Privacy policy

CHecked – Discover Swiss spots

Last updated: 28 May 2026

1. Controller

The controller for processing your data within the CHecked app is:

2. What data we collect

At registration

• Email address
• A randomly generated password (hashed with bcrypt, never stored in plain text)
• Optional: display name you choose yourself

When you use the app

• Which spots you have marked as "visited" — with optional date and 1–5 star rating
• Which spots you have marked as "planned"
• When you enable cloud sync: the above data is transferred to our server and linked to your account

Location

When you use the "Spots nearby" feature or the location button on the map, the app requests location permission. Your location is used only locally in the app and is not transferred to our server.

For suggestions and reports

• Suggested spot data (name, category, coordinates, optional notes, location/region via reverse-geocoding through OpenStreetMap)
• Reported issues including your description
• Account association (user ID)

Server logs

When you call our endpoints, our web server logs:

• IP address
• Timestamp
• Requested URL
• HTTP status code
• User agent

These logs are stored for security and performance analysis and automatically deleted after at most 30 days.

3. Purpose of processing

• Account & login: email and password hash are used solely for authentication.
• Visits & planning: enable cross-device storage of your collection.
• Suggestions & reports: enable quality improvements to the spot catalogue.
• Email delivery: initial password on registration and password reset.

We do not use your data for advertising, do not sell it, and do not share it with third parties.

4. Where & how long data is stored

• Location: servers in Switzerland (cyon.ch / Infomaniak for email delivery)
• Database: MariaDB
• Transport: exclusively encrypted via HTTPS
• Duration: account data and visits remain stored as long as your account exists. You can request deletion at any time by emailing support@hung.ch.
• Server logs: at most 30 days

5. Third parties

CHecked uses the following external services:

swisstopo (geo.admin.ch)

Provides the Swiss map tiles. When a map is displayed, your IP address is transmitted to swisstopo. Licence: Open Government Data, BGDI.

OpenStreetMap (Nominatim)

Used when suggesting new spots to derive location and region from coordinates (reverse geocoding). Licence: Open Database License (ODbL).

Infomaniak Mail

Sends registration and password reset emails. Processes the recipient address, email content and delivery metadata. Based in Switzerland.

What we do NOT use

• No analytics or tracking services (Google Analytics, Firebase, Facebook Pixel etc.)
• No ad networks
• No third-party crash reporting
• No social media plugins

6. Your rights (GDPR / CH-FADP)

You have the right, at any time, to:

• Access to data stored about you
• Correction of inaccurate data
• Deletion of your data ("right to be forgotten")
• Data portability (export of your visited/planned data)
• Restriction of processing
• Objection to processing

Please send such requests to support@hung.ch. We respond within 30 days.

7. Local storage on your device

CHecked stores locally on your smartphone:

• Authentication token (for logged-in state)
• Local spot database (SQLite) — updated on every data refresh
• Settings such as the most recently selected map style and timestamp of the last sync

This data leaves your device only when you actively trigger an action (e.g. cloud sync, suggest spot, report spot). When you uninstall the app, all local data is removed.

8. Security

• Passwords are hashed with bcrypt and never stored in plain text
• All server communication runs over HTTPS (TLS 1.2+)
• Authentication tokens are cryptographically random (64 hex characters, 256 bits of entropy)
• No credit card storage — CHecked is completely free and has no in-app purchases

9. Children

CHecked is for users from the age at which your local law allows independent consent to data processing (in Switzerland: no fixed lower limit; in the EU typically 16 years). We do not aim the app at children under 13.

10. Changes to this policy

We may adjust this privacy policy when data processing changes. The current version is always available at this URL. We communicate significant changes additionally via the status message in the app.

11. Delete account

You can delete your account at any time in three ways:

On the web (without the app)

Open checked.hitparade.ch/delete-account, enter your email address and password, and confirm. Your account and all associated data are removed from the server immediately.

In the app

Tap the account icon at the top right → "Delete account" at the bottom. Confirm with your password. Your account and all associated data (visited spots, planned spots, suggestions, reports) are removed from the server immediately.

By email

Write to support@hung.ch from your registered email address or include it in the subject. We confirm receipt and manually delete the account within 30 days.