IPHONE EARLY ACCESS · UPDATED 27 OCTOBER 2026

Your trips.
Your privacy.

Pistio is a ski-trip planning app from SmitSocial.Media Limited. This page explains the information used by the TestFlight app, including its offline saving, shared updates, resort catalogue, account emails and Trip Pass purchases.

App lock and iPhone notifications

You can choose Face ID or Touch ID unlock, with your iPhone passcode as fallback. Apple performs this check on your device; Pistio does not receive or store your face, fingerprint or iPhone passcode. App-lock preferences are stored in the iOS Keychain for this account on this iPhone. The app hides its contents in the app switcher.

Push notifications start off. If you enable them, we store an installation identifier, a protected device push token, its signed-in account and the notification categories you choose. Delivery goes directly through Apple Push Notification service, not the Expo push relay. Previews contain general updates and routing identifiers, never private booking references, names, amounts or notes. Your private bookings never generate group notifications. Itinerary plans are Shared by default. Busy shares only the people and times; its title, place and notes are visible only to its author. Private plans are visible only to their author. We store invitations and replies for shared plans. Plan alerts go only to the people involved, and optional reminders go only to people marked Going. Reminders require Trip updates to be enabled. Personal plans can generate a reminder for their author, without alerting the group.

Push preferences apply to your account, while iPhone notification permission applies to each device. We check preferences, sessions and current trip access before delivery. Signing out disables that device; if it is offline, the app saves a request to disable it on reconnect. A notification already in transit may still appear. Taps check the signed-in account and trip access before opening a trip.

Queued alerts expire after an hour, completed delivery records are removed after 30 days, and device registrations not refreshed for 90 days are removed. You can turn categories off in Pistio or disable alerts in iPhone Settings. Push settings are separate from optional email settings and essential account emails.

Your account

We store the first name, surname and email address you enter, a protected password hash, and records needed to sign you in and protect the service. Earlier accounts keep their original display name until you supply the separate fields. Your password is not stored as readable text. Your iPhone keeps its sign-in token in the iOS Keychain. Server sessions expire after 30 days.

New accounts receive a welcome email with an optional email-confirmation link. Normal app use does not require confirmation; optional trip emails do. Password recovery uses a single-use email link that expires after 30 minutes. A successful reset changes your password, signs out all existing sessions and sends a security notice. The app keeps unsent local drafts so you can reconnect the same account.

Your email choices

Account emails come from notifications@pistio.app, with replies directed to hello@pistio.app. Recovery, confirmation, password-change and purchase-confirmation messages support your account and are separate from optional trip emails. We do not send marketing emails.

In Settings → Notifications → Choose your emails, you can confirm your address and choose optional trip emails. They are off by default. When enabled for a confirmed address, these cover personal invitations explicitly emailed by an organiser, jobs newly assigned to you, and notices when someone joins a trip you organise. Ordinary edits and your own assignments do not generate these messages. Private booking contents are never included.

Organisers can enter an email address to send an existing personal invitation code. We send only if that address belongs to a confirmed account that has opted in; the organiser's response does not reveal the recipient's account or preferences. The app also lets organisers share codes directly. It does not access your address book.

You can switch optional trip emails off in the app or through the preference link in an optional email. An email already in transit may still arrive. Essential account and security messages remain enabled. Delivery goes through Pistio's mail server and the recipient's email provider.

Queued email contents, recipients and action links are encrypted in private server storage. Reset and confirmation tokens are stored as hashes for validation. Queued contents are removed after delivery, cancellation, expiry or final delivery failure; limited delivery metadata is retained for up to 30 days. Account deletion removes associated queued mail, tokens and preferences. Emails already delivered to your mailbox remain subject to your mailbox and provider's retention settings.

Your shared trip

Trip names, destinations, dates, people, travel and accommodation notes, ski details, itinerary entries, jobs and shared expenses are available to the members of that trip. Members can see the names of the people travelling and who recorded shared entries. Your account email is not displayed to other trip members.

An organiser can add someone's name before they join, assign jobs and include that person in expenses. A personal invitation code can be used once and expires after seven days. Share it privately: anyone who has an unused code may claim that invitation.

Your profile photo

A profile photo is optional. When you choose a photo from your library, the app crops and compresses it before uploading. Pistio accepts a small JPEG up to 512 pixels on each side and 512 KB, decodes it and creates a fresh JPEG to remove embedded metadata such as EXIF location information.

Photos are stored outside the public website folder. Fetching a photo requires a signed-in session and is permitted only for you or someone sharing an active trip with you. A photo URL does not contain a sign-in token and does not grant access by itself. Your photo appears beside your name in shared trip screens.

You can replace or remove it in Your profile. The old photo stops being available through the app service when its version is replaced or removed; obsolete files are cleaned from active storage. Account deletion removes your photo reference and cleans its active file. Operational backups may retain older copies until those backups are replaced or removed. A device that already displayed a photo may retain a cached copy until its cached app data is removed.

Accommodation, travel and ski bookings

Bookings can include selected travellers, property or supplier contact details, addresses, map links, local dates and times, transport services, equipment or lesson arrangements, and an optional payment schedule. The person who adds a booking chooses its visibility and controls edits. A shared booking shows its plans and payment schedule to trip members; booking references, door codes, key collection and booking-party notes are returned only to its creator and selected current travellers. They are concealed on screen until revealed, and never included in notification previews.

For “My booking — plans shared”, the group sees the public itinerary, location and selected people, while costs, references and access details stay private to the creator. “Only me” bookings are visible only to their creator. The organiser has no special access to private bookings. Existing private bookings remain private. Booking data is stored on Pistio’s server and in your account’s local app database; it is not end-to-end encrypted.

Payments have separate amounts, due dates, payers and shares. Only payments deliberately marked paid and shared in Expenses enter group balances. Expense entries are visible to the trip group, with costs allocated only to the chosen people. Undoing paid status removes the linked expense from current balances while preserving its history; repayments remain separate. Refundable holds are excluded from spending. Recording a booking or payment does not reserve accommodation, buy tickets or move money. Account deletion removes personal bookings and access details from active service, while shared booking and expense history may remain for the group with the account removed.

Me, private bookings and shared journeys

Your private booking records can contain suppliers, booking references, locations, dates, notes and an optional amount in the trip's currency. Within the app, only your signed-in account can retrieve these records. Other trip members, including the organiser, cannot view or edit them. They are stored on Pistio's server and in your account's local app database to provide the service; they are not end-to-end encrypted.

Journey legs are shared with the group: origin, destination, transport type, local departure and arrival times, operator, service number and notes. Only the traveller who added a leg can edit or remove it. Keep private booking references in the private booking section rather than shared journey notes. Recording a private booking amount does not create a shared expense or transfer money.

Removing a booking or journey clears its content and retains a small deletion marker so other devices can finish syncing safely. Account deletion removes your private booking and journey rows. Shared change notifications identify a trip that changed, without sending the booking contents.

Saving on your iPhone

The app keeps a private local database of your trips so you can read them and make supported changes without a connection. A change is saved on the device together with an outgoing record, then sent to Pistio's server when a connection is available. A change marked as saved on this device may not yet be visible to the group. The app's Sync status shows changes still waiting or needing review.

If two people change the same item, a conflicting draft is kept for review. Unsent changes and unresolved drafts must be shared or deliberately discarded before signing out, switching accounts or deleting your account. If your session expires, those drafts stay on the device so you can sign back into the same account.

Signing out clears that account's local trip cache after its pending changes have been resolved. If the server reports that access to a trip has ended, the app removes its cached shared details when it next connects; your own unsent drafts may remain for review until you discard them. Public resort catalogue data, photographs and weather reports may remain cached because they contain no account or private trip data. Your device's security and backup settings also apply to locally stored information.

Group polls

Polls store their question, answer options, optional price estimates, creator, closing time and each member’s current ballot. Votes are linked to your account on the server to allow one ballot per member, changes and withdrawal. The app shares aggregate totals and your own selections with you, not other members’ individual ballots. This is not an anonymous survey service.

Saved results and your personal unfinished poll draft are kept in the app’s account-scoped storage on your iPhone. Voting requires a connection and server confirmation. Drafts are cleared when that account’s local data is cleared; poll drafts for a trip are also removed when the app learns that access has ended. Removing a poll clears its question, answers and votes from active storage. Account deletion removes your ballots and direct creator link; the group’s remaining poll may stay with “Former traveller” as its author. Backups follow the server retention policy.

Poll notifications are separately opt-in. A new poll can generate a general notice. An optional closing reminder is sent at most once, during the final hour, to current members who have not voted and allow poll alerts. No alerts are sent for individual votes. Estimates are for comparison and do not create expenses or payments.

Trip chat

Each trip has a conversation for its joined members. We store messages, author and trip identifiers, timestamps, optional shared-item links, compressed photos, reactions, pins, your read position and mute/block preferences to provide chat. Shared-item previews contain titles and links; private bookings, booking references and access codes are not copied into those previews. Anything you type or photograph yourself is shared with your trip group.

Photos are resized on the iPhone and re-encoded on the server to remove embedded metadata. They are kept in the private database and require current trip access to download. Recently loaded photos may be cached in the app’s account/trip-specific iPhone cache, which iOS may clear. Recent messages and unsent messages are saved on the iPhone; earlier history may need a connection. A sent status confirms receipt by Pistio, not that every member has read it. This is not an end-to-end encrypted messaging service.

Chat alerts are separately opt-in and can be muted per trip. Their previews contain a general new-message notice and routing identifiers, not message text or photos. Blocking in a trip’s chat hides each person’s messages from the other and prevents alerts between them; shared bookings and balances are unaffected. Reporting hides the message for the reporter and records a reason for manual review by Pistio’s administrator. Contact hello@pistio.app for urgent support; this beta does not promise immediate moderation.

Removing a message clears its text, photo, link and reactions from active server storage and leaves a removed-message marker. Deleting an account also removes that person’s chat content from active storage. Other devices receive removals when they reconnect. We cannot recall screenshots, recipients’ saved copies or existing backups. Reports and limited moderation records may remain for handling abuse and security requests.

Keeping the group up to date

Data is shared with Pistio over HTTPS. While the app is open, an authenticated encrypted WebSocket connection can notify it that something changed. These notifications contain sync markers, rather than trip contents, and the app retrieves the latest permitted records through the API. The socket closes when the app goes into the background; reconnecting triggers another check.

The server records versions, change markers and operation receipts to prevent a retried change from creating duplicate entries and to detect conflicting edits. Those records are used to provide the service.

Shared expenses

Expense amounts, payers, each person's share, balances and recorded repayments are shared within your trip. Pistio records what the group enters. Shared expenses do not connect to a bank, pay other travellers or move the group’s money. Removing a mistaken financial entry preserves its history while excluding it from the balance.

Trip Pass purchases

A Trip Pass is a one-time App Store purchase for one trip's group. The app displays Apple's current price for your storefront before purchase. Apple handles payment; Pistio does not receive your payment-card details. A pass enables invitations for that trip. If a purchase is refunded, the trip becomes read-only for everyone. Existing members can still view its records, but changes and invitations pause until a valid pass is restored. Qualifying earlier beta trips may already have a pass.

To verify purchases and refunds, Pistio records Apple transaction and original transaction identifiers, product and environment, purchase and verification times, an opaque purchase-intent identifier, account/trip links and verification status. Signed purchase data is checked with Apple's server tools; the PHP service does not retain the full signed receipt. Apple also sends signed purchase-status notifications. We do not send consumption information to Apple without separate explicit consent.

Account deletion removes the direct user link from retained purchase/verification records. Those records and the trip's entitlement may remain to prevent repeated use of a purchase and to reconcile refunds. Deleting a Pistio account does not itself request an App Store refund. Contact hello@pistio.app for purchase-access questions.

Public resort catalogue

The searchable destination list is bundled with the app and cached separately from private trip information. Updates are downloaded from Pistio as versioned public files. Search happens on your iPhone; your searches, account, trip dates and device location are not sent to OpenSkiData. Choosing a destination stores its identifier in your private trip. Manually entered destinations stay private trip labels and are not added to the public catalogue.

The catalogue combines public sources and may contain missing, duplicate, outdated or incomplete information. A listed or “operating” ski area is not a live opening report. Area coordinates are reference points, not a promise of a specific village, lift, accommodation or safe route. Confirm travel and operating details with the resort.

Data from OpenSkiData / OpenSkiMap.org, © OpenStreetMap contributors (ODbL), Skimap.org, Who's On First, © Mapterhorn. The public catalogue's download, provenance and licence are available from the catalogue's credits. The public data licence does not provide access to private accounts, bookings, expenses or trip records. Resort photographs have their own separate licences and credits; a catalogue entry does not grant rights to trail-map photographs or other images.

Resort weather

Pistio's server retrieves forecasts for a supported resort's fixed location from MET Norway. It sends the resort coordinates and an application identifier. It does not send your account, device location, trip dates, notes or expenses to MET Norway. The app does not request GPS access.

Forecasts are cached on Pistio's server and may be stored on your iPhone for offline viewing. An update time and stale-data indication help distinguish a saved forecast from a freshly checked report. Weather source and licence details are available in Settings → Legal & privacy → Weather data. Photograph credits are in the separate Photo credits section.

Server storage and access

Account and shared trip records are kept in a private database outside the website's public folder. Access checks restrict trip data to its current members. The hosting provider may keep routine access and error logs. Pistio also keeps shared change history and limited security records to prevent repeated sign-in or invitation attempts.

This beta has no advertising, third-party analytics, precise-location tracking or address-book access. Photo-library access is used for the optional profile photo and chat photos you choose to share. Apple may collect TestFlight diagnostics and feedback under its own policies.

Deleting your account

Open Settings → Delete my account. You need your password, an internet connection and confirmation. Resolve or discard any outstanding local changes first. Deletion removes your sign-in credentials, separate names and sessions, removes your private bookings and journeys, removes your profile photo from active service, removes account email tokens/preferences and pending mail, and clears the account's local data on that device. Purchase records follow the retention described above.

Your retained membership is labelled “Deleted member”. Existing shared expenses and other shared trip history remain so the group can understand its plans and balances. Text you entered in shared plans may remain visible to the group. Task and plan assignments to your account are cleared.

If you organise a trip, ownership passes to the oldest remaining joined member. If no other joined member remains, the trip becomes inaccessible and unused invitations are revoked. Another device may retain a previously saved local copy until its local app data is removed. A revoked session cannot share further changes with the server.

Beta feedback

Use Send Beta Feedback in TestFlight to report a problem, or email hello@pistio.app for support, privacy questions or data requests. Avoid putting passport numbers, payment card details or other sensitive documents in trip notes.