Privacy Policy

1. Who we are

This policy explains how Tanit Consulting AB (organisation number 559114-6005), trading as FrostLink, collects, uses, shares and keeps personal data when you use the FrostLink mobile app or visit frostlink.ski. Together, these are the “Service”.

Tanit Consulting AB is the data controller. Our registered address is Klubbvägen 5, 182 57 Danderyd, Sweden. For privacy questions or requests, email support@frostlink.ski.

2. Data we collect

Launch notification list

If you join the launch list, we collect your email address and/or phone number (at least one is required), optional device platform, signup time and a record of the consent wording you accepted. We use this information only to notify you when FrostLink launches on your chosen platform using the email address and/or phone number you provide, based on your consent. Your phone number is optional and stored in international format. The phone-country selector can suggest an approximate country from your IP address using GeoJS, or use a country already provided to the page. When the signup form is approached or used, your browser may contact GeoJS directly; GeoJS and its network provider receive your IP address and technical request information. We send no email address or phone number to GeoJS, do not request GPS location, and do not store the lookup response or IP address as part of the signup record. The suggestion can be changed and may differ from your actual country, for example when using a VPN. See GeoJS’s privacy policy. The website launch list is stored privately in Cloudflare D1 through our hosted signup service. It is not visible to other visitors or app users. Google Firebase continues to provide the mobile app’s backend. Signing up does not create an app account or subscribe you to a general newsletter.

You can withdraw consent and request removal at any time by emailing support@frostlink.ski using your signup contact details so we can verify the request. We delete launch-list details within 90 days of notifying you about the relevant launch, or earlier if you withdraw consent. To limit abuse, we temporarily store a hashed network identifier and request counts; request logs may also be processed by our hosting providers for security.

Account and profile

We collect your email address, name, date of birth, sign-in method and account identifier. Your profile may also include gender, languages, city and country, preferred app language, equipment, skill level, riding preferences, personality and group preferences, trip-budget preference, network memberships and subscription plan.

Trips and matching

We process the trips you create or join, including dates or date ranges, destinations and coordinates, capacity, trip details, accommodation or transport notes, membership status and the preferences you submit when looking for matches.

Messages and safety information

We process trip-chat messages, replies, mentions, reactions, message status information, reports and blocks. A report may include the reported message and the reason for the report.

Location

If you grant permission, FrostLink can use your precise foreground location to show your position on the map or suggest your city. We do not request background location and do not keep a continuous history of your device's GPS position. We do store the city and country saved to your profile and the destination coordinates of trips.

Subscriptions

We receive subscription and entitlement information from Apple, Google Play and RevenueCat, such as your plan, purchase status and renewal status. FrostLink does not receive or store your full payment-card details.

Device and technical information

If you enable notifications, we store an Expo push token and your notification preference. We may also process device or app language, limited local app storage, invite information, and technical server logs needed to operate, secure and troubleshoot the Service.

Information we do not use

The current app does not use advertising networks, advertising identifiers or cross-app advertising tracking. It does not currently provide profile-photo or video uploads, and it does not use a first-party analytics or crash-reporting service. We do not sell personal data.

3. How we collect data

• From you when you register, complete your profile, create or join trips, send messages, make reports or contact support.
• From your device when you allow location or notifications.
• From Apple or Google when you use their sign-in or store services.
• From payment services when Apple, Google Play or RevenueCat confirms a subscription or entitlement.
• Automatically through the activity and technical logs required to provide and protect the Service.

4. How and why we use data

Where we rely on legitimate interests, we consider the effect on your rights and use the data only where those interests are not overridden by your rights.

5. Who we share data with

Other FrostLink users

FrostLink is a social service, so information needed to plan trips is visible to relevant users. Depending on the feature, this can include your name, email address, city or country, sports and trip preferences, network membership, trip participation and messages. People you message will retain their copy of the conversation.

Service providers

We use trusted providers to operate FrostLink:

• Cloudflare, through OpenAI Sites hosting for the website launch signup endpoint and private database.
• Google Firebase for authentication, databases and backend functions.
• GeoJS for an approximate IP-based country suggestion in the website signup form; no signup contact details are sent to this service.
• Google Maps and Google Places for maps, place searches and destination information.
• Apple and Google for sign-in, app distribution, purchases and push infrastructure.
• Expo for app tooling and push-notification delivery.
• RevenueCat for subscription and entitlement management.
• Hugging Face for automated safety screening of message content submitted for moderation.

These providers process information only for their relevant role, subject to their agreements and privacy terms. Apple and Google may also act as independent controllers for their own store, payment and sign-in services.

Legal and safety disclosures

We may disclose information where required by law, a valid legal request or court order, or where reasonably necessary to protect FrostLink, our users or others. We may also transfer information as part of a merger, financing, acquisition or sale, subject to appropriate notice and safeguards.

6. International data transfers

Some providers may process personal data outside Sweden or the European Economic Area. Where required, we use recognised safeguards such as European Commission adequacy decisions or Standard Contractual Clauses.

7. How long we keep data and how to delete it

We keep account and profile data while your account is active. Trips, memberships and chats are kept while needed to provide the Service and preserve shared trip conversations. Safety reports and technical records are kept only as long as reasonably needed for moderation, security, legal claims or legal obligations.

Delete in the app: open Settings and choose Delete Account. You may also request deletion by emailing support@frostlink.ski from the address connected to your account.

Account deletion removes your authentication account and identifying profile data, removes or updates trip memberships, and anonymises messages that remain in other users' shared conversations. We may retain limited information where required for accounting, fraud prevention, safety, disputes or other legal obligations. Anonymised information that can no longer identify you may also remain.

Subscription and transaction records may remain with Apple, Google or RevenueCat under their own legal and retention requirements. Deleting FrostLink does not cancel an active subscription; subscriptions must be managed in your Apple or Google account.

8. Your privacy rights

Under the GDPR, you may have the right to access, correct, erase or receive a copy of your personal data; restrict or object to certain processing; and withdraw consent at any time where processing is based on consent. Withdrawing consent does not affect processing that was already lawful.

Send a request to support@frostlink.ski. We may need to verify your identity before completing a request. We normally respond within one month, although the GDPR allows an extension for complex requests.

You may also complain to the Swedish Authority for Privacy Protection, Integritetsskyddsmyndigheten (IMY), at imy.se, or to the data-protection authority where you live or work.

9. Security

We use technical and organisational measures designed for the level of risk, including encrypted connections, authenticated access and server-side controls for privileged operations. No online service can guarantee absolute security, so please use a strong password and sign out on shared devices.

10. Age requirement and child safety

You must be at least 17 years old to create a FrostLink account. We do not knowingly allow accounts belonging to anyone younger than 17. If you believe someone under 17 has created an account, contact us so we can investigate and take appropriate action.

FrostLink has zero tolerance for child sexual abuse and exploitation or child sexual abuse material. Report concerns through the in-app reporting feature or at support@frostlink.ski.

11. Website and cookies

As of the date of this policy, frostlink.ski does not intentionally use analytics, advertising cookies or marketing trackers. Our hosting provider may process basic technical request information, such as IP address, browser information and request time, to deliver and secure the site. If we add non-essential cookies or analytics later, we will update this policy and request consent where required.

12. Changes and contact

We may update this policy when FrostLink, our providers or the law changes. We will change the “Last updated” date and provide additional notice where a change materially affects your rights or how we use personal data.