Privacy policy

Effective from 1 November 2026

Controller

The controller of personal data is NMS Europe s.r.o., U Nikolajky 1070/13, 150 00 Praha 5, Czech Republic, Company ID (IČO) 07723156 (“we”). Data protection contact: hello@snoday.app.

Without an account

You can use the snoday.app website without an account. Your choices (where you are travelling from, the day, the preset) are only stored in the page address; we do not save them anywhere. With every request, the server (Cloudflare) processes your IP address and technical browser data in order to deliver the page and protect it against attacks.

Anonymous visitor statistics (PostHog, servers in the EU) run without cookies and without browser storage: each page load gets a new random identifier, and we do not create profiles of individuals. We only send the page address without parameters and fixed values (day, preset, opened resort), never your location.

Some content is loaded by your browser directly from third parties, which can therefore see your IP address: map tiles (OpenFreeMap) and webcam previews (foto-webcam.eu) on resort pages.

With an account: what data we process

account: email address and account identifier (if you sign in with Google or Apple, we only receive your email address and ID from them),
preferences: language, where you travel from, travel time, skiing style and level, score weights, quiet mode, custom places (coordinates you enter), my resorts and ski passes,
alerts: alert rules, chosen channels (email, push, Telegram), push notification tokens, the Telegram connection and a log of sent alerts (subject, channel, time, whether you opened the message),
diary: resort, day, rating 1–10, note, equipment, trips and photo (before uploading, we remove location and camera data from it),
Strava (only if you connect it): athlete ID, encrypted access tokens and ski activities (type, start, distance, elevation gain, moving time) – visible only to you.

A diary rating entered on the same or the following day is counted anonymously in the public community rating. We only publish the average and the count per resort and day, and only once there are at least 5 ratings.

Purpose and legal basis

account, personal overview, ranking based on your profile, alerts, diary and connections – performance of a contract (Art. 6(1)(b) GDPR),
server security and operation, anonymous visitor statistics and the aggregated community rating – legitimate interest in a working and improving service (Art. 6(1)(f) GDPR).

We do not sell your data or use it for advertising or for profiling on behalf of third parties. We do not carry out automated decision-making with legal effects – the personal ranking of resorts only sorts the forecast according to your weights.

Processors and recipients

Supabase – database, sign-in and photo storage; data in the EU (Ireland),
Cloudflare – website hosting, content delivery, protection against attacks and storage of forecast data,
Migadu – the hello@snoday.app mailbox and sending of sign-in emails,
Resend – sending email alerts (only if you turn on email alerts),
PostHog (EU) – anonymous visitor statistics, without cookies,
Expo, Apple and Google – delivery of push notifications to the app; in the browser, push notifications are delivered by the browser vendor’s service (Google, Mozilla, Apple),
Telegram – messages, only if you turn on the connection; Strava – activity import, only if you turn on the connection; Google and Apple – sign-in, if you choose it (their own policies also apply),
Stay22 – only after you click an affiliate link to accommodation: we pass on the selected property, dates, number of guests, language and a campaign label (resort and place of the click), no data about you. Stay22’s and the accommodation providers’ own policies apply on their websites.

Where a processor processes data outside the EEA, this only happens with safeguards under the GDPR (an adequacy decision, such as the EU–US Data Privacy Framework, or standard contractual clauses).

Retention period

account data, preferences, alerts and diary: as long as you use your account; deleted immediately after account deletion, and from database backups within 30 days at the latest,
log of sent alerts: 180 days,
Strava data: no more than 7 days; immediately after you disconnect or revoke access on Strava,
technical server logs: only for as long as necessary for operation and security.

Deleting your account

You can delete your account yourself: my.snoday.app → Account → “Delete account” (with confirmation). We delete your diary photos and the account with all its data (preferences, alerts, trips, diary, equipment, connections). We will also delete it for you on request by email.

Your rights

You have the right to access your data, to rectification, erasure, restriction of processing and data portability, and the right to object to processing based on legitimate interest. You can export all your data (JSON) in my.snoday.app → Account. You can lodge a complaint with the Czech Office for Personal Data Protection (ÚOOÚ, uoou.gov.cz) or with the supervisory authority in your country of residence.

Cookies

We only use strictly necessary cookies. Details: Cookies.

Changes and contact

We may update this policy; we will inform users with an account about material changes by email. Questions: hello@snoday.app.