Privacy Policy

In short

Who is responsible

MiniZürich is developed by Marco Lüthi, the controller responsible for data processing under the Swiss Federal Act on Data Protection (FADP) and, where applicable, the EU General Data Protection Regulation (GDPR).

Marco Lüthi
Gutstrasse 172
8055 Zürich
Switzerland
hi@luthi-mar.co

Your address and settings

You set your home (and, if you like, your work) by typing an address. The search runs on your device over the city's address list, which is part of the app, so what you type is never sent anywhere. The chosen addresses (street, postcode, district and coordinates), the nearest stop, the things you've marked as put out, which layers you show on the map, your reminder settings and the shop you chose for the closing reminder are stored in the app on your device. If you use the tax dates, the app also keeps what you tell it about each year's tax return (open, extended until a date, or filed), on your device only. The widgets read a copy of your street, upcoming collections and events, and their map pictures, from a storage area on your device shared only with the app's own widgets.

Nothing is synced to iCloud or to any server. Your data may be included in your device backups, depending on your own backup settings. Deleting the app deletes all of it.

Your location (optional)

MiniZürich knows your home because you typed it; it doesn't need your location for that. If you allow location access (only while you use the app), your position is shown on the map, so the nearest shop, toilet or tram is easy to find when you're out. The app only uses it to draw that pin: it doesn't store your position or send it anywhere. You can change the permission at any time in the iOS Settings app.

The map (Mapbox)

The 3D map is provided by Mapbox, Inc. To show it, the app downloads map data for the area on screen, and for the pictures in your widgets it downloads the area around your home. Like any internet request, this reveals your device's IP address and the map area requested to Mapbox; your address itself is not sent. By default, the Mapbox software also sends anonymous usage data about the map to Mapbox to help improve its maps; if you have allowed location access, this usage data can include anonymised location information. You can turn it off in the app under About & data, “Share anonymous map usage”. Mapbox processes this data under its privacy policy (see also Mapbox telemetry).

Weather (Apple Weather)

The rain, snow, fog and clouds on the map come from Apple's WeatherKit service. While the app is open, it asks for the current weather at your home's position (its coordinates, not the street address) about every 10 minutes and whenever you return to the app. Apple processes these requests under its privacy policy. Apple says it uses the location only to provide the forecast and doesn't associate it with information that identifies you.

Live departures and delays

Timetables are part of the app. When you open a stop's live board or a departure, and while your way to work is on screen, the app asks transport.opendata.ch for live times. It sends only the id of the stop (for your way to work, the ids of the stops near home and work), along with your device's IP address, as with any internet request. No account or identifier of yours is sent.

Reminders

Every reminder is scheduled by your iPhone itself, not sent from a server, and only if you turn it on:

• collection reminders at 19:00 the evening before each collection at your home address;
• a reminder an hour before your chosen shop closes, on the days it's open;
• tax reminders a week before the City of Zürich's deadlines, and a question the day after the tax return is due (whether you filed or extended); your answer stays on your device.

You can turn them off in the app or in the iOS Settings app.

Directions and links

If you ask for directions, the app opens Apple Maps or Google Maps with the destination, for example a recycling point. A shop's website or phone number, and the city's online tax extension (E-Frist), open outside the app when you tap them. What happens there is covered by the privacy policy of the service you open.

Legal basis

Where the GDPR applies, the processing described above is necessary to provide the features you use (Art. 6(1)(b) GDPR). Mapbox's anonymous usage data is based on our legitimate interest in a working, improving map (Art. 6(1)(f) GDPR), and you can object to it at any time with the switch in the app. Location access and notifications are based on your choice to allow them, which you can withdraw at any time in the iOS Settings app. Under the Swiss FADP, we process personal data only as described here and in line with its principles.

What MiniZürich does not do

• No account, sign-up or login.
• No tracking of where you go: your location is only shown on the map, never stored or sent by the app.
• No advertising, analytics, crash-reporting or tracking SDKs.
• No tracking across apps or websites, and no selling or sharing of data with data brokers.

Web app

MiniZürich also runs as a web app on this website. It runs in your browser: there is no account, and the developer receives none of what you enter.

• Your home and work address, your map filters, your stop and what you tell it about your tax return are kept in your browser's local storage on your device. Clearing this website's data in your browser deletes them.
• The address search is offline: the city's address list is loaded from this website, and what you type is never sent anywhere.
• The map comes from Mapbox, Inc. (USA). To show it, your browser loads map data, styles and fonts from Mapbox, which reveals your IP address, browser type and the map area shown, and the Mapbox software reports each time the map loads. Its optional performance measurements are switched off. Mapbox processes this data under its privacy policy, which also describes the safeguards for transfers to the United States.
• Live departures, delays and the connections to work are fetched from transport.opendata.ch when you open them. Each request sends only the id of a stop (and the time and number of departures wanted), along with your IP address, as with any internet request.
• Showing your location is optional and up to your browser's permission. Your position is only drawn on the map; the page doesn't store it or send it anywhere.
• Reminders become calendar files: they are generated in your browser and downloaded to your device. Nothing is sent to a server, and what you do with the file is up to your calendar app.

The map and live departures are based on the legitimate interest in showing you the map and your departures (Art. 6(1)(f) GDPR).

This website

This website is a static site without cookies, analytics or tracking. Fonts are served from this website itself, so your browser does not contact third-party font services. When you visit a page, the hosting provider Vercel Inc. (based in the United States, with data centres worldwide) automatically records technical access data in server logs: your IP address, date and time, the requested page, referrer and browser type. This is needed to deliver the site and keep it secure (legitimate interest, Art. 6(1)(f) GDPR). The logs are deleted after a short period. Links to the App Store take you to Apple, where Apple's privacy policy applies.

Your rights

You have the right to request access to your personal data and to have it corrected or deleted, to object to or restrict processing, and to data portability. Because the apps store your data on your device and do not identify you, the developer usually holds no personal data about you. Most of it you can delete yourself by deleting the app.

To exercise your rights, email hi@luthi-mar.co. You can also lodge a complaint with a supervisory authority: in Switzerland the Federal Data Protection and Information Commissioner (FDPIC), in the EU the data protection authority of your country.

International transfers

Apple may process data in the United States and other countries. Apple describes the safeguards it uses for these transfers, such as the Data Privacy Framework and standard contractual clauses, in its privacy policy. This website is hosted by Vercel Inc., based in the United States; its server logs are transferred under the same kind of safeguards.

Children

MiniZürich is not directed at children and does not knowingly collect data from them.

Changes to this policy

If the app starts handling data differently, this page will be updated before the change ships, and the date at the top will change.