Privacy Policy

1. Who we are

Broski is operated by Broski App Limited (NZBN 9429053334664), a company based in Wellington, New Zealand (“Broski”, “we”, “us”). We are responsible for your personal information (the “controller” under the GDPR, and the “agency” under the New Zealand Privacy Act 2020). You can contact our Privacy Officer at privacy@broski.app.

2. Summary

• We collect the information you put in your profile, your availability, trips, events, messages and requests, and your location only if you choose to share it.
• Your profile, photos, availability and trips are visible to other Broski users. Your email address isn’t shown to other users, and we never store your exact location.
• Chats are moderated. Our moderation team can read messages in any chat, including private messages between two riders, to keep Broski safe. See What other people can see.
• We don’t sell your personal information, show ads, use advertising identifiers, or use analytics or tracking tools.
• We use a small number of service providers to run Broski, including Amazon Web Services (in Australia, with copies in the United States and Germany so the app is fast wherever you ride, and in Japan for the optional face check), Stream (for chat), RevenueCat (for Broski Pro subscriptions) and Firebase Crashlytics (for crash reports).
• If you choose to get the Verified badge, a short video selfie is compared with your profile photos. The video and selfie aren’t stored. See The face check.
• You can access, correct or delete your information, and delete your account in the app at any time.

3. Information we collect

Information you give us

The face check

The Verified badge is optional, and you can use every part of Broski without it. If you choose to do the face check:

• the app asks for your camera and records a short video selfie, which is sent straight from your phone to Amazon Rekognition, a service run by Amazon Web Services, in Japan (Tokyo);
• Amazon Rekognition checks that a real, live person is in front of the camera, and a still image from the video is then compared with your profile photos to check they show the same person;
• this uses the features of your face, which some laws treat as biometric information. We use it only for this check, and only with your consent, which you give by starting the check;
• the video and the still image aren’t saved to our systems, and we don’t create or keep a face template or any face measurements. They aren’t used to identify you anywhere else, to train any system, or for advertising, and we don’t sell or share them;
• we keep only the result: that you’re verified, and which of your photos matched. If you remove every photo that matched, the badge is removed. The result is deleted when you delete your account.

The badge shows that the person who did the check looks like the photos on that profile. It isn’t an identity check: we don’t check anyone’s name, age or ID documents.

Information collected when you use the app

• Location, only if you choose to share it. See Location.
• Push notification token, if you allow notifications, so we can send you notifications.
• Invite links: if you open a rider’s link before you sign up, the app remembers it on your device so the invite can be counted when you finish signing up. On Android, Google Play may also pass the link to the app when you install it.
• Crash reports: if the app crashes, it sends Firebase Crashlytics your device model, operating system and app version, and technical details of the crash, with a pseudonymous ID rather than your name or email address.
• Technical information that our service providers process when your device connects to them, such as your IP address and the time of the request. They use it to deliver the service and keep it secure.
• Information stored on your device, such as your settings, map visibility choice, filters, users you’ve blocked, and cached data and messages so the app works quickly and offline.

Information from other people

Other users may send you requests, message you, add you to chats, or report you. Sign-in providers (Apple or Google) send us the details described above when you use them to sign in.

What we don’t collect

We don’t use analytics, advertising or tracking tools, and crash reports are used only to fix bugs. We don’t collect your device’s advertising identifier, and we don’t track you across other companies’ apps or websites.

4. How we use your information

We only use your information where we have a lawful reason to. If you’re in the EU or UK, the legal bases we rely on are shown below.

We don’t make decisions about you based solely on automated processing that have legal or similarly significant effects. Features like filters and “what you have in common” simply compare the information riders have added to their profiles. The face check is automated, and it only decides whether your profile shows the Verified badge. If it doesn’t pass and you think it should have, you can try again or email us.

5. What other people can see

Other Broski users can see:

• your name, age (not your full date of birth), nationality, photos, bio and prompts;
• your home resort, resorts you’re riding this season, season pass, ski or snowboard and ability, seasons riding, job title, interests and languages;
• your Instagram, TikTok and Slopes links if you add them, and when you joined Broski;
• your availability calendar and upcoming trips;
• if you share your location: an approximate pin on the map and a rounded distance on your profile, such as “Less than 1 km away”;
• events you host, and messages you send in chats to the other people in that chat (and to our moderation team, see below);
• whether you have Broski Pro (a Pro badge on your profile), and any note you add to a request, which only the rider you send it to can see;
• whether you’re verified (a tick next to your name), if you’ve done the face check;
• what you have in common with them, such as shared resorts, days or interests.

Chats are moderated. Messages in every chat, including private messages between two riders, aren’t only visible to the people in the chat: Broski’s moderation team can read them, along with any photos, attachments and voice messages, to keep riders safe and enforce our Terms and Community Guidelines. We don’t wait for a report to do this. Only our moderation team can see your messages this way; we don’t show them to other users or use them for advertising.

If you join from a rider’s invite link, that rider is told that a friend joined and sees how many riders have joined from their link. We don’t tell them who joined. Your own link (broski.app/u/…) opens your profile in the app for anyone you send it to who has Broski; the web page it opens for everyone else doesn’t show your profile.

Your email address, gender and exact location aren’t shown to other users in the app. Profile and event photos are stored on a content delivery network, so anyone who has a photo’s link can view it.

6. Location

Broski only accesses your device’s location while you’re using the app, never in the background, and only if you give permission. Location sharing is off until you turn it on. In Settings, under Map Visibility, you choose to:

• Share my live location: your current location, rounded to about 1 kilometre, is saved to your profile when you open the map;
• Choose a static location: you pick a spot on the map (also rounded to about 1 kilometre), and your device’s GPS isn’t used;
• Stay hidden: your saved location is deleted and you don’t appear on the map, but you can still see other riders.

We never store your exact position: your location is rounded to about 1 kilometre on your device before it’s saved. On the map, other users see a pin that’s moved a further 250 metres to 1 kilometre in a direction that changes daily, and your profile shows only a rounded distance. When you look at an event, we send the event’s location (not yours) to a weather service to show the forecast. When the map looks up your home resort, the resort name is sent to Apple’s map search. Resort positions, which we use to suggest nearby resorts and to check the snow forecast for a resort, come from OpenStreetMap data that we keep on our own servers, so nothing about you is sent to OpenStreetMap.

7. Who we share information with

We don’t sell your personal information, and we don’t share it for advertising. We share it only as follows.

Service providers

These companies process information on our behalf to run Broski, under contracts that require them to protect it:

Other situations

• Other users, as described in What other people can see.
• Legal and safety reasons: if we believe in good faith it’s necessary to comply with the law or a lawful request, to protect someone’s safety, to prevent or investigate fraud or abuse, or to enforce our Terms.
• Business changes: if Broski is involved in a merger, acquisition or sale of assets, your information may be transferred, and we’ll tell you before it becomes subject to a different privacy policy.
• With your permission, for example when you tap a link to someone’s Instagram, TikTok or Slopes profile, which opens that service.

8. International transfers

We’re based in New Zealand, our main servers are in Australia with copies in the United States and Germany, the optional face check is processed in Japan, and some providers process data in the United States and other countries. Privacy laws in these countries may differ from where you live. When we transfer personal information overseas, we take steps to make sure it stays protected to standards comparable to the New Zealand Privacy Act. For information from the EU, UK or Switzerland, we rely on adequacy decisions (the EU and UK recognise New Zealand as providing adequate protection) and on Standard Contractual Clauses (and the UK Addendum) included in our providers’ data processing terms. Contact us for more information about these safeguards.

9. How long we keep information

We keep your information while your account is active. If you don’t sign in to Broski for 24 months, we’ll email you a warning at 23 months, and then delete your account as described below.

When you delete your account in the app, we delete:

• your profile and all your photos, including ones you replaced earlier;
• your availability and trips;
• contact requests you’ve sent and received;
• events you hosted, with their images and chats;
• your Verified badge and the record of which photos matched;
• the record of whose invite you joined from, and your own invite count;
• your rider alerts, your Broski Pro status and your RevenueCat customer record (deleting your account doesn’t cancel a subscription; cancel it in your App Store or Google Play settings);
• your chat account with Stream, and the messages you sent;
• your Broski sign-in account, and if you signed in with Apple, Broski’s access to your Apple sign-in.

See Delete Your Account.

We may keep some information for longer where needed:

• deleted database records can remain in our systems for up to 30 days before they’re permanently removed;
• reports and related information, for 12 months, after which we remove the details of who made the report. We may keep a record of a ban for longer, so banned users can’t return;
• your answer about why you left, if you gave one. It isn’t linked to you, so we can’t find or delete an individual answer afterwards;
• support emails, for as long as needed to help you and keep a record of what we’ve agreed;
• anything we must keep to comply with the law or respond to legal claims.

10. Security

We use encryption (HTTPS) to protect information sent between your device and our services, and our providers encrypt stored data. Chats aren’t end-to-end encrypted, so that our moderation team can read them (see What other people can see). We keep strengthening our security, but no service can be completely secure. Please use a strong, unique password.

If a privacy breach is likely to cause serious harm, we’ll notify you and the relevant regulators (such as the New Zealand Privacy Commissioner) as required by law.

11. Your rights and choices

Depending on where you live, you may have the right to:

• access the personal information we hold about you and get a copy;
• correct information that’s wrong (you can edit most of your profile in the app);
• delete your information and account;
• receive your information in a portable format and have it sent to someone else;
• object to or ask us to restrict certain uses of your information;
• withdraw consent at any time, for example by choosing Stay Hidden, turning off notifications or update emails, or asking us to remove your Verified badge, without affecting what we did before;
• complain to a privacy regulator (see below).

To make a request, email privacy@broski.app from the email address on your account. We may need to confirm your identity. We’ll respond within 20 working days (or sooner if your local law requires, for example within one month under the GDPR). We won’t charge you or treat you differently for using your rights.

12. Information for your country or state

New Zealand

We comply with the Privacy Act 2020 and its Information Privacy Principles. You can ask to access and correct your information. If you’re not happy with how we’ve handled a privacy concern, you can complain to the Office of the Privacy Commissioner at privacy.org.nz.

Australia

We handle personal information in line with the Australian Privacy Principles. You can complain to the Office of the Australian Information Commissioner at oaic.gov.au.

European Economic Area, United Kingdom and Switzerland

You have the rights listed in section 11 under the GDPR, UK GDPR or Swiss law, including the right to lodge a complaint with your local data protection authority (in the UK, the Information Commissioner’s Office at ico.org.uk). The legal bases we rely on are set out in section 4.

Brazil

If you’re in Brazil, the Lei Geral de Proteção de Dados (LGPD) gives you the rights in section 11, and the right to confirm whether we process your information, to have unnecessary or excessive information anonymised, blocked or deleted, to know who we share it with, and to know when you can refuse consent and what happens if you do. We rely on the legal bases in section 4, and transfer information overseas as described in section 8. Our contact for LGPD requests (the encarregado) is our Privacy Officer at privacy@broski.app. You can also complain to the Autoridade Nacional de Proteção de Dados (ANPD) at gov.br/anpd.

Canada

You can access and correct your information and withdraw consent under PIPEDA and applicable provincial laws, and complain to the Office of the Privacy Commissioner of Canada at priv.gc.ca.

California and other US states

Where US state privacy laws (such as the CCPA as amended by the CPRA) apply, this section also applies to you. In the last 12 months we have collected these categories of personal information: identifiers (name, email address, user ID); characteristics of protected classifications (age, gender, nationality); commercial information (your Broski Pro subscription status); approximate geolocation (if you share your location); audio and visual information (photos and voice messages); biometric information (only if you choose to do the face check, and only for the moment of the check: it isn’t stored); device and crash information; and other information you choose to add to your profile. The sources, purposes and recipients are described above.

• We do not sell or “share” (for cross-context behavioural advertising) personal information, and have not done so in the last 12 months. We have no actual knowledge of selling or sharing the personal information of anyone under 16.
• We only use sensitive personal information (such as your account login, and your face during the optional face check) to provide the service you ask for, so the right to limit its use doesn’t apply. We don’t collect precise geolocation: the location we store is rounded to about 1 kilometre.
• You have the right to know, access, correct and delete your personal information, and not to be discriminated against for using these rights. You can use an authorised agent, and we may need to verify your request.

To make a request, email privacy@broski.app.

13. Children

Broski is only for people aged 18 and over, and you must confirm your date of birth when you sign up. We don’t knowingly collect information from anyone under 18. If we learn that someone under 18 is using Broski, we’ll delete their account. If you think a child is using Broski, please tell us at privacy@broski.app. See our Child Safety Standards.

14. Our website

Our website (broski.app) is hosted by Vercel, which processes technical information such as IP addresses to deliver the site and keep it secure. The website doesn’t use cookies or tracking tools. It counts visits in aggregate: which pages are viewed, which buttons on our links page are tapped, and the kind of site a visit came from (for example Instagram or Google). These counts are kept as daily totals on Amazon Web Services, with no cookies, device identifiers or IP addresses, so they can’t be linked to you. To check how quickly pages load, the website also uses Vercel Speed Insights, which records page-load timings for each page with the browser, operating system, device type, network speed and country, but no cookies, IP addresses or identifiers, so these measurements can’t be linked to you or to each other either. Before Broski was on Google Play, you could join an Android waitlist through a form provided by Google Forms: what you entered there was handled under Google’s privacy policy and shared with us so we could tell you when the app launched. The website no longer links to it; if you joined and want your details removed, email privacy@broski.app. Links to other sites, such as Instagram or our sticker shop, are covered by those sites’ own policies.

15. Changes to this policy

We’ll update this policy when our practices change. We’ll change the “last updated” date above and, if the changes are significant, tell you in the app or by email before they take effect.

16. Contact us

Privacy Officer, Broski App Limited
NZBN 9429053334664
Wellington, New Zealand
Email: privacy@broski.app