Privacy

Your account

Your email address. If you sign up with a password, it goes straight to our sign-in provider and is stored only as a one-way hash. We never see it. If you sign in with Google, Google tells us your name, email address and profile picture, and nothing else. We don’t get access to your Gmail, contacts or anything else in your Google account.

What you set up

The mountains you save, the conditions you prefer, and your alert and weekly-email settings. We also keep a record of which alerts we’ve sent you, so you don’t get the same one twice.

Season pass purchases

The amount, the date, how long the pass lasts, and Stripe’s reference numbers for the payment. Your card details go directly to Stripe and never reach our servers.

Referrals

If you arrive through an affiliate’s link, we remember which affiliate sent you and connect it to your account when you sign in, so they can be paid if you buy a pass. Clicks on referral links are counted without recording who clicked.

Affiliate applications

If you apply to be an affiliate: your display name, legal name, postal address, PayPal email address and a description of your audience. These are used to review your application and pay you. US affiliates paid $600 or more in a year will also be asked for a W-9, which is required for tax reporting.

Page visits

We count which pages are viewed so we know which mountains people look at. No cookie is set and no IP address is stored: each visit is recorded as the page and a scrambled code made from your IP address and browser, mixed with a value that changes every day and is then deleted. That code can only tell us that two page views on the same day came from the same visitor. It can’t be traced back to you or linked across days.

Server logs

Like every website, our host briefly records the IP address, browser type and page requested for each visit. This is used to keep the site running and to stop abuse.

We don’t ask for or use your device’s location. Forecasts are fetched for the mountain’s coordinates, not yours.

A few companies run parts of the site for us. Each one sees only what it needs to do its job, and none is allowed to use it for anything else.

Supabase

Stores your account and everything listed above, and handles sign-in.

Stripe

Processes season pass payments. Stripe’s own privacy policy covers your payment details.

Google

Only if you choose “Continue with Google”, to confirm who you are.

Resend

Delivers the alert and weekly emails you turn on. It sees your email address and the email itself.

Vercel

Hosts the website, and keeps the server logs described above.

PayPal

Receives affiliate payouts, so it sees the affiliate’s PayPal address and the amount.

Weather comes from Open-Meteo, which is only sent mountain coordinates and never anything about you. We may also share information if the law requires it, or to protect the site or its users from fraud or abuse.

We email you to confirm your address and to reset your password, and Stripe emails a receipt when you buy a pass. Condition alerts and the weekly digest are off until you turn them on, and you can turn them off again from your profile at any time.

Your account and settings are kept until you ask us to delete them. Purchase records are kept for as long as tax and accounting rules require, even after an account is deleted, but they are no longer connected to you. Server logs are deleted automatically within a few weeks.

You can ask us for a copy of the information we hold about you, ask us to correct it, or ask us to delete your account and everything attached to it. Email slopestate@gmail.com from the address on your account and we will do it within 30 days. You won’t be treated any differently for asking.

Depending on where you live, laws such as the GDPR or California’s CCPA may give you further rights, and you can use them the same way. We don’t sell personal information or share it for targeted advertising.

We use a few cookies to keep you signed in and to credit referrals, and nothing for advertising or tracking. The cookie page lists every one.

Everything is sent over HTTPS, passwords are hashed by our sign-in provider, and only the people who run SlopeGauge can see account data. No system is perfectly secure, though. If we ever learn that your information has been exposed, we will tell you.

SlopeGauge is not meant for children under 13, and we don’t knowingly collect information from them. If you think a child has made an account, email us and we will delete it.

Our services are run from the United States. If you use SlopeGauge from somewhere else, your information is transferred to and stored in the US.

If we change this policy, we will update the date at the top. If the change is significant, for example a new kind of data or a new company handling it, we will also email account holders before it takes effect.