Privacy Policy

Account Information:

• First name
• Email address

Authentication: If you sign in via Google or Apple, we may receive your name and email address from those providers.

Subscription Information: Subscriptions and in-app purchases are processed by Apple App Store or Google Play. Subscription validation and management are handled via RevenueCat. We do not store credit card details.

Automatically Collected Data:

• IP address
• Device type
• Operating system version
• App version
• Basic usage data (e.g., learning progress)

We process your personal data on the following legal grounds (Art. 6 GDPR / Art. 31 nFADP):

• Account creation, authentication, subscription management — performance of contract (Art. 6(1)(b) GDPR)
• Waitlist email signup — your consent (Art. 6(1)(a) GDPR), which you may withdraw at any time
• Security, fraud prevention, service stability — our legitimate interests in operating a secure service (Art. 6(1)(f) GDPR)
• Aggregated usage analytics — our legitimate interests in improving the App (Art. 6(1)(f) GDPR)
• Responding to support requests — performance of contract (Art. 6(1)(b)) or legitimate interest (Art. 6(1)(f))

We do not sell personal data. We do not perform automated decision-making with legal or similarly significant effects (Art. 22 GDPR).

Advertising: we do not use personal data to target advertising at you, and we do not build advertising profiles. We use personal data for advertising in one narrowly limited way: we share hashed (irreversibly encoded) email addresses with Meta Platforms so that people who have already joined our waitlist or created an account can be excluded from seeing our ads. The purpose is to avoid showing you advertising for something you already have. The legal basis is our legitimate interest in not wasting advertising on existing users and not bothering them with irrelevant ads (Art. 6(1)(f) GDPR / Art. 31(1) nFADP). You can object to this at any time (Art. 21 GDPR) by contacting us, and we will remove your address from that suppression list.

User data is stored on infrastructure hosted in the European Union (Frankfurt, Germany). We apply appropriate technical and organizational measures (Art. 32 GDPR / Art. 8 nFADP), including encryption in transit and at rest, access controls, and audit logging.

Transfers outside Switzerland and the EU/EEA:

• RevenueCat (United States) — subscription management. Transfer is protected under the EU-US Data Privacy Framework and Swiss-US Data Privacy Framework (RevenueCat is DPF-certified).
• Apple Inc. (United States) — payment processing and authentication for iOS users (independent controller).
• Google LLC (United States / Ireland) — payment processing and authentication for Android users (independent controller).
• Meta Platforms Ireland Ltd. (Ireland, with onward transfer to Meta Platforms, Inc. in the United States) — hashed email addresses used only to exclude existing users from our advertising (joint controller for this operation). Transfer is protected under the EU-US Data Privacy Framework and the Swiss-US Data Privacy Framework (Meta is DPF-certified).

For transfers to processors in countries without an adequacy decision, we rely on Standard Contractual Clauses (Art. 46(2)(c) GDPR) or DPF adherence (Art. 45 GDPR; Art. 16 nFADP).

We share personal data only with the following categories of recipients:

• Apple Inc. — payment processing and Sign in with Apple (independent controller — governed by Apple's privacy policy)
• Google LLC — payment processing and Sign in with Google (independent controller — governed by Google's privacy policy)
• RevenueCat, Inc. — subscription management and validation (data processor under Art. 28 GDPR, bound by Data Processing Agreement)
• Amazon Web Services EMEA SARL — cloud hosting and authentication (Cognito) in Frankfurt, Germany (data processor under Art. 28 GDPR, bound by Data Processing Agreement)
• Meta Platforms Ireland Ltd. — hashed email addresses, shared for the sole purpose of excluding existing waitlist members and account holders from our advertising (joint controller for this operation under Art. 26 GDPR). We do not share personal data with Meta to target advertising.

We do not share personal data with any other third parties except where required by law (Art. 6(1)(c) GDPR).

Under the GDPR (for users in the EU/EEA) and the Swiss Federal Act on Data Protection (nFADP, for users in Switzerland), you have the following rights:

• Access — request a copy of the personal data we hold about you (Art. 15 GDPR / Art. 25 nFADP)
• Rectification — correct inaccurate or incomplete data (Art. 16 GDPR / Art. 32 nFADP)
• Erasure — request deletion of your data ("right to be forgotten") (Art. 17 GDPR / Art. 32 nFADP)
• Restriction — limit how we process your data (Art. 18 GDPR)
• Portability — receive your data in a structured, machine-readable format (Art. 20 GDPR)
• Objection — object to processing based on legitimate interests (Art. 21 GDPR)
• Withdraw consent — where processing is based on consent, you may withdraw it at any time without affecting the lawfulness of past processing (Art. 7(3) GDPR)
• Lodge a complaint with a supervisory authority:
  • Switzerland: Federal Data Protection and Information Commissioner (FDPIC) — edoeb.admin.ch
  • EU users: your national data protection authority (e.g., UODO in Poland, BfDI in Germany)

To exercise any of these rights, contact us at swissli.support@gmail.com. We will respond within 30 days (Art. 12(3) GDPR). Exercising your rights is free, except for manifestly unfounded or excessive requests.

Providing your email and name is required to create and maintain your account. Without this data, you cannot use the App.

We retain personal data only as long as necessary for the purposes described in this policy:

• Account data (name, email) — for the duration of your account, deleted within 30 days of account closure
• Subscription and payment records — 10 years (mandatory under Swiss Code of Obligations Art. 958f for accounting records)
• Security and access logs — 90 days, then deleted or anonymized
• Waitlist email — until you unsubscribe or for a maximum of 24 months from signup
• Support correspondence — 24 months from last contact
• Backups — overwritten on a 30-day rolling basis

To delete your account, send an email request to the contact address below. Requests are processed within 30 days.

Swissli is not directed to children under 16. We do not knowingly collect personal data from children under 16 without verifiable parental consent (Art. 8 GDPR; Art. 21 nFADP). If you believe a child under 16 has provided us with personal data, contact us and we will delete it.

In the event of a personal data breach likely to result in a risk to your rights and freedoms, we will notify the competent supervisory authority within 72 hours of becoming aware of the breach (Art. 33 GDPR) and, where the risk is high, will inform affected users without undue delay (Art. 34 GDPR; Art. 24 nFADP).

Data Controller:

Swissli is operated by an independent developer based in Switzerland.

Email: swissli.support@gmail.com

Full operator details, including legal name and postal address, will be published when the application launches (Summer 2026). For data subject requests in the meantime, please contact the email address above.

No EU representative is currently appointed under Art. 27 GDPR, as processing of EU residents' data is occasional and limited in scope (waitlist email signup only). This will be reviewed and updated upon product launch.