MisaboardPrivacy policy
Version 1.0 · valid from [launch date]
In short: your documents never leave your device unless you share them yourself. We collect as little as possible: with an account, your email address and a few counts — stored on our server in Switzerland. No advertising, no tracking, no selling of data, no cookies.
1. Who is responsible
[full name or company name, address, Switzerland], email [email protected]. This policy follows the Swiss Federal Act on Data Protection (FADP) and, where it applies, the EU General Data Protection Regulation (GDPR).
2. What stays on your device
Your documents, drawings, imported PDFs and pictures, scans, signatures, symbols and all app settings are stored only on your device. We have no access to them. They leave the device only when you export or share them yourself, and then go where you send them.
For scanning, the camera picture is processed on the device; nothing is uploaded.
3. What we process, why, and how long
| Data | Purpose | Legal basis (GDPR) | Kept |
|---|---|---|---|
| Account: email address; with Google sign-in also the Google account ID and name Google passes on | Sign-in, account on several devices, answering you | Contract (Art. 6(1)(b)) | Until you delete the account, then removed within 30 days |
| Usage counts: number of exports, plan, date of the last sign-in | Free limits, plans, preventing abuse | Contract; legitimate interest (Art. 6(1)(f)) | As long as the account exists |
| What you use Misaboard for (if you answer the question at the start) | Statistics to decide which tools to build next — never used to identify you | Consent (Art. 6(1)(a)); optional, can be changed any time | As long as the account exists; without an account it stays on the device |
| Messages to us (feedback, problems) | Answering and fixing problems | Legitimate interest; contract | As long as needed, at most 2 years |
| Technical access data of the website and the server: IP address, time, page, browser, error messages | Delivering the website, security, fending off attacks | Legitimate interest | At most 30 days |
We do not use your data for advertising, do not build profiles and do not sell or rent data to anyone.
4. Where the data is: Switzerland
Our server and our email run at Infomaniak Network SA in Geneva, Switzerland. Switzerland has data protection recognized by the EU as adequate.
5. Who else is involved
- Infomaniak Network SA, Switzerland — server and email (on our behalf).
- Cloudflare, Inc., USA — protects and speeds up the website and the server (encryption, protection against attacks). Requests pass through Cloudflare's network, which also sees technical access data. Transfers are covered by the EU–US and Swiss–US Data Privacy Framework and standard contractual clauses.
- Google — only if you sign in with Google (Google's privacy policy applies) and for downloads and purchases through Google Play.
These providers process data only as needed for their service. Authorities receive data only where the law obliges us.
6. Cookies and similar technology
The website sets no cookies and uses no analytics, no tracking pixels and no advertising networks — so there is no cookie banner. Fonts and all files of the website come from our own server. The app stores its settings only on your device. If we ever wanted to use analytics, we would ask you first.
7. Security
All connections are encrypted (HTTPS, TLS 1.2 or newer). Our server is reachable only through Cloudflare, runs with current security updates and makes encrypted backups. We store no passwords: you sign in with Google or with a one-time code sent to your email.
8. Your rights
You can ask us at any time what data we have about you, and have it corrected, deleted or handed over in a common format; you can object to processing based on legitimate interest and withdraw consent with effect for the future. Deleting your account in the app deletes the data linked to it. Write to [email protected]; we answer within 30 days.
You can complain to a supervisory authority — in Switzerland the Federal Data Protection and Information Commissioner (FDPIC), in the EU the authority of your country.
9. Children
An account requires an age of at least 16, or the consent of a parent or guardian. We do not knowingly collect data of younger children.
10. Changes
We update this policy when Misaboard changes. The current version is always on this page; we announce important changes in the app.