Privacy Policy

01 / About this policy

A clear purpose for each type of information

雪拼 is operated by Xuelei Zou (referred to as “we” or “us”). It helps skiers and snowboarders discover and organize ski outings and communicate within their groups. This policy explains how information is processed when you use the 雪拼 app or website, or contact support.

You can browse public content without signing in. Registration, creating or joining outings, chatting, saving favorites, following users and editing a profile require an account and relevant information. Provide only what you need for these activities. Avoid including passwords, identity documents, financial account details or other unrelated sensitive information in public content or chats.

Available features can vary by beta build and server settings. The description of each feature below applies when you use that feature.

02 / Information we process

Information you provide and information from using the service

Account and verification

Email address, login name, password verification information, verification-code records and login sessions are used for registration, sign-in, password recovery, identity verification and account security. The server stores password hashes for verification, not plaintext login passwords.

Profile

Your nickname, avatar, profile background image, gender, region, biography, snow sports, stage and skill level, MBTI and interest tags, your member number (雪拼号) and your registration date (when you joined 雪拼) are used to display your profile page and coordinate outings. Your profile page also shows server-calculated counts of the people you follow, your followers, the likes you have received (on your posts and comments) and the outings you have organized.

Outings and interactions

Resorts, dates, departure regions, group sizes and plans you post; join requests, membership relationships, messages, images, resort submissions and related statuses are used to organize outings, communicate and maintain activity records. The server stores reading progress by account and conversation to calculate unread counts and sync progress across devices signed into the same account. Reading progress is returned only to you; other members do not receive read receipts. Your community likes (on posts and comments), comments, replies and follows are stored on the server. The other person sees your nickname, avatar, the time and a summary of the related post or comment in Interactions on the Messages page, and you see the same for actions others take toward you. Interactions show records from the last 90 days; a record stops appearing after the like is removed, the comment is deleted, the follow is removed, or either person blocks the other. Read states for each tab are stored on the server to sync unread counts across your devices.

Preferences and safety reports

Favorites, follows, blocked-user lists, hidden records, notification preferences, reports, reported targets, handling records and necessary evidence are used to provide personal features, limit harassment and handle violations. In-app system announcements and your read and cleared states are stored on the server to sync what you see across your devices.

Device and access records

Push device tokens, recipient account identifiers, app versions and build numbers are used for notification delivery, account separation and compatibility. OS versions, device models and app channels provided at sign-in help with account security and troubleshooting. Network services also process IP addresses, request times, requested paths, browser or client information, response statuses and error records for request delivery, security and troubleshooting.

Support and beta feedback

Email addresses, issue descriptions, screenshots and other attachments you send are used to respond and investigate problems. When you manually submit an in-app issue report, the app uploads the category and description you provide, selected compressed screenshots, and a limited diagnostic summary such as app and OS versions, device model, connection and push-permission status. It does not continuously collect diagnostics in the background or automatically upload chat bodies. We may also view feedback submitted through TestFlight and beta diagnostic information provided by Apple.

03 / Who can see information

Public content, group content and personal data have different access rules

• Public display: Your public profile information (nickname, avatar, gender, region, biography, snow sports, stage and skill level, MBTI and interest tags, member number and registration date) is shown to other users. All other signed-in users can view your full profile page (this information plus your profile background image, these counts, your community posts and the public outings you organize), except users who have blocked you or whom you have blocked. Visitors who are not signed in can browse public outings and community posts and comments, and can see the public profile information of the post authors, commenters and outing organizers shown there (without the profile background image or profile counts); opening a profile page in the app requires signing in. Your lists of follows and followers are not shown publicly; however, when you follow someone, that person sees you in New Followers in Interactions. Your likes, comments and follows appear in the other person’s Interactions. Your profile page does not list outings you have joined. Information you include in public content may be viewed or shared by others.
• Within an outing: Organizers and accepted members can view the member list, joining information and the group chat. A pending application does not grant membership access.
• Personal features: You manage your favorites, blocked-user list, notification preferences and hidden records. Email addresses, password verification information, sessions and push tokens are not displayed as public profile information.
• Administration and reports: Authorized administrators may access necessary information to handle reports, security incidents and support requests. Report evidence is not made available through ordinary user interfaces.

Blocking does not automatically remove you or other members from shared outings. Existing activities retain necessary membership relationships. Blocking or account deletion cannot retrieve content that others have already received, downloaded or captured.

04 / Permissions and storage

Permissions are requested when you need a feature

Location

The app requests location access while in use when you sort nearby resorts or obtain a departure region. Distance sorting happens on your device. Converting a location into a region name uses Apple’s geocoding service. The 雪拼 backend receives the region text you ultimately submit; it does not continuously receive your live coordinates, and the app does not request background location access. You can decline location access and select a resort or enter a departure location manually.

Photos, videos and voice messages

You select images or videos to upload through the system photo picker. Saving a share poster or chat media may request permission to add content to your photo library. These features do not automatically read your entire library. Media you actively select for avatars, outings, chats or issue reports is sent to the server during the relevant upload flow. Selection and upload may happen separately from saving or sending the content. In chats you can also tap “Take photo or video”: the camera is used only when you tap it, recording a video uses the microphone to capture sound, and the photos and videos you take (including their sound) are uploaded only when you send them. You can also record voice messages in a chat. The app uses the microphone only while you record a voice message, and the recording is uploaded only when you send it; nothing is uploaded if you cancel the recording, if it is shorter than 1 second, or if it is interrupted by a call or a similar event. We do not transcribe voice messages, perform voiceprint recognition on them or use them for any other purpose.

Notifications

The notification master switch is off by default for new accounts. The app requests system notification permission only after you turn it on. Push notifications are delivered through Apple’s service. Group chat pushes do not contain message bodies; they include recipient account and relevant outing or conversation identifiers so the app can distinguish accounts and open the corresponding content. You can disable pushes in the app or in iOS Settings. In app versions that support them, system announcements are read from the message page; their read and cleared states affect only your account, do not depend on system notification permission, and do not generate Apple pushes in this version.

Push notifications are prioritized: direct messages, outing group messages and join requests show a banner with sound; comments, replies, new outings and member changes show a banner without sound; likes and new followers are delivered quietly to Notification Center without sound or waking the screen, with at most one like notification per hour; later likes are combined into the next like notification as “N more likes”. Like, comment, reply and follow notifications show the other person’s nickname.

Local storage and the website

The app stores necessary login credentials, preferences, chat history and media caches by account on your device. Signing out or switching accounts isolates related private state; clearing a conversation or deleting an account handles local copies under the relevant rules. The website’s privacy page requires no login and contains no advertisements, analytics scripts or forms. It does not actively set tracking cookies. Network providers may still process access data for security.

05 / Service providers

Infrastructure used to run the service

雪拼 stores service data on AWS cloud servers and uses the services below. The information involved and its purposes are described here; the linked notices explain the providers’ data practices.

These providers may process service data outside your country or region. Refer to their notices for information about particular services and regions. You can also ask us about 雪拼’s data storage and processing using the email address on this page.

When you use system sharing, email or external maps, the recipients or apps you select receive the content you share and handle it under their own rules. We may also provide information to the extent necessary to comply with applicable law or respond to lawful requests.

06 / Retention and deletion

Deleting an account and hiding a record have different effects

While your account is in use, we retain information needed to provide the features described above. Hiding an archived chat or past outing affects only your own list; it does not delete other people’s records or shared messages.

Chat history and attachments

After a ski outing is completed, its group chat remains open for a 72-hour discussion period. When this period ends, or when the outing is dissolved or cancelled, the group chat is archived as read-only. After archiving, the server retains chat message bodies for another 7 days, then clears them, keeping only minimal information such as message IDs, senders, timestamps and attachment IDs for synchronization, unread counts and report verification. Chat history is stored primarily on your own device.

You can recall a group or direct message you sent within 2 minutes of sending it. When you recall a message, the server immediately deletes its body and stops serving its attachments (photos, videos and voice messages); the attachment files are then deleted shortly afterwards by the regular cleanup job. The server keeps only the message ID, sender, timestamp and a recall marker so the chat can show that a message was recalled. Copies of the body in daily backups made before the recall expire on the backup schedule described below (ordinary chat photos, videos and voice messages are not included in backups). Evidence of reports submitted before the recall is retained under the report rules below. Recalling a message cannot delete copies that others have already saved, captured in screenshots or forwarded.

Newer direct messages are stored primarily on the current device. After the recipient confirms that a message has been saved, the server retains its body for another 7 days; bodies not yet received remain on the server. Older direct-message history is not currently cleared automatically. Confirmation of saving does not mean a message has been read.

Direct-message history has no cloud recovery or additional backup feature. After uninstalling the app, changing devices or clearing a chat, bodies already removed from the server cannot be recovered. Other devices can obtain messages still retained within the 7-day period, but permanent multi-device synchronization is not guaranteed. Deleting chat history also clears the corresponding local records and attachments.

Chat images, videos and voice messages are not permanent cloud storage. By default, when total cloud media exceeds 5 GiB, files whose most recent successful send was more than 14 days ago are cleared. Reaching 14 days alone does not trigger deletion if the capacity condition has not been met. Viewing or downloading a file does not extend its retention.

Images, videos and voice messages follow this separate rule and may expire even before the recipient receives them. Confirmation that a message body was received means the message and attachment description were saved, not that the media was downloaded.

Downloaded attachments are stored primarily on the current device. Clearing chat history also clears related local attachments; clearing the attachment cache preserves text records. Files also removed from the cloud cannot be downloaded again. Save important content to your photo library separately.

Automatic downloads pause when local attachments reach approximately 1 GiB. Manual downloads remain available, and existing original files are not automatically deleted. Signing out does not allow other accounts to access these files.

Ordinary chat media (images, videos and voice messages) and thumbnails are excluded from routine cloud and device backups, but they are included in the whole-server snapshots described below and are deleted when those snapshots expire. Text, message times and attachment records follow the chat-history retention rules. Necessary evidence for reports is stored separately for 180 days under the reporting rules and is not affected by ordinary media cleanup.

1. Resolve unfinished outings first. Dissolve unfinished outings you organize, withdraw pending join requests and leave unfinished outings you have joined. Completed outings and the chat period after an outing ends do not require an additional wait.
2. Verify and confirm. Email/password accounts must re-enter the current password. If third-party sign-in is enabled and an identity is linked to your account, you may instead re-verify with that provider. Deletion always requires explicit confirmation and cannot be undone. Registering again with the same email creates a new account and member number.
3. Clear account information and personal content. Email, password verification information, profile data, sessions, push associations and private data such as favorites, follows and blocks are cleared, as are your chat message bodies. Personal free text and related information in historical records are cleared or anonymized according to the relevant rules.
4. Retain necessary shared facts. Shared outing numbers, resorts, dates, statuses, group sizes and membership relationships may remain, displayed anonymously using labels such as “Deleted user.” A minimal account placeholder and permanent number ledger are retained; numbers are not reused. Other members’ content is not all deleted when you delete your account.

Group ledger

Outing members can use a group ledger to record shared expenses. A ledger contains each expense’s amount, the names of the payer and the people sharing it (including names members add for companions without a 雪拼 account) and notes. It is visible only to the outing’s organizer and current members and is never shown publicly. Creating a ledger posts a fixed system message in the outing’s group chat (“the organizer created a ledger”, without a nickname); adding, changing or deleting an expense posts a system message there with the member’s nickname, the category and the amount; these group messages follow the chat-history retention rules above and are not deleted with the ledger after 90 days; after you delete your account, your nickname in them is replaced with “Deleted user”.

A ledger, with its expenses and activity records, is deleted automatically 90 days after the outing ends, and immediately when the outing is dissolved, cancelled or deleted. After you delete your account, your name in a ledger is shown as “Deleted user”; the expenses you recorded (amounts, splits and notes) are kept so other members’ settlement is not affected. Ledger copies in daily backups expire on the backup schedule described below.

Images, report evidence and backups

For personal images whose ownership can be established and which have no shared references from other service records, access is revoked before file deletion is attempted. Failed deletions are retried; we do not promise that every file will be removed within a fixed number of minutes. Shared references, older images with unknown ownership and copies already downloaded by others may not all be removed through a single account deletion. Contact support to review them.

Report evidence and handling content are retained for 180 days from the report’s creation. Handling or reopening a report, or deleting an account, does not restart that period. At expiry, evidence and content are cleared, leaving only minimal audit information such as target identifiers, status, actions and dates. If the service is interrupted, cleanup resumes after service recovery.

Backup retention for the production service

To recover the service after a failure, the production service backs up the database and uploaded images daily (excluding ordinary chat media and thumbnails described above). Backups are used for maintenance and recovery and are not publicly available to ordinary users.

In addition, to protect against server failure, a whole-server snapshot is taken daily and kept for 7 days. These snapshots contain all data on the server (including ordinary chat media), are used only to recover the entire server after a failure, are not available to ordinary users, and are deleted automatically when they expire.

• Daily backups: Ordinary daily copies are retained for 7 days.
• Weekly backups: The first successful daily copy of each week also serves as the weekly backup and is retained for 28 days (4 weeks).
• Deployment and historical manual backups: Pre-deployment copies and historical manual backups are not deleted automatically. They require separate review and cleanup and may remain longer than the daily or weekly periods above.

Expired automatic backups are removed after a subsequent new backup passes restore verification and the service resumes normally. Cleanup may be delayed by backup failures, service interruptions or the need for manual checks. Unconfirmed anomalous or incomplete copies require manual handling.

Sign-in events are retained in the primary database for 90 days by default, up to 200 per user. This is separate from network access-log retention.

The TestFlight beta uses a separate test environment, which is backed up once a week and retains the latest 2 routine backups and 1 pre-deployment backup.

Historical backups are not immediately overwritten or fully erased when an account is deleted. Before restoring a historical backup, deletions and expiry cleanup that occurred after the backup should be reapplied to prevent deleted information from becoming public again. Neither the 180-day report-evidence period nor the backup periods above specify how long access logs are retained. Access logs are managed separately, and a uniform fixed retention period has not yet been verified. Account deletion cannot recall emails, notifications, screenshots or externally shared copies that have already been sent.

07 / Your choices and rights

Manage your profile, withdraw permissions or make a request

• View and edit your editable profile information and manage favorites, follows, blocks and notification preferences in the app.
• Withdraw location, photo, camera, microphone or notification permissions in iOS Settings. Features that depend on a permission may then be unavailable, but unrelated features are not affected.
• Use the account deletion entry or contact us about access, correction, deletion, obtaining a copy of your information or other applicable data rights. To protect your account, we may verify your identity and explain what we can process and what information must be retained.

Do not email login passwords, verification codes or complete identity documents. Start with your member number, the type of issue and necessary details about the action involved. We will follow up based on the nature of your request.

08 / Security and minors

Protecting information and using the service carefully

We use encrypted transmission, password hashing, authentication and access controls to protect information. Networks and storage systems cannot be guaranteed absolutely secure. Contact support promptly if you discover account misuse or a data leak.

Public outings and group chats may involve offline activities and information you choose to provide. Be careful when sharing home addresses, detailed travel plans and contact information, and respect other members’ privacy.

Account registration, trip creation and enrollment through the app are limited to account holders aged 18 or older. Third-party sign-in does not verify age. If you believe someone under 18 has registered an account or provided personal information, contact support@xue-pin.com so we can investigate and respond under applicable law and this policy. This account-age requirement does not cover users’ private companion arrangements.