Privacy Policy — Send Planning

Effective date: 24 September 2026 · Alpine Lynx, Switzerland

The short version

Send Planning collects no personal data. Your team, schedules, addresses and history are stored only on your device. There is no account to create, no analytics, no advertising and no trackers — in the app and on this website. The only things that reach an Alpine Lynx server are the annual subscription's invite codes — and the server doesn't know who you are.

What stays on your device

Everything you enter in the app: team members and their contact details, work sites, shifts, rates, reports and settings.
Your app PIN, if you set one, is stored in the device Keychain. Face ID / Touch ID are handled entirely by iOS; biometric data never reaches us.
The built-in assistant and voice input run on Apple's on-device models. What you say or type is processed on the device.

What leaves your device — only when you choose

Sending schedules. When you send a schedule — or at the time you scheduled it, if you turned on automatic email sending — the message is delivered by the app you pick (WhatsApp, SMS, email…). It travels through that provider under its own privacy policy. Alpine Lynx never sees or receives it.
Routes and addresses. Distance and travel-time calculations use Apple Maps. Those requests are processed by Apple under Apple's privacy policy; we do not receive them.
Backups. Device backups and any backup files you export go to your own iCloud or wherever you choose to save them. They are yours; we have no access.
Purchases. Subscriptions are processed by Apple through the App Store. We never see your payment details. With the annual subscription, the app sends our server the receipt signed by Apple, for the invite codes — see below.

Invite codes (annual plan)

Each annual subscription has its own invite code. When someone subscribes to the annual plan with your code, your next renewal costs less; their price stays the same. That's all our server is for: keeping the codes and knowing which subscription each one belongs to. This is everything it knows.

When. Invite codes only exist with the annual subscription (including the free trial period). Without it, the app never talks to our server. The monthly subscription has no invite code.
What the app sends. The annual subscription's receipt, signed by Apple — which contains the subscription number Apple assigned, the product, the purchase and renewal dates, and the environment (production or sandbox) — and, if you entered it, the code of the person who invited you. That receipt does not contain your name, your email, your Apple account or payment details, and the app does not send them.
What we store. That subscription number, your invite code (generated by us, at random), the code of the person who invited you, the subscription's status, dates and amounts paid, and a log of the notifications Apple sends us about it (renewal, expiration, refund). Apple sends those notifications with the same numbers — never with personal data.
What for. To know which subscription each invite code belongs to and apply the renewal discount, and to confirm with Apple, in the days before each renewal, that the subscription is still active. Nothing else.
What we never store. Name, email, Apple account, IP address, payment details. There is no account and no sign-in: the server doesn't know who you are. The IP address is used only in memory, to block abuse, and is never logged.
Where. On Cloudflare, with the database in Western Europe.
Who sees what. You can see the invite codes of the people you invited, and whoever invited you can see your invite code. Codes only — never names. We do not share this data with anyone besides Apple, who already has it; we do not sell it, it is never used for advertising, and it is never used to train AI models.
Keeping and deleting. The records stay for as long as the annual subscription exists: they are what calculate your discount, and the app re-creates them every time it opens while the subscription is active. Once it ends, you can ask us to delete them — write to us with your invite code. Without a request, we delete them ourselves: at the latest 12 months after the subscription ends. Test invite codes (TestFlight) are kept in a separate ledger, marked "Sandbox", and never mix with the real ones.

Connected email accounts (Google)

If you choose to, Send Planning can connect to your own email account to send the schedules: either with an app password you create at your provider (SMTP), or by connecting your Google account (OAuth). Nothing is connected until you connect it, and you can disconnect at any time.

Google: sending only. We request a single scope, gmail.send. It permits sending, nothing else. We do not read, list, search, modify or delete your messages, and we have no access to your mailbox, contacts, calendar or files.
What we use it for. Only to send the schedule emails you start yourself, one message per worker, from your own address. Nothing else is ever sent through your account.
Where it is stored. The OAuth tokens and app passwords live only in your device's Keychain. We have no servers: nothing is transmitted to us, and the messages go from your device straight to your email provider.
Sharing and retention. We share this with nobody. It is kept until you disconnect the account in the app — at that point it is deleted from the device.
How to revoke access. Disconnect the account in the app (Settings → Sending account), and/or revoke it at your provider: for Google, at myaccount.google.com/permissions. If you used an app password, delete it at your provider.
Never for AI training. We never use your data — or anything received from Google APIs — to train AI or machine-learning models, and we never sell it or transfer it to anyone.

The use of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Support

If you email email, we receive your email address and whatever you write. We use it only to reply, and we do not add you to any list.

This website

This site sets no cookies and runs no tracking scripts. It is served by our hosting provider, which may keep standard technical logs (such as IP addresses) to operate the service.

Your rights

Under the Swiss Federal Act on Data Protection (revDSG) and the GDPR you have rights of access, correction and deletion. Because your data lives only on your device, you exercise them directly in the app: edit or delete anything at any time, export a backup, or delete the app to remove everything. For anything else, write to us. The invite codes are the only data outside your device: to delete them, write to us with your invite code after the annual subscription has ended.

Children

Send Planning is a business tool and is not directed at children under 13.

Changes

If this policy changes, the new version will be published on this page with a new effective date. Material changes will be highlighted in the app's release notes.

Contact

Alpine Lynx · Switzerland · email