Privacy Policy

Last updated: April 30, 2026

Overview

Skater XP ("we," "our," or "us") is a community app for skateboarders. This policy explains what data we collect, how we use it, and your rights. We do not sell your personal information.

What We Collect

• Account info: Email address, username (handle), password (hashed), country, and skateboarding stance.
• Profile content: Profile photo you choose to upload.
• User content: Videos and photos you post, captions, trick names, and any other content you submit.
• Spot data: Skate spots you add, including name, type, location, and photos.
• Location: Approximate location when you use the Spot Map feature, to show nearby spots. We do not store your precise location.
• Trick logs: Tricks you land and post clips of, used to power skill-level matching features.
• Activity: Check-ins, posts, S.K.A.T.E. game history, and other in-app interactions.
• Contest scoring data: If you accept a judging invitation: the scores, trick names, and notes you submit for each skater. If you compete in a contest: your placement, every trick logged for you by judges, and the final score. This data is visible to other contest participants and the host.
• Microphone audio (when you opt in): When you tap and hold the mic button to log a trick name during contest judging, your speech is converted to text on-device using your browser/system speech recognition. The audio itself is not uploaded; only the transcribed text is stored alongside the score.
• Trophy records (when enabled): When the Trophy Case feature is on, contest-winning records are written to a public ledger that anyone can read. Each record includes the contest name, date, location, judges, scoreboard (skater handles + scores + tricks), and the recipient. Once written, this record is permanent and cannot be deleted, though deleting your Skater XP account will anonymize your handle within it.
• Device info: Basic device and OS data for debugging and crash reporting.
• Event waiver signatures: For ranked contests and any event you opt in to: typed legal name, signed PDF, IP address (last octet truncated for storage), user-agent, timestamp, and a hash of the agreement text. Stored on your account and made available to the event organizer.
• Guardian co-sign data (minors only): For participants under 18: parent/guardian email address (used to send a one-time signing link), guardian typed name, guardian IP, and guardian timestamp.
• Connected social accounts (optional): If you connect YouTube, Instagram, or TikTok: handle, display name, follower/subscriber count, avatar URL, and an internal ID. Read-only OAuth tokens are stored encrypted and never shared. We never post on your behalf.
• Cross-link metadata: When you cross-link a video to a Skater XP post: the external video ID, URL, title, thumbnail, and duration. Validated against your connected account before attaching.
• Subscription & purchase records: When you buy Pro or a Contest Credit on skaterxp.com, Stripe sends us a record of the transaction (Stripe customer ID, subscription ID, period start/end, status). We do not see your card number, billing address, or any other payment details — Stripe handles all of that.
• Promo code redemptions: When you redeem a promo code in the app, we record the code, the credit/entitlement granted, and the redemption timestamp.

How We Use It

• Operate the app — feed, spots, S.K.A.T.E. games, leaderboards
• Match you with skaters at a similar skill level for solo mode
• Show nearby skate spots on the map
• Send account-related notifications (e.g., game challenges, replies)
• Grant Pro entitlements and Contest Credits when you buy or redeem
• Verify ownership before attaching a cross-linked video to your post
• Improve the app based on how it is used
• Enforce our community guidelines

Sharing

We do not sell or rent your data. We share data only in these situations:

• Supabase: Our database and storage provider. Data is hosted on Supabase infrastructure.
• Resend: Transactional email provider. Used to send guardian co-sign magic links and other account emails.
• Stripe: Payment processor for Pro subscriptions and contest credits purchased through skaterxp.com. Stripe handles card data; we never see your card number.
• YouTube / Meta / TikTok: Only if you connect those accounts. Each platform sees the OAuth scopes we request (read-only profile + video list). We do not transmit any of your Skater XP activity back to them.
• Event organizers: When you sign a waiver for an event, the organizer receives your typed name, signed PDF, IP, and timestamp for their records. SkaterXP is not a party to that agreement.
• Apple: If you use Sign in with Apple, Apple processes your authentication.
• Google: If you use Sign in with Google, Google processes your authentication and shares your name + email with us.
• Public ledger (Trophy Case only, when enabled): Trophy records are written to a public blockchain ledger. Anyone can read the contest scoreboard, your handle, and your placement. We never write payment, identity, or location data to this ledger.
• Legal: If required by law or to protect the rights and safety of users.

Connected Accounts & Tokens

When you connect YouTube, Instagram, or TikTok, the platform issues OAuth tokens that allow Skater XP to read (but not modify) your account. Tokens are stored server-side under row-level security and accessed only by privileged Edge Functions.

You can disconnect any platform at any time from Settings → Connected Accounts. On disconnect, we mark the connection inactive and stop using the tokens. Tokens automatically refresh once per day via a scheduled job; if a refresh fails (you revoked us in the platform's settings), the connection is marked expired and you'll need to reconnect.

Event Waivers

Skater XP provides registration and electronic-signature tools to event organizers. When you sign a waiver, your agreement is with the event organizer, not Skater XP. Skater XP is not a party to that agreement.

Your typed name + IP address (last octet truncated for privacy in storage) + user-agent + timestamp + a SHA-256 hash of the exact waiver text are stored on your Skater XP account and made available to the event organizer for their records. For participants under the configured guardian-required age, a parent/legal guardian must co-sign via a magic link emailed at signup.

Your Rights

You can, at any time:

• Update or delete your profile information in app settings
• Delete posts, clips, and spots you have created
• Request deletion of your entire account and data by contacting us

Children

Skater XP is not directed at children under 13. We do not knowingly collect data from anyone under 13. If you believe a child has created an account, contact us and we will delete it.

For users between 13 and 17 who participate in events that require a waiver, a parent or legal guardian must co-sign electronically via a one-time magic link sent to the guardian's email address. We collect only what's needed to verify the guardian signed (their email, typed name, IP address, and timestamp) — nothing more.

Data Retention

We retain your data as long as your account is active. When you delete your account, your personal data is deleted within 30 days. Some anonymized usage data may be retained for analytics.

Signed event waivers are an exception: the participant's typed name, signature audit trail (IP address, user-agent, timestamp), and waiver text hash are retained for up to seven (7) years after the event date as a legal record of the agreement, even if you delete your account. This retention period reflects the typical statute-of-limitations window for personal-injury claims relating to recreational events. Event organizers receive a copy of the signed waiver at signature time and may retain their copy independently.

Changes

We may update this policy. Significant changes will be communicated in-app. Continued use after changes means you accept the updated policy.