Careful with guest and patient information.

Each mountain is walled off.

One mountain can never see another's records.

• Every record belongs to one mountain, and every request is checked against the mountain you are signed in to.
• Signing in to one mountain gives no way to ask for another's data, by name or by number.

Every release is tested by creating a second mountain, signing in as it, and trying every page and action against the first mountain's records. A release does not ship if any of them get through.

Access by role.

People see what their job needs.

• Counter, patrol, instructor, staff and manager roles each get their own menu.
• Within patrol, the director sets what each access level can do: open cases, approve them, manage medications, release records.
• Each document category lists which roles can see it and which can add to it.
• Only managers see what assets cost, what they are worth, and vendor account numbers.
• Turn off an app and its pages stop working for everyone at that mountain, not only the menu.

Signing in.

Strong where you need it, quiet where you don't.

• Passkeys: sign in with a fingerprint, face or the phone's own PIN. Nothing to phish or guess.
• Owners, managers and patrol must use a passkey or an authenticator app. You can require it for everyone.
• Sensitive actions, like a large refund or downloading patient records, ask you to confirm it is you, even when signed in.
• Shared counter computers are enrolled by a manager, and staff switch in with a personal PIN, so nobody shares a login.
• A sign-in from a new device is emailed to the person, and seasonal logins stop at the end of the season.
• Screens sign themselves out after 15 minutes without activity.
• Passwords are stored hashed, never readable. Changing one signs out every other device.
• Signing out ends the session on our side too, and a session left unused for an hour ends on its own.
• Ten wrong passwords lock that login for 15 minutes, and passwords already exposed in other sites' breaches are refused.
• The employee-entrance time clock is paired to your mountain by a manager before it works.
• Our own operator console needs a named login with a password and an authenticator code.

A record of what happened.

Questions about who did what have answers.

• Changes are logged with who made them and when.
• Refunds need a reason, and the reason is kept.
• Policies and manuals keep up to 10 versions each, and you can restore an older one.
• Ask people to confirm they have read a policy, and see who has.

Patient records that hold up.

A care record should show what happened, including the corrections.

• Nothing is deleted. A wrong vital, injury or treatment is marked entered in error, with a reason, and stays on the record struck through.
• Every submit and every approval keeps a frozen copy of the whole report.
• An entry typed long after the time it records says when it was typed, and times in the future are refused.
• Refusal of care and the hand-off to EMS are signed on the phone. A patient who cannot decide cannot refuse, and a guardian signs for under-18s.
• Medications can only be recorded as given by someone your medical director allows, from your formulary.
• Records requests are logged, and only the approved version is released, with a release number. A legal hold stops any change to the case.
• Entries made without signal are kept on that phone, locked with a key tied to the person who typed them, and sent once. Signing out on purpose clears them from the phone.

Phone alerts.

Fast, without carrying the chart.

• Alerts go only to the phones a patroller turned them on for, and are encrypted from our servers to the phone.
• An alert says where the call is and what was reported. The patient's record stays behind the sign-in.

Waivers you can stand behind.

Signed, not just ticked.

• Each signing keeps the drawn signature, the typed name, the time, the device, and the exact wording signed.
• Every version of your wording is kept, and a mistaken waiver is voided with a reason, never erased.
• Removing a guest's personal details keeps their signed waivers, the mountain's legal record.

Payments.

Card and bank numbers never touch DAY/OS.

• Guests pay for tickets, lessons and gifts on Stripe's own checkout page.
• Your DAY/OS subscription is paid the same way, by card, bank account or Stripe invoice.
• We keep only what Stripe tells us happened: paid, refunded, failed.
• A double tap is not a double charge: each payment request is sent to Stripe once.

Your data is yours.

Leaving should not mean losing your records.

• Customers, sales, payments, refunds, incident reports, signed waivers and asset costs download as spreadsheets whenever you want them.
• Turning an app off never deletes its records.
• If a subscription lapses, everything stays readable and exportable, and patrol keeps working.
• DAY/OS runs on Google Cloud in the United States, with daily database backups.