Privacy Policy

Last updated: 1 October 2026

This Privacy Policy describes how personal data is processed in connection with the PTB app («PTB», «Place to be») and the placetobe.li website.

PTB is currently aimed at users in Switzerland.

1. Controller

The controller responsible for processing personal data is:

Rafael Burkhalter
Schulhausstrasse 27A
3052 Zollikofen
Switzerland

Privacy requests can be sent to:

rafael.burkhalter@placetobe.li

2. Principles

PTB is a social planning app for creating and sharing plans with friends.

We process only data required to operate the app, provide its features, secure the service, and provide support and troubleshooting.

PTB contains no advertising and creates no advertising or marketing profiles. Personal data is not sold or disclosed to third parties for advertising purposes. PTB has no paid features or payments.

PTB does not make automated individual decisions with legal or similarly significant effects.

3. User account and profile

To create and use a PTB account, we process in particular:

phone number
internal user ID
display name
language settings
appearance settings
account-creation time and technical account information

A phone number and display name are required for an account. The display name can be chosen freely and does not have to be a legal name.

A profile picture is optional. Users are responsible for choosing an appropriate picture. If other people are identifiable in the picture, it should be used only if they agree to that use.

PTB does not access the camera directly for profile pictures.

Sign-in uses the registered phone number and a one-time SMS verification code.

To carry out and secure this process, we process in particular:

phone number
hashed verification code
verification time and status
number and status of verification attempts
IP address
session and security information

The verification code is not stored in plaintext in our database.

Verification data is generally deleted after 7 days.

Sign-in sessions can exist for a maximum of 90 days and may end earlier through rotation, sign-out, or account deletion.

To defend against automated attacks and abusive verification attempts, IP addresses may be blocked. Such security block records may be stored indefinitely to prevent repeated attacks.

Sending SMS messages

We use SMS Gateway for Android to send verification codes. The cloud service forwards the SMS to an Android device operated by us, which sends it through the mobile network.

This processes in particular the recipient phone number and verification code. The connection between the gateway service and the device used is encrypted.

For the actual SMS delivery, we use a Swiss mobile network provider. The mobile network provider processes the connection and metadata required for telecommunications.

5. Friends and contact matching

PTB can optionally access device contacts to find people already known to you on PTB.

Contact permission is optional. PTB can also be used without access to the address book.

During contact matching:

names and phone numbers are read on the device,
phone numbers are normalised locally and duplicates are removed,
only normalised phone numbers are transferred to the PTB server,
they are matched against existing PTB accounts.

Names from the address book are not transferred to the PTB server.

Contact matching is not stored permanently on the server. Matches may be cached on the device together with the local contact name. This local cache is deleted, among other cases, when the user changes or signs out.

Matching can also process phone numbers belonging to people who do not themselves have a PTB account.

A phone number is not shown directly to other users. However, a person who already knows a phone number can use contact or phone-number search to determine whether it belongs to a PTB account.

6. Friendships, groups, and blocks

PTB stores social relationships required to use the app, in particular:

friendships
private names or aliases for friends
groups and group memberships
blocks between users

Private aliases are visible only to the person who assigned them.

Groups are used in particular to determine who can see a plan.

7. Plans

When creating a plan, the following data may in particular be stored:

title
creator
date and time
creation and change times
place name
where applicable, geographical coordinates of the plan location
selected audience
submitted signals or interest or participation states

Plans are not publicly accessible on the internet.

If no group is selected, a plan is visible to the creator’s friends. If a group is selected, access to the plan is limited to members of that group.

Users who can see a plan can see which people have already submitted a signal and which signal they chose.

People in the target audience who have not yet submitted a signal are currently not shown as participants or invited people.

Plan data generally remains stored until the plan or the associated account is deleted.

8. Chat and end-to-end encryption

Chats belong to a plan and can be used only by users who have access to that plan.

In PTB’s release state, chat messages are end-to-end encrypted on user devices before they are transferred to the PTB server.

The keys required for decryption exist exclusively on authorised users’ devices. PTB stores message content only in encrypted form and cannot decrypt it.

Chat content is not transferred in plaintext through push services either.

The association of an encrypted message with a plan and sender, as well as technical time information, may still be processed on the server.

9. Location and maps

Access to the current device location is optional. PTB also works without location permission.

The current location is used, for example, to centre the Map on the current position. PTB does not store the current device location in the user account and does not transfer it to its own PTB server.

This is distinct from deliberately selected plan locations. Independently of location permission, a plan can contain a place name and, where applicable, coordinates. This information is stored as part of the plan and shown to people who have access to it.

OpenStreetMap and Nominatim

PTB uses services from the OpenStreetMap Foundation (OSMF) for maps.

Map tiles are retrieved directly from OpenStreetMap by the device. For technical reasons, the provider receives, among other things, the IP address and information about the requested map area.

We use Nominatim for place search and reverse geocoding. Search terms, or the relevant coordinates during reverse geocoding, are transferred directly from the device to Nominatim.

The current location is therefore not transferred to the PTB server, but can be part of a direct request to OpenStreetMap or Nominatim when the corresponding map or geocoding function is used.

10. Push notifications

Push notifications are optional. PTB can also be used without push permission.

For Android, we use Google’s Firebase Cloud Messaging (FCM). On iOS, notifications are delivered through FCM and the Apple Push Notification Service (APNs).

This processes in particular push or device tokens and notification information necessary for delivery.

A plan title may be part of a push notification and may therefore be transferred to the participating push services.

In the intended release state, chat messages are not transferred to these services in plaintext.

11. Technical logs and error analysis

Technical logs are created for operations, error analysis, and security.

They may include in particular:

time of access
technical request information
request ID
user ID, if the request is authenticated
IP address, where it arises for security or infrastructure purposes
error and status information

Production application and observability logs are generally retained for 14 days.

We use Grafana Cloud for central log and error analysis.

There is no routine review of user-data content. Only authorised persons can access production systems, and only to the extent necessary for support, troubleshooting, maintenance, or security purposes.

Administrative access is protected by multi-factor authentication.

12. Hosting and storage

PTB infrastructure is mainly operated at DigitalOcean.

For regular PTB operations, the backend, database, and object storage are located in DigitalOcean’s FRA1 region in Frankfurt, Germany.

Backups are created for the production database. These backups are retained for 7 days and are then deleted or replaced by newer backups.

Deletion from the production database does not retroactively remove data from backups that have already been created. Deleted data may therefore remain in a database backup for up to 7 days. Such backups are used only for recovery purposes.

DigitalOcean may use further subprocessors for certain infrastructure and support services.

13. The placetobe.li website

The placetobe.li website is provided as a static website through GitLab Pages.

The website itself uses:

no analytics or tracking services
no advertising trackers
no cookies
no local browser storage
no externally loaded fonts, videos, maps, or scripts

Its content consists primarily of static pages and screenshots.

When operating GitLab Pages, GitLab may process technically necessary access data, including IP address, access time, and page visited.

The website contains no contact form. Contact takes place directly by email.

14. Email and support

Email communication takes place through Proton Mail, operated by Proton AG in Switzerland.

Privacy and support requests are generally retained only as long as necessary to handle them, and deleted after no more than 30 days, unless longer retention is required for legal reasons.

For requests requiring access to user or account data, we may confirm identity using a verification code sent to the registered phone number.

15. Retention period

Unless this Privacy Policy states otherwise, we store personal data only for as long as it is needed for the relevant purpose.

The following principles apply in particular:

Data	Retention
Account and profile	until account deletion
Profile picture	until replacement, removal, or account deletion
OTP and verification data	7 days
Sign-in session	maximum 90 days
Regular logs	14 days
Database backups	7 days
Security blocks of IP addresses	potentially indefinitely
Plans and plan locations	until plan or account deletion
Social relationships and groups	until the relevant change or deletion, or account deletion
Chat	until plan or relevant account deletion
Support and privacy emails	generally a maximum of 30 days

Inactive accounts are not automatically deleted after a particular period.

16. Account deletion

Users can delete their PTB account directly in the app.

Deletion occurs without an intended recovery or reactivation period.

The data and relationships assigned to the account are removed, including:

profile
own plans
friendships
group memberships
signals
own chat messages, including in other people’s plans
read states
active sessions
push associations

The profile picture is also deleted.

Existing database backups may continue to contain the deleted data for up to 7 days. Backups are retained solely for recovery purposes and are deleted or replaced after the retention period expires.

Where certain technical security information must be retained independently of the account, in particular permanently blocked attack IP addresses, it may remain after account deletion.

Data already transferred to external infrastructure or communications providers is also subject to their technical deletion and retention processes.

17. Sensitive personal data and content about third parties

PTB does not require sensitive personal data.

Please do not enter information about health, religion, political views, sexual orientation, or other sensitive information in PTB’s free-text fields.

In free-text fields, share only information you want to share with the intended recipients. Content such as plan titles, chat messages, group names, or place names can also contain information about other people.

Users are responsible for uploaded profile pictures and entered content. Information or pictures about other people should be used only where lawful and where the people concerned agree, if such consent is required.

18. Minimum age

PTB is intended for people aged 18 and over.

There is currently no technical age verification.

19. Disclosure and processing abroad

We disclose personal data to service providers only where necessary for the respective PTB service.

The main recipients include in particular:

Provider / category	Purpose	Relevant countries/regions
DigitalOcean	Hosting, database, image storage	Germany, and where applicable further subprocessors
SMS Gateway for Android	SMS gateway	Provider infrastructure
Swiss mobile network provider	SMS delivery	Switzerland
Google Firebase	Push delivery	International infrastructure
Apple	Push delivery	International infrastructure
OpenStreetMap Foundation	Maps and geocoding	International infrastructure
Grafana Labs	Technical logs and observability	Grafana Cloud infrastructure in use
GitLab	Website hosting	International infrastructure
Proton	Email	Switzerland

For disclosures abroad, we observe the requirements of Swiss data-protection law. Where necessary, appropriate safeguards for international data transfers are used.

20. Data security

We take technical and organisational measures to protect personal data in accordance with the risks involved.

These include in particular:

encrypted data transfer
modern authentication and session procedures
multi-factor authentication for administrative access
restricted administrative access rights
logging of security-relevant events
rate limits and abuse protection
end-to-end encryption of chat content in the release state

Despite such measures, absolute protection cannot be guaranteed for electronic data processing.

21. Rights of data subjects

Under Swiss data-protection law, data subjects can in particular request information about whether and which personal data about them is processed.

Depending on the situation, they may also request correction or deletion. Under the legal conditions, there may also be a right to receive or transfer certain personal data.

Requests can be sent to