Privacy policy

PistePilot is run by Berkay Koralturk, a private person in the Netherlands, who is the controller of your personal data under the General Data Protection Regulation (GDPR). Contact: info@pistepilot.app.

Without an account we keep nothing about you. Your choices (country, Overview resorts) stay in your browser, see section 6.

With an account we keep:

• Your email address and how you sign in (an emailed code or Google). With Google we receive your name, email and profile photo from Google.
• Your profile: name, photo, home country and Instagram handle, as far as you fill them in.
• What you save: trips (resort, dates, group, level, packing list), ski days (date, runs, vertical, distance, speed and an elevation profile; a GPX import keeps only this summary, never your GPS positions), favourite resorts and your Overview choices.
• On the resort feeds: your posts, replies, likes, saved posts and reports. Reports are only seen by us.
• If you connect Strava: the access tokens Strava gives us and the summaries of your ski activities.

We use this to run your account and the features you use (the agreement between us, GDPR article 6(1)(b)), and to keep PistePilot safe: posting limits, reports and preventing abuse (our legitimate interest, article 6(1)(f)). We don't sell your data, show ads or build advertising profiles.

The resort feeds and member profiles are for signed-in members. Other members can see your name, photo, home country, Instagram handle (if you add it), when you joined, and your posts and replies, and can find you by name in the search. Your email address, trips, ski days, favourites, likes and saved posts are never shown to others; likes only count towards a total.

Think before you post: don't share your address, phone number or anything you want to keep private.

These companies process data for us, each only for its part:

• Supabase: database, sign-in and photo storage (your account and everything listed in section 2).
• Cloudflare: hosting and delivery of the site, and Cloudflare Web Analytics, which counts visits without cookies and without identifying you.
• Google: sign-in with Google, if you choose it. Place listings and photos come from Google Maps, requested by our servers, not linked to you.
• Strava, only if you connect it.
• Sentry: reports of errors in the app (what broke, on which page, browser and device type), so we can fix them. We switched off sending cookies, request details and anything that identifies you.
• Forecasts (Open-Meteo), satellite snow (NASA), maps (OpenStreetMap) and resort photos (Wikimedia Commons) are fetched by our servers; no personal data is sent to them.

Some of these companies are based in, or use servers in, the United States. Transfers outside the EU rely on the EU–US Data Privacy Framework or the European Commission's Standard Contractual Clauses.

Live cams are played by their owners and providers (for example Roundshot, feratel, Windy or YouTube). They only load after you choose “Allow external content”; those providers then receive your IP address and may set their own cookies under their own policies.

As long as you have an account. When you delete it (Settings → Delete account), your account, profile, photo, trips, ski days, favourites, Strava connection, posts, replies, likes, saves and reports are deleted straight away. Backups held by our providers are overwritten within their normal cycle. Cloudflare keeps short-lived technical logs (such as IP addresses) for security.

We only store what the site needs to work, so we don't ask for cookie consent. Nothing is used for advertising or tracking:

• Two cookies remember the Overview's country and the resorts you chose on it.
• Local storage keeps your sign-in session, and on this device your trips, ski days and favourites (copied to your account when you sign in), and whether you allowed external content.

You can clear them in your browser at any time; you'll be signed out and the site resets.

Under the GDPR you can ask us to:

• show you the data we keep about you, or give it to you in a common format;
• correct it (most of it you can change yourself in Settings);
• delete it (Settings → Delete account does this at once);
• restrict or object to how we use it.

Write to info@pistepilot.app; we answer within a month. If you think we handle your data wrongly, you can complain to the Dutch data protection authority, Autoriteit Persoonsgegevens, or the authority where you live.

You need to be 16 or older to create an account.

When this policy changes, the date at the top changes too. If a change matters for how we use your data, we'll tell signed-in members in the app first. See also our terms of use.