Privacy Policy

1. Who is responsible (controller)

Snow Trace is published and operated by an individual based in France. For data-protection questions or to exercise your rights, contact hello@snow-trace.com. See also our legal notice.

2. What data we process

Depending on how you use Snow Trace, we process:

• Account & identity — your Strava athlete ID, username/name, profile picture, and email address if you choose to share it via Strava.
• Activities & location — your ski-touring activities imported from Strava: GPS routes (map polylines and detailed latitude/longitude, time and altitude points), bounding areas, distance, elevation, dates, names/descriptions, snow-condition notes you add, and photos.
• Interactions — comments, private messages, notifications, referral links you use, and badges/points you earn.
• Mountain-guide profile (optional) — if you create one: display name, bio, certifications, contact email/phone, links, and operating zones.
• Technical data — a truncated IP address and browser user-agent kept as proof of consent and for security, and your login dates. We do not use analytics or advertising trackers.

3. Where the data comes from

Most data is imported from Strava when you connect your account — your public profile and the activities you choose to sync. You provide the rest directly (comments, messages, conditions notes, a guide profile). We only sync private Strava activities if you give explicit, separate consent.

4. Why we process it, and on what legal basis

• Run your account and show your tours — performance of our agreement with you (GDPR Art. 6(1)(b)).
• The public conditions map, leaderboards and community features — our legitimate interest in providing a shared, useful conditions resource (Art. 6(1)(f)). You can limit this at any time (see section 5).
• Security, abuse prevention and demonstrating consent — our legitimate interest, and our legal obligation to be able to demonstrate consent (Art. 7).
• Importing your private Strava activities — your explicit consent, requested separately and withdrawable.
• Promotional emails — your consent (Art. 6(1)(a)), withdrawable at any time.

5. Public visibility and your controls

Snow Trace is a community conditions map, so activities are shown publicly by default. You are in control:

• Make an activity private — hidden from the map and everyone but you.
• GPS privacy zones — define areas (e.g. your home or trailhead) and the part of your tracks inside them is removed from how others see your activities, even on public activities.
• Disconnect Strava — stops all syncing; a disconnection also triggers deletion of your data (see section 8).

These controls are in the settings menu. They are how you exercise your right to object to the public display described above.

6. Who we share it with

We never sell your data. We rely on a small number of service providers (processors) to run the service:

• Strava (United States) — source of your activity and profile data.
• Amazon Web Services — hosting and database in the EU (Ireland); some map/terrain tiles are served from AWS in the United States.
• CARTO (United States) — base-map tiles.
• Sentry — error monitoring, with personal data redacted.
• Resend (United States) — transactional email.
• Buy Me a Coffee (United States) — if you choose to make a donation.

When you view the map, your browser fetches tiles directly from CARTO and AWS, which therefore receive your IP address — this is a technical necessity of displaying a map. See our Cookies & Storage page.

7. International transfers

Hosting and your stored data are in the European Union (Ireland). Some recipients above are in the United States (Strava, CARTO, AWS tiles, Resend, Buy Me a Coffee). Where data is transferred outside the EU, we rely on appropriate safeguards under Chapter V of the GDPR — the EU-US Data Privacy Framework where the recipient is certified, and/or Standard Contractual Clauses.

8. How long we keep it

• Account and activity data — for as long as your account is active.
• When you delete your account, or disconnect Strava, your personal data is deleted (and your comments on others’ content anonymised) promptly.
• Consent records — the decision, version, date, a truncated IP and user-agent, kept as proof for a limited period.
• Technical/security logs — kept for a short period and with IP addresses redacted.

9. Security

We encrypt your Strava access and refresh tokens at rest (AES-256-GCM), serve the site over HTTPS, use HttpOnly/Secure session cookies, redact IP addresses and secrets from logs, and request only the minimum Strava permissions needed (read access — never write access to your Strava activities).

10. Your rights

You have the right to:

• Access and portability — “Download my data” in the settings menu gives you a machine-readable copy of your data.
• Erasure — “Delete my account” in settings permanently deletes your account and data.
• Rectification — profile data comes from Strava; update it there, or contact us.
• Restriction and objection — including objecting to the public display of your activities (use private mode / privacy zones, or contact us).
• Withdraw consent — for promotional emails and private-activity syncing, at any time.

To exercise any right, use the in-app tools or email hello@snow-trace.com. You also have the right to lodge a complaint with the French data-protection authority, the CNIL (cnil.fr).

11. Cookies and storage

We use only strictly-necessary first-party cookies and functional local storage — no tracking or advertising. Everything stored on your device is listed on our Cookies & Storage page.

12. Automated decisions and minors

We do not carry out automated decision-making or profiling that produces legal effects. Snow Trace is not intended for children under 15; if you believe a minor’s data is present, contact us and we will remove it.

13. Changes and contact

We may update this policy and will revise the date above. For any question, contact hello@snow-trace.com.