Privacy Policy

Last updated: 28 September 2026

Who is responsible

The controller for the website www.skiingthebalkans.com and the Skiing the Balkans apps for iOS and Android is XCo Publishing EOOD, 11 Orel St., fl. 3, apt. 5, Lozenets district, 1407 Sofia, Bulgaria, UIC 202074802, VAT BG202074802, publisher of the guidebook “Skiing the Balkans”. Contact: xcopublishing@xcosports.com, +359 89 2233040. We have not appointed a data protection officer; write to the address above about anything in this policy.

Website

Server logs. Our host (Hostinger, EU) records technical request data such as IP address, browser and pages requested, to keep the site running and secure. Logs are kept only for a limited period set by the host and are not used for profiling.
Analytics and advertising measurement — only if you accept. With your consent we use Google Analytics 4 (Google Ireland Ltd.) to understand how the site is used, and the Meta Pixel (Meta Platforms Ireland Ltd.) to measure and improve our ads on Facebook and Instagram. These set cookies such as _ga, _ga_* and _fbp and send usage data (pages viewed, device, approximate location) to Google and Meta. For the collection and transmission of Pixel data we and Meta are joint controllers; Meta’s own use of the data is governed by Meta’s privacy policy. If you decline, neither is loaded.
Your cookie choice is stored in your browser (localStorage key stb-consent) so we don’t ask again. Change it any time with “Cookie settings” at the bottom of every page.
Embedded videos. Some blog posts embed YouTube videos in privacy-enhanced mode (youtube-nocookie.com); opening such a post connects your browser to YouTube (Google).
Email. If you write to us, we use your message only to reply.

The website has no user accounts, forms or payments.

Mobile app

Account (optional). If you sign in: your email address and an identifier from Firebase Authentication. You may use email, Google, or Sign in with Apple. We do not receive your Google or Apple password. No account is needed for the free sample route.
Purchases. Full Access is a one-time in-app purchase through Apple or Google, who process the payment. We never see your card details. The app stores your purchase status on the device so it can unlock content.
Location. Only while the app is in use, and only if you allow it, to show your position on maps. We do not use location in the background and do not sell location data. Your coordinates stay on the device and are not attached to crash reports. When the app downloads map tiles, our map provider IskarTour (iskartour.com) receives your IP address and the map area requested, as with any online map.
Profile photo (optional). If you pick a photo, it is stored on your device in the app’s encrypted database. We do not upload it.
Diagnostics. Firebase Crashlytics receives crash logs, device type, OS version and a technical identifier so we can fix bugs. Product analytics and push notifications are off.
Guidebook content. Route text, photos and tracks ship with the app and are not personal data about you.

The app has no advertising SDK, no camera access and no continuous or background tracking. Local databases are encrypted (SQLCipher, AES-256); sign-in, crash reporting and map tiles use HTTPS.

Legal basis

Website analytics and advertising cookies: your consent (GDPR Art. 6(1)(a)). You can withdraw it at any time; this does not affect processing before the withdrawal.
App account and purchases: performance of our contract with you (Art. 6(1)(b)).
Server logs, crash diagnostics and replying to email: our legitimate interest in running, securing and fixing our services (Art. 6(1)(f)). You may object to this processing at any time.

We do not make decisions about you based solely on automated processing, including profiling.

Recipients and transfers

Our processors are Hostinger (website hosting), Google (Analytics, Firebase Authentication, Crashlytics and Hosting), Meta (Pixel, see above), Apple and Google (sign-in and in-app purchases), and IskarTour (map tiles for the app). Google and Meta may process data in the USA; both are certified under the EU–US Data Privacy Framework, and standard contractual clauses apply where needed.

How long we keep data

App account: until you delete it (see below).
Crash reports: 90 days (Crashlytics retention).
Website analytics: up to 14 months (our Google Analytics retention setting). Cookies expire per their settings or when you clear them.
Emails: as long as needed to deal with your request.
Local app data, including your profile photo, is removed when you delete the app.

Delete your account

To delete your Skiing the Balkans app account and its data, use the account deletion option in the app’s settings, or email xcopublishing@xcosports.com from the address you signed in with, with the subject “Delete my Skiing the Balkans account”. We delete your Firebase account (email address and identifier) within 30 days and confirm by email. Your purchase record stays with Apple or Google under their own policies, and you can restore Full Access in a new account through the store. Crash reports are deleted automatically after 90 days.

Your rights

You have the right to access, rectify and erase your data, to restrict processing, to object, and to data portability. Email xcopublishing@xcosports.com. You can also lodge a complaint with the Bulgarian Commission for Personal Data Protection (www.cpdp.bg) or the authority where you live.

Children

The website and app are a backcountry skiing guidebook and are not directed at children. We do not knowingly collect data from children under 16.

Changes

We will update this page if our data practices change and change the date at the top. For material changes that affect app users, we will also inform you in the app.