Privacy Policy — Send Planning Connect
The short version. Send Planning Connect has no accounts and no Alpine Lynx database. The team's data — names, shifts, rules, swap requests — lives in a base that is encrypted on the device before it goes anywhere, and only the team's own devices hold the keys. We cannot read it. There is no analytics, no advertising and no tracking, in the app or on this website.
Who decides what
The owner is the person who creates the team and makes the schedules. The owner decides what goes into the base (collaborators' names, shifts, absences, rules) and who can see what. For the data about their team, the owner is the controller under data-protection law (in Switzerland, the revDSG; in the EU, the GDPR). Alpine Lynx never receives that data, so it is not a processor of it either.
Collaborators connect their own device to the team with a one-time invitation or a QR code. Their device keeps its own key; there is no account, e-mail or password.
What stays on the device
- The encrypted base: the team, places, shifts, absences, holidays, rules and swap requests.
- The device's keys, and the passkey or PIN used to unlock the app, if the owner turned that on. Passkeys are handled by the operating system; we never see them.
- Preferences such as theme and language and, if the owner connected a cloud, its sign-in and where the base is kept there: in the browser's or the app's local storage.
- The camera is used only to read QR codes when connecting a device. Images are processed on the device and never saved or sent.
What leaves the device — and in what form
- The owner's storage. The owner chooses where the base is kept: only on the device, in a file they save themselves, in their own iCloud, or in their own Google Drive. The base is always encrypted before it leaves the device. It goes to the owner's own account, under that provider's terms; we have no access to it.
- Google Drive. If the owner connects Google Drive, the app asks for a
single permission,
drive.file: it can only see and change the files it created itself, never the rest of the Drive. The sign-in token stays on the device. It is used only to save and open the team's encrypted base, never shared, never sold and never used to train AI models. The owner can disconnect at any time in the app, or revoke the access at myaccount.google.com/permissions. The use of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. - E-mail from the owner's account. The owner can send schedules to the
team by e-mail, from their own account. With Gmail, the app asks for a single permission,
gmail.send: it can only send the e-mails the owner starts in the app. It never reads, searches, changes or deletes anything in the mailbox. Each e-mail goes straight from the device to Google; we never see it. The app also reads the account's e-mail address, only to show which account is connected. The sign-in token stays on the device: in the iPhone's Keychain in the app, and in the browser's local storage on the web, where it lasts one hour. It is used only to send those e-mails, never shared, never sold and never used to train AI models. The owner can disconnect at any time in the app, or revoke the access at myaccount.google.com/permissions. The use of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. With another provider (SMTP, in the iPhone app), the app password stays in the iPhone's Keychain and each e-mail goes straight from the device to that provider's server. - iCloud. If the owner chooses iCloud, the encrypted base goes to the private database of the owner's own iCloud account, handled by Apple.
- Schedules and swap requests between the team. These travel as
letters that are encrypted end to end on the sending device and signed, one per person.
They pass through our relay (
spc.alpinelynx.ch, on Cloudflare), which hands them to the notification service of the receiving device (Apple, Google, Mozilla or Microsoft). The relay cannot open the letters. To deliver one, it sees the device's notification address and the encrypted letter, only in memory and only for the moment of delivery. It stores nothing and writes no logs. Cloudflare and the notification services process the connection data (such as the IP address) needed to carry the message, under their own policies. - Links. When a device cannot receive notifications, the app offers a link to send by another way (e-mail, messaging). The link carries the same encrypted letter. It goes through whatever app you choose to send it with.
Subscription
Only the owner pays, through the App Store (and later Google Play). We never see payment details. The store gives the app a receipt signed by Apple, with the transaction number, the product, the dates and the environment (production or test), and no name, e-mail or Apple account. The app keeps that receipt inside the encrypted base and gives it to the team's devices, so each one can check, on its own, that the team's subscription is valid. It never reaches an Alpine Lynx server: we have none for this.
Support
If you write to our support address, we receive your e-mail address and what you write. We use it only to reply.
This website
This site and the web app set no cookies and run no tracking scripts. They are served by our hosting provider, which may keep standard technical logs (such as IP addresses) to operate the service.
Your rights
You have the rights of access, correction and deletion under the revDSG and the GDPR. Because the data is on the team's devices and in the owner's own storage, they are exercised there: the owner can change or delete anything in the app and export the base. To remove the base itself, the owner deletes it where they chose to keep it (the file or their cloud) and removes the app, or the site's data, from the device. A collaborator who wants their data changed or removed should ask the owner of their team. A collaborator can also leave a team in the app, which removes that team's data from their device. For anything else, write to us.
Children
Send Planning Connect is a work tool and is not directed at children under 13.
Changes
If this policy changes, the new version will be published on this page with a new date. Material changes will be highlighted in the app's release notes.
Contact
Alpine Lynx · Switzerland · e-mail · Terms of Use