Privacy policy

Who is responsible

Responsible for processing your personal data in this app (controller under the GDPR and the Swiss Federal Act on Data Protection):

[Company or person], [Street and number], [Postcode and city], [Country]
privacy@example.com

What data we process and why

We only process the data the app needs. We don't use it for advertising and don't sell it.

• Account data such as your name, email address and sign-in details, to provide your account (Art. 6(1)(b) GDPR, performance of a contract).
• Your settings, such as language and appearance, to show the app the way you chose (Art. 6(1)(b) GDPR).
• Your profile picture, if you upload one, and the name the file had, to show it to you in the app; the app's administrators can see it too (Art. 6(1)(b) GDPR). We store it at most 1024 pixels in size and without the information cameras add to photos, such as the location.
• Emails your account needs, such as confirmation links and security notices (Art. 6(1)(b) GDPR).
• If you turn on notifications on a device: the address the push service of your browser gave for it, and the browser and operating system, to send you notifications there (Art. 6(1)(b) GDPR). Notifications travel through that push service, which is run by the maker of your browser; their content is encrypted, so it can't read them.
• Technical data such as IP addresses, the date of your last sign-in, the browser and operating system of a sign-in from a new device (only in the email we send you, not stored), and records of changes administrators make to accounts, to keep the app secure and prevent misuse (Art. 6(1)(f) GDPR, our legitimate interest in a secure service).

Your name and email address are needed to create an account; without them you can only use the public pages. We don't use automated decision-making or profiling.

Cookies

We only use cookies that keep you signed in, remember your settings, and recognize a browser you have signed in with before, for 1 year, so we can email you when your account is used on a new device. There are no tracking, analytics or advertising cookies, so we don't ask for consent. You can delete cookies in your browser at any time; you will then be signed out and your settings reset. The app also keeps its own program files in your browser, so it starts faster and can show a notice when you're offline; they contain no personal data.

Service providers

We use service providers that process data only on our instructions, under a data processing agreement (Art. 28 GDPR):

• Hosting: [Hosting provider, country]
• Sending emails: [Email provider, country]

If a provider is located outside Switzerland or the EU/EEA, data is only transferred to countries with an adequate level of data protection or on the basis of the EU standard contractual clauses.

How long we keep data

We keep your data as long as your account exists. If you delete your account, its data is deleted. A profile picture you replace or remove is deleted right away. Accounts whose email address is never confirmed are deleted automatically after 7 days. IP addresses are only kept in the server's memory, for at most 24 hours, and never stored permanently. Entries in the administrators' change log are kept so it stays clear who changed what; once your account is deleted, your name and email are removed from them 12 months after each change. Backups of the database and of the profile pictures are kept for up to 6 months and then deleted. If a backup ever has to be restored, accounts and profile pictures deleted since then are deleted again right away; for this we keep a note of each deletion, without name or email address, for 12 months. The address for notifications on a device is deleted when you turn them off there, remove the device in the settings, or sign out there; after "sign out everywhere", notifications stop at once and the addresses are deleted within 24 hours.

Your rights

Under the GDPR and the Swiss data protection law you have the right to:

• access the data we hold about you,
• have incorrect data corrected,
• have your data deleted,
• have processing restricted,
• object to processing based on our legitimate interest,
• receive your data in a common, machine-readable format,
• lodge a complaint with a data protection authority, for example in your country of residence, or in Switzerland with the FDPIC.

You can download a copy of your data yourself in your account settings. For any other request about your data, write to:

privacy@example.com

Changes to this policy

We update this policy when the app or the law changes. The date at the top shows the current version.