Privacy policy

Troisroues is a private project run by two natural persons, jointly the controller in the sense of Art. 5 lit. j revFADP:

Tim Fischer and Luca Macchi
Switzerland
support NOSPAM @ NOSPAM troisroues.org

There is no company behind the project. You can reach either of us at the address above for any question about this policy or to exercise your rights.

We process the following categories of personal data:

• Identity and contact data — email address, display name, phone number, country, account creation date.
• Authentication data — what is needed to sign you in and to keep you signed in on your device. Your password itself is never stored in readable form.
• Membership data — your role (Member, Trusted, Diamond, Admin), the user who invited you, the invitations you have issued, and the timestamps of acceptance, revocation, or expiry.
• Event participation data — RSVPs to events, plus-one count, dietary preference, arrival selection, and a free-text note, plus approval / rejection state and timestamps.
• Device data — the push-notification token Apple assigns to your device, so we can send you notifications about RSVPs and events. It is removed when you sign out or delete the app.
• Security and administration log — who did what and when, for administrative actions and security-relevant events such as sign-ins and the use of invitations. For those events the log also holds a pseudonymised network address and a device identifier; a failed sign-in records the attempted email in shortened form. The log never contains your name or your readable email address.
• Technical logs — sign-in and session renewals leave short-lived technical logs with your network address and a pseudonymous account reference, kept for security monitoring and deleted automatically after a short period.
• Public forms (no account) — if you join the iOS-app waitlist or put your name on the door list of an open event, we store the name you gave (for events: first name and surname), your email, the time you submitted, a pseudonymised network address and your browser type. If you signed up through a guest-list link we shared with you personally, we also note that you used it, so your name gets priority at the door. The door list of an open event is seen by our administrators and, on the night, may be shown to the event’s co-host at the door. An event RSVP never leads to an email from us and does not put you on the waitlist. If you join the waitlist, the only email you will receive from it is your invitation to the app once a place opens (sent again if it expires unused); we use the address for nothing else. Neither form creates an account. Legal basis: our legitimate interest in running the event or the waitlist (Art. 31 revFADP; Art. 6(1)(f) GDPR).

We do notprocess special categories of personal data (Art. 5 lit. c revFADP), with one exception: dietary preferences may reveal information about health or religion. We treat these as sensitive, protect them accordingly, and make them visible only to the organisers of the specific event you have RSVP’d to.

The legal bases under Art. 31 revFADP are:

• Performance of the membership relationship — sign-in, RSVP, event invitations, member-to-member invitations, push notifications about your events.
• Legitimate interest — security monitoring, abuse prevention, security logging, and operating the service.
• Legal obligation — responding to lawful requests from competent Swiss authorities.
• Your consent, where applicable — for example when you opt in to push notifications via the iOS system prompt. You can withdraw consent at any time.

We do not use your data for advertising. We do not sell or rent personal data. We do not perform automated decision-making with legal or similarly significant effects on you (Art. 21 revFADP).

We share personal data only with the processors listed below and, for open events, with the co-host described at the end of this section, and only to the extent strictly necessary to provide the service. Each processor is bound by a written data-processing agreement.

• Resend, Inc. (United States) — sends transactional email (invitations, account-related messages). Receives recipient email and message content.
• Apple Inc. (United States) — delivers push notifications via the Apple Push Notification service. Receives an opaque device token and the notification payload. We do not include personal content beyond an event identifier in the payload.
• Cloudflare, Inc. (United States, with global edge presence) — carries the traffic between you and troisroues.org and protects the site against abuse. Processes your network address and the technical details of each request in transit.
• Hosting — the service and its data are hosted in Switzerland under our own administration. The hosting provider does not access personal data.

Event organisers (Admins) within Troisroues see, for events they manage, the names, RSVPs, dietary preferences, and arrival selections of attendees — strictly to run the event.

Open events with a co-host — when we host an open event together with a partner venue (currently the Oak Brew summer closing in Vienna and Under the Trees at honeytree in Zug), the co-host (the Oak Brew founder, or the honeytree team) may be shown the door list at the door on the night, solely to admit guests. The co-host is a recipient, not a processor acting for us: no copy is handed over and no other data is shared.

Where we transfer personal data outside Switzerland, we do so only to states that the Swiss Federal Council recognises as providing adequate data protection, or under appropriate safeguards within the meaning of Art. 16 para. 2 revFADP.

• Switzerland — primary hosting location; no transfer abroad takes place for the data we hold, other than the door list shown at the venue of an open event (section 4).
• United States — Resend, Apple, and Cloudflare process personal data in the United States. The US is recognised by the Federal Council as providing adequate protection for transfers under the Swiss-US Data Privacy Framework where the recipient is certified; otherwise we rely on the EU Standard Contractual Clauses adapted for Switzerland by the FDPIC. If you are in the EU/EEA, the same transfers rest on the EU-US Data Privacy Framework where the recipient is certified and otherwise on the European Commission’s Standard Contractual Clauses (Art. 45 and 46 GDPR).

You can request a copy of the safeguards in place by writing to support NOSPAM @ NOSPAM troisroues.org.

We keep personal data only as long as necessary for the purposes listed above:

• Account data — for the lifetime of your account. When you delete your account from inside the iOS app, we erase your account data together with your RSVPs, notification registrations, and any unused invitations you issued. The link between you and the user who invited you is severed. Consumed invitations remain in the platform with the issuer reference anonymised. Security-log entries are anonymised and kept only for security and incident-response purposes, with no link back to you.
• Security and administration log — currently retained for the lifetime of the service for security and incident-response purposes. It holds only pseudonymous identifiers (no email, no name); when an account is deleted, the associated entries are anonymised. We are working on a time-bounded retention period and will update this section when it applies.
• Sign-in sessions — until they expire or you sign out.
• Public-form entries — until they have served their purpose or you ask us to remove them: write to [email protected] from the address you used and we delete the entry within 30 days. There is no automatic purge for these lists.
• Backup copies — kept in Switzerland for up to 30 days for disaster recovery, then destroyed. A deleted entry can therefore survive in a backup copy for up to 30 further days.

We apply technical and organisational measures appropriate to the risk (Art. 8 revFADP, Art. 1–6 revFADP-Ordinance): personal data is encrypted in transit and at rest, access is limited to the two operators and, for their own events, to event organisers, security-relevant actions are logged, and backup copies are protected in the same way as the live data. We do not publish the details of these measures. On iOS, your sign-in session stays on your device and is protected by Face ID / Touch ID where the device supports it.

As a data subject under the revFADP — and, if you are in the EU/EEA, under Art. 15–21 GDPR — you have the right to:

• Access the personal data we hold about you (Art. 25).
• Rectify inaccurate data (Art. 32 para. 1).
• Erase data we no longer need or that you consented to and now withdraw (Art. 32 para. 2). You can erase your account directly from the iOS app under Card → ⋯ → Delete data.
• Restrict processing while a dispute about the accuracy or lawfulness of the data is being resolved (Art. 18 GDPR).
• Object to processing carried out under our legitimate interest, where your interest in the protection of your data overrides ours (Art. 30 para. 2 lit. b; see the separate notice below).
• Receive a structured, machine-readable export of the data you have provided to us (Art. 28 — data portability). Write to support NOSPAM @ NOSPAM troisroues.org and we will deliver it within 30 days.
• Lodge a complaint with the Federal Data Protection and Information Commissioner (FDPIC, Feldeggweg 1, 3003 Bern, edoeb.admin.ch). If you are in the EU/EEA you may also complain to the supervisory authority of your habitual residence, place of work or of the place where the issue arose (Art. 77 GDPR); for Austria that is the Datenschutzbehörde, Barichgasse 40–42, 1030 Wien (dsb.gv.at).

Right to object. Where we process your data on the basis of our legitimate interest (security monitoring, abuse prevention, security logging, operating the service, and the two public forms), you may object at any time on grounds relating to your particular situation (Art. 21 para. 1 GDPR; Art. 30 para. 2 lit. b revFADP). Write to support NOSPAM @ NOSPAM troisroues.org. We will then stop processing the data concerned unless we can demonstrate compelling legitimate grounds that override your interests, rights and freedoms.

We respond to verified requests within 30 days. We may ask for a proof of identity proportionate to the request, to prevent disclosure to third parties.

The web side of Troisroues at troisroues.org is a public landing page. We set only a short-lived security token — not a tracking cookie.

We do not use analytics, advertising, or third-party tracking cookies. Because none of our cookies trigger Art. 45c TCA consent obligations, we do not display a consent banner. The iOS app stores no cookies.

Troisroues is not directed at, and not intended for use by, persons under the age of 18. We do not knowingly collect personal data from minors. If you believe a minor has accessed the service, contact us and we will erase the account.

We may update this policy as the service evolves. The effective date at the top reflects the latest version. Material changes will be communicated via email to the address on your account at least 14 days before they take effect.