Privacy Policy
Last updated: September 28, 2026
This site is run by Maxwell Kroll, an individual in Massachusetts doing business as SnowTop ("we", "us"). Maxwell and his mom host three vacation homes. This page says what we collect when you use this site, who helps us handle it, and what you can ask us to do with it. We don't sell your information.
1. What we collect
- What you give us when you book, sign in or message us: name, email, phone, dates, party size and anything you write to us.
- Payment details, which go to Stripe. We see the amount and the last four digits, never the full card number.
- What you type into the AI chat assistant (see section 4).
- Basic technical information when you visit: your IP address, in our hosting logs, and the anonymous visit counts described in section 5.
2. How we use it
- To take and manage your booking, and send your confirmation and arrival details.
- To email you about your booking or request, and, if you ask to be told when dates open up, that one alert. We don't send marketing email: no newsletters, no offers, no reminders to finish a booking.
- To answer your messages and help during your stay.
- To keep the site working and to stop fraud and abuse.
3. Who else handles it
We don't have property managers or agents; we run the homes ourselves. These services handle data for us, only to do their job:
| Service | What it does for us | What it sees |
|---|---|---|
| Stripe | Takes card payments and refunds | Name, email, card details (we never see the full card number), amounts |
| Hostfully | Our booking calendar and property management system | Name, email, phone, dates, party size, special requests |
| WorkOS | Account sign-in | Name, email, sign-in details |
| Resend | Sends booking and arrival emails, and the dates-open alert if you ask for one | Name, email, the content of those emails |
| Anthropic | Powers the AI chat assistant | Whatever you type into the chat |
| Sentry | Tells us when the site breaks | Technical details of errors, which can include the page or request that failed |
| Umami | Only if we switch it on: counts visits so we know which pages help | Pages viewed, referrer, device type; no cookies and no profile of you |
| Vercel | Hosts the website | Standard web request logs, including IP address |
| Neon | Hosts our database | Everything we store about bookings, accounts and messages, our daily visit totals (nothing that identifies you), and the counters that limit how many requests one visitor can send (a keyed hash of your IP address, never the address itself) |
| Upstash | Only if we switch it on: keeps those request counters instead of our database | A keyed hash of your IP address, in a counter that deletes itself within an hour |
Links such as "Open in Google Maps" take you to that company's own site, under its own privacy policy. Our pages don't load maps or anything else from Google.
We may also share information when the law requires it.
4. The AI chat assistant
The chat assistant on this site is an AI, run by Anthropic. What you type into it is sent to Anthropic to write the reply. If you're signed in, we keep the conversation with your account so we can follow up; if you're not, we don't store it. It can be wrong, so check anything important with us, and please don't type card numbers, door codes or other sensitive details into it.
5. Cookies and analytics
We use a few cookies the site needs to work: one keeps you signed in, and one lets you come back to a booking you started. We don't use advertising cookies.
We count visits ourselves, without cookies. When you leave a page, your browser tells our server what kind of page it was (the home page, a home's page, checkout; never its address), whether you're on a phone or a computer, how quickly it loaded and responded, whether you viewed a home, picked dates or reached checkout, and, once per visit, the campaign tag or the website of the link that brought you here (for example "google.com"). We add these to daily totals. We don't store your IP address, your browser's details, the page's address or anything else that identifies you, and we don't build a profile of you. Some browsers and blockers stop this count, and that's fine. If we switch on Umami (see section 3), it counts visits the same cookie-free way.
The site also keeps a few things in your browser's own storage (not cookies). They stay on your device except when the site uses them for what they're for. Until you close the tab: the campaign tag of the link you arrived by, so a booking can record which campaign brought it; which of the steps above were already counted, so each counts once; and short-lived markers so a payment confirmation shows and is counted only once, and the page reloads at most once after we update the site. Until you clear it: a friend's referral code from their link, so it applies when you book; your recent searches and your saved and recently viewed homes; and, if you join a group trip plan, the name you gave and a key for your votes. Once you've booked, the phone you open your trip page on keeps that trip, so the page works with no signal: the home, your dates and directions, and the receipt with the email you booked with, stay for a year after check-out unless you remove them with the button on the trip page. The Wi-Fi details, and a door code if we've saved one for the home, are kept only from 3 days before check-in until 12 hours after check-out, and are deleted the next time any page of this site is opened on that phone after that.
6. How long we keep it
| Information | How long |
|---|---|
| Bookings and payment records | As long as tax and accounting rules require. On request we remove your contact details from past bookings we no longer need them for. |
| Your account | Until you ask us to delete it. |
| Messages to us, and chat conversations while signed in | Until you ask us to delete them. |
| Rate-limit counters (a keyed hash of your IP address) | Each counts requests for an hour at most, and is deleted automatically after that. |
| Visit counts (daily totals; nothing that identifies you) | 13 months, then deleted automatically. |
| Addresses given to our former email sign-up (we no longer send to them) | Until you ask us to delete them. |
| Error reports and hosting logs | Deleted automatically by Sentry and Vercel under their standard retention. |
7. Your rights
Wherever you live, you can ask us to:
- Send you a copy of the information we hold about you
- Correct something that's wrong
- Delete your information, except records the law requires us to keep
There's no self-service button for this yet. Email us and we'll do it by hand, and reply within 30 days. We may ask you to confirm it's you first.
8. Security
The site uses encrypted connections and card payments are handled by Stripe. No system is perfectly secure, so if we ever learn of a breach that affects you, we'll tell you.
9. Contact
Privacy questions and requests: maxwell@staysnowtop.com or (774) 254-5289.