Privacy policy

Who is responsible

The controller for pistewindow.com, app.pistewindow.com and the assistant (MCP) service is [OWNER: full legal name or company name], [OWNER: postal address], Sweden. Organisation number: [OWNER: organisation number (organisationsnummer)]. Contact for privacy questions and requests: [OWNER: contact email for privacy and legal requests]. No data protection officer is appointed [OWNER: confirm none is required].

The supervisory authority is Integritetsskyddsmyndigheten (IMY), imy.se. You may also complain to the authority in your own country.

Visiting the website

You do not need an account to read forecasts, resort pages or guides. PisteWindow loads no advertising, no third-party trackers and no scripts, fonts or maps from other companies. Visitor counts are described below.

To deliver pages, our host Cloudflare processes your IP address and request details such as the page and browser type. This is technically necessary and protects against abuse. PisteWindow does not store IP addresses in its own database for page views or analytics. Cloudflare keeps its own operating and security logs under its terms. Basis: legitimate interest in running and securing the service (Art. 6(1)(f) GDPR).

Visitor counts

Our server forwards each beacon request to Umami, open-source analytics software on a server we operate ([OWNER: name the Umami server's host and where it runs]), reached through a Cloudflare tunnel. For this, the beacon also sends your screen size and, for page views, the page title, plus a few fixed values for some actions. Your browser never loads an Umami script or contacts the Umami server. Our server forwards: the page address without query string or fragment, the page title, the host name of the site you came from, screen size, browser language (from the Accept-Language header), the action name and its fixed values, and your IP address and user agent. Umami uses the IP address and user agent to work out approximate location (country, region, city), browser, operating system and device type, and to count unique visitors with a one-way hash of the website, IP address, user agent and a salt that changes regularly. Umami does not store the IP address or the full user agent. Nothing is forwarded when your browser signals Global Privacy Control or Do Not Track.

The actions, with fixed values only: a Trip forecast request (typed, chosen with the controls or with “Try a week later”) and its outcome (resolved, needs clarification, invalid, passed on to your account, error), never the text or dates; which Plan tool was used; which ski area’s “View in 3D” was opened; a sign-in started or completed, without your email address; a trip saved (the resort and whether on this device or to your account, no dates); copying the assistant (MCP) address; switching language (from and to); and following a link to another site (only its host name) or between www and app (only the page family). No cookie or browser storage is involved. Retention: [OWNER: set how long Umami data is kept]. Basis: legitimate interest in knowing how the service is used (Art. 6(1)(f) GDPR).

Accounts and sign-in

An account is optional. We ask only for your email address and send a six-digit code (valid for five minutes, three attempts); the code is stored hashed. After sign-in we keep a session record: a session token, its expiry (7 days, extended while you use the app), the IP address and browser description seen at sign-in, plus short-lived rate-limit counters that may include your IP address. Your account holds your email address, a personal workspace, the trips you choose to save (resort, arrival and departure date) and a language and time-zone preference. PisteWindow sends no newsletters or notifications; the only emails are sign-in codes.

Basis: providing the account you ask for (Art. 6(1)(b)) and securing sessions (Art. 6(1)(f)). We keep this data while the account exists. [OWNER: set how long expired session records are kept; no automatic purge exists yet]. To delete your account and its data, write to [OWNER: contact email for privacy and legal requests]; there is no self-service deletion yet.

Trip forecast and assistants

When you type a trip request such as “Saalbach, 14–21 March”, the text, the interface language and, for a follow-up, your previous dates are sent to our server to work out destination and dates. We do not store the text, and it is kept out of logs, analytics and web addresses. We store only operational diagnostics for 30 days: time, outcome, response time, which interpreter was used and token counts. If the optional language-model interpreter is enabled, the typed text, language, previous dates and a list of candidate resorts go to OpenAI through its API with storage switched off, only to interpret the request; otherwise a built-in rule-based interpreter on our servers handles it. [OWNER: confirm whether the OpenAI interpreter is enabled in production]. Please do not put personal data in a request. Requests are rate limited per IP address by Cloudflare; we do not store the address.

The public assistant (MCP) service answers read-only questions about forecasts and resorts and needs no account. It is rate limited per IP address the same way. We count calls as a daily number, not tool names, questions or answers. Your assistant provider applies its own privacy terms to what you ask it.

Device storage and cookies

PisteWindow sets one cookie: a session cookie on app.pistewindow.com after you sign in, needed to keep you signed in. It ends when you sign out or the session expires. No other cookie is set, so there is no cookie banner.

Your browser also stores, on your device only, settings and a guest trip: for example pistewindow.theme, pistewindow.website.theme, pistewindow.motion and pistewindow.trip in local storage, and a short-lived draft of a Trip forecast request in session storage that is removed once read. These are not sent to us unless you save a trip to your account, and clearing site data removes them.

Payments

Paid plans are not on sale yet; billing runs in Stripe test mode only. [OWNER: update this section before paid plans go live]. When payments open, Stripe will process card and payment details and we will receive no card numbers. We send Stripe your email address and an internal workspace ID to create your customer record, and we store the customer and subscription identifiers, plan, status and paid-until date. Basis: contract (Art. 6(1)(b)) and accounting duties (Art. 6(1)(c)); Swedish bookkeeping rules generally require seven years of retention [OWNER: confirm].

Who helps us

Cloudflare: hosting, network, Workers, the D1 database and R2 file storage [OWNER: confirm the D1 database region]. Resend: delivers sign-in emails (your address and the code). Stripe: payments, test mode only today. OpenAI: only the optional Trip forecast interpreter described above. Umami: open-source analytics software that runs on our own server ([OWNER: name the Umami server's host and where it runs]), not a service of another company. Weather providers such as Open-Meteo and MET Norway receive requests from our servers for resort coordinates and never receive visitor data. We do not sell data and show no advertising.

Some of these providers may process data outside the EU/EEA, for example in the United States. Safeguards are the EU–US Data Privacy Framework or standard contractual clauses. [OWNER: record the data processing agreement and transfer safeguard for each provider].

Your rights and changes

You have the right to access, correct, erase, restrict and receive a copy of your data, and to object to processing based on legitimate interest. Write to [OWNER: contact email for privacy and legal requests]; we reply within one month. Giving an email address is necessary only if you want an account. We make no automated decisions about you and do no profiling.

This policy was last updated on 2026-11-08 (draft). We will describe material changes on this page.