Transparency about your data
Privacy Policy
This policy explains which personal data the public website and ShootingPlaner process, why it is needed and which rights individuals have.
1. Controller and contact
The controller is [Rechtlichen Namen oder Firma ergänzen], [Vollständige Postadresse ergänzen]. Privacy requests may be sent to support@shootingplaner.ch.
The operator details must be completed before publication. No data protection officer or EU representative is documented; their contact details will be added if legally required.
2. Scope and legal grounds
This policy covers www.shootingplaner.ch, planer.shootingplaner.ch and their project, invitation and sharing features. Swiss data-protection law applies. Where the GDPR applies, processing relies in particular on contract performance, consent, legal obligations and legitimate interests in secure and economical operation.
3. Data categories and sources
We process account and profile data such as name, email, mobile number, date of birth and profile image; authentication and security data; project, role, scheduling, packing-list, location and contract data; images, filenames and selected EXIF metadata; ratings, shares, feedback and technical usage data.
Data comes from registered people, project owners inviting participants, uploaded files, sharing interactions and integrated services. Anyone entering another person’s data must inform them appropriately and be authorised to do so.
4. Public website and server logs
The public website is delivered statically. It uses no analytics, ad trackers or externally loaded fonts. Images, fonts and the demo video are served by our web server; a connection to an external destination is made only after clicking a link.
The server infrastructure necessarily processes information such as IP address, time, requested URL, referrer, browser identifier and response status to deliver content and maintain stability and security. Hosting: [Produktiven Hostinganbieter und Serverstandort ergänzen]. The log-retention period must be added before publication.
5. Registration, profile and sign-in
For an account we process names, email, mobile number, date of birth, an optional profile image and either a password hash or external Google identity. Email-confirmation tokens are valid for 24 hours. Passwords are not stored in plain text.
Sign-ins use secure HttpOnly cookies. Access tokens last 15 minutes; refresh sessions end after 30 days of inactivity and no later than 90 days. Security events exclude passwords, tokens, IP addresses and user agents and are purged after 90 days.
6. Projects, participants and contracts
Planning data includes project title and description, status, roles, participations, date options and responses, schedules, personal packing lists, locations, sharing settings and, where used, contract parties, addresses, country references and versioned contract text.
Project information is provided only to people authorised by role, accepted participation or a valid sharing token. Some functions intentionally work without an account, so each link must be treated as an access key.
7. Images and metadata
Profile, reference, location, feedback and album images are validated and converted into necessary variants. Album originals may also be stored privately. Sanitised filenames, local capture time and GPS coordinates from EXIF may be stored for album images and are available only in designated owner views.
Image files are stored in a private Cloudflare R2 bucket. Rights are used only for storage, processing and user-selected delivery. Content is not used to train AI models.
8. Invitations, email and support
We send registration, project, scheduling and notification emails to the supplied addresses. Production delivery provider: [Produktiven E-Mail-Dienstleister und Serverstandort ergänzen]. Content and delivery metadata are limited to what is necessary.
For support or feedback we process contact details, the message, technical context and voluntarily attached images to answer the request and investigate issues.
9. Service providers and recipients
Internally, only people who need personal data for operations and support receive access. Processors may act only on instructions and under appropriate safeguards. The production host and email provider must be named before publication.
10. Google services
For optional Google sign-in, we exchange a technical identifier and profile data required for the account. Existing local accounts are not linked automatically.
Google Maps and Places support address search, maps, navigation and—only when the relevant owner dialog is opened—capture locations. Google may receive IP address, device and browser data, queried addresses or coordinates. External navigation starts only after an intentional link click.
11. Open-Meteo
Weather forecasts are requested from Open-Meteo by the server. Location coordinates, time range and requested measurements are sent, but no account details or sharing tokens. Results are cached in memory for up to 30 minutes and are not persisted.
12. Cookies and similar technologies
The landing page sets no analytics or marketing cookies. The planner uses technically necessary cookies for access, sessions, CSRF protection and Google sign-in. They support the requested authentication and secure operation and are not used for advertising.
13. Retention and deletion
Accounts and project content are generally retained until deletion by an authorised person or account termination. Project data and images are removed together under the applicable domain rules. Expired sessions, tokens and security records follow the periods above.
Other data is kept only as long as needed for contract performance, security, evidence or legal obligations. Exact periods for server logs, backups, support and future billing records must be documented before production.
14. International disclosures
Some providers have companies or subprocessors outside Switzerland and the EEA. Recipient countries and safeguards will be checked and documented before production. Data is disclosed only where protection is adequate or suitable safeguards such as recognised standard clauses and additional measures apply.
15. Security
Measures include encrypted transmission, password hashing, short-lived rotating sessions, private object storage, server-side authorisation, input validation, rate limiting and data-minimised security records. No method can guarantee absolute security.
16. Individual rights
Within the law, individuals may request access, correction, deletion, release or transfer of their data, restriction or objection, and may withdraw consent for the future. Contact support@shootingplaner.ch; proof of identity may be required to prevent unauthorised disclosure.
Complaints may be made to the Swiss Federal Data Protection and Information Commissioner or, where the GDPR applies, a competent European supervisory authority.
17. Changes
We update this policy when features, providers or laws change. The current version and date are published here. Material changes will also be communicated appropriately.