Privacy Policy

Last updated: 16 July 2026

1. Controller

The controller responsible for data processing in connection with PowrFlats is:

PowrFlats
Florian Aerni
Harstrasse 94
4052 Basel, Switzerland
Email: powrflats@gmail.com

This policy follows the Swiss Federal Act on Data Protection (revFADP), the EU General Data Protection Regulation (GDPR) where applicable, and — for users in the United States — applicable US state privacy laws (see section 10).

2. Data we process

  • Account data: email address, optional display name, password (stored only as a bcrypt hash) or your Google account identifier when using "Sign in with Google", language preference.
  • Flat content: data you and your flatmates enter in the app — calendar tasks, grocery lists, expenses and settlements (CHF), pet and plant care, community content (chat, laundry schedule, events).
  • Push subscriptions: the technical endpoints of your browser/device used to deliver Web Push notifications.
  • Usage counters: monthly per-flat counters (e.g. push notifications sent, Matey requests) used to enforce plan limits.
  • Plan status: the selected plan (Free/Pro) and its expiry date. We currently process no credit-card data; if a payment provider (e.g. Stripe) is integrated in the future, we will state so here.
  • Technical logs: server error logs for troubleshooting.

We run no tracking, no analytics tools, and no advertising.

3. Cookies

PowrFlats uses strictly necessary functional cookies only: a login (session) cookie, a CSRF protection cookie, and a language cookie. There are no tracking or marketing cookies, so no consent banner is required.

4. Purposes and legal bases

  • Performance of contract (Art. 6(1)(b) GDPR): providing the app's features, account and plan management.
  • Legitimate interests (Art. 6(1)(f) GDPR): security, abuse prevention, troubleshooting.
  • Consent (Art. 6(1)(a) GDPR): push notifications (enabled in your browser and revocable at any time).

5. Recipients and processors

  • Google Sign-In (optional): when you sign in via Google, Google learns of the login event; we receive your email address and account identifier.
  • Google Gemini (Matey): if you use the Matey assistant, your chat messages (and the flat context needed to answer) are sent to Google's Gemini API. A flat may store its own API key (BYOK); Google's terms then apply to the key holder. The key is stored encrypted.
  • Open Food Facts: barcode scans send the product code to Open Food Facts (no personal data).
  • Web push gateways: push notifications are delivered through your browser's push service (e.g. Google FCM, Apple, Mozilla), encrypted in transit.
  • Email delivery: password resets, invitations, and support replies are sent via an SMTP service (Gmail).

6. Storage and security

Data is stored on servers located in Switzerland. Passwords are stored only as hashes; stored integration credentials (e.g. API keys) are encrypted at rest. All traffic uses HTTPS.

7. Retention and deletion

We keep personal data for as long as your account exists. On request to powrflats@gmail.com we delete your account and the personal data tied to it; shared flat content belonging to other members remains with the flat but is detached from your account.

8. Your rights

You have the right of access, rectification, erasure, restriction of processing, data portability, and objection. You may withdraw any consent at any time. Contact powrflats@gmail.com.

You may also lodge a complaint with a supervisory authority — in Switzerland the Federal Data Protection and Information Commissioner (FDPIC), in the EU your local data protection authority.

9. International transfers

Storage takes place in Switzerland (recognised by the EU as providing adequate protection). The services listed in section 5 may process data in the United States; such transfers rely on appropriate safeguards (in particular the Swiss–U.S. or EU–U.S. Data Privacy Framework where the provider is certified, or standard contractual clauses).

10. Notice for US users

For users in US states with privacy laws (e.g. California — CCPA/CPRA): we collect only the categories listed above (identifiers such as email; content you create). We do not sell personal information and do not share it for cross-context behavioural advertising. You have the rights to know, delete, and correct, and to non-discrimination when exercising these rights. Send requests to powrflats@gmail.com; we honour requests equally regardless of your state.

11. Children

PowrFlats is not directed at children under 13, and we do not knowingly collect data from children under 13.

12. Changes

We may update this policy. The version published here is authoritative; for material changes we will notify you in the app or by email.