Privacy policy

3.2 Survey data (encrypted)

When you create a survey or take part in one, the following data is stored on our server:

• A randomly generated survey identifier
• A randomly generated admin token (contained only in the sharing link)
• The encrypted survey content (title, description, options)
• The encrypted voting responses (including the name you entered)
• The chosen expiry date

The server cannot decrypt this content. The encryption key is located exclusively in the URL fragment (after the # sign) and is not sent to the server in HTTP requests. A maximum of 500 responses are stored per poll (with Premium, a maximum of 10,000).

3.3 Surveys with questionnaires

For surveys with questionnaires (addresses /umfragen, /neue-umfrage and /u/…), the questionnaire is encrypted in the same way as above. Each response is additionally encrypted with a public key of the person who created the survey. Only someone with the admin link can read the responses – neither other participants nor we. The date (without time) of each response and their number are also stored.

3.4 Optional account

An account is optional. It keeps your admin links. The list is encrypted in your browser; the server stores only the encrypted data block and cannot read it. Your password never leaves your browser. We do not store your username or email address in plain text, only as an irreversible check value (HMAC).

• Account with email: We use your email address exclusively to send you the key email (confirmation of the address and personal recovery key). The recovery key is generated in your browser and handed over only for sending to our mail server; we do not store it. Sending takes place via the Infomaniak mail server in Switzerland; send logs containing the recipient address may arise there, in accordance with Infomaniak’s retention periods.
• Account without email: No email address is processed. The recovery key is shown to you once as a code.
• Unconfirmed email addresses are released again after 7 days. Accounts without a login for 3 years are deleted automatically. You can delete your account yourself at any time.

Two-factor authentication (optional): If you turn on 2FA for your account, we store data for it in your account: for an authenticator app, a secret that we store encrypted and use to check your codes; for a passkey or security key, only the identifier, the public key and a counter; for the recovery codes, only a hash. In addition there are the name you gave the method, the time of setup and of last use, and technical counters to protect against abuse. This data serves only to secure your sign-in and is deleted with the account; you can remove individual methods at any time. Your survey data stays encrypted with your password regardless. If your organisation requires 2FA, the admin can see whether you have turned it on and can reset it if you lost your device; you can see the time of the reset in your account. We do not pass this data on to third parties and do not use external services.

3.5 Premium: order, invoice and licence

You can use terminsuche.ch without providing any personal data. Only if you order a paid Premium subscription do we process the following data, kept separate from all poll data and without any link to it:

• Billing details from the order form: name, company or club where applicable, address, email address and language (for clubs, the information on the club discount)
• Order data: plan, term, number of seats, invoice number, amount, value added tax, due date, and the date and method of payment
• We store the licence key only as a non-reversible check value (hash), not in plain text
• A log of events (e.g. order, payment received, renewal, cancellation)

You receive the invoice with a QR bill as a PDF by email via Infomaniak’s mail server. Payments are currently made by invoice; no external payment provider is integrated. Before we use one, we will extend this statement. We keep invoice and payment data for the statutory retention period under Swiss law.

3.6 Premium: team area and attachment

With a Team or Organisation plan you can save poll links in a shared team area. It is encrypted in your browser; the server stores only the encrypted data block, a check value (hash) of the access code and the link to the licence, and cannot read the content. Anyone with the invitation link has access to the team area. Orphaned team areas are deleted once the licence has been expired for more than 180 days.

For date polls you can attach a file of up to 2 MB with an active licence. It is also encrypted in your browser, cannot be read by us, and is deleted together with the poll.

3.7 Data in your browser

Some information is stored by your browser only locally on your device (local storage or session storage), for example a Premium licence key, the connection to a team area, templates you created, the session of a signed-in account and display settings. This information is not transmitted to third parties; a licence key is only sent to us when you use a function that checks it. You can delete it at any time in your browser settings. These are not cookies.

3.8 No cookies, no tracking

terminsuche.ch uses no cookies, no tracking pixels, no analytics services (e.g. Google Analytics) and no social media embeds. No user profiles are created.

Visitors do not receive any cookies from the website. The website software (Joomla) uses a technical session cookie only in the operators’ login area; it does not affect visitors.

3.9 Contact and feedback

There is no form on the “Feedback” and “FAQ” pages. If you report ideas, bugs or questions to us, your own email program opens with a message to kontakt@terminsuche.ch. The message is sent only by you and is not stored on the website.

With such a message, we receive your email address, your name (as far as it is contained in your sender address), the content of your message and any details you provide voluntarily (e.g. device and browser). We use this information exclusively to handle your request and reply to you. Email traffic runs via the Infomaniak mail server in Switzerland.

Please do not send us complete survey links. Participant and admin links contain the key to your content. Instead, briefly describe what you see or expect. We delete messages as soon as the matter is resolved, unless a statutory retention obligation applies.