Terms of Service

Last updated: May 12, 2026

1. Description of the Service

AlpinToilet is a free application that allows users to express their appreciation of restroom (bathroom) quality in ski refuges and ski resort facilities. The Application operates exclusively as a technological platform aimed at collecting and statistically aggregating subjective expressions of appreciation from Users regarding specific parameters of refuges and ski facilities in general (hereinafter "Refuges"). The identifying data of the Refuges is sourced from publicly available lists, third-party cartographic databases, or entered by Users. The app allows you to add new refuges and facilities, submit ratings, and browse community ratings.

2. Age Requirements

Use of the app is restricted to individuals aged 14 years or older. By using the app, the user confirms meeting this requirement. We do not knowingly collect data from anyone under 14.

3. Nature of Ratings and Anonymity

Ratings expressed by Users are made in a completely anonymous form. By methodological choice and to protect privacy, individual ratings are neither publicly accessible nor viewable in analytical form by third parties or by the Refuge operators themselves. The Application processes data exclusively in aggregate form, displaying only the average score derived from the mathematical calculation of the collected data.

AlpinToilet does not publish individual reviews, free-text content, nicknames, photos, or narrative content from Users. It exclusively publishes statistical aggregates of numerical ratings on predefined criteria, subject to a minimum threshold of 5 votes per criterion. There is no identification of the rater and no certainty of proof of the actual experience. Each individual rating, which cannot be consulted by anyone, constitutes solely an anonymous statistical input contributing to an editorial aggregation. For methodological transparency and provenance verification, a GPS weighting system is in place as described in art. 4 and the moderation system described in art. 4.1.

4. Statistical Reliability Threshold and GPS Validation

In order to increase the objectivity of the data and protect the image of the Refuges, the Application adopts a "Minimum Quorum" criterion for displaying scores:

Up to 4 ratings: The data is considered "partial" or of "low statistical relevance" and will be accompanied by an appropriate visual or informational indicator in the user interface.

From 5 ratings onward: The data is considered consolidated and displayed as a standard satisfaction index.

In addition, when a rating is submitted, the Application — if the User has granted location permission — compares the device's GPS position with the coordinates of the rated Refuge. Ratings submitted from a distance of 2 km or less from the Refuge are marked as "GPS-validated" and contribute to the average with full weight (100%). Ratings submitted from a greater distance, or without an available GPS position, are considered "unvalidated" and contribute to the average with reduced weight (50%). This purely statistical mechanism aims to improve the overall reliability of the averages without excluding any rating. The breakdown of validated and unvalidated ratings can be consulted by the User via the dedicated info icon on the Refuge detail screen.

Time-decay of weight. To ensure that the published score reflects the current state of the Refuge without penalising the historical record, ratings are never deleted based on their age; instead, their weight in the average calculation decays over time as follows:

From 0 to 48 months from the submission date: full weight per the GPS rule (100% if validated, 50% if not);
From 48 to 72 months: reduced weight of 0.1 for both validated and unvalidated ratings;
Beyond 72 months: weight of 0 (the rating remains archived and visible in historical counts but no longer contributes to the published average).

This mechanism is purely statistical, applied automatically, uniformly and without discrimination to all ratings and all Refuges.

4.1 Anti-Fraud Moderation System

To protect the statistical integrity of the averages and prevent coordinated, automated or manipulative voting (so-called *bot bombing*, *review bombing*, *vote stuffing*), the Application implements a multi-layer technical and automated moderation system:

Per-device technical limit: the same device (identified via anonymous DeviceID) cannot submit more than one rating per gender per Refuge (database-level uniqueness constraint) nor more than 2 ratings per minute across distinct Refuges. Exceeding the threshold results in temporary rejection of the next rating.
Per-Refuge state machine: each Refuge is monitored in real time by an automatic state machine with four phases (*normal → buffer1 → buffer2 → blocked*). When a single Refuge receives more than 10 ratings per minute, ratings are temporarily set aside (*buffer1*, 60 minutes). If the abnormal volume persists, non-GPS-validated ratings are discarded and a second window opens (*buffer2*, additional 60 minutes) reserved for validated ratings only. If the volume remains abnormal at the end of that window, submission of new ratings for that Refuge is temporarily suspended (*blocked*) until the volume returns within the threshold.
GPS-based anti-fraud weighting: ratings submitted within ≤ 2 km of the Refuge (GPS-validated) contribute with full weight (100%); those submitted without GPS or from greater distance contribute with reduced weight (50%). This mechanism structurally reduces the impact of remotely coordinated ratings.
Incident logging: every anomaly producing more than 60 minutes of buffer or a block longer than 120 minutes is recorded in an internal log (`moderation_incidents`) with date, affected Refuge identifier, incident type, narrative summary and detail of DeviceIDs, timestamps and IP addresses of the suspicious ratings neutralized. This log is not public and is retained under a two-phase retention policy: for the first 24 months in full form (including IP addresses and country code); thereafter, up to a total of 120 months (10 years), in anonymized form (IPs irreversibly removed; date, type, country code and technical device identifier are kept). After 10 years the log is deleted in full. This retention serves exclusively as evidence of professional diligence to protect the Refuge's reputation and for any motivated requests by competent Authorities. For details see section 5 of the Privacy Policy.
Sanctions on the device: in case of manifestly abusive behavior, the AlpinToilet team reserves the right to add the DeviceID to a ban list (*banned_devices*), with consequent removal of all previously generated ratings and technical events and blocking of any subsequent submission.
Transparency to the User: during any suspension of ratings for a given Refuge, the Application shows a notice to the User consulting the Refuge page. Ratings in buffered or discarded state never contribute to the published average.

These measures are entirely automated, non-discriminatory and proportionate; they pursue the legitimate interest of AlpinToilet, its Owner and the Refuges in reliable statistical data.

4.2 How We Verify Ratings

The AlpinToilet team expressly discloses the methodology adopted to value the genuineness and representativeness of the published ratings to the extent possible, without having, guaranteeing or otherwise declaring certainty:

1. Proximity validation via GPS. When a rating is submitted, the Application automatically compares — server-side and immediately — the GPS location reported by the User's device (subject to operating system authorization) with the coordinates of the Refuge being rated. Ratings submitted from a distance equal to or less than 2 km from the Refuge are flagged as "GPS-validated" and contribute to the average with full weight (100%). The 2 km threshold has been chosen as a reasonable technical compromise between GPS accuracy (which in alpine environments may fluctuate due to the environment itself, cloud cover or vegetation) and the need not to require the User to be physically inside the structure for the rating to be acknowledged.

2. Reduced weighting in the absence of GPS validation. Ratings submitted from greater distance, or with no GPS location available (because the User has not granted access, is in an area with no satellite coverage, or is consulting the app after returning to the valley), are not excluded but contribute to the average with a reduced weight of 50%. This weighted average mechanism allows the User to leave their opinion even outside the physical proximity window, while structurally reducing the statistical impact of ratings that are potentially less reliable or more exposed to remotely coordinated voting.

3. Adequacy of the system relative to the service model adopted. The Application does not publish free-form text reviews, nicknames, photographs, pseudonyms or any other individual narrative content (cf. art. 3): it publishes only statistical aggregates of numerical ratings on predefined criteria, subject to a minimum threshold of 5 ratings per criterion. Within this editorial architecture, where the single numerical vote constitutes only an anonymous statistical input, the Owner considers that the combination of (a) GPS proximity validation, (b) reduced weighting in case of non-validation, (c) the multi-layer anti-fraud system described in art. 4.1, (d) the temporal weight decay described in art. 4 and (e) the notice-and-action mechanism, constitutes an appropriate and proportionate verification mechanism for the aggregated and numerical nature of the published data, suitable to satisfy a diligent control of the provenance of the ratings. This approach has further been preferred to more invasive mechanisms (such as User registration, identity verification, documentary proof of experience, collection of biometric or personal data) in order to safeguard the highest level of anonymity and data minimization for the User, consistently with the privacy-by-design principle.

4. Transparency to the User and the Refuge operator. The number of GPS-validated ratings and of non-validated ratings contributing to the average of a Refuge is at all times accessible to the User and the Refuge operator through the dedicated information icon on the Refuge detail screen. Any significant change to the calculation methodology or to the thresholds indicated above will be communicated through an update of these Terms.

5. User-Generated Content and Disclaimer

Ratings and refuges added by users constitute user-generated content. Users agree to:

Post only truthful, relevant, and non-offensive content.
Not include personal data of third parties (names, phone numbers, etc.).
Not publish discriminatory, defamatory, obscene, or illegal content.
Not use the app for spam or unauthorized commercial purposes.

We reserve the right to remove content that violates these terms without prior notice.

The Owner of the Application does not verify the physical presence of the User at the Refuge, nor the truthfulness of any individual expression of appreciation. The User and the Refuge Operator acknowledge that:

The average scores displayed do not constitute quality certifications, objective opinions, or professional assessments.

The app is provided "as is" without warranties of any kind. We do not guarantee the accuracy, completeness, or reliability of user-published ratings. Ratings express subjective opinions and do not represent our views.

The Owner declines all responsibility regarding the accuracy, completeness, or reliability of statistical data, which remain expressions of the free opinion of individual Users.

The Owner is not responsible for the accuracy of the identifying data (name, location, category) of Refuges manually entered by Users, reserving the right to correct or remove entries reported as incorrect.

The Owner is not liable for any direct or indirect damages, reputational or commercial, arising from the display of statistical averages.

The Owner implements appropriate technological measures to ensure database integrity, including the technical limitation of a single rating per unique device identifier (DeviceID) per Refuge. These measures are intended to proactively prevent multiple, mass, or artificial manipulation of average scores.

6. Intellectual Property

The design, code, and AlpinToilet brand are the exclusive property of the app's Owners. User-generated content remains the property of its authors, who grant a non-exclusive, free license for display and use within the app.

The User may remove their ratings at any time using the appropriate function provided by the Application.

The User acknowledges that changing devices, performing a factory reset, or any other invasive operation that compromises the associated DeviceID, without generating the appropriate recovery code, will result in the loss of the ability to delete their ratings.

7. Device Identification

The app uses an anonymous device identifier (DeviceID) generated locally to associate ratings with the device that created them. This ID:

Is not linked to your personal identity.
Is randomly generated on first use.
Is used exclusively to allow you to manage (view and delete) your ratings and to ensure the integrity of the statistical system by preventing multiple ratings from the same device.

8. Geolocation

The app may request access to the device's GPS location to center the map, show nearby refuges and validate the User's proximity to the Refuge when submitting a rating (see Section 4). The GPS position is never stored: it is used transiently and immediately discarded.

9. Service Availability

We reserve the right to modify, suspend, or discontinue the service at any time without prior notice. We are not responsible for any interruptions or malfunctions.

10. Changes to Terms

These terms may be updated periodically. Continued use of the app after changes are published implies acceptance of the new terms.

11. Notice & Action Procedure and Refuge Removal

Anyone (User, Operator, third party) may report content or Refuge listings they consider unlawful, incorrect or harmful by sending a written communication to support@alpintoilet.it containing:

Identification of the contested Refuge or content (name, location, link or screenshot);
A sufficiently detailed reason for the complaint (illegality, error, harm);
Email address for the response;
A good-faith declaration as to the truthfulness of the information provided.

The Owner undertakes to:

1. Acknowledge receipt of the report within 10 business days;

2. Carry out the assessment and adopt a reasoned decision within 20 business days of receipt of a complete report, save for cases of particular complexity for which a reasonable extension will be communicated;

3. Notify the reporter and, where relevant, the affected party of the outcome of the assessment and any action taken (Refuge removal, listing correction, deletion of related ratings, retention with reasons);

4. Where a Refuge is removed, simultaneously delete all ratings and technical events associated with it;

The Refuge Operator may at any time request — using the procedure described above — the full removal of their Refuge from the Application. The AlpinToilet Owner reserves the right to retain the Refuge listing in cases where its presence serves a legitimate informational interest of the public (e.g. a publicly known accommodation already indexed in third-party cartographic databases), providing written reasons to the requester for not proceeding with removal.

12. Contacts

The email address support@alpintoilet.it constitutes the point of contact. Communications may be sent in Italian or English and are handled with the utmost promptness compatible with the nature of the request.

For any communication, please contact the administration at the email address:

support@alpintoilet.it