Privacy Policy

1. Who is responsible for your data

The controller is:

We are not required to appoint a Data Protection Officer, so privacy requests go to the address above and are handled by the company.

2. What we collect

2.1 Account data — you give us this

• Email address
• Display name and username
• Profile picture, if you upload one
• If you sign in with Apple or Google: the identifier that provider gives us, and the email address they release to us. If you use Apple's Hide My Email, we only ever receive Apple's private relay address, never your real one.

2.2 Content

• Run recordings captured by fixed park cameras while you are riding a monitored feature
• Clips you trim from those recordings, including the framing you choose
• Trick names, resort names and captions you enter
• Likes, follows, blocks and reports you make

2.3 Location — please read this section

Trickbook uses your phone's precise location, including in the background when you turn on automatic recording. This is the feature that films you without you touching your phone: your device works out when you have entered a monitored feature at a partner park, and tells our recorder to cut the footage covering that run.

Two things about how this works matter:

• Your coordinates are evaluated on your device. The app compares your position against the park's feature zones locally. It does not transmit your latitude and longitude to us, and we do not store a location history for you. What reaches our servers is which feature you entered and when — not where you were.
• It only runs where you turn it on. Automatic recording is off until you enable it, you can switch it off at any time, and iOS shows the background-location indicator while it is active. Outside partner parks there is nothing for it to match, and it records nothing.

You can revoke location access entirely in iOS Settings. Automatic recording then stops working; the rest of the app continues to function.

2.4 Technical and usage data

• Authentication tokens and session state, to keep you signed in
• Error and diagnostic logs from our servers
• Product analytics (via PostHog): in-app events such as starting a run, saving or publishing a clip, playing a clip, switching camera angle and liking a post, together with your account ID and basic device and app information

We do not use advertising identifiers, advertising SDKs, or cross-app or cross-site tracking, and we do not sell personal data. We do not collect contacts, health data, or payment card details (purchases, when offered, are handled by Apple).

3. Why we process it, and our legal basis

We do not make decisions about you by automated means that produce legal or similarly significant effects (GDPR Art. 22). Nothing here profiles you for advertising.

4. Other people in the footage

Park cameras point at a feature on a slope that other people can walk or ride across. People who are not Trickbook users may therefore appear in recordings incidentally. We take this seriously and it is not something a notice board can wave away.

Our legal basis is legitimate interests (Art. 6(1)(f)), not consent. Consent under the GDPR has to be a freely given, specific, informed, unambiguous act — passing a sign on a piste is none of those, and we will not pretend otherwise. We rely instead on our legitimate interest in operating the Service, balanced against the rights of people who appear, and we limit the processing so that the balance holds:

• Cameras are aimed at the feature, not at the crowd. Framing covers the jump or rail and its run-in and landing, not lift queues, terraces or general public areas.
• Nothing is kept by default. Cameras write to a rolling buffer that is continuously overwritten, currently after 15 minutes. Footage only persists if a rider's run is matched to it. If nobody rides the feature, nothing survives.
• We do not identify bystanders. No facial recognition, no biometric processing, no attempt to name or track anyone who is not the rider.
• Signage at the park. Partner parks display notices at the monitored features so people know cameras are operating and where to find this policy. This is how we meet our transparency duty under Arts. 12–14; it is not a consent mechanism.
• You can object and have footage removed. See §8.

We carry out a Data Protection Impact Assessment for each park before cameras go live, as required by GDPR Art. 35 for systematic monitoring of publicly accessible areas, and we review it when a camera moves or a park's layout changes.

5. Who else processes your data

We do not sell your data. We use these providers, each under a data-processing agreement:

Your public profile — username, display name, profile picture, bio and home resort — and the list of who you follow and who follows you are visible to other signed-in Trickbook users, so they can find and follow you. Content you choose to publish — a clip, shown with that profile — is visible to them too. Runs and clips you do not publish are not shown to other users.

We may disclose data where the law requires it, or to establish or defend legal claims.

6. International transfers

Our core storage and processing is in the EU/EEA, as set out in §5. Where a provider processes data outside the EEA, that transfer is covered by appropriate safeguards — the European Commission's Standard Contractual Clauses, or an adequacy decision, as offered by that provider. You can request details of the safeguards in place at admin@trickbook.fi.

7. How long we keep things

When you delete your account we remove your profile, username, public profile, runs, clips, published posts, likes, follows and profile picture, and we delete the stored video files belonging to them within 30 days. Records we must keep for legal reasons, and moderation records where you were the subject of a report, are retained for the periods above. Backups are cycled out on their normal schedule.

8. Your rights

Under the GDPR you can: access your data; have inaccurate data corrected; have your data erased; restrict processing; object to processing based on legitimate interests, including the analytics in §2.4 and the footage in §4; receive your data in a portable form; and withdraw consent where we rely on it.

In the app you can:

• Edit your profile
• Delete individual clips, or remove a published clip from the feed
• Delete your account — Profile → Settings → Delete Account
• Opt out of product analytics

If you appear in footage and want it removed, or want to exercise any other right, contact admin@trickbook.fi. It helps if you tell us the park, the approximate date and time, and anything that identifies the clip. We respond within one month, as the GDPR requires, and will tell you if we need longer for a complex request.

You can also complain to the Finnish supervisory authority: the Office of the Data Protection Ombudsman (Tietosuojavaltuutetun toimisto), tietosuoja.fi.

9. Security

You have to sign in to use the Service, and our database enforces per-user access rules on every read and write, so one account cannot read or change another's private records. Video files are stored in the EU. Traffic is encrypted in transit (HTTPS/TLS). Cameras are not exposed to the public internet; our recorder reaches them over a private encrypted tunnel. Server credentials are least-privilege and are not embedded in the app.

No system is perfectly secure. We take measures appropriate to the risk, and where a breach is likely to result in a risk to your rights we will notify the supervisory authority, and you, as required by Arts. 33–34.

10. Children

The Service is for people aged 13 and over — the age of digital consent in Finland. We do not knowingly collect data from children under 13. If you believe a child under 13 has an account, contact admin@trickbook.fi and we will delete it.

11. Changes

We may update this policy. If a change materially affects how we handle your data we will tell you in the app or by email before it takes effect, and the "Last updated" date above will change.

12. Contact