or finishing a ride | Finish only: the number of runs, and your vertical rounded down into a band (0, 100, 250, 500, 1,000, 2,000, 4,000 or 8,000 m) |
| Creating a challenge | Which metric (a short code) |
| Accepting, declining or viewing a challenge | — |
| Adding a friend | How: QR code, search, contacts or invite |
| Sharing an invite | — |
| Opening scores | Which view (a short code) |
| Opening a game | Which game view (a short code) |
| Switching the Games view | Friends, resort or global |
| Filming, uploading, viewing or sharing a coaching clip | — |
| Viewing or sharing a clip, or sharing a recap | — |
| Redeeming a Season Pass club code | — |
| Changing a setting | Which setting (its name, never its value) |
| Opening a notification | Which kind of notification |
| Reaching an onboarding step | Age, or complete |
There is no event for claiming a zone or completing a mission. A “short code” is letters, digits and the characters _ . : - only, at most 64 characters — no spaces, so no free text.
Who is counted. Only riders aged 18 or over who have Share usage stats on. Our nightly summary job checks your profile before counting anything: if the switch is off, if you told us you are 16 or 17, if your account has not recorded an age band, or if your account is being deleted, your events are not counted and no summary is kept for you. If you are 16 or 17 — or the app has not recorded your age — the server refuses usage events from your account even if the switch is on.
What we keep. Each event is deleted automatically 90 days after we receive it. A short summary per rider — the day your account was created, the day of your first ride, first challenge and first share, and which days you used the app in the last 35 — is kept while your account is active and you keep the switch on, so we can count returning riders without keeping raw events longer. Daily totals hold counts only, never an account identifier; where fewer than 5 riders did something on a day, we do not store how many riders did it.
Switching it off. Switching Share usage stats off stops the app sending new events (our server also refuses them), discards any events still waiting on your phone, and deletes the events we already hold and your usage summary.
Notifications that remind you to come back
As well as notifications about things that happened to you (a friend sent a request), the app may send a few notifications that bring you back, each about a real event:
- A friend took the lead in a friend challenge you are in;
- Your challenge is ending — its last three hours have begun and you are not leading.
Separately, when your coaching clip has been scored (Coach my clip) we tell you it is ready. That is a service message — the result of your own upload — not a reminder.
We do not send reminders based on how long it is since you opened the app, and we do not use the usage log to decide whom to remind.
How often. At most one “friend took the lead” reminder and one “challenge ending” reminder a day (a Zurich day), so never more than two; the coaching-clip message does not count towards either. Never between 21:00 and 08:00 in your local time (the time zone of your last ride, otherwise Zurich time): a coaching-clip message is held until 08:00; a reminder is dropped if it would be out of date by then.
Defaults and switching them off. The two reminders are on for riders aged 18 and over, and off for riders aged 16–17 and for accounts that have not told us their age, unless you switch them on. The coaching-clip message is on for everyone, whatever your age, because you asked for the result by uploading the clip; you can switch it off like the others. Each one has its own switch in Settings › Notifications › Reminders (“A friend passes you”, “Challenge ending”, “Coaching tip ready”), and turning off “Capture ready” notifications also stops the coaching-clip one. You can also turn notifications off for Capture Ski in your phone's settings.
Lawful basis. Reminders: Art. 6(1)(f) legitimate interests — telling you about activity in challenges you take part in, with a one-tap opt-out; for riders aged 16–17, off unless you switch them on. The coaching-clip message: Art. 6(1)(b), part of providing the Coach my clip service you requested.
The friends activity feed (Games tab)
The Games tab shows you a short feed of what your friends have been doing, and shows your friends what you have been doing. An item is one of:
- a zone you claimed — the zone’s name and its ski area;
- a new personal best — your top speed (km/h) or the most vertical in one ride;
- a day’s riding — how many runs and how much vertical so far that day;
- you took the lead in a friend challenge — which challenge and its metric, never a number.
Each item carries your display name and initials. It never carries your position on the mountain or a map.
Who sees it. Only friends who have added you back (both of you must be friends), never anyone either of you has blocked, and at most 100 friends per item. A challenge lead goes only to the other people in that challenge.
Defaults by age, and the switch. If you are 18 or over, your activity is shared with your friends unless you switch off Share my activity with friends (Settings › Privacy & GDPR). If you are 16 or 17, or have not told us your age, nothing is shared unless you switch it on yourself. A top speed is only ever shared by an adult, and only with friends who are adults.
Zone claims say where you were, so a zone claim is shared only if you have also allowed live location (“Allow live location” in Settings › Privacy & GDPR), as well as sharing your activity. If live location is off, or has never been set on your account, no zone claim of yours reaches anyone; your other activity still can.
How long. Each item is deleted automatically 7 days after it was posted. If you delete your account, your items are removed from your friends' feeds too.
Lawful basis. Art. 6(1)(b) — the social features of the app you use; adults can switch it off; for riders aged 16–17, only with the switch on.
Daily missions and effort points (Games tab)
Each day the app shows you three or four small goals — for example a number of runs, an amount of vertical, claiming zones, or filming a friend for Coach my clip — each worth effort points (EP). Our server decides whether you completed one, from your ride data, not from anything the phone claims: runs, vertical and top speed come from your recorded rides, and a ride we have flagged as implausible (for example a GPS jump or a car journey) never completes a mission. Each mission's points are granted at most once.
One mission may be “beat a friend's top speed”. It is offered only between adults, only names a friend who shares their activity with friends (see the feed above), and uses the top speed that friend's profile already shows you.
What we store. The day's missions and which you completed (deleted automatically after 14 days), and one effort-points row per completed mission, kept with your other effort points while your account is active. Both are in your data export and deleted with your account.
Lawful basis. Art. 6(1)(b) — providing the game you play.
Speed challenges
Speed challenges (who rides fastest over the challenge's days) are for adults only: the person who creates one and everyone invited must have told us they are 18 or over — checked when it is created and again when each person accepts. If someone invited is not, the challenge is refused without saying who. Only plausible rides count: a ride we have flagged as implausible never sets a speed. No notification ever contains a speed value — a speed challenge is named as one, but the number is only shown inside the app.
3.How we collect it
In the mobile app
Most data reaches us because you enter it, or because you started a session. Location, motion, Bluetooth, contacts and health data all sit behind an operating-system permission prompt. If you decline a prompt the related feature is switched off; the rest of the app keeps working. You can withdraw any of these permissions at any time in your phone's settings.
From the on-mountain cameras
Cameras at participating resorts are fixed to a marked capture zone. They are not continuously recording to our servers: a camera records a short clip when a rider running an active session enters its zone, and that clip is associated with that rider. Resorts sign the capture zones so riders can see where cameras are and choose to avoid them.
From Health Connect
The current app does not read Health Connect: the wearable connection was removed in app version 0.1.2. Earlier versions read heart rate and active calories, only after you explicitly granted those permissions and only for the window of an active session; they did not read any other health record, and never wrote to Health Connect.
From beacons
The app scans for Capture Studio Bluetooth beacons installed at the resort. It records the identifier of our beacon, not the devices of other people around you.
On this website
We collect what you type into a demo-request or waitlist form, plus the strictly necessary browser storage described in our Cookie Policy.
5.International transfers
Your account record, clips, location samples and motion samples are stored in the European Union (Google Cloud, in Belgium, the Netherlands and Germany). Your sign-in (Firebase Authentication) is processed in the United States, crash reports and push notifications run on Google's global infrastructure, and some of our other processors are established in the United States, as listed in section 4. Where personal data is transferred outside the United Kingdom or the European Economic Area, we rely on the European Commission's Standard Contractual Clauses, together with the UK International Data Transfer Addendum where UK data is involved, and we carry out a transfer risk assessment before onboarding a processor.
You can request a copy of the safeguards we rely on by writing to info@capture-studio.app.
6.How long we keep it
The table below describes what our systems actually do today, not what we intend them to do. Where a period is automatically enforced we say so; where something is kept until you remove it, we say that instead. We would rather publish a modest promise we keep than a generous one we do not.
| What | How long | Enforced by |
|---|---|---|
| Capture video, thumbnails and share-renders (the media files) | Until you delete the clip or your account. We are putting a 12-month expiry in place on the video files themselves; until this row says otherwise, it is not yet running | Deleting a clip, or account deletion |
| The clip’s record — trick name, score, coaching tips, body-mechanics figures | Kept while your account is active, even where the video behind it has been removed. Deleting the clip removes both | Deleting a clip, or account deletion |
| Location samples (1 Hz) and motion samples (50 Hz) | Deleted automatically 12 months after the ride they belong to. Samples recorded during our early testing, before we began stamping an expiry date on them, are not covered by that sweep and are removed when you delete the session or your account | An automatic expiry sweep run by our database, or deleting a session or your account |
| Heart rate and calories read from Health Connect | Stored as session averages and kept for as long as the session. No automatic expiry today | Deleting a session, or account deletion |
| Session summary statistics (distance, vertical, top speed, personal bests) | While your account is active | Account deletion |
| Bluetooth beacon observations | 48 hours | A scheduled job that runs every 6 hours |
| Anti-abuse counters (rate limits) | The count stops applying within an hour to a day, and the row itself is deleted automatically shortly after the expiry date it carries | An automatic expiry sweep run by our database |
| Live location broadcast to your crew while you are riding | 30 minutes after your last update | A scheduled job that runs every 5 minutes |
| One-shot “share my location now” pins | 24 hours after you share it: it stops being shown, and the pin itself is deleted automatically shortly afterwards | An automatic expiry sweep run by our database |
| Data export bundles | The download link expires after 7 days. We intend to delete the zip itself after 30 days; that automatic deletion is not switched on yet, so until it is, the bundle is removed when you delete your account or when we clear it by hand | Link expiry, and account deletion |
| App usage events | 90 days after we receive them; straight away if you switch “Share usage stats” off or delete your account | Each event carries an expiry date 90 days out (our server refuses one without it) and our database deletes it after that date, normally within a day. A nightly job at 04:30 Zurich time also deletes any event older than 90 days. Switching off: a server trigger deletes your events and summary |
| Your app usage summary (the day your account was created; your first ride, challenge and share days; the days you used the app in the last 35) | While your account is active and the switch is on | Deleted by the same trigger when you switch off, by the nightly job if you are no longer eligible, and by account deletion |
| Daily usage totals (counts only; no account identifier; per-action rider counts under 5 are not stored) | Indefinitely | — |
| Usage erasure marker (your account identifier and two dates, kept so the nightly job cannot re-create your usage summary while your account is being deleted) | 100 days after deletion | An automatic expiry sweep run by our database, with the nightly job as a backstop |
| Server-side operational logs (Google Cloud) | 30 days | Google Cloud log retention |
| Audit-log records of sensitive actions (for example friend-finder searches, administrative changes) | While your account is active, and afterwards in pseudonymised form — we remove your name and email address, leaving an account identifier, the action and the time. We have not yet set an end date on the pseudonymised records | Automatic redaction during account deletion |
| Escalations you raised to our on-call team | Same as the audit log: retained with your name and contact details removed | Automatic redaction during account deletion |
| The record that you asked us to delete your account | Retained, reduced to an account identifier, the status and the dates. Your email address and any reason you gave are removed | Automatic redaction at the end of the cascade |
| Account data (everything else linked to you) | When you ask us to delete your account a 30-day grace period starts, during which you can cancel. Erasure begins at the end of it and normally finishes within hours; a very large account can take a further day or two | The scheduled erasure job, which runs hourly and resumes where it left off |
| Records we must keep by law (for example accounting records, or an incident report) | For the period the relevant law requires | Manual review |
You can delete an individual clip at any time from the app or the web rider portal, and you can delete your whole account from Settings → Privacy. Either removes the data ahead of the schedule above.
Why we keep some records after you leave
Three things survive account deletion: our audit log, any escalation you raised, and the record of the deletion request itself. In each case we strip your name, email address and any free text you wrote, leaving an account identifier, what happened and when. A fourth record, the usage erasure marker in the table above, holds only your account identifier and two dates, and is deleted 100 days after your account is.
We do this because the audit log is our security record. If asking us to delete your account also deleted the log of what was done with it, deletion would become a way to destroy the evidence of misuse — of your account by someone else, or of someone else's account by whoever was using yours. We rely on Art. 17(3)(b) and (e) and on our legitimate interest in securing the service. If you think a specific entry should go as well, write to us at info@capture-studio.app and we will look at it individually.
7.Your rights
Under UK and EU data protection law you have the right to:
- Access — get a copy of the personal data we hold about you.
- Rectification — have inaccurate data corrected.
- Erasure — have your data deleted.
- Portability — receive your data in a structured, machine-readable format, or have it sent to another provider.
- Restriction — ask us to pause processing while a dispute is resolved.
- Object — object to processing we carry out on the basis of legitimate interests.
- Withdraw consent — at any time, for anything we do on the basis of consent (location, health data, contacts, marketing email).
- Complain — to a data protection supervisory authority (section 12).
How to exercise them
- In the app: Settings → Privacy. You can delete individual clips immediately. You can also ask for a copy of your data, which we build automatically and email to you as a zip — usually within the hour, and always inside the one-month deadline. The download link in that email lasts 7 days, and we keep the zip itself for 30 days so we can re-send the link if you miss it.
- Also in Settings → Privacy: account deletion. Requesting it starts a 30-day grace period during which you can cancel; after that we erase your data automatically (section 6 explains the few records we keep, and why).
- On the web: the rider portal, under Account Settings → Your data. Same routes as the app.
- The app usage log: your usage events and your usage summary are included in your data export, and deleted as part of account deletion. To object to it, switch off Share usage stats in Settings › Privacy & GDPR: the app stops sending new events (our server also refuses them), discards any still waiting on your phone, and we delete the events we already hold and your usage summary.
- By phone permission: revoke location, health, contacts or Bluetooth access in your device settings at any time.
- By email: info@capture-studio.app. We reply within one month, and will tell you if we need to extend that (we can extend by two further months for complex requests).
We do not charge for these requests and we do not require a specific form. We may ask you to confirm your identity before we act, so that we don't disclose your data to someone else.
8.Children
You must be 16 or over to hold a Capture Ski account. We do not knowingly create accounts for anyone younger. If we learn that an account belongs to someone under 16, we delete it.
If you are 16 or 17, we do not collect the app usage log at all; reminder notifications (section 2) are off unless you switch them on yourself; your activity is not shown to friends unless you switch Share my activity with friends on, and never your speed; and you cannot take part in speed challenges or speed missions (section 2).
Riders under 16 who appear in video
Ski resorts are public places and our cameras are fixed to marked capture zones on public pistes. A child skiing past a capture zone may appear in another rider's clip. This is unavoidable in the way a person appearing in the background of someone else's photograph is unavoidable, and we take it seriously:
- The resort is responsible for signing its capture zones so that everyone on the mountain — including parents and guardians — can see where cameras are and choose a different line.
- We do not attempt to identify, name, tag or build a profile for anyone who is not an account holder.
- We never create an account, a profile or a stats record for a bystander.
- Clips are private to the rider who triggered them unless that rider chooses to share them.
- A parent or guardian can ask us to remove any clip in which their child appears, by writing to info@capture-studio.app. Tell us the resort, the approximate date and time, and enough description to find the clip. We will remove it, and we will not ask for more information about the child than we need to do that.
9.Security
- All traffic between your device, our cameras and our servers is encrypted in transit with TLS.
- Data at rest in Firestore and Cloud Storage is encrypted by Google Cloud.
- Access is enforced per-document by Firebase Security Rules: a rider can read their own data, and a resort administrator can read only their own resort’s data.
- Administrative access is limited to named individuals, and administrative actions are written to an audit log.
- The friend-finder is rate-limited to ten searches per account per hour, of at most 500 numbers and 500 email addresses each, and every search is written to our audit log, so the feature cannot be used to test large lists of numbers or addresses.
- Push tokens, email addresses and phone numbers are excluded from public profile reads.
How the contacts friend-finder protects your address book
We want to be exact about this rather than reassuring. When you run the friend-finder, your phone converts each contact's phone numbers to a standard international format, lower-cases their email addresses, and puts each one through SHA-256, a one-way hashing function. Only the resulting hashes leave your device. We never receive, and never store, the phone numbers or email addresses themselves, your contacts' names, or anything else from your address book. The hashes we receive are compared against the stored hashes of riders who have switched on “Let friends find me”, and are then discarded.
What this does not do is make the hashes impossible to reverse. There is only a limited number of possible phone numbers, so anyone who obtained a list of these hashes could work out which numbers produced them by trying every candidate. The hashing means your contacts' numbers and addresses are not sitting in our database in readable form, and it limits what an accidental disclosure would expose — but it is not the same as anonymising them, and we do not claim that it is. We treat these hashes as personal data and protect them accordingly.
No system is perfectly secure. If we suffer a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify the relevant supervisory authority within 72 hours and tell you directly where the law requires it.
11.Changes to this policy
This is version 2.4, published 30 October 2026. Every version carries a version number and a last-updated date at the top of this page.
If we make a change that materially affects how we use your data — a new category of data, a new purpose, a new processor handling special category data — we will tell you before it takes effect, by email to the address on your account and by an in-app notice. Minor changes (clarifications, corrections, a new address) are made by updating this page. Where a change requires your consent, we will ask for it rather than assume it.
12.Complaints
If you are unhappy with how we have handled your data, please tell us first at info@capture-studio.app — we would rather fix it.
You also have the right to complain to a supervisory authority. In the United Kingdom that is the Information Commissioner's Office (ICO), Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF — ico.org.uk. If you are in the European Economic Area you may complain to the data protection authority in the country where you live, where you work, or where the alleged infringement took place.
Complaining to a regulator does not affect your right to a legal remedy.