PeakWait Privacy Policy

Last updated: August 17, 2026 · Effective: August 17, 2026

PeakWait ("PeakWait," "we," "us") is operated by PeakWait LLC. This policy explains what we collect, why, how long we keep it, who we share it with, and the choices you have. It applies to the PeakWait iOS app and related services (the "Service"). The Service is intended for users in the United States.

1. Information we collect

• Precise location — only during an active ski session. When a session is active, we use your device location to show nearby lifts, let you report waits near a lift, calculate your day, and (anonymously) improve estimates. To keep tracking accurate while your phone is in your pocket or locked, location may be collected in the background during an active session; iOS displays its location indicator while this happens. Tracking runs only during a session and stops automatically when your day ends. To start and stop your session automatically when you arrive at or leave a ski area, PeakWait may use location-based geofencing (region monitoring); if you grant "Always" location access, this lets iOS wake the app at a ski area so a session can begin on its own. Apart from this automatic start/stop, we do not collect precise location outside an active session, and you can turn off auto-start or use the app without granting "Always" access.
• Approximate location — to show mountains near you. When you sort by nearest, we take a single, coarse (region-level) reading and use it on your device to order the list. When you use "Where to ski today," we send that coarse reading to our backend only at the moment of your request, solely to rank mountains near you and return the result. We do not store it with your reports, keep it as part of your profile, or use it to build advertising profiles or infer characteristics about you.
• Live location with buddies (optional, off by default). If you enable it, your live position is shared with your accepted buddies while you are in a session, so you can find each other. You choose who can see you (per-buddy mute), it stops automatically when your session ends, and positions are transient (they expire within minutes and are not kept as history). Turning it off deletes your shared position immediately. Note: once a buddy has seen your position in their app, that view is on their device and outside our control until it expires.
• Powder alerts (optional). If you enable Powder Alerts, the names of the resorts you've favorited are sent to our backend to look up snow conditions so we can notify you. No precise location is used or sent for this.
• On-mountain and notification data. Notifications require your one-time iOS permission, and nothing is delivered unless you grant it. Once you allow notifications, some on-mountain alerts (such as an arrival or shorter-wait nudge) are on by default and can be turned off in the app, while others (such as Powder Alerts) stay off until you enable them. These alerts are currently computed and shown on your device (local notifications) — we do not send them from our servers. You can turn any of them off at any time in the app or in iOS Settings. If we later add server-sent (push) notifications, we would receive a device push token from Apple solely to deliver them to your device.
• Your ski day. During a session we compute your day — vertical, runs, top speed, distance, and an elevation profile over time — for your recap and season history. Your detailed route/elevation trace is kept on your device and is not uploaded. Season totals (such as vertical feet, runs, chairlift rides, and ski days) are synced to our backend so they persist and can be shown on public leaderboards and shared with friends you accept. If you set a public handle, these totals are visible to other users under that handle; if you do not, they remain tied only to your anonymous device identifier.
• Profile and social features (optional). If you opt in, we store a public handle and a preset (non-photo) avatar, your friend connections, requests, and mute settings, a reporter reputation/trust score derived from how your reports compare with other users' reports, and your self-declared ski ability level. Your handle and avatar are public (shown on leaderboards and used for add-by-handle); friend connections are shared only with the users involved. You remain anonymous until you choose to set a handle.
• Queue reports you submit — a band like "Short" or "Busy," together with the precise location where you made the report and the time, which we use to attribute the report to the correct lift and to validate it. As described in Section 4, we strip the precise coordinates from stored reports on a short rolling basis; some reports are stored with no link to your device identifier at all.
• An anonymous device identifier — kept separate from any account, used to rate-limit, detect abusive or coordinated reports, and attribute product analytics. You can reset it in Settings.
• Device attestation. To confirm that reports come from a genuine, unmodified copy of the app on a real Apple device (which helps us prevent fake and coordinated reports), we use Apple's App Attest. A key identifier, a public key, and a counter are stored on our backend; the corresponding private key never leaves your device's secure hardware and we never receive it.
• Product analytics (first-party). To understand how features are used and improve PeakWait — for example how often the app is opened, which upgrade screens are viewed, and whether a purchase completed — we log a small set of interaction events on our own backend, keyed only to the anonymous device identifier above. These events do not include your name, contacts, or precise location, and we use no third-party advertising or analytics SDKs — but because they are tied to your device identifier they are treated as personal information and are covered by your data-rights choices below.
• Network information. Our servers automatically receive your device's IP address with each request. We use it transiently to rate-limit requests and to protect the Service against abuse and unauthorized access, and we do not use it to build an advertising or interest profile about you. We do not retain your IP address as part of a general usage or advertising profile, except as described in "Proof of your agreement" below and where reasonably necessary to comply with law or to establish, exercise, or defend legal claims.
• Proof of your agreement. When you affirmatively accept our Terms and this Privacy Policy, we keep a record of that acceptance so we can show that you agreed — the version you accepted, the time you accepted it (as reported by your device and as received by our server), and the IP address from which you accepted — tied to your anonymous device identifier. We keep this limited record as evidence of your agreement, including your consent to the arbitration agreement, class-action waiver, and the assumption-of-risk release in our Terms.
• Purchase status. When you subscribe or buy a Day Pass through Apple, we receive your entitlement status (whether you have an active subscription) from Apple to unlock features. Apple processes the payment; we do not receive your full card details.
• Sign in with Apple (optional, on-device). Sign in with Apple is optional and is handled entirely on your device. If you use it, your Apple account identifier — and a display name only if you choose to share one — is stored only on your device (in the iOS Keychain) to link your anonymous session to your Apple account so your history stays with you across reinstalls. We do not receive, transmit to our servers, or store your name, email address, or Apple account identifier, and it is never tied to your reports, analytics, or leaderboard profile. It is removed when you sign out or delete the app.

We do not access your contacts or address book.

2. Why we use your information

We use the information above to: provide and operate the Service (lift status, waits, routing, your day, buddies, alerts); validate and improve crowd-sourced estimates; keep the Service secure and prevent abuse; process and unlock purchases; understand and improve how features are used; and comply with law. Precise location is used only for the purposes described here — not to build advertising profiles or infer characteristics about you.

3. How we share information

We do not sell your personal information and do not share it for cross-context behavioral advertising, as those terms are defined under the California Consumer Privacy Act (CCPA/CPRA). We have not done so in the preceding 12 months. We share information that identifies you or your device only with service providers that help us run PeakWait, by category:

• Cloud hosting & infrastructure (application, database, and cache hosting) — to run the backend and store data.
• Apple — for App Store purchases and subscription status, Sign in with Apple, App Attest, and Universal Links (for invite and share links). Today all notifications are generated on your device; only if we later add server-sent push notifications would Apple also handle push delivery.
• Weather and mapping providers — to show conditions and maps. These providers may process data only to provide services to us. We may also disclose information if required by law, to protect rights and safety, or in connection with a merger or acquisition (in which case this policy governs the transferred data).

Aggregated and de-identified data. We create aggregated and de-identified insights from queue, lift, and activity data (for example, resort-level crowding, wait, and demand trends) that do not identify you or your device and cannot reasonably be used to identify you. We may use, retain, and disclose this aggregated, de-identified data indefinitely and for any lawful business purpose, including sharing or licensing it to resorts, operators, and other business partners. We create these insights only at the resort-day level or higher and suppress any figure derived from fewer than five distinct devices, so no individual person or device can be singled out. We maintain this information in de-identified form, take reasonable measures to ensure it cannot be associated with you, publicly commit not to attempt to re-identify it (except limited testing to confirm de-identification), and contractually require every recipient not to re-identify it. Because it is de-identified and aggregated, this is not a sale or sharing of personal information under the CCPA/CPRA.

Content you choose to share. If you opt into a public handle and public leaderboards, your handle, preset avatar, and season totals are visible to other users of the Service. If you share a day, season, rank, or invite link, the information in that card is served at a public web address and can be viewed by anyone who has the link. These are features you choose to use — not a sale or sharing for advertising.

4. How long we keep it

• Precise location coordinates submitted with reports are used to attribute the report to the correct lift and to validate it, then converted into de-identified lift/queue events. The precise points are stripped from stored reports on a short rolling basis — typically within hours, and in no event longer than 30 days.
• Aggregated, de-identified queue/lift history may be retained indefinitely to improve estimates and predictions and to create aggregated, de-identified insights and data products (for example, resort-level crowding and activity trends); it no longer identifies you or your device.
• Legal-acceptance records (the Terms/Policy version you accepted, the acceptance timestamps, and the IP address used) are retained for as long as needed to establish, exercise, or defend that agreement or as required by law — even after other data associated with your device is deleted.
• Anonymous analytics events are retained no longer than needed for these purposes and generally for up to 24 months, after which we delete or aggregate them.
• Profile, season stats, friend connections, and reporter reputation are retained while your device or account remains active, and until you delete them in the app or request deletion at [email protected]. After deletion, residual de-identified aggregates (which no longer identify a device) may remain as described above.
• Sign in with Apple details (the account identifier, and any display name you choose to share) are stored only on your device (in the iOS Keychain) and are never sent to or stored on our servers. They are removed when you sign out or delete the app; we hold no server-side copy to retain or delete.
• Live buddy positions are transient and expire within minutes; they are not retained as history. We keep information only as long as needed for the purposes above or as required by law.

5. Security

We use reasonable administrative and technical measures designed to protect your information (for example, transport encryption and access controls). No method of transmission or storage is perfectly secure, so we cannot guarantee absolute security.

6. Your choices and rights

• Delete my history and Export my history are available in the app (Settings → Your data). Delete my history permanently deletes your full footprint associated with your device — your submitted queue reports and lift observations, your ski-session and season activity data, your public profile (handle and preset avatar), your friend connections, requests, and mute settings, your reporter reputation, your analytics events, and your device state — except information we must retain for legal, security, tax, or anti-abuse purposes and de-identified aggregates that no longer identify a device. Some queue and lift reports are stored without any link to your device identifier; because these cannot be traced back to you, we cannot single them out to export or delete individually, and they remain only in de-identified form. Export my history provides a copy of the data we can associate with your device. We honor verified deletion requests, including from California and other U.S. state residents, to the extent required by law. You may also email [email protected] to access, correct, or delete your information.
• Reset anonymous device ID unlinks future reports from past ones.
• Turn off location, notifications, or live-sharing any time in iOS Settings or in the app; PeakWait still shows official status.
• California residents (CCPA/CPRA) have the right to: know/access the personal information we collect, delete it, correct it, and opt out of "sale"/"sharing" (we do neither). Because we collect precise location (a category of sensitive personal information), we use it only for the purposes disclosed here, which means we are not required to offer a "Limit the Use of My Sensitive Personal Information" option. We will not discriminate against you for exercising these rights. To exercise any right, email [email protected]; we may need to verify your request using your device identifier or account. You may appeal a decision by replying to our response. Some of these rights may also be available to residents of other U.S. states with similar laws.

7. Children

PeakWait is intended for users 13 and older. We do not knowingly collect personal information from children under 13. If you believe a child under 13 has provided us information, contact us and we will delete it. Live location-sharing is off by default and requires mutual, per-buddy consent. If you are under 18, you may use PeakWait only with the permission and supervision of a parent or legal guardian, and you must not set a public handle, appear on public leaderboards, or turn on live location-sharing without their consent — these features are off by default and require you to turn them on. We do not knowingly enable live location-sharing or public-profile display for a user we know to be under 18 without a parent or guardian's consent. Public profiles never require and never display your real name, a photo, age, or contact information — only a handle you choose and a preset avatar. A parent or legal guardian may email [email protected] to review, restrict, or delete a minor's information, including removing a handle from public leaderboards and disabling location features.

8. Third-party feeds

PeakWait shows lift/resort status and weather sourced from licensed and public feeds through our own backend; that data belongs to its providers and is provided "as is." No third-party advertising or analytics SDKs collect your information.

9. International users

The Service is intended for users in the United States and is hosted in the United States. If you access it from elsewhere, you do so on your own initiative and are responsible for compliance with local law.

10. Changes to this policy

We may update this policy. Material changes will be reflected by the "Last updated" date above and, where appropriate, by in-app notice. Continued use after changes take effect means you accept the updated policy.

11. Contact

Questions or requests: [email protected] · PeakWait LLC.