LinkUp Privacy Policy

Last updated: 7 November 2026

LinkUp ("we", "us") is operated by LinkUp App Ltd, a company registered in England and Wales, no. 17360953. This policy explains what data the LinkUp app handles and where it goes.

The short version

An account is optional. Without one, your profile, stats, photos, achievements, ratings and settings live on your phone. If you claim a username, what you share is stored as described in "Your LinkUp account and posts" below. What leaves your phone goes only to the service providers needed to make a feature work, and only while you use that feature.

The things we keep on our own server are your email address, only if you choose to give it and tick the box to hear from us (see "Marketing emails" below), anonymous usage counts, only if you switch on "Share usage data" (see "Usage data" below), daily counts of Alice questions, kept for 30 days to apply her daily limit (see "Third-party services" below), and, if you claim a username, your account and what you post.

Data on your device

This stays on your phone unless this policy says otherwise.

• Profile name, weight (for calorie estimates), chosen sports
• Avatar photo, unless you claim a username
• Any email address you type when you set up the app or claim a username. It's kept on your phone to fill in the username screen for you
• Session stats: distance, speed, descent, calories, session history, unless you post them
• Time in snow parks, and the jumps you made (when, airtime, where), if you allow motion. The motion-sensor readings themselves are processed on the phone as you ride and never stored or sent anywhere
• Achievements, levels, resort visit days
• Feed photos you take or import, unless you post them
• Piste maps you import, and map calibration points
• Settings, including any API keys you paste in
• Offline maps you download
• Lift passes you scan. The photo is read on your phone by Apple's Vision and is never uploaded.
• When your free day pass started. This one is kept in your phone's Keychain, so it survives deleting and reinstalling the app; that's what stops the day pass being reset. It never leaves your phone.

Deleting the app deletes all of it apart from that day-pass date. In-app deletion is available for photos and stats. Deleting the app doesn't delete a LinkUp account: use Delete account first.

Your LinkUp account and posts

A LinkUp account is optional. You only need one to use Find Friends, the Feed and posting. Tracking, maps, navigation and squads work without it. If you claim a username, the following is stored on our servers, which are run for us by Cloudflare.

What we store

• Your username, and when you created it
• A scrambled copy of your email address (see "Your email" below)
• Whether you are under 18 (if you never told us, we treat you as under 18). We ask your date of birth before you claim a username. Your phone uses it once to work out your age group and keeps only that group. The date itself is never saved or sent to us
• Your profile picture, which is uploaded when you claim a username, and your level, level name and resort if they are set
• Posts you choose to share: session or stats figures, your caption, photos, and the date
• Replays you choose to attach: the record of that session, with the first and last ten minutes removed. That means your GPS route, and the runs, jumps, time in snow parks, speed, distance, descent and calories on it
• Stories: photos that disappear after 24 hours
• Comments, likes, tags, who you follow and who follows you, and who you have blocked
• Which riders you've linked up with on a squad code. To tell that, your phone sends a scrambled copy of your squad code, never the code itself. We keep that copy for 30 days after it was last sent, and only use it to match riders who share a code
• Reports you make or that are made about you (see below)
• A device token for each phone, if you allow notifications. We pass it to Apple Push Notification service, with the text of the notification, so Apple can deliver it

We don't store a password. Your phone holds a random key, and we keep only a scrambled (hashed) copy of it. We don't store IP addresses; short-lived limits on some requests use a salted hash that lasts only as long as the limit.

Your email

Claiming a username needs a confirmed email address. We email you a 6-digit code, and you type it in the app. The code is sent through Resend, our email-sending service, which receives your address and the code in order to deliver it (see "Third-party services" below).

We keep only a scrambled copy of your email address for your account, never the address itself. We can't read your address from it, but we can check an address against it. We use it to confirm your email, to recover your account, and to stop suspended riders returning. One email can have one account. We keep the code only in scrambled form, and it expires after 10 minutes.

This is separate from marketing email. Confirming an email for your account doesn't sign you up for anything, and we never use the scrambled copy to contact you. News from us only comes if you turn that on yourself (see "Marketing emails" below).

Accounts made before we added this have no email until you add one in Username & account. Everything still works without one, but you can't sign back in on a new phone (see below).

Who can see it

• Anyone signed in who types your exact username can find you. Nobody can browse or search for riders.
• Your posts, replays and stories are for your accepted followers. Until someone is an accepted follower they see only your username, picture and level.
• If you are 18 or over, anyone who finds your username can follow you straight away, and then sees what you post. Block someone to remove them.
• If you are under 18, or never answered, someone becomes a follower only when you accept their request, and your picture is hidden from them until you do. If you change your age to under 18, everyone already following you has to be accepted again. Your squad is separate: people with your squad code still see your squad picture and name.
• Someone you block can't find you, and you can't find them.
• If you are 18 or over, a comment you make shows to anyone who can see that post, along with your username and picture. If you are under 18, or never answered, it shows only to your accepted followers and to the author of the post.
• You can tag only riders you've linked up with through a shared squad code, and they can only tag you the same way.
• If you tag someone, they can see that post, its photo or replay and its comments even if they don't follow you, until they remove the tag. It shows them nothing else of yours.
• If you are tagged, the author and people who can see their post can see your username, unless you are under 18, in which case only the author, you and your accepted followers can.

How long we keep it

• Stories: 24 hours, then removed along with the photo.
• Sign-in codes: 10 minutes.
• Reports: until 12 months after they are closed (see below).
• Everything else: until you delete it, or delete your account.

Deleting your account

Username & account > Delete account removes your profile, picture, scrambled email, posts, photos, replays, stories, comments, likes, tags, follows, blocks, squad links and device tokens straight away. Copies already on other people's phones are out of our control.

There are two exceptions: reports, below, and suspended accounts. If your account is suspended, the scrambled copy of your email stays on a blocked list after you delete the account, for as long as the suspension stands, so that you can't register again. It's kept for that reason only. We don't keep it for anyone who wasn't suspended.

Lost your phone?

Your account can't move with you on its own, because the key stays on the old phone. To get it back, use "Lost your phone?" in Username & account: enter your email and the code we send you, and you're signed in on the new phone, with a new key. The old phone is signed out and stops getting notifications.

Or email support@linkup.ski from your confirmed address. We check that address against the scrambled copy, and can then help, including deleting the account. Your message stays in our support inbox like any other email. If your account has no email, we have no way to confirm it's yours.

Reports and moderation

If someone reports a post, comment, story or profile, we keep a copy of the reported content with the report, so it can be reviewed even if the original is deleted. That copy, your account identifier and the reporter's reason are visible only to LinkUp's moderators. Any reported photo is deleted when the report is closed. The report itself, with the text copy and your identifier, is kept for 12 months after it is closed, even if you delete your account, so that repeat abuse can be dealt with. If you delete your account, reports you made lose your name.

We review reports within 24 hours. We check captions and comments against a list of offensive words before they are posted. Photos and stories aren't scanned automatically: reports are how they're dealt with. We can remove content and suspend accounts that break the Terms.

Why we do this (legal basis)

Performance of contract, to run the features you use; legitimate interests, to keep the service free of abuse, to act on reports and to keep suspended riders out.

Apple Watch and Apple Health

If you use the LinkUp Apple Watch app, your watch reads your heart rate, active energy and skiing distance during a ski workout, and the workout is saved to Apple Health on your own devices. Health data stays in Apple Health: LinkUp never uploads it, never sends it to your squad or to Alice, and never uses it for advertising or marketing.

Marketing emails (optional)

When you set up the app you can give an email address and switch on "Email me LinkUp news, new resorts and offers". The switch is off unless you turn it on. If it's off the address stays on your phone, to fill in the username screen if you ever claim one, and isn't sent to us for marketing.

You can also join the launch list on linkup.ski. That form stores your email address with Netlify, and we use it only for launch news. We send one welcome email through Resend to confirm you've joined. You can unsubscribe at any time.

This is separate from the email for a LinkUp account. Each has its own purpose, and neither depends on the other.

If you opt in, we store:

• your email address and the name you entered,
• the wording you agreed to, which version of it, and when.

We use this only to send you LinkUp's own news, resort updates and offers. We never sell it or share it for anyone else's advertising.

• Where it's kept: on our backend, hosted by Netlify (see netlify.com/privacy). We don't use an email-sending service for marketing yet; if we add one, we'll name it here before any of your details go to it.
• How long: until you unsubscribe or ask us to delete it.
• Legal basis: your consent (UK GDPR Article 6(1)(a); the Privacy and Electronic Communications Regulations, regulation 22).
• Changing your mind: every email has an unsubscribe link, or email support@linkup.ski and we'll delete your details. Withdrawing consent doesn't affect anything else in the app.

Data shared with your squad (via our relay)

There's no voice chat in LinkUp: nothing you say is ever sent to your squad. When you join a squad, your phone shares the following with the people in that squad only, through LinkUp's own small relay (a Cloudflare Worker that we run):

• Your squad code, so the relay knows which squad you're in
• Your display name, a small copy of your profile picture, and whether your phone is in your hand or your pocket
• Your GPS position (every 10–30 seconds during a live session)
• Meet-up pins and short notes you send
• Stats summaries for the squad leaderboard and squad games, including your time in snow parks and your jump totals (number of jumps and longest airtime). Never raw motion data, and never where each jump was
• The title you chose for squad awards (King, Queen or Legend). The answer behind it (male, female or prefer not to say) stays on your phone
• A random squad ID made for each install, which is sent only to our relay. Other riders see a scrambled version that changes from squad to squad

The connection is encrypted. You need the squad code to join, and a squad can have at most 10 people. In a group (up to 1,000 people), the organisers see everyone's position and everyone else sees only the organisers and their own team of up to 10. The relay keeps everything in memory only, never on disk: positions for 5 minutes and pins, notes and stats for 30 minutes, so everything is gone within 30 minutes and nothing is kept after the day. Cloudflare runs the relay for us as our processor.

Location sharing runs only while a session is live. During a session it keeps going in the background, so navigation and your squad's map keep working with the phone in your pocket. It stops when you end the session.

When you record a ski day with Start day, your location runs in the background the same way, for your stats, and stays on your phone. Without a linked squad it goes to nobody. It stops when the day ends, either when you end it or, after 17:00 resort time, once you have been still for 45 minutes.

Third-party services, feature by feature

Alice sends nothing until you agree on her consent screen, and you can switch her off again in Settings › Privacy.

Assistant requests pass through our backend (hosted by Netlify) so that no service keys live in the app. The backend forwards them and does not keep what you asked. Your phone sends along your anonymous install ID and purchase ID so the backend can check you have Pro and apply Alice's daily limit. To do that it keeps daily usage counters, keyed by that install or purchase ID, in Netlify Blobs (Netlify's storage); they hold only counts, never what you asked, and are deleted after 30 days. If the backend can't be reached, navigation falls back to the iOS voice.

Usage data (optional, off by default)

If you switch on "Share usage data" in Settings, the app sends counts of things like app opens, sessions started, invites opened and joined, and purchases started. It does not send your name, email, location, photos or voice. Each phone has a random install ID, made on first use and gone if you delete the app, which we scramble (hash) on our server before storing. Squad codes are scrambled the same way, so we can't read them back. These counts go to our own backend and are used only to see which parts of the app work. Turning the switch off stops it, and anything not yet sent is thrown away. We keep usage counts for 12 months and then delete them. To have your usage data deleted sooner, email support@linkup.ski.

We do not use third-party analytics SDKs, advertising SDKs, or trackers. We set no cookies. We never sell data.

International transfers

Some of the providers above (Anthropic, Fish Audio, Netlify, Cloudflare, Resend, Apple, Garmin and RevenueCat) may process data outside the UK, for example in the United States. Where they do, the transfer is covered by UK adequacy regulations, or protected by the UK International Data Transfer Agreement (IDTA) or the UK Addendum to the EU Standard Contractual Clauses.

Permissions

• Microphone — asking Alice. Audio is used only while you ask, recordings aren't kept, and it is never sent to your squad.
• Location (while using, and in the background during a session or a recorded day) — your pin on the map, navigation, stats, home-base warnings, and sharing your position with your squad.
• Notifications — squad and milestone alerts are generated on your phone. If you have a LinkUp account, likes, comments, follows and tags reach you through Apple Push Notification service.
• Motion & Fitness — counting your jumps and airtime while you ride (beta), asked the first time you track a session. The phone's motion sensor is read only during a session while you're moving on snow, on the phone itself; only your jump totals are shared with your squad. Saying no just means jumps aren't counted.
• Camera / photo library — feed photos, scanning a lift pass (read on your phone by Apple's Vision, never uploaded), the dates and places of your photos for your Wrapped recap, and saving your Wrapped video, run cards and photos to your library when you choose Save. All of this stays on your phone unless you share it.
• Speech recognition — asking Alice by voice. Apple turns your speech into text (on your phone when you're offline); that text is then sent through LinkUp's server to Anthropic, Alice's AI provider.

Legal bases (UK GDPR)

Where we act as controller: performance of contract (running the features you invoke), legitimate interests (service integrity and preventing abuse), and consent (Alice, marketing emails and usage data, only if you agree or opt in). No profiling, no automated decisions with legal effect.

Your rights

Most data lives on your device or is short-lived relay traffic, so most rights are exercised directly in the app (edit or delete data, delete the app). If you have a LinkUp account, you can correct or delete it in the app, or ask support@linkup.ski for a copy of it, a correction or its deletion. If you opted in to marketing emails or usage data, you can ask for a copy of what we hold, correct it, or have it deleted, or simply switch it off or unsubscribe. For anything else contact support@linkup.ski. You can also complain to the Information Commissioner's Office (ico.org.uk).

Children

You must be 13 or older to have a LinkUp account. If the date of birth you enter shows you are under 13, the app won't create one, and the rest of the app keeps working on your phone. We don't knowingly collect data from anyone under 13.

Changes

We'll post changes here and flag material changes in the app.