Privacy Policy
Last updated: 20 September 2026
1. Data Controller
PhinFinder is operated by PhinLabs, Markus Egolf, Glärnischstrasse 52b, 8712 Stäfa, Switzerland. For any privacy-related inquiries, contact [email protected]. The Swiss Data Protection Act (FADP) applies, as does the GDPR where applicable.
2. Principles
We only collect data that is required to run PhinFinder. We do not sell data, we do not use Google Analytics, Facebook Pixel or any other tracking or advertising services, and we do not build usage profiles.
3. Hosting and Infrastructure
The website, the app and the backend run on a server operated by Hetzner Online GmbH (Gunzenhausen, Germany) in its Nuremberg data centre. Cloudflare, Inc. sits in front of it as reverse proxy, CDN and DNS provider. Hetzner and Cloudflare may store the IP address and time of a request for a short period to ensure security and availability (data processing on our behalf under Art. 28 GDPR). For Cloudflare as a US provider, the EU Standard Contractual Clauses and the EU-US Data Privacy Framework apply.
4. Cookies and Local Storage
The website sets no cookies of its own, so there is no cookie banner. Cloudflare may set short-lived, technically necessary cookies for bot and attack protection. The app keeps your login session, settings and in-progress data (for example a running trip) in your browser's or device's local storage, not in cookies.
5. Account and Login
Using the app requires an account. We store your name, e-mail address, a hashed password, your license key and your plan. Sessions are managed server-side. A password reset link is valid for one hour. Legal basis: performance of a contract (Art. 6(1)(b) GDPR).
6. Data in the App
Everything you create in PhinFinder is linked to your account and stored on our server so it is available on all your devices: favourites, visited places (name, category, coordinates, time), reviews, saved routes and recorded trips including the GPS track, distance, duration and stops. You can delete these entries in the app at any time and export trips as GPX. If you enable notifications, we also store the push subscription of your browser or device.
7. Location Data and Third-Party Sources
To find places near you or along your route, the app sends your position or the chosen route to our backend. The backend queries data sources with it, including OpenStreetMap (Overpass), Google Places, Mapbox (geocoding and routing), OpenRouteService, MET Norway and MeteoAlarm (weather), GBIF, Wikidata, Wikipedia and Wikimedia Commons, as well as national open-data portals (e.g. swisstopo). These services receive coordinates and search terms only, never account data; the requests originate from our server, so your IP address is not passed on to them. Exception: map tiles are loaded by your browser directly from CARTO and Esri, which therefore see your IP address.
8. E-Mail and Waitlist
We send e-mails (registration, password reset, waitlist) via Zoho Mail (Zoho Corporation, EU servers). If you join the waitlist, we store your e-mail address and name until you unsubscribe. If you write to us, we keep your message in order to reply.
9. Retention
Account and app data are kept for as long as your account exists. If you delete your account or ask us to, we remove all associated data within 30 days. Technical access logs at Hetzner and Cloudflare are deleted automatically after a short period.
10. Your Rights
You have the right to access, rectify, delete, restrict the processing of, export and object to the processing of your data at any time. Contact [email protected]. You may also lodge a complaint with the competent supervisory authority; in Switzerland this is the Federal Data Protection and Information Commissioner (FDPIC).
11. Changes
We update this policy when our operations change. The current version is always available on this page.
Privacy inquiries: [email protected]