Snowshack Software privacy policy

Snowshack Software LLC makes apps, games, and websites. This policy explains how we handle information across Snowshack websites and products, including Spellshooter 2, Alpenkeep, Ampledger, and AlpenForm.

Contact

For privacy questions or requests, email [email protected].

Information we collect

Depending on the product and features you use, Snowshack products may collect account information, contact information you provide, product settings, app content you create, subscription or purchase status, device and diagnostic information, usage information, and feature-specific data such as location or weather-related inputs when you choose to use those features.

Snowshack Software's games (including Spellshooter 2's web preview and its iOS/Android app) store your gameplay preferences, scores, and progress locally on your device by default. Spellshooter 2 also automatically sends us anonymous, aggregate gameplay analytics — for example, which mode, theme, or level was played and whether a run ended in success or failure — tallied as bucketed counts. This analytics data is not personal information and can't be used to identify you or build a profile of you over time: it carries no advertising ID, no persistent device ID, no cookie, and we don't retain your IP address with it, only a random identifier that rotates every day and can't be linked across days, across sessions, or across other apps. It is processed on our behalf by Cloudflare, a subprocessor running infrastructure we control, and is never shared with any advertising or analytics network. There's no separate opt-in prompt for this analytics because there's nothing personally identifying to consent to; see "Subprocessors" below for the technical detail. Some games separately offer optional, opt-in leaderboards and friends features (for example, Spellshooter 2's leaderboards, available on web and in the app). If you turn one of these on, our backend provider (Google Firebase) receives an anonymous player ID, the player name/alias you choose, your friend code, and the scores you submit, so we can display global and friends leaderboards; Google also processes your device's IP address as part of the App Check / reCAPTCHA check we use to block abuse of that feature. Leaderboards and friends features remain off unless you opt in. In the app, if you make a purchase (such as unlocking Deluxe) or watch a rewarded video ad, our billing and advertising providers process limited purchase and advertising data as described under "Subprocessors" below. The web preview does not sell anything and does not show ads today. The web preview's code does include a dormant, test-mode ad-serving code library (Google Ad Manager) that is not connected to a live advertising account, does not request or display any ad, and does not send any advertising data anywhere in its current configuration; before any ad is actually shown on the web preview, we will update this policy with full advertising disclosures and add a consent notice for EEA/UK visitors — see "Subprocessors" below. If you email us, we receive the information you send, including your email address and message contents.

If you join a product beta waitlist (for example, for Spellshooter 2, Alpenkeep, or Ampledger), we collect the email address you provide, which product you're interested in, and an optional short message about what you're hoping to use it for. We use this only to notify you about beta access for that specific product. We do not sell this information or use it for advertising. You can request access, correction, or deletion of your waitlist entry at any time by emailing us.

Ampledger stores your account, panel photos, breaker labels, notes, and sharing settings using Supabase, our backend database, authentication, and file-storage provider. When you use Ampledger's photo-based panel reconstruction feature, the full-panel and close-up directory photos you capture (plus any caption or note you add and technical details like image size and orientation) are sent to OpenAI, a third-party AI service provider, which returns a suggested breaker map and labels for your review — see "AI-assisted and third-party-processed features" in our Terms and "Subprocessors" below. Ampledger does not use these photos for advertising or to train its own AI models.

Alpenkeep stores your account, ski profiles, uploaded ski photos, maintenance and ski-day history, and sharing settings using Supabase, our backend database, authentication, and file-storage provider. If you use Alpenkeep's trip-planning "which skis to bring" guidance, we send an approximate location and date range to Open-Meteo, a weather-data provider, to fetch a forecast or historical conditions snapshot; no account identifier accompanies that request. If you use Alpenkeep's optional Trip Intelligence feature to turn a free-text trip note into trip settings, we also send that text, your trip defaults, the full list of your household's skier/profile display names, and our full resort-name catalog (not just the names you typed) to OpenAI, a third-party AI service provider, for interpretation, along with a pseudonymous, one-way hashed account identifier; this feature does not automatically include your account login credentials, and we do not send your account email, password, or payment information to OpenAI automatically — only what you type into the free-text trip note is sent as written, so avoid entering sensitive information there — see "AI-assisted and third-party-processed features" in our Terms and "Subprocessors" below.

AlpenForm stores your account, injury and readiness flags, baseline and workout performance data (including one-arm-plank hold times and measured cycle power and body mass, if you complete those optional tests), Apple Health data you choose to authorize (such as heart rate, heart rate variability, resting heart rate, and active energy), workout and training history, elevation and travel timing you provide, and equipment or Carv-import photos, using Supabase, our backend database, authentication, and file-storage provider. Apple Health data is used solely to power AlpenForm's health and fitness features, such as readiness-based training adjustments, and is never used for advertising or shared with data brokers. Apple Watch sync is off by default; turning it on is a separate, explicit action that sends your selected workout and a short-lived access credential to your paired Watch, and disabling sync, logging out, or switching accounts clears that Watch-side data. If you use AlpenForm's optional AI features — reordering your already-eligible exercises within a workout, or extracting equipment or Carv values from a photo you choose to submit — OpenAI, a third-party AI service provider, receives only the limited information described under "Subprocessors" below; AlpenForm never sends OpenAI your name, email, injury or readiness data, Apple Health data, or other raw health telemetry, and OpenAI cannot invent or change your training prescription — it can only reorder exercises we've already screened as safe for you. Photos and Carv files you submit for AI extraction are processed only in memory and are not retained by AlpenForm once you review and confirm the extracted values. AlpenForm does not use your health, injury, or readiness data for advertising, and does not sell it.

How we use information

We use information to provide and improve Snowshack products, respond to support requests, operate subscriptions or purchases, fix bugs, protect our services, and comply with legal obligations.

Subscriptions, purchases, and third-party services

Some Snowshack products may offer subscriptions, in-app purchases, analytics, crash reporting, cloud services, or advertising. Payments made through an app store are processed by that app store. We do not receive your full payment card details from Apple or other app stores.

If a product uses third-party services, those providers may process information on our behalf or under their own policies. We aim to choose providers that protect user information appropriately. Product-specific privacy details will be kept up to date as each app launches and changes.

Subprocessors

Where a specific product feature depends on a named third-party subprocessor, we list it here so it's easy to see exactly who touches your data and why.

• Cloudflare — hosts the analytics endpoint that automatically receives anonymous, aggregate gameplay analytics (bucketed counts such as mode/theme/level played and win/loss outcome) from Spellshooter 2's web preview and app by default. No advertising ID, cookie, or IP address is retained; the only identifier is a random value that rotates daily and cannot be linked across days, sessions, or other apps. Cloudflare acts purely as infrastructure for us and does not use this data for its own purposes. See Cloudflare's privacy policy at cloudflare.com/privacypolicy.
• Google Firebase (Firestore, Cloud Functions, App Check/reCAPTCHA Enterprise) — powers Spellshooter 2's optional, opt-in leaderboards and friends features. Processes an anonymous player ID, your chosen player name/alias, friend code, and submitted scores, plus your device's IP address for App Check/reCAPTCHA abuse prevention. Only active if you opt in to leaderboards or friends; see Google's privacy policy at policies.google.com/privacy. In the app, you may also optionally connect a Game Center (Apple) or Google Play Games account to your player profile; this shares a platform account identifier with us through Firebase to link the accounts, not your Apple ID or Google account email or other account details, and remains off unless you choose to connect it.
• RevenueCat — processes in-app purchases in the Spellshooter 2 app (Deluxe unlock and similar one-time purchases). Receives an anonymous purchaser ID and purchase/entitlement history so we can validate and restore purchases; it does not receive your name, email, or payment card details. See RevenueCat's privacy policy at revenuecat.com/privacy.
• Google AdMob — shows optional rewarded-video ads in the Spellshooter 2 app's free tier (never shown to Deluxe purchasers). Ads are non-personalized: AdMob receives device and ad-interaction data needed to serve and measure the ad, but we configure it not to use your data for personalized advertising and we do not show an ad-tracking (ATT) prompt. See Google's privacy policy at policies.google.com/privacy.
• Google Ad Manager — the Spellshooter 2 web preview's code includes an ad-serving library from Google Ad Manager that is currently in test mode only: it has no live ad account, ad units, or network configuration attached, requests no ads, and processes no advertising data. We will expand this entry with full details (what's collected, non-personalized-ads configuration, and an EEA/UK consent notice through a certified consent-management platform) before any ad is actually shown on the web preview. See Google's privacy policy at policies.google.com/privacy.
• OpenAI — processes limited data for optional, off-by-default AI features in three products. For Ampledger's photo-based panel reconstruction, we send the full-panel and close-up directory photos you capture, any caption or note you add, and basic image metadata (size, rotation, crop) to OpenAI's API, which returns a suggested breaker map and labels for your review. For Alpenkeep's optional Trip Intelligence feature, we send the free-text trip brief you type, your trip defaults (dates, max skis, preferences), the full list of your household's skier/profile names and our resort-name catalog (so the AI can match what you typed against the right options, not just the ones you mention), and a pseudonymous, one-way hashed account identifier to OpenAI's API, which returns a structured interpretation (dates, resort, skier selection, ski count) for your review before it's applied; we do not automatically send your account email or other account credentials to OpenAI — whatever you type into the free-text trip note is sent as you wrote it, so avoid entering sensitive information there, and the household skier/profile names above may be real names if you entered them that way. For AlpenForm's optional workout-ordering feature, we send only your normalized workout intent (target training phase, duration, and categories), the IDs, names, and categories of exercises we've already screened as eligible and safe for you, and an anonymized, HMAC-derived identifier used only to detect abuse — never your name, email, injury or readiness data, Apple Health data, or other raw health telemetry; OpenAI can only reorder the exercises we send it and cannot create or change your prescription. For AlpenForm's optional equipment- and Carv-photo extraction feature, we send only the image you select, with identifying metadata stripped before transfer; the image is not retained by AlpenForm after processing, and you must review and confirm any extracted values before they're saved. In no case do we automatically send your email or account credentials to OpenAI as part of these requests, outside the Alpenkeep skier/profile names disclosed above and whatever you type into Alpenkeep's free-text trip note. Per OpenAI's API terms, data submitted through its API is not used to train OpenAI's models by default; note that OpenAI's store: false request setting does not guarantee zero retention on OpenAI's side — under OpenAI's default abuse-monitoring controls, prompts and responses may be retained for up to 30 days. See OpenAI's privacy policy at openai.com/policies/privacy-policy and its current API data-usage terms.
• Supabase — provides the backend database, authentication, and file storage for Ampledger (accounts, panel photos, breaker labels and notes, sharing settings), Alpenkeep (accounts, ski profiles, uploaded ski photos, maintenance and ski-day history, sharing settings), and AlpenForm (accounts, injury and readiness flags, baseline and workout performance data, Apple Health data you authorize, workout and training history, equipment photos, and confirmed Carv-import values). Supabase acts as infrastructure for us and does not use this data for its own purposes. See Supabase's privacy policy at supabase.com/privacy.
• Open-Meteo — supplies weather forecast and historical-conditions data for Alpenkeep's trip-planning "which skis to bring" guidance. Receives an approximate location and date range, not an account identifier or other personal information. See Open-Meteo's terms and privacy information at open-meteo.com/en/terms.

Children

Snowshack apps and games are not directed to children under 13. We do not knowingly collect personal information from children under 13. If you believe a child has provided personal information to us, contact us and we will take appropriate steps to delete it.

Data retention and deletion

We keep information only as long as reasonably needed for the purposes described in this policy, unless a longer period is required by law, dispute resolution, security, or legitimate business needs. You can request access, correction, or deletion by emailing us.

Your choices

You can choose not to provide optional information, disable device permissions such as location where supported by your operating system, unsubscribe from marketing messages if any are sent, and request deletion of account data where applicable.

California privacy rights (CalOPPA)

This section applies to California residents under the California Online Privacy Protection Act (CalOPPA). The categories of personal information we collect and the categories of third parties with whom we may share it are described above in "Information we collect" and "Subscriptions, purchases, and third-party services." California residents may request access to, correction of, or deletion of their personal information by emailing [email protected], and we notify users of material changes to this policy as described in "Changes."

Do Not Track. Some browsers offer a "Do Not Track" (DNT) setting. Because there is no industry-standard way for websites to interpret DNT signals, the Snowshack website does not currently respond to them. We will update this policy if that changes.

Third-party tracking. The Snowshack website does not use third-party analytics or advertising cookies to track you across other websites over time. Pages do load fonts from Google Fonts (fonts.googleapis.com and fonts.gstatic.com), which receives your device's IP address to serve those font files — this is a technical request to display text correctly, not an advertising or tracking integration. The Spellshooter 2 web preview also includes a dormant, test-mode Google Ad Manager code library (see "Subprocessors") that does not request ads or set any cookies in its current configuration. If a Snowshack product later allows third parties to collect personally identifiable information about your online activities across different websites, we will disclose it here.

Security

We use reasonable technical and organizational measures to protect information. No method of transmission or storage is perfectly secure, but we work to keep Snowshack products appropriately protected.

Changes

We may update this policy as Snowshack products evolve. The updated version will be posted here with a new effective date.