Privacy policy
Last updated: 3 November 2026
This policy covers the Swiss Koscher apps (iPhone, iPad, Mac and Android), the website swiss-koscher.ch and the AI assistant connector at swiss-koscher.ch/mcp. It follows the Swiss Federal Act on Data Protection (revFADP) and, for people in the EU and EEA, the GDPR.
1. Who is responsible
Shlomo Isaacs. Email: privacy@swiss-koscher.ch
2. What we collect and why
- Account. An account (Sign in with Apple or Google) is required to use the apps. We store your name, email address (or Apple relay address), Google profile picture link, account ID, sign-in method and sign-in times, to run your account, show your name to staff answering your reports, and keep the service secure.
- Scans. Barcode, matched product, result, scan method and time, linked to your account. Used to run the service, find missing products and show trending products (counts only, never who scanned what). Administrators can see individual scans for support, quality control and abuse prevention.
- Reports and submissions. Reason, note, barcode and product, photos you add, and your account. Used to correct the list and reply to you. Staff using Store Mode or Shelf AR also store the photos, barcodes and confirmations they capture.
- Push notifications. If you allow them: device token, platform, app language and version. Used only to tell you about your reports.
- Analytics and diagnostics. In the apps: usage events (such as screens opened, products viewed and scanned barcodes), the length of your searches (not the search text), app version, platform, language and connection status, and on Android the device model, Android version and crash reports. These are linked only to a random account ID and your role (for example, regular user or staff), never to your name or email. We do not record your screen. On the website, visitors who are not signed in are counted without cookies or any identifier stored in the browser. Staff who sign in to the website are also measured with page views, clicks and error reports. Used to improve the service and fix bugs.
- Website visits. IP address, browser details and pages requested, to deliver and protect the site and measure loading speed. Staff who sign in get a sign-in cookie.
- AI assistant connector. If you sign in and connect an assistant (such as Claude or ChatGPT), it can read your name, email and reports and send reports for you. You can disconnect at any time at swiss-koscher.ch/oauth/connections. On Android 16 and later, the app can offer search, barcode lookup and your recent scans to assistants on your phone; the app itself does not send this to us.
- Business contacts. Contact details and notes (including factory visits) for people at food producers, for our certification work. These come from the people themselves, their companies or kashrut organisations.
Saved products, recent scans, recent searches, recently viewed products and the kashrut lists you choose are kept in the app on your device and are not sent to us. The apps do not ask for access to your location. We do not show ads, sell personal data, or track you across other companies' apps or websites.
Which products you look up could say something about your religious practice. We use this information only to provide the service, and not to build profiles about you.
3. Who receives data
| Recipient | Purpose | Location |
|---|---|---|
| Supabase | Database, sign-in, file storage | Switzerland |
| Vercel | Website hosting, speed measurement | EU (Germany) and global network; US company |
| PostHog | Analytics and error reports | EU (Germany); US company |
| Apple, Google | Sign-in and push notifications (notification text passes through them) | USA and worldwide |
| Open Food Facts, Migros | Product information. Only the barcode or product number is sent. | France (Open Food Facts), Switzerland (Migros) |
| Coop | Product information. The barcode is sent directly from your device, so Coop also sees your IP address. | Switzerland |
| AI assistants you connect | Answering your requests, as independent controllers under their own policies | Depends on provider |
Except where noted, these providers process data only on our behalf and under contracts that require them to protect it. Product images are loaded from retailer and database servers, which see your IP address. We may also disclose data where the law requires it.
4. Transfers abroad
Our database is in Switzerland and our analytics and hosting are in the EU, which Switzerland recognises as adequate. For providers in the USA we rely on the Swiss-U.S. and EU-U.S. Data Privacy Framework where the provider is certified, and otherwise on standard contractual clauses.
5. Legal bases (GDPR)
- Contract (Art. 6(1)(b)): your account, scans, reports and the AI connector.
- Legitimate interests (Art. 6(1)(f)): keeping the list accurate, analytics, security and business contacts.
- Consent (Art. 6(1)(a)): notifications, camera and photos. You can withdraw it in your device settings.
- Legal obligation (Art. 6(1)(c)), where a law requires it.
6. How long we keep data
- Account, scans, sign-in records, reports, photos and messages: until your account is deleted. Changes staff made to the list are kept without their name.
- Analytics: for the retention period set in PostHog. After account deletion, remaining analytics are linked only to a random ID that can no longer be traced back to you.
- Push tokens: until your account is deleted or the token stops being valid.
- Hosting logs: for the short period Vercel keeps them.
- Business contacts: as long as we work with the company.
7. Your rights
You can ask to access, correct, delete or receive a copy of your data, restrict or object to its processing, and withdraw consent. Email privacy@swiss-koscher.ch; we reply within the time limits set by law.
Deleting your account. You can delete your account yourself in the app (Settings) or at swiss-koscher.ch/delete-account. If you can't sign in, email us from the address you sign in with (or give your Apple relay address). Deleting your account removes your account and the data linked to it, as described in section 6.
You can complain to the Swiss Federal Data Protection and Information Commissioner (www.edoeb.admin.ch) or, in the EU and EEA, to your local data protection authority.
8. Children
Swiss Koscher is not directed at children under 16.
9. Changes
We may update this policy from time to time. The date at the top shows the latest version. Continuing to use the service after a change means the updated policy applies.