Privacy policy

Last updated: 2026/2027 season.

Data controller

SkiRouter is operated by the controller named in the footer. For data-protection questions, contact us via the contact page.

What we store

• Your trip selection (resort, dates, group composition, choices) and the trip token, when you create a shareable trip page.
• Your cookie choice, stored locally in your browser (localStorage, key sr_consent_v2) — not a cookie.
• A session cookie (sr_sess), strictly necessary for the site to work, plus its expiry cookie (sr_sess_exp, the expiry time only) so it isn't renewed needlessly.
• A departure-city cookie (sr_origin), strictly necessary — remembers your chosen departure city across pages.
• A language cookie (lang), strictly necessary — remembers the site language (English or Portuguese) across pages, plus its version marker (lang_v, a number only) so a change to how the language is picked is applied just once.

The trip page contains no personal data and its address is not guessable (random token).

Departure-city suggestion

On a first visit, we may suggest a departure city based on your IP address's country, without storing the IP. We use a locally hosted geolocation database: MaxMind GeoLite2 (this product includes GeoLite2 data created by MaxMind, available from maxmind.com) or DB-IP (IP Geolocation by DB-IP — db-ip.com). It's only a suggestion — you can always pick a different city in the origin selector.

What we share

Nothing personal is shared with partners. When you use a booking link, only a technical sub-ID from the /go layer (source · resort · party size · reference) is sent, to measure clicks and usage statistics. Your group's details stay with the trip and never go to partners as personal data.

Cookies

• Strictly necessary (sr_sess, sr_sess_exp, sr_origin, lang, lang_v) — always on, no consent required. The cookie choice itself lives in localStorage, not a cookie.
• Analytics — opt-in: only load after "Accept". You can change this any time in Manage cookies.

Retention

Saved trips are retained while useful for reopening the shared link; you can request deletion. /go click logs contain no personal data.

Usage-analytics events are first-party (no third-party trackers) and are kept with no fixed deletion date, to analyse how the service is used; IP addresses are stored only as a salted hash, never in clear. Web server access logs are kept for up to 60 days.

Your rights

You have the right to access, rectify, erase, restrict and object to the processing of your data. To exercise them, use the contact page. You may also complain to the supervisory authority (CNPD).

Legal basis and transfers

Processing relies on your consent (non-essential cookies) and the legitimate interest of providing the service (trip selection). We do not make international transfers of personal data to partners.

No payment

SkiRouter does not process payments or collect card data. Booking is always done on each supplier's site.