Frostday privacy notice

Last updated 9 October 2026.

Frostday (frostday.app) is a snow forecast and mountain conditions service. This notice explains what personal data Frostday handles, why, who else processes it and what you can ask us to do. Frostday is run by Michael Katsoulakis as an individual, who is the controller of this data. Contact: hello@frostday.app.

What we collect

Your account. If you create an account we hold your email address, a password (stored only as a hash by our sign-in provider), any name you add and the access level of your account (guest, FrostPro, resort operator or admin). Frostday's own database stores only your account's internal identifier, not your email or name.
Your settings. Units, forecast weights and saved strategies you choose are stored against that identifier so they follow you between devices.
Resort operator records. If you act for a resort, the reports, requests and replies you submit are stored with your account identifier, and administrators can see your name or email next to them.
Questions to Frosty. If you ask Frosty, the assistant, a question, the question and the forecast it is about are sent to our AI provider to produce the answer. Frostday does not store the conversation. OpenAI does not use it to train models and may keep it for up to 30 days for abuse monitoring under its API terms. To limit abuse we keep a one-way hash of your IP address combined with the current day, deleted within a day.
Technical data. Like any website, our hosting provider receives your IP address, browser details and the pages you request in order to deliver and protect the site. Our request logs record the method, path, status and timing of each request, without query strings, and are kept for up to 7 days.
Resort website modules. When a Frostday module is shown on a resort's own website, Frostday counts views and interactions per day, by module, device type (phone, tablet or desktop), language and the resort website it appeared on. No cookies, browser storage, identifiers or IP addresses are used for these counts, nothing is counted when your browser sends Do Not Track or Global Privacy Control, and the counts are deleted after 90 days.
Using Frostday. When you use the Frostday app we count, per hour, which resorts and sections are viewed, which map layers are switched on or off, which kinds of map features are opened, whether a comparison produced a result, whether a strategy was saved, and clicks to a resort's own website, together with your device class (phone, tablet or desktop), language, whether you were signed in and the access level of your account. These are counts only: no cookies, browser storage, identifiers or IP addresses are used for them, nothing is counted when your browser sends Do Not Track or Global Privacy Control, and hourly counts are deleted after 90 days and daily totals after 24 months.

We do not sell personal data, use it for advertising, or build profiles of you.

Why we use it

To provide your account and the features you use, including your saved settings (performance of our agreement with you).
To keep the service secure and available, prevent abuse and keep operator records (our legitimate interest in running a reliable service and accountable resort reporting).
To give resorts aggregate counts of how their Frostday modules are used (our and the resort's legitimate interest; no individual can be identified).
To understand which resorts, forecasts and features are used and where Frostday shows incomplete or outdated information, so we can improve the service (our legitimate interest; no individual can be identified from these counts).
To meet legal obligations where they apply.

Who processes it for us

Clerk, Inc. (United States) — account sign-up and sign-in. Sign-up is protected by Cloudflare Turnstile, which checks that the request comes from a person.
Cloudflare, Inc. — hosting, database, storage and security.
OpenAI (United States) — answers to questions you ask Frosty, only when you use it.
OpenStreetMap Foundation and Overpass API operators — map tiles, place search and map data, loaded by your browser only in the resort editing tools used by resort operators and administrators.

Where data leaves the European Economic Area, the transfer relies on the EU–US Data Privacy Framework or the European Commission's Standard Contractual Clauses, as applicable to each provider.

Cookies and browser storage

Frostday uses no advertising or analytics cookies and no tracking pixels.

Sign-in cookies set by Clerk keep you signed in. They are strictly necessary for the account you asked for and are removed when you sign out or they expire.
Your preferences, such as theme, units, forecast weights and which map layers and labels are shown, are kept in your browser's local storage so the site remembers the choices you made. They never leave your device unless you are signed in and save them to your account. You can clear them at any time in your browser settings.

Because none of this is used for anything other than providing the service you requested, there is no cookie banner.

How long we keep it

Account data and settings: until you delete your account. Deleting it removes your account from Clerk and your settings and saved strategies from Frostday.
Resort operator records and the audit trail of administrative actions: kept as the resort's and Frostday's records after an account is deleted, linked only to the former account identifier.
Abuse-prevention hashes: deleted within a day. Request logs: up to 7 days. Module usage counts: 90 days. App usage counts: hourly counts 90 days, daily totals 24 months.

Your rights

You can ask us for access to your data, to correct it, to delete it, to restrict or object to how we use it, or for a copy in a portable format. You can delete your account yourself from the account menu (Manage account), or email support@frostday.app and we will respond within one month. If you think we have handled your data wrongly, you can complain to the Hellenic Data Protection Authority (www.dpa.gr) or the authority where you live.

Children

Frostday accounts are for people aged 15 or over. If you believe a younger child has created an account, contact us and we will delete it.

Changes

We will update this notice when what we collect or who processes it changes, and change the date above.