Privacy Policy

Last updated: 11 November 2026

Who we are

Mountain Marker is a guide to ski resorts and ski trips. This policy covers www.mountainmarker.com and the emails we send.

Operator: Mountain Marker, PO Box 895, New York, NY 10163 Contact: hello@mountainmarker.com

Write to us with any question about your data, or to use any of the rights below.

The short version

• We collect as little as we can, and we don't sell personal data.
• Visitors in the EU/EEA, the UK and Switzerland get no Google Analytics and no advertising or tracking cookies from us. Elsewhere, we use Google Analytics, which sets cookies.
• Every email we send has a one-click way to stop it.

What we collect, why, and for how long

Visiting the site

Vercel Web Analytics counts page views and a few actions for every visitor, wherever you are: for example, clicking from an article to a resort, or signing up. It uses no cookies and stores nothing on your device. Vercel recognises a visit by a temporary hash of the request, which it discards after 24 hours. It records the page, the referring site, your country, region and city, and your device type, browser and operating system. We see only totals. We can view the totals for 12 months.

Google Analytics (Google LLC) runs only for visitors outside the EU/EEA, the UK and Switzerland. If we can't tell where you are, we treat you as in Europe and don't load it. It sets the cookies listed below and collects page views, approximate location, device and browser details, and the same actions as above. Google keeps this data for 14 months.

Where you are, roughly. On each visit, our hosting provider tells our site your country and approximate location, worked out from your IP address. We use it at that moment for two things only: deciding whether to load Google Analytics, and suggesting the nearest departure airport in the trip planner. We don't store it.

Legal basis: our legitimate interests in understanding how the site is used and keeping it working well.

Your browser also contacts Supabase, our database, for some live data. It receives your IP address, as any website you load does, but sets no cookies for us. All our fonts and images are served from our own site, so your browser doesn't contact a font or image service. When you open a webcam, it plays from Windy.com, which receives your IP address.

Our weather forecasts come from Open-Meteo. Our server requests them, so your browser doesn't contact Open-Meteo.

The newsletter

If you subscribe, we store your email address, the regions you chose, where on the site you signed up, and the date. Our newsletter is sent by Buttondown, which receives your email address and your IP address (to screen out fake signups). Before your first issue, Buttondown sends a confirmation email. Every issue has an unsubscribe link. Legal basis: your consent, which you can withdraw at any time by unsubscribing.

After you unsubscribe. We delete our own copy of your signup (email address, regions, where you signed up, date) automatically, within a day. Buttondown keeps your address marked as unsubscribed, so you aren't emailed again; email hello@mountainmarker.com if you want it deleted there too, and we'll arrange it.

Snow alerts

If you ask for a snow alert, we email you when the forecast shows the amount of snow you chose at a resort within the next 48 hours.

What we store. Your email address, the resort, the amount of snow you chose, and whether you also asked for our weekly newsletter. The wording you agreed to, and when. A one-way hash of your IP address, used only to stop our form being used to send unwanted email; we never store the IP address itself. A record of each alert we send you (your email address, the resort, the forecast amount and the time), so we can keep our limits of one alert per resort every 3 days and three a week.

Nothing is sent until you confirm. We email you a link first, and your alert starts only when you click it. If you ticked the newsletter box, the same click also subscribes you to the weekly Pow Alert newsletter, which is sent by Buttondown.

How long we keep it. Requests you don't confirm are deleted 7 days after our last confirmation email. Records of alerts sent are deleted after 90 days. While an alert is active, we keep the details above. When you stop an alert, we delete those details and keep only a suppression record: a one-way hash of your email address, the resort (or "all resorts"), a hash of the unsubscribe link, and the date. That record is how we make sure we don't email you again, and we keep it for as long as we run snow alerts. A one-way hash can't be turned back into your address, but it does let us recognise the same address if it's entered again.

Signing up again. If you stopped alerts and later ask again, nothing restarts until you click the link in our confirmation email. To an address that has stopped alerts, we send at most one such email every 30 days.

How to unsubscribe. Every alert has an unsubscribe link, and supports one-click unsubscribe in email apps that offer it. From the link you can stop one resort's alert or all of them. You can also email hello@mountainmarker.com.

Legal basis. Your consent, which you can withdraw at any time by unsubscribing.

Snow alert and confirmation emails are sent by Resend, which receives your email address and the content of the email in order to deliver it.

The trip planner

If you create a trip, we store what you enter:

• the trip name, the resort, the dates, the group size and the currency;
• what you add to the trip (for example, a ski school or a place to stay);
• if you set one, a PIN (six digits; trips made before November 2026 may have four). We store it only as a one-way hash, never as you typed it.

A trip has no name or email address attached to it. Anyone with its link can view it. Without a PIN, anyone with the link can also change it; with a PIN, only people who know the PIN can. On your device:

• the trip's link is kept in the mm-current-trip cookie (below), so "Add to my trip" knows which trip to add to;
• when you enter a trip's PIN, or create a trip with one, the mm-trip-<slug> cookie (below) lets that device change the trip for 30 days without entering the PIN again. It holds a signed code, not the PIN. "Lock again" on the trip page removes it, and changing or removing the PIN stops it working.

To stop PINs being guessed and trips being created in bulk, we record each wrong PIN and each new trip with a code made from your IP address and the date, using a secret key. We never store your IP address itself. These records are deleted within 3 days. Legal basis for these records: our legitimate interest in keeping trips safe.

If you choose a departure airport, we remember it in the mm-user-airport cookie.

Trips that haven't been opened or changed for 12 months are deleted automatically. Legal basis: providing the trip planner you asked to use (contract).

Asking a business about your trip

If you send an enquiry about a resort's businesses, we store your name and email address, your message, your dates and your group size. They go to our team by email. We may pass your enquiry to the business you asked about, and from then on that business handles it under its own policy. Enquiries are deleted automatically after 2 years. Legal basis: our legitimate interests in answering your enquiry and connecting you with the business.

Contact form and listing claims

Messages through our contact form (name, business name, email, message) are stored so we can reply, and deleted automatically after 2 years. Requests to claim a business listing (name, email, role, message, and how you'd like to receive customer requests: email, WhatsApp, SMS, Viber or other, with the number for WhatsApp, SMS or Viber if you choose one) are stored so we can check them, and deleted automatically after 2 years. That channel and number are used only to send you customer requests. They are never shown on the site, and never passed to AI assistants that use our data. Legal basis: our legitimate interests in replying to you and checking who manages a listing.

Business listings and payments

If you list a business, we store what you submit: the business name, resort, category, description, website, contact name, email and phone. Your business phone and website are shown on your listing; your contact name and email are not. Paid listings are processed by Stripe. You enter your card details on Stripe's page, never ours, and we receive only Stripe's customer and subscription references. We keep listing details while the listing exists, and billing records as long as the law requires. Legal basis: performing our contract with you for the listing, and our legal obligations for billing records.

How our team is told

When you send an enquiry, a contact message, a listing or a listing claim, we email the details to our team's mailbox on Google Workspace (Google LLC), which processes them to deliver and store the email. We delete these emails within 2 years.

Links to partners and businesses

Some links to booking partners are affiliate links: if you book through them, the partner may pay us a commission, at no cost to you. Our affiliate partners are Expedia, Vrbo and World Nomads (through the CJ Affiliate network), Skiset (through the Awin network) and Ski-Lifts (airport transfers, through the Adtraction network).

We record clicks on links to partners, on a listed business's website or phone number, on the featured business, and on sponsored placements, all in the same way. When you click one:

• we record the resort, the link, where on the page it was, the time, and a one-way code that changes every day, made from your IP address and browser with a random value that is deleted within 3 days. The code is deleted from the record within 3 days too, so after that it can't be linked to you, even by us. We never store your IP address;
• a link to a partner takes you to the partner's site through the affiliate network's own link (CJ Affiliate, Awin or Adtraction), which may set its own cookies. From there, the partner's and the network's privacy policies apply. A link to a business's website tells the business the visit came from us (it carries utm_source=mountainmarker), and nothing about you.

We count how many times each business listing appears on screen, as daily totals per listing. We use no cookie for this and store nothing about you.

Click records and the daily totals are deleted automatically after 24 months. Legal basis: our legitimate interests in counting referrals, getting paid for them, reporting to the businesses we list, and spotting fraud.

Search

We keep the words people type into our resort search, and how many results they got, to improve our coverage. Nothing about who searched is stored. Legal basis: our legitimate interests in improving the site.

Hosting

The site runs on Vercel (hosting) and Supabase (database), both in the United States. Our database is in Supabase's East US (North Virginia) region. The site's server code runs in Vercel's Washington, D.C. region, and pages are delivered through Vercel's global network. Vercel keeps short-lived server logs that include IP addresses, to run and secure the service. Legal basis: our legitimate interests in keeping the site secure and working.

International transfers

We're based in the United States, and our providers process your data there (Supabase also through its Singapore company). For data from the EU/EEA, the UK and Switzerland, these are the safeguards each provider publishes:

• Vercel (hosting and Vercel Web Analytics; Vercel Inc.) is certified under the EU-U.S. Data Privacy Framework, its UK Extension and the Swiss-U.S. Data Privacy Framework (Vercel privacy notice, updated 1 June 2026). Its Data Processing Addendum also includes the European Commission's 2021 Standard Contractual Clauses (Decision 2021/914) with the UK Addendum (Vercel DPA, updated 17 March 2026).
• Supabase (our database; Supabase Pte. Ltd.) relies on the 2021 Standard Contractual Clauses (Modules 2 and 3), the UK Addendum (version B.1.0) and a Swiss addendum (Supabase DPA, version 1, 1 August 2026). Our database is in its East US region.
• Buttondown (our newsletter; Buttondown, LLC) relies on the 2021 Standard Contractual Clauses (Module 2), with the UK Addendum and the changes Swiss law requires (Buttondown DPA, updated 17 September 2026).
• Resend (snow alert emails; Plus Five Five, Inc.) relies on the 2021 Standard Contractual Clauses, with the UK Addendum and the changes Swiss law requires (Resend DPA, updated 31 December 2025), and is also certified under the EU-U.S. Data Privacy Framework and its UK Extension.
• Stripe (payments; Stripe, LLC) is certified under the EU-U.S. Data Privacy Framework, its UK Extension and the Swiss-U.S. Data Privacy Framework, and falls back on the 2021 Standard Contractual Clauses and the UK Addendum (Stripe Data Transfers Addendum, updated 18 November 2025).
• Google Workspace (our team's email; Google LLC) is certified under the EU-U.S. Data Privacy Framework, its UK Extension and the Swiss-U.S. Data Privacy Framework, and its Cloud Data Processing Addendum includes Standard Contractual Clauses (last modified 8 June 2026).
• Google Analytics isn't loaded for visitors in the EU/EEA, the UK or Switzerland, so it receives none of their data.

Cookies

What we set (checked in a browser on 13–14 October 2026; to be re-checked on www on the launch date):

• Visitors in Europe get no cookies at all unless they use one of those trip planner features.
• Vercel Web Analytics sets none.
• Admin pages, used by our own team, set a sign-in cookie; visitors never see those pages.
• Partner sites and widgets may set their own cookies once you click through to them, under their own policies.

You can delete cookies in your browser at any time.

Children

Mountain Marker is not aimed at children, and we don't knowingly collect personal data from children under 16. If you think a child has given us personal data, email hello@mountainmarker.com and we'll delete it.

Your rights

Wherever you live, you can ask us for a copy of your data, ask us to correct it or delete it, or object to how we use it. Under GDPR and UK GDPR, you also have the right to restrict use and to data portability, and to complain to your data protection authority. US state laws, such as California's, give similar rights. We don't sell personal data, and we don't share it for cross-context behavioural advertising. Email hello@mountainmarker.com and we'll answer within 30 days.

Changes

When this policy changes, we update the date at the top.