Privacy Policy
Last updated: October 8, 2026
The Terms of Service are a separate document.
Who we are
SnowSure (snowsure.ai, the SnowSure apps for iPhone and Apple Watch, and the SnowSure app inside ChatGPT) is operated by 43 Nord LLC, a Maine limited liability company, doing business as Afore Travel, of 310 Market Street, Basalt, Colorado 81621, United States. Snowdata and SnowSure are its brands. 43 Nord LLC is the data controller for the personal data described in this policy: it decides what is collected and why.
Write to us at privacy@snowsure.ai, or by post to 43 Nord LLC, 310 Market Street, Basalt, Colorado 81621, United States. We have not appointed a data protection officer; we are not required to, and privacy questions reach the people who run the service directly.
This policy covers the website, the mobile apps and the ChatGPT app. For a detailed breakdown of the data flowing through the ChatGPT app specifically, see the "SnowSure ChatGPT App (MCP Connector)" section below.
Information We Collect
Information you give us
When you register, add resorts to My Mountains, submit snow reports or photos, sign up for powder alerts or newsletters, ask Surely (our AI concierge) a question, request a mountain, book a hotel, or contact us, we collect what you enter:
- Your name, email address and, if you add them, phone number, country, city, postal code, currency and a profile photo
- Your skiing preferences: the resorts in My Mountains, ski pass, ski level, units, home mountain, alert thresholds
- Family members you list for trip planning: a name, a relationship and a ski level, nothing else
- The snow reports, photos and feedback you submit, and the resort you submit them about
- The questions you ask Surely
- Guest details for a hotel booking, entered on our booking partner's checkout
Information collected automatically
- IP address, browser or app version, operating system, device type and screen size
- Pages and screens viewed and the time spent on them
- Approximate location from your IP address, used only to decide which region's consent rules apply and which resorts are near you
- Precise location, only while you allow it in the app. For "near me" and road conditions it is used on the device and in the request that answers it, and not stored. On a snow report, the form's location switch is off until you turn it on; when it is on, the coordinates are stored with the report, rounded to about 100 m, and shown only to you. Photos are re-encoded when you upload them, so they carry no location or camera metadata
- A push notification token, if you turn alerts on
- Purchase status from the App Store or Google Play, through RevenueCat; never your card number
Why we process it, and on what legal basis
Where the GDPR, the UK GDPR or the Swiss FADP applies, every use below rests on one of the bases the law allows.
- To provide the service you asked for (contract): your account, My Mountains, the alerts you turned on, Surely's answers, your subscription and purchases, hotel bookings, and the snow reports you publish.
- With your consent: website analytics (Google Analytics, PostHog, Vercel Analytics and Speed Insights, Sentry session replay) and the Travelpayouts affiliate tag in the EEA, the UK, Switzerland and Canada; product analytics in the app; push notifications; precise location; marketing email. Consent can be withdrawn at any time, at snowsure.ai/privacy/choices, in your device settings, or by unsubscribing.
- Our legitimate interests, balanced against yours: keeping the service secure, rate-limiting and abuse prevention, error monitoring (masked session replays only with consent where it is required), moderating photos before they are shown, understanding aggregate usage outside the regions where consent is required, and sending service messages about your account.
- Legal obligation: keeping the financial records that tax and payment law require, and answering lawful requests.
We do not sell personal data, and we do not use it for advertising. We do not make decisions about you by automated means that have legal or similarly significant effects.
SnowSure ChatGPT App (MCP Connector)
SnowSure is available as an app inside ChatGPT, delivered through our Model Context Protocol (MCP) connector at snowsure.ai/mcp. This section describes exactly what data flows into and out of that app so you understand how it works.
No account or login required
The SnowSure ChatGPT app is read-only and fully anonymous. You do not create an account, sign in, or provide any personal details to use it. We do not ask for, collect, or store your name, email address, or contact information through the app, and we do not build user profiles from your ChatGPT activity.
Tool inputs (data the app receives)
When you ask SnowSure a question in ChatGPT, ChatGPT sends our connector only the specific parameters needed to answer it. This is limited to ski- and snow-related query information, such as:
- Resort names or identifiers (e.g. "Zermatt", "Jackson Hole")
- Locations, regions, or destinations you mention
- Dates or date ranges for forecasts and trip planning
- Search criteria such as snow depth, terrain, or conditions you specify
- The relevant portion of your question that the assistant forwards to fulfill the request
We do not request, and ChatGPT does not send us, your broader conversation history, identity, or any data beyond what is needed to answer your snow and ski questions. We ask you not to include personal or sensitive information in queries to the app, as it is not required.
Tool outputs (data the app returns)
In response, the app returns non-personal ski and snow information drawn from our datasets and partners, including snow reports and depths, multi-model weather forecasts, SnowSure™ scores, powder rankings, resort guides (lifts, runs, terrain, season dates), and resort photos and webcam status. These outputs are returned to you inside ChatGPT and are not personalized to your identity.
Technical and log data
To keep the service reliable and secure, our servers automatically process limited technical metadata for each request — such as IP address, timestamp, and the tool invoked — which we use solely for rate-limiting, abuse prevention, debugging, and aggregate usage analytics. This metadata is not used to identify you or to advertise to you. The SnowSure app does not serve advertisements and does not sell personal data.
OpenAI as the platform
Because the app runs inside ChatGPT, your interactions with it are also subject to OpenAI's own terms and privacy policy, which govern how OpenAI handles your ChatGPT conversations. We receive only the tool inputs described above; we do not control or receive the rest of your ChatGPT session.
User-Submitted Content
When you submit first-hand snow reports, photos, or other content to SnowSure.ai:
- Your content may be displayed publicly on resort pages and in our snow reports
- Your display name (not your email) may be shown alongside your submissions
- Photos are checked by automated moderation before they are shown; a photo that cannot be checked is held out of public view until a person has looked at it
- You grant us a non-exclusive license to use, display, and share your content
- You can delete your own reports in the app, and deleting your account anonymises the rest, as described under Data Retention
Cookies and Similar Technologies
The website sets these cookies. None of them is used for advertising.
- Strictly necessary: your sign-in session;
ss_region, which records only which consent rules apply where you are (not your country), for one day;ss_consent, your analytics and affiliate choice, for 6 months; and your unit and display preferences. - Analytics (Google Analytics, PostHog, Vercel Analytics and Speed Insights, Sentry session replay): which pages are read, which steps of the paywall are used, how fast the site loads, and a masked replay of a session that hit an error. In the EEA, the UK, Switzerland and Canada none of it loads until you allow it.
- Affiliate attribution (Travelpayouts): credits a flight booking you make through a link on the site. In the EEA, the UK, Switzerland and Canada it loads only after you allow it.
You can allow, change or revoke the analytics and affiliate choices at any time at snowsure.ai/privacy/choices. The mobile apps set no cookies; the app keeps your session and preferences on the device.
Processors and Other Recipients
We do not sell your personal information. The companies below process it on our behalf, each under a data processing agreement that limits what it may do with the data to the role listed. This list matches the data-collection disclosure on the App Store listing.
| Processor | What it does for us | Data it handles | Where |
|---|---|---|---|
| Vercel | Hosting, serverless functions, request logs, file storage (Blob) and key-value cache; Vercel Analytics and Speed Insights on the website (only with your consent in the EEA, the UK, Switzerland and Canada) | Everything the site and the API handle in transit; IP address and request metadata in logs; uploaded photos and web profiles in storage; page views and loading-speed measurements, without cookies | United States |
| Supabase | Database and authentication | Account, My Mountains, alerts, purchases, snow reports, feedback, chat sessions, deletion records | United States |
| Sanity | Content and customer profiles | Profile fields you enter (name, email, phone, country, family members as name, relationship and ski level), newsletter choices | United States / EU |
| RevenueCat | App subscription management and Apple Search Ads campaign attribution | Apple or Google purchase receipts, an app user identifier, and the email address and display name on your account so a purchase can be matched to you in support; the campaign that brought you to the app, from Apple’s AdServices framework, without an advertising identifier; no card numbers | United States |
| Stripe | Payments on the website | Payment details you enter on Stripe’s checkout; we receive the outcome, not the card | United States |
| Apple and Google | Sign in with Apple / Google, App Store and Play billing | The identity the provider shares when you sign in; purchases on the app stores | United States |
| Expo | Push notifications and app builds | Push token and device platform | United States |
| Mapbox | Maps and 3D terrain | IP address and the map tiles you request | United States |
| Google Analytics | Usage analytics on the website (only with your consent in the EEA, the UK, Switzerland and Canada) | Pages viewed, approximate location, device and browser | United States |
| Travelpayouts | Affiliate attribution for flight links (only with your consent in the EEA, the UK, Switzerland and Canada) | Click and referral identifiers | EU |
| OpenAI | Surely (our AI concierge), daily briefs and answer generation; automated moderation of the photos you upload; and the ChatGPT platform where the SnowSure app runs | The questions you ask Surely and the snow data needed to answer them; each photo you attach to a snow report or set as your profile picture, sent once for a moderation check before it is shown; no account details | United States |
| Anthropic | Internal quality testing of Surely’s answers | Test questions written by us; no user data | United States |
| Sentry | Error monitoring and masked session replay | Error reports with IP and device details; replays with all text and media masked | United States |
| Resend | Transactional and marketing email, and the newsletter audience | Your email address and the alert, report, confirmation or newsletter we send; your newsletter subscription | United States |
| PostHog | Product analytics on the website and in the app (on the website only with your consent in the EEA, the UK, Switzerland and Canada; in the app, off until you turn it on in those regions and on until you turn it off elsewhere) | Pages and screens viewed, paywall steps taken, and your account id when signed in; never your name or email | United States |
| Lux.Ski | Hotel booking checkout, on whose pages you pay; merchant of record for the booking | The guest name, email and payment details you enter on their checkout; the booking and its status, which they report back to us | United States / EU |
| RateHawk (Emerging Travel Group) | Hotel inventory and reservation partner behind Lux.Ski | The guest details on a booking | EU / United States |
| Airtable | Operational records we work on by hand | Contact-form messages (name, email, company, message) and resort data; no account or usage data | United States |
| Slack | Alerts to the team | A photo held for review (your account id and where the photo is stored, never a link to it), a feedback digest (the text of feedback left on Surely’s answers), and operational alerts; no email addresses | United States |
| Webcam and video hosts (YouTube and each resort’s camera provider) | Embedded live webcams on resort pages | Your IP address and browser details when an embedded player loads, under that host’s own policy | Varies |
Weather, snow, avalanche, road and webcam data come from public agencies and providers who receive no personal data from us. We may also disclose information where required by law, to enforce our terms, or to protect our users, the public or our rights.
International transfers
We are established in the United States and our processors run there and in the EU. If you are in the EEA, the UK or Switzerland, your data is transferred to the United States under the European Commission's Standard Contractual Clauses (with the UK addendum and Swiss adaptations where they apply), or to processors certified under the EU–US Data Privacy Framework, as set out in each processor's data processing agreement.
Data Storage and Security
Personal data is encrypted in transit and at rest with our hosting and database providers. Access is limited to the people who run the service, sign-in tokens expire and can be revoked, uploaded photos are checked before publication, and public profile objects carry unguessable addresses. No method of transmission or storage is completely secure, and we cannot promise absolute security; we can promise to tell you if a breach affects you, as the law requires.
Data Retention
We keep personal data only as long as the purpose it was collected for requires, then delete or anonymise it. The table says how long, per family of data, and what happens to each when you delete your account.
| Data | Where it lives | Kept for | When you delete your account |
|---|---|---|---|
| Account and profile | users, Sanity customer, web profile | While your account exists | Deleted |
| My Mountains, alerts, push registrations, saved resorts | saved_resorts, alert_subscriptions, subscriptions, subscribers | While your account exists | Deleted |
| Sign-in tokens | oauth_refresh_tokens | Until they expire or you sign out | Deleted; every device is signed out |
| Surely conversations | chat_sessions; answer_engine_queries and answer_engine_feedback are keyed by session, not by you | Chat sessions for 90 days after you last use them, or until you delete your account, whichever comes first; questions and the feedback on them for 180 days, as anonymous records | Chat sessions deleted; the anonymous records cannot be linked to you, and expire on their own schedule |
| Purchases and subscription status | RevenueCat and Stripe records; abandoned_checkouts, founding_reservations | Subscription status while your account exists; financial records for the statutory period (up to 7 years) at the payment provider | Our checkout and reservation rows are deleted; the provider keeps the financial record it is legally required to keep |
| Hotel and trip bookings | bookings, hotel_bookings, booking_attributions | Booking records for the statutory period a refund, chargeback or tax audit can reach (up to 7 years) | Your account link is removed; the guest name and email on a booking stay on that transaction record until the period ends |
| Snow reports, photos and feedback | snow reports, app_feedback, content_flags, user_blocks | While published | Anonymised: your name, photo and location are removed and the report shows “Former member”; attached photos and any photo on moderation hold are deleted |
| Personalisation and product events | personalization_events, decision_events | Personalisation events for 90 days, product decision events for 180 days, or until you delete your account, whichever comes first | Deleted or unlinked from you |
| Requests you send us | resort_requests; contact-form messages in Airtable and email | Until handled, then with our records; the copy we keep of a contact-form message for 180 days | Resort requests are anonymised; contact-form messages are removed when you ask |
| Server, API and ChatGPT-app logs | Vercel logs, rate-limit counters, mcp_tool_calls | Request logs for the days our hosting plan keeps them; rate-limit counters expire within a day; the record of an agent tool call for 90 days | Expire on their own schedule |
| Error reports and masked replays | Sentry | 90 days (Sentry’s retention) | Expire on their own schedule |
| Website analytics | Google Analytics, Vercel Analytics (with consent where required) | Per each provider’s retention setting (Google Analytics: 14 months) | Not linked to your account |
| Product analytics | PostHog (with consent where required) | Per PostHog’s retention for our project | The person record is removed when you ask; it carries your account id, not your name or email |
| Consent and region cookies | ss_consent, ss_region | 6 months and 1 day | Clear them from your browser or at /privacy/choices |
Deleting your account runs every step above at once. If any step cannot complete, we tell you which, sign you out everywhere, and finish the rest; nothing is reported as deleted that is not. The deletion runs against our own systems: the database, the profile store, uploaded photos, push registrations, sign-in tokens and, for Sign in with Apple, the grant at Apple. It also tells the processors that hold a record of you: your customer record at RevenueCat and at Stripe, your contact in the Resend audience, your person in PostHog, and the messages you sent us in Airtable. Stripe keeps the financial record the law requires of it, and a hotel booking stays with Lux.Ski as merchant of record for the period named above. Sentry is never told who you are, so it holds nothing to delete. If any step cannot complete we tell you which, and you can ask us to finish it at privacy@snowsure.ai.
Your Rights
Wherever you are, you can see, correct and delete what we hold about you. If the GDPR, the UK GDPR or the Swiss FADP applies to you, you have the right to:
- Access your personal data and receive a copy of it
- Have inaccurate data corrected
- Have your data erased
- Restrict or object to processing that rests on our legitimate interests
- Receive the data you gave us in a portable format
- Withdraw consent at any time, without affecting what was done before
How to exercise them. In the SnowSure app: Profile → Settings → Delete Account. On the website: your profile page, under Danger Zone, typing DELETE to confirm. Either deletes your profile, My Mountains, preferences, push registrations and uploaded photos, anonymises your snow reports, signs you out everywhere and sends a confirmation email. For access, correction, portability, restriction or objection, email privacy@snowsure.ai. We answer within one month, and we may ask you to confirm you own the account first.
Complaints. 43 Nord LLC is established in the United States and has no lead supervisory authority in the EU. If you are in the EEA, you may lodge a complaint with the data protection authority of the member state where you live or work. In the United Kingdom, the authority is the Information Commissioner's Office (ico.org.uk). In Switzerland, the Federal Data Protection and Information Commissioner (edoeb.admin.ch). We would rather hear from you first.
California. We do not sell or share personal information as the CCPA defines those terms, and we do not use sensitive personal information to infer characteristics. You may ask what we collect, ask for deletion, and will not be treated differently for asking. Your Privacy Choices is where the analytics and affiliate scripts are turned off.
Children's Privacy
Our website and apps are not intended for children under 13 years of age, under 15 in France, or under the age of digital consent where national law sets it higher (up to 16 in the EU). We do not knowingly collect personal information from children below those ages, and the family members you may list on your profile carry a name, a relationship and a ski level only: we do not accept or store their dates of birth or contact details. If you are a parent or guardian and believe your child has provided us with personal information, please contact us.
Changes to This Privacy Policy
When this policy changes, the new version is posted here with a new "Last updated" date. If a change reduces your rights or adds a purpose, we tell signed-in users by email or in the app before it takes effect.
Your Privacy Choices
The analytics on the website (Google Analytics, PostHog, Vercel Analytics and Speed Insights, Sentry session replay) and the Travelpayouts tag, which credits a flight booking you make through a link here, are not needed to show you the snow. In the EEA, the UK, Switzerland and Canada none of them loads until you allow it. In the app, product analytics is a switch under Profile → Preferences: off until you turn it on in those regions, on until you turn it off elsewhere. You can allow, change or revoke that at any time at snowsure.ai/privacy/choices. The choice is kept on your browser for six months. If your browser sends a Global Privacy Control signal, the website reads it as a refusal: none of them loads, wherever you are, unless you turn it on yourself on that page.
Contact Us
Questions about this policy, or a request about your data:
- Email: privacy@snowsure.ai
- Controller: 43 Nord LLC, a Maine limited liability company, doing business as Afore Travel, 310 Market Street, Basalt, Colorado 81621, United States
- Website: www.snowsure.ai
