Privacy

Every page, statistic and source on this site is public and works without an account. An account only remembers the resorts you mark.

• Your email address and name: what you type, or what Google shares if you sign in with Google (name, email and profile picture).
• The resorts you mark as skied, want to ski or favorite, and when you marked them.
• The views you save: the name you give each one and the page address it opens.
• The runs you tick on a resort’s run checklist, and the day you skied them when you give one.
• The days you log at a resort with Log a day: the resort, the date, and when you logged it. They are yours alone: friends and the community never see them, not even how many.
• Your username, your invite link, your choices about who can find you and the public leaderboards, your friends and the friend requests you send and receive, the people you block, and the reports you send.
• Whether you want an email when someone asks to be friends or uses your invite link (on unless you turn it off on your Friends tab), and when the last one went, so you get at most one every few hours.
• When you invite a friend by email: when you sent it. Their address is used to send that one email and never kept; only a scrambled fingerprint of it is, so one address gets at most one invite a month and none once it says no.
• Whether you asked to hear when the aurora.ski app is ready, and when you asked. We send one email when it is, and nothing else; leaving the waitlist removes it.
• When you were last on the site, and the last time before this visit (a new visit starts after six hours away), so the site can show what changed since you were last here. Only you see these times; friends never do.
• Your sign-in sessions: a random token, when it expires, and the browser it was created in, so you can stay signed in.

You, and the friends you agree to. A friend sees your name, username and picture, how many resorts you’ve skied, which ones (your sticker wall) and your share of each resort’s run checklist; never your email, the days you skied, which runs, your want-to-ski list, favorites or the mountains you follow. Friendship takes both of you: a request you accept, or your invite link opened by someone you sent it to. Remove a friend, or make a new invite link, at any time.

Unless you turn it off, people can find you by your name, username or email address (typed, or among the contacts they choose to compare): they see your name, username and picture, nothing else. Contacts compared that way are used once and never stored. Someone you block can’t find you, add you or use your invite link, and isn’t told. A report goes to the aurora.ski team, never to the person reported. Reports, and anything you share about a lost ski area, are first read by Claude, an AI model made by Anthropic, which reviews them on aurora.ski’s behalf; the team sees what it decided and can change it. The public leaderboards show only people who turn them on, by username, with their resort and run counts and checklist shares.

Some figures count everyone without naming anyone: how many aurora.ski skiers have skied a resort, its most-skied runs, and where your share of a run checklist stands among everyone’s. Each appears only once at least three people are in it (ten for where you stand). The aurora.ski team also sees, once a day, how many members were on the site in the last day, week and four weeks, and how many accounts there are: numbers only, never who. Your data is not sold, rented or used for advertising, and the site has no advertising trackers.

If you press Google contacts on your Friends tab (or while setting up your account), Google asks whether aurora.ski may see your contacts and your “Other contacts” (the people you’ve emailed), read-only. Each is its own permission: you can allow one, both or neither, and aurora.ski reads only what you allow. If you allow them:

• aurora.ski asks Google for your contacts’ email addresses and nothing else: no names, phone numbers, photos or notes.
• On its server, it compares those addresses with the addresses of members who let themselves be found, and shows you the members it found, so you can send them a friend request.
• Then the addresses are thrown away. Nothing from your contacts is stored or logged, and nothing is shared, sold, used for advertising or used to train AI models. No one in your contacts is emailed, invited or told that you looked.
• aurora.ski never asks Google for lasting (offline) access. The access Google gives ends within an hour; until then it is stored encrypted, and it is used only when you press Google contacts. Pressing it later takes you through Google again.

You can remove aurora.ski’s access at any time on your Google Account’s third-party connections page. aurora.ski’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

• Every page and request travels encrypted over HTTPS, and browsers are told never to connect any other way.
• Account data is kept in its own database, apart from the resort data, with Neon, which encrypts it on disk (AES-256) and accepts only encrypted connections. The site itself runs on Vercel.
• Passwords are never stored, only a salted one-way hash of each (scrypt).
• The access Google gives when you allow your contacts is encrypted before it’s stored, with a key kept outside the database.
• The sign-in cookie can’t be read by the page’s scripts and is sent only over HTTPS. A session you don’t use for 30 days ends, and no IP address is kept with it.
• The database keeps IP addresses in one place only: a count of requests to the sign-in service from each address and when the last one came, to slow down password guessing.
• Other websites can’t change anything in your account through your browser, and comparing contacts is limited to 25 times a day.
• Only the aurora.ski team can open the account database or the hosting, and the keys to them are kept in the host’s settings, never in the site’s code.
• If we learn that someone got into account data, we’ll email the people affected promptly and say what happened.

When you send feedback, your message is emailed with the page you sent it from and your browser (such as “Chrome on Mac”), and, if you’re signed in, your account’s name and email; signed out, the email you give, if any. It goes to the aurora.ski team’s inbox to be read and answered, and isn’t kept on the site. To stop floods, the site keeps only the time of each send and, if you’re signed in, which account sent it, for two days, then deletes it; never the message.

To learn what helps skiers, aurora.ski counts how the site is used with PostHog, an analytics service whose servers are in the United States: the pages opened, and a few actions such as following or marking a resort, ticking runs, logging a day, choosing a search result, opening a comparison, playing a webcam, sending feedback, or sharing a sticker or an invite link, and which filters people use in the resort explorer and how many resorts they leave. Each says which resort and where on the site it happened, never your name, your email, what you typed or the dates you skied. When something on a page breaks, the error, as your browser describes it, and the page it broke on are sent too, so it can be fixed.

If you’re signed in, these are linked to your account’s ID number (not your name or email), so we can see whether members come back. Without an account, each visit counts on its own. Nothing is stored in your browser for it: no cookie and no local storage. Page addresses lose any invite code, username or private link before they’re sent, PostHog is set to discard your IP address, and none of it is used for advertising.

Some visits are recorded as a replay of the page (what was on screen and where the pointer went) to find what’s confusing. Everything typed is hidden, every word on pages that show people is hidden, and some pages are never recorded.

If your browser sends Do Not Track or Global Privacy Control, none of this loads and nothing is counted.

Signing in sets one cookie that keeps you signed in; signing out removes it. Without an account the site sets no cookies, and its analytics stores nothing in your browser. Your choice of light or dark theme is kept in your own browser, and so is a note that you have an account, so the home page opens on your mountains, and when your browser last told the site you were here, so it says so at most every half hour; signing out clears both.

On your account page you can download everything your account holds as a JSON file, or delete your account. Deleting removes your account, your marks, ticks, logged days, friends, last-visit times and sessions at once.