Privacy policy

1. Information we collect

• Accounts and profiles: email address, authentication credentials or sign-in identifiers, public username and avatar, account settings, saved resorts and preferences. Sign in with Apple may provide a private relay email. Your account email and private profile name are not part of your public community profile.
• Location and activity: precise GPS coordinates, point timestamps, altitude, motion and device signals used when you record, calculate statistics or share a session. Recording history includes routes, activity times, resort information and statistics.
• Community and friends: posts, photos, comments, reviews, conditions reports, reactions, friend connections, session invitations, meeting pins, sharing preferences, blocks and reports.
• Technical information: IP addresses, device and app information, request and error logs, authentication events, push notification tokens and delivery information needed to operate and secure the service. Optional product analytics are described below; map services have separate SDK collection.
• Support: messages, request-verification information and information you provide when contacting us.

Some preferences and recording data are stored on your device; account-connected features also store data in the cloud. Guest use can still involve device storage and technical requests.

2. How and why we use information

We use information to provide accounts, resort discovery, forecasts, saved mountains, alerts, recording and statistics, community features, friend sessions and support; secure the service; prevent abuse; resolve failures; and improve Snowpack. We do not use or share rider information for unrelated business or research purposes.

Where data-protection law requires a legal basis, we rely on performance of our agreement for requested account and service features; consent for optional analytics and processing that legally requires it; legitimate interests in security, support and service improvement where permitted and balanced against your rights; and compliance with legal obligations. A device permission alone does not replace any consent required by law.

Snowpack is free, with no paid plans or advertisements. We do not sell personal information or share it for targeted or cross-context behavioral advertising.

3. Optional usage analytics

Usage analytics are off by default. If you enable the optional Share usage analytics setting, selected feature-use events and device/app metadata are sent to PostHog US Cloud. Events describe actions such as opening a screen, saving an alert or completing a recording. They use a coded account identifier or anonymous guest identifier; coded identifiers can still be personal information.

These events exclude names, email addresses, passwords, usernames, precise coordinates, route points, photos, post or comment text, search text and push tokens. Session replay and automatic screen, tap and crash capture are disabled. IP geolocation enrichment is disabled.

Declining analytics does not block features. Change the choice on each device in Settings → Privacy → Share usage analytics. Turning it off stops new capture; previously queued events may finish uploading. It does not automatically erase earlier cloud events. You can request deletion by email.

4. Precise location and shared sessions

Location permission is needed for recording and location-based features. A recording or sharing session you start can use location while the app is in the background. Device settings let you revoke access, which can interrupt recording or sharing.

An invitation alone does not record or share your position. Explicitly joining a session connects your own recording to that session and enables the applicable sharing flow. Joined riders can see shared positions and meeting pins; they can include friends invited by other participants. Friendship alone does not grant location access.

Stop sharing location stops publication while your personal recording can continue. Leaving a shared session also lets your recording continue. The live sharing service exchanges the latest position, rather than your complete recording history. Shared sessions last at most 24 hours and close when the last active rider leaves.

GPS, connectivity and battery can delay updates. If you stop or leave while offline, the app retains that intent and retries; remote removal may not be immediate. Session expiry and access controls limit availability, but are not a promise that every stored record is erased at that moment.

5. What other riders can see

Your public username, avatar, posts, photos, comments, reviews, conditions reports and eligible shared resort sessions can be visible to other users, including guests. Account email, private profile name and owner-only recording archives are not public profile fields.

Share resort sessions is on by default for new community profiles. Existing saved preferences are preserved. Enabling sharing can publish summaries of eligible past synced resort recordings as well as future recordings. Change it in Settings → Edit community profile → Share resort sessions. Turning it off removes those summaries from public feeds, public profiles and rankings.

A public session summary includes your public identity, resort, completion time, route-map coordinates and aggregate statistics. It does not expose raw GPS point timestamps. Off Piste recordings and manual ski-day logs are excluded from public resort-session feeds and rankings. This is separate from live sharing with joined session participants.

Uploaded community photos are re-encoded to remove embedded location metadata, but the image itself, captions and route maps may still reveal a location. Deleting content cannot recall screenshots or copies made by others.

6. Providers and disclosures

We use the following services for the features you choose. They receive information necessary for delivery, security and their respective functions:

• Supabase: authentication, databases, cloud recordings, community data and media storage.
• Apple: Sign in with Apple, WeatherKit forecasts, App Store distribution and push delivery. Weather requests include the requested forecast location; notification delivery uses a device token and notification payload.
• Mapbox: map content, requests and SDK telemetry, which may include device, network, usage and location information as described in its product privacy disclosures. Its map attribution dialog includes a telemetry opt-out. Snowpack’s optional analytics switch does not control Mapbox telemetry.
• PostHog US Cloud: optional usage events and coded identifiers described above.
• Resend: transactional account emails, including recipient addresses, message delivery and recovery messages.
• Google Gmail: messages you send to the support inbox.
• Sites hosting and Cloudflare: website delivery, network security and request information.

Some providers also process information under their own policies, such as for platform security or SDK services. Information can be processed in the United States and other countries where providers operate; PostHog analytics use its US Cloud service. We do not promise that all information remains in your country.

We may disclose necessary information to comply with law or valid legal process, investigate fraud or abuse, protect people and rights, or facilitate a business transfer subject to applicable notice and protections. Public and participant sharing follows the audiences described above.

7. Your choices and requests

Manage notification preferences in the app and permission settings on your device. You can edit your profile, change session-sharing preferences, remove your own posts or comments using available controls, and manage location and photo access. Uninstalling the app or signing out does not delete your cloud account.

For account deletion, access, correction, export or another privacy request, email patrick.dayton12@gmail.com, preferably from your account email. State your request and the account it concerns. Do not send your password. We may request proportionate information to verify identity or an authorized representative.

Patrick Dayton personally reviews these requests. We aim to send an initial response within 7 calendar days. This is an acknowledgement target, separate from completing your request. Applicable legal deadlines still apply.

8. Retention and deletion

• Account and activity history: we keep your profile and recordings while your account remains open, until you delete the relevant recording or request account deletion. Content you publish remains available until removed by you, an authorized content owner or moderation, or through account deletion.
• Account deletion: our target is to delete your profile, recordings, posts, comments, photos and other account-owned content from active systems within 14 calendar days after verifying your request. We do not retain your public content merely by anonymizing its author. We will explain a necessary delay or legal exception; applicable deadlines take priority.
• Live sessions: shared access ends under the session controls and expiry described above. Position, membership, invitation and delivery records are retained only as needed to operate the session, handle retries, investigate a specific security issue or meet a legal obligation. These records are separate from the recording history you save.
• Analytics: identifiable event data are retained only as needed to evaluate feature use and improvement, subject to provider retention settings and deletion requests. Turning the switch off does not itself delete historical events.
• Support, reports and logs: retention depends on resolving the request or incident, preventing repeated abuse, maintaining security and meeting applicable legal or dispute-related obligations. Any exception to deletion is limited to information needed for that purpose.
• Backups: active-system deletion does not necessarily erase an existing recovery copy immediately. Residual copies remain protected and are not used for ordinary service activity; they are removed when the applicable backup is replaced or expires. If a backup is restored, deletion requests must be reapplied. The 14-day active-system target is not a guaranteed backup-erasure deadline.

Deletion from our systems does not erase copies already made by other people or data independently held by a platform under its own legal obligations. Device-local copies may require deleting the relevant recording or app from that device. Contact us for information about retention relevant to a specific request.

9. Security and international processing

We use access controls, authenticated service operations and other technical and organizational measures to protect information. No device, network or service can be guaranteed completely secure. Protect your account and report suspected unauthorized access to support.

Snowpack is operated from Texas, United States. Cross-border processing can be subject to different privacy laws. Where transfer safeguards are legally required, international processing must be covered by an applicable lawful transfer mechanism, such as an adequacy decision or approved contractual safeguards. Contact patrick.dayton12@gmail.com for details relevant to your information or a request for a copy of applicable safeguards.

10. Age and regional privacy rights

Snowpack is intended for people aged 13 and older, and is not directed to children under 13. Snowpack does not impose an additional parental-permission rule solely because a rider is 13–17. Higher local age thresholds, legal capacity rules and legally required parental consent still apply. If we learn we hold information about a child collected contrary to applicable requirements, we will restrict the affected processing and delete information as required. A child or parent can contact support.

Depending on your location and applicable law, you may request access, correction, deletion, portability or a copy of your information; object to or restrict processing; and withdraw consent for consent-based processing without affecting prior lawful processing. We do not use solely automated decisions to make legal or similarly significant decisions about you.

Email your request to patrick.dayton12@gmail.com. We verify requests proportionately and respond within applicable deadlines. If we decline, we explain the reason and available appeal rights. Reply to the same address with “Privacy appeal” to request reconsideration by Patrick Dayton. You may also complain to your local data-protection authority or, where applicable, state attorney general. We do not penalize you for exercising privacy rights.

11. Website cookies and storage

The marketing website has no advertising trackers, product analytics scripts, website accounts or mailing-list form. Fonts and images are served with the website. The hosting and security services can process IP addresses, requested URLs, browser information, request times and security logs.

Cloudflare may set security cookies, including __cf_bm for bot protection, and use similar necessary technologies. These support delivery and abuse prevention, not advertising. Browser controls can block or clear cookies, which may affect access. Retention of infrastructure records follows the provider’s service configuration and security or legal needs.

12. Updates and contact

We update the effective date when this policy changes. For material changes, we will provide an in-app notice or another direct notice appropriate to the change, and obtain new consent where law requires it before applying the change. These notice commitments do not authorize a new use of information without any required consent.

Operator: Patrick Dayton, operating as Snowpack, based in Texas, United States.
Privacy and support: patrick.dayton12@gmail.com.