Privacy policy

NYC Nordic Ski (https://nycnordicski.com) · Last updated September 28, 2026

NYC Nordic Ski is a small community board where New Yorkers post ski trips and outings and join each other's. This page says what we keep about you, why, who can see it, and how to get a copy or have it erased — written to work whether or not a privacy law like the EU's GDPR or California's CCPA applies to you.

What we collect

From Google, when you sign in with Google: your email address, your name (only to suggest a display name for you), and Google's internal account ID for you. We do not receive your Google password, contacts, calendar, files, or any other Google data, and we don't store your profile picture.

What you add yourself: the display name you choose, what you write on your application to join, an optional phone number, the trips and outings you post or join, and comments you write.

Technical data: a sign-in cookie that keeps you logged in (necessary for the site to work, lasts up to 30 days, deleted when you sign out), a short-lived cookie that carries one-time messages such as "Profile saved", and standard web-server logs (which include IP addresses) used for troubleshooting and blocking abuse. Every cookie this site sets is strictly necessary to run it — there is no advertising, no analytics, and no third-party tracker — so there's nothing to ask your permission for and no cookie banner.

Why we're allowed to process it

For readers where this matters (for example under the EU/UK GDPR): we process your sign-in and profile information because it's necessary to provide the service you asked for — an account, and a trip board that works — which is our legitimate interest in running the site and, once you're a member, the basis of our arrangement with you. We ask for your explicit agreement to the ground rules and this policy when you apply. We don't process anyone's data for advertising or profiling, and we don't need a separate legal basis for that because we don't do it.

Who can see what

• Anyone, even logged out: only general information about the site. Trips are not shown to visitors who aren't logged in, or to people whose application hasn't been approved, and they are not indexed by search engines.
• Approved members: trips (their details and the organizer's display name), who has joined each one, and its comments.
• The site's organizers: your email address, your name, your application answers, and any private note they add when reviewing your application. Members never see these.
• Only the driver or organizer and confirmed riders on the same trip: each other's phone numbers, if provided.
• Nobody else: your email address is never shown to other members. The people who run this site can access the database that holds it.

Who we share it with

We do not sell, rent, or trade your personal information, to anyone, for any reason — including under California's definition of "sale" and "sharing" for cross-context advertising, neither of which we do. A short list of services that process it on our behalf, each bound to use it only to provide that service:

• Google — processes your sign-in when you use "Continue with Google". See Google's privacy policy.
• Hetzner Online GmbH (Germany) — hosts the server this site runs on.
• An email delivery service — only once we turn on email notifications, and only to send you the emails this site would send you (sign-in links, trip updates). We'll name the provider here before that happens.

We may disclose information if the law requires it, or to protect the safety of our members.

International transfers

The site's server is hosted with Hetzner; Google's sign-in processing may occur in the United States or elsewhere Google operates. If you're in the EU or UK, this can mean your data is processed outside your country, under safeguards those providers publish (for Google, see the link above).

Google user data

NYC Nordic Ski's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. We request only the basic sign-in scopes (openid, email, profile), and we use that information only to create and identify your account on this site.

Automated decisions

We don't use your data to make any automated decision about you. Membership applications are decided by a person.

How long we keep it

We keep your information while your account exists — including if your application is still pending or wasn't approved, until you delete your account or ask us to. We don't currently delete inactive accounts automatically; if you'd like your data removed and no longer want to keep an account, see "Your rights" below.

Your rights, and how to use them

Wherever you are, you can do the following yourself, any time, from your profile page once you're signed in — no need to write to us:

• Access and portability — "Download my data" gives you a JSON file with your profile, application, trips, and comments.
• Rectification — edit your name and phone number directly on your profile.
• Erasure ("right to be forgotten") — "Delete my account" removes your name, phone number, application, and Google sign-in, and signs you out everywhere. We keep the account record and any comments you've posted, but with everything that identifies you removed — comments show as posted by "Former member" — so that conversations and trips other members were part of still make sense. If you'd like those removed too, contact us.
• Withdraw consent — deleting your account withdraws it.

If you can't sign in — you've lost access to your Google account, for instance — or you want something the self-service tools don't cover (for example, removing a comment's text entirely, or a question about what we hold), contact us at the address listed on this site's home page. We'll ask enough to confirm the request is really about your own account, and respond within 30 days (45 for California residents, extendable once if a request is unusually involved, in which case we'll tell you). Restriction and objection — if you'd like us to pause processing your data while a request is being sorted out, ask; the simplest way we can do that today is deleting the account (see above) and, if you want to come back afterward, reapplying.

Signing out removes the sign-in cookie from that browser without deleting anything; "Sign out on all devices" on your profile page ends every session, also without deleting anything.

If you're in the EU or UK and think we've mishandled your data, you can lodge a complaint with your local data protection authority. California residents can contact the California Privacy Protection Agency. We'd appreciate the chance to sort it out directly first.

Security

The site is served over HTTPS. We store no passwords, because you sign in through Google. Sign-in sessions are stored only as one-way hashes.

Children

The site isn't directed at children under 13 (or under 16 in the EU/UK), and we don't knowingly collect their information. If you believe a child has an account, contact us and we'll remove it.

Changes

If this policy changes, we'll update the date at the top. Material changes will be announced on the site.

Contact

Questions about this policy? Get in touch with the site's organizers through the community.