Privacy Policy

1. Who we are

[Company name] (“we”) runs SlopeRelay, a scheduling and operations app for ski areas. One SlopeRelay site serves many customers. Each customer, a ski-area company, has its own account, with one owner, a plan and one or more mountains. The customer decides what goes into SlopeRelay and who gets access. We hold that information for the customer so we can run the service.

If you work at a mountain, your employer is responsible for your records in SlopeRelay. Ask your manager first about anything in them. You can also write to us at [Contact email].

2. What SlopeRelay holds

• Staff on a schedule: name, job title or role, availability and days off, preferred shifts and lifts, maximum hours and days, qualifications and skill levels, season start and end dates, a payroll employee ID if the mountain adds one, and notes managers write.
• Shifts and hours: schedules, time-off requests and their notes, shift swaps, call-out reasons, and when someone confirmed they had seen their schedule.
• Actual hours: when a manager uploads hours worked, SlopeRelay keeps only each day’s total for the team. Names and IDs in the uploaded file are used to check the rows and count people, and are not saved. The file’s name is kept.
• Pay and budgets: pay rates for team staff (if the mountain enters them), a default pay rate for each team, and hours and dollar budgets.
• Team records: Ski Patrol’s weather log and trail reports, training sessions and certifications with expiry dates, lift logs (who ran and signed each lift, stops and why), maintenance and snowmaking jobs, events, team notes and the mountain status board.
• Your own profile (owner, directors, managers and supervisors): your phone number, an emergency contact and notes, if you add them. Nobody else can see your profile in the app.
• Sign-in details: email addresses, and when each person last signed in. The owner signs in with a password; everyone else signs in with an access code from a manager. Passwords, codes and two-step recovery codes are stored only in scrambled (hashed) form. Two-step sign-in also keeps the key your authenticator app uses. Calendar links (below) are stored only in hashed form too.
• Phone alerts: for each phone (or browser) where someone turns on notifications, its push address (a web address its browser’s push service made for it) and the two encryption keys the browser made for it, with the mountain, whose phone it is (as an ID, not a name or email) and when it was turned on. Up to 10 phones per person.
• Change history: who made each change (their email and role), when, and what changed.
• Account details: each customer account’s name, its owner’s email, its plan and limits, which features each mountain has, whether the account or a mountain is paused or requires two-step sign-in, and private notes SlopeRelay staff keep about the account.
• SlopeRelay staff: each operator’s email and sign-in, and a log of every change they make to customer accounts, with their email.
• Technical details: sign-in cookies (see “On your device”), and counts of recent sign-in attempts by network address and email, kept for 15 minutes in hashed form to slow down guessing. Our hosting provider keeps a few days of request logs (page addresses and errors).

SlopeRelay has no place for home addresses, dates of birth, government ID numbers, bank details or guest medical records. Notes are free text, so please don’t type health details into them.

3. Who can see what

The server checks every request against the person’s account, mountain, team and role, so nothing is simply hidden on screen. Nobody at one customer sees anything of another customer’s. People see one mountain at a time. Directors, managers, supervisors and HR can have access at several of their customer’s mountains, with a role and teams set at each, and switch between them; the same email can’t be given access at another customer. Staff on a schedule belong to one mountain.

Shared across the mountain: every manager, supervisor and HR person at the mountain sees the status board, trail reports, weather logs, lift logs, maintenance jobs and events, and each team’s roster for the day (names, titles and shift times, without notes or budgets) for the morning briefing. Each team’s full schedule, staff details, training records, team notes, budget and pay rates stay with that team.

Employees

Their own posted schedule, time-off requests and shift swaps, the names of active teammates on the same team (to offer swaps), and current trail conditions without patrollers’ names.

Supervisors

Their own team’s schedule and staff, plus what’s shared. Managers choose what each supervisor can change. Supervisors see hours budgets only if a manager turns that on, and never pay rates or dollar budgets.

Team managers

Everything for their own team, including its budget and pay rates, plus what’s shared. They also see the other shifts of anyone who works on two teams (matched by payroll ID), so nobody gets double-booked.

HR and accounting (read-only)

Every team’s schedules, hours, hours budgets and payroll exports at the mountain. They can’t change anything, and they don’t see pay rates or dollar budgets.

Mountain-wide managers

Every team at the mountain, including budgets and pay rates.

Directors

Everything at the mountain, including every budget and pay rate. Directors can also download every team in one workbook and choose how long change history is kept.

Account owner

The person who owns a customer’s account. They can open every mountain in their account and see everything in it, and nothing in other customers’ accounts. Only the owner adds, archives, downloads or deletes mountains in their account, and manages recovery copies.

SlopeRelay operators

[Company name] staff who manage customer accounts. They see each account’s settings and who has access, never schedules, staff details, pay or budgets (see “What SlopeRelay staff see and do”).

Managers can preview the employee portal as one of their staff sees it. The owner, directors and managers give out access codes for the people they manage. People at [Company name] who look after the hosting account can reach the database directly; we do that only to run, fix or restore the service, or when the customer asks.

4. What SlopeRelay staff see and do

SlopeRelay operators are the [Company name] staff who run the service and its customer accounts. Only the emails we list in the site’s settings can sign in as an operator, and on the live site they must use two-step sign-in. They work in a separate console, and their sign-in can’t open any customer’s mountain.

• What they see: each account’s name, owner email, plan, limits and status, and when the owner last signed in. For each mountain: its features, and whether it’s paused or requires two-step sign-in. For the owner and each director, manager, supervisor and HR person: email, role and teams, whether they sign in with a code or a password, whether two-step sign-in is on, when they last signed in, and how many devices they’re signed in on. For staff, counts only: how many in each team have portal access and have signed in, when anyone on the team last signed in, and how many staff sign-ins are open.
• What they never see: schedules, hours, staff names or details, notes, team records, pay rates or budgets.
• What they can change: an account’s plan and limits; which features a mountain has; pausing an account or a mountain and turning it back on; requiring two-step sign-in for every manager and supervisor at a mountain; one-time setup, password reset and full reset links for the owner, approving another operator’s full reset, and cancelling an unused link; and signing out the owner, one manager or supervisor, or everyone at a mountain. They can’t add or remove anyone’s access.
• The customer sees every change: each one is listed in the mountain’s Activity (account-wide changes in the account’s first mountain), marked as SlopeRelay, where the owner, directors and mountain-wide managers can read it. The exceptions are private notes about the account, which the customer doesn’t see, and settings changes that leave every feature and limit as it was. Every change, those included, is also kept in an operator log with the operator’s email.
• Setup and reset links are shown once to the operator, who sends them to the owner. Only a hashed form is stored, and a link works once, for 7 days. A password reset link works only with a code from the owner’s two-step sign-in, so the operator who makes it can’t use it to sign in as the owner. Using it sets a new owner password, keeps two-step sign-in on and signs the owner out everywhere else. For an owner who has lost their two-step sign-in too, a full reset also turns two-step sign-in off; it needs a reason, which the customer sees, and works only after a second operator approves it. While a reset link is unused, the owner sees it when signed in and can cancel it. Making, approving, cancelling and using a link are all listed in the Activity, with who did it.

5. Where it’s stored

SlopeRelay runs on Cloudflare Workers. Its data is kept in a Cloudflare D1 database in Eastern North America, and everything travels over HTTPS.

All the customers and mountains on one SlopeRelay site share a database. Every record is tagged with its mountain, and every mountain with its customer’s account, and the server returns only what the signed-in person’s account, mountain and role allow. A separate test copy, with its own database, holds made-up data only.

6. Backups and how long things are kept

• Schedules, staff and records stay until someone at the mountain changes or removes them, or until the mountain’s data is deleted when it leaves. Removing a person’s access ends their sign-ins at once; their name stays on past schedules and in history.
• Lift Operations recovery copies: before each Lift Operations save, the app keeps a copy of the previous version, including the access list (emails and hashed codes). It keeps the newest 30 copies plus the last copy of each day for 30 days. Copies the owner saves on purpose, and copies made before a restore or a season change, stay until the owner deletes them. Only the owner can see, restore or delete recovery copies.
• Other teams (Ski Patrol, Terrain Parks, Snowmaking, Lift Maintenance and added teams) aren’t in those recovery copies. Their change history records what changed.
• Season archives: when a season ends, a full copy of that season’s Lift Operations schedule is kept for later reports.
• Change history is kept for the period the mountain chooses (1, 2, 3 or 7 years, or forever; 3 years unless changed), then deleted automatically. Lift log history isn’t deleted by that rule, because lift logs are safety records; it goes only when the mountain’s data is deleted.
• Paused accounts and mountains keep all their data. While paused, nobody there can sign in, and calendar links stop updating. Nothing is deleted.
• Features a mountain’s plan leaves out: when a feature is turned off, its records are kept, but they aren’t shown or changed until it’s turned back on.
• Phone alerts: a phone stays signed up until someone turns its alerts off or signs out on it, the person’s access is removed or reset, its push service says it’s gone, it’s the oldest of more than 10 phones for one person, or the mountain’s data is deleted. A sign-in ending any other way, such as expiring or SlopeRelay signing someone out, doesn’t take the phone off: it can still get alerts meant for that person, such as a schedule they’re on being posted. Alerts go out only when someone saves a change, so none are sent while a mountain is paused. When a mountain’s plan leaves out phone alerts, nothing is sent, but the phones stay signed up and get alerts again once it’s back on. Phones aren’t in the mountain’s download.
• Account details and the operator log are kept while the account exists. The operator’s entries in a mountain’s Activity follow that mountain’s change history period.
• Cloudflare’s own history: Cloudflare keeps a point-in-time history of the database for [7 or 30] days, so deleted information can remain there for that long.
• When a mountain leaves, everything above is deleted for that mountain at once (see “When a mountain or customer leaves”).

7. On your device

• Sign-in cookies: page scripts can’t read them, they’re sent only over HTTPS, and they last 12 hours, or 30 days if you tick “Remember me”. Signing out ends them.
• Your chosen mountain: for the owner and anyone with access at more than one mountain, a cookie that remembers which mountain you last opened, for up to 400 days.
• Your theme (Light, Dark or match device), and in the staff app the last five places you opened with quick jump (Ctrl K), saved as IDs rather than names.
• Offline copies: so SlopeRelay opens without signal, your device keeps the pages and data you last opened. Edits made offline wait on the device until they upload. Signing out clears both, and warns you first if edits haven’t uploaded.
• Employee portal: your device keeps a copy of your own posted shifts for up to 52 weeks, to highlight what changed since you last looked. It stays after you sign out; clearing this site’s data in your browser removes it.
• Downloads: Excel workbooks and backup files stay wherever you save them. Treat them like paper records.
• Calendar apps: staff can add their posted shifts to Apple Calendar, Google Calendar, Outlook or another calendar app, by downloading a file or with a private link the app checks for changes. Managers can do the same for their team’s schedule. Only posted shifts go in (times, position, team and location; a team calendar also names who works), with no pay or notes. The calendar provider keeps its copy under its own terms. Making a new link, turning it off, or losing access stops updates but doesn’t remove shifts already in the calendar.
• Phone alerts: where the mountain’s plan includes them, staff, the owner, directors, managers and supervisors can turn on notifications for the phone they’re holding. Staff get one when their schedule for this week or a later one is posted or updated, and when a manager approves or declines their shift swap. The owner, and the directors, managers and supervisors who can approve a team’s swaps, get one when a swap is waiting for them. Alerts say only what happened, with the team, dates and times, never anyone’s name, and they can show on the phone’s lock screen. A phone gets one person’s alerts at one mountain at a time. Tapping Turn off, or signing out on that phone, stops them, and the phone’s own settings can block them.

SlopeRelay has no advertising or analytics cookies and no tracking scripts. Pages load only from SlopeRelay’s own address.

8. How it’s protected

• HTTPS only, and browsers are told to always use it.
• Passwords, access codes and sign-in tokens are stored only in hashed form. Sign-in attempts are limited.
• The owner, directors and HR and accounting must use two-step sign-in. SlopeRelay can require it for every manager and supervisor at a mountain, and its own operators must use it.
• Every request is checked on the server for the person’s account, mountain, team and role.
• Security headers let only SlopeRelay’s own scripts run, stop other sites from framing its pages, and turn off camera, microphone and location.
• Removing or resetting someone’s access ends their sessions, calendar links and phone alerts immediately. Resetting the owner’s password signs out older sessions.

No system is perfectly secure. If we learn that a customer’s data was exposed, we will tell that customer within [number] days.

9. Sharing

We don’t sell personal information or use it for advertising. We share it only with Cloudflare, which hosts SlopeRelay; with the push service that delivers phone alerts (below); when the customer asks us to; or when the law requires it.

Phone alerts go through the push service of the browser that turned them on, which the browser chooses: Apple’s for Safari, iPhone and iPad, Google’s for Chrome and Android, Mozilla’s for Firefox, or Microsoft’s for Edge on Windows. SlopeRelay sends alerts to no other address. Each alert is encrypted with that phone’s keys before it leaves SlopeRelay, so the push service can’t read it. It does see the phone’s push address, when each alert is sent and how big it is, and that it comes from SlopeRelay, and it holds an alert for up to 24 hours while the phone is offline. The browser maker’s own privacy terms cover what its push service does with that.

SlopeRelay sends no email or text messages, and sends nothing to analytics services.

10. When a mountain or customer leaves

Before leaving, the mountain can have a copy of its records:

• Everything, in one file: on the Mountains page, the account’s owner can download everything SlopeRelay holds for a mountain: Lift Operations, every team’s schedules and records, change history (lift log history included), the status board, season archives, settings, profiles, and who has access (emails, roles and teams, without codes). It’s a JSON file, a standard format other software can read. Recovery copies are listed by date and name without their contents, which are earlier versions of Lift Operations. We send this file to the customer when it asks, and offer it before deleting anything.
• Download everything (Settings › Data & backups, owner and directors): every team’s next four weeks, staff, budgets and seasons, Ski Patrol records and maintenance plans, in one Excel workbook.
• Export to Excel on each schedule page for a chosen date range, payroll exports, the Lift Operations workspace backup file and season archives.

Lift logs and other safety records may be ones the mountain must keep. Download them before leaving.

When one mountain leaves, the owner archives it in SlopeRelay. Nobody at that mountain can sign in after that, it drops out of the app, and the owner then deletes the mountain’s data on the Mountains page when the customer is ready. Deleting removes every record SlopeRelay holds for that mountain at once: schedules, staff, team records, change history, recovery copies, season archives, settings, profiles, access codes, sign-ins, two-step keys and phones signed up for alerts. It can’t be undone in SlopeRelay. The deleted data stays in Cloudflare’s point-in-time history of the database for [7 or 30] more days, and then it’s gone.

An account’s first mountain can’t be archived or deleted in the app. When a whole customer leaves, [Company name] pauses its account, which stops every sign-in at its mountains, the owner’s included, so the owner should download and delete what they can first. Within [number] days, [Company name] then deletes by hand the first mountain’s data and any mountain’s the owner didn’t delete. Deleting mountains doesn’t remove the account itself (its name, owner email, plan and private notes) or the operator log. [How long we keep the account details and operator log after a customer leaves.]

Files the customer downloaded are its own to keep or destroy.

11. Your choices

• Employees: ask your manager to correct or remove information about you.
• Managers and supervisors: you can change your own profile at any time.
• Anyone: to ask about your data or make a request under privacy laws that apply to you, write to [Contact email]. We may pass it to your mountain, which controls the records. [State privacy rights section, if any apply.]

Some mountain staff are under 18. SlopeRelay holds the same work information for them as for anyone else. [Review for minors’ data.]

12. Changes to this policy

We’ll post changes on this page and update the date at the top. Before a change that matters takes effect, we’ll tell each account’s owner.