Privacy Policy

Last updated: March 2026

1. Data controller

GVA Horizon

Geneva, Switzerland

Email: contact@gvahorizon.ch

The data controller within the meaning of the new Swiss Federal Act on Data Protection (nFADP) and the General Data Protection Regulation (GDPR) is GVA Horizon, whose contact details are listed above.

2. Scope

This privacy policy applies to the GVA Horizon mobile application (iOS and Android) and all associated services.

Use of the application is restricted to persons aged 16 or older.

This English version is a convenience translation. In case of discrepancy, the French version prevails.

3. Data collected

3.1 Account data

• Email address
• First name
• Password (hashed with bcrypt, factor 12)
• Preferred language (French or English)
• Google OAuth identifier (optional, if signing in via Google)
• Premium status (active or inactive)
• RevenueCat subscription identifier
• Consent preferences (service improvement, urban statistics)

3.2 Profile data

• Home and work location (latitude and longitude)
• Preferred transport modes
• Preferred border crossings
• Commute destination
• Preferred beach
• Active scenario
• Geneva experience level
• Household type
• Neighbourhood
• Interests
• Personas
• Bicycle ownership
• Widget installed
• Attention budget
• Deduced traits

3.3 Behavioural data

• Application interactions (retained for 90 days)
• ASK chatbot messages (retained for 30 days)
• Personalised alerts
• Briefing blocks displayed
• Active scenarios
• Briefing logs (retained for 30 days)
• Notification logs
• Push tokens

3.4 Participatory data

• Place reports (anonymised after 24 hours, deleted after 7 days)
• Real-time signals (expire after 2 to 8 hours)
• Border reports
• Briefing block feedback

3.5 Gamification data

• Badges earned
• Consecutive streaks
• Anecdotes viewed
• Monthly reports
• Referrals
• Shared cards

4. Purposes of processing

Your data is processed for the following purposes:

• Morning briefing personalisation: adapting content to your profile, interests and location
• ASK chatbot: providing personalised responses through conversational artificial intelligence
• Push notifications: sending relevant alerts based on your preferences and context
• Premium subscription management: processing payments and activating premium features
• Service improvement: analysing usage to improve the application (only if you have enabled the "Improve Horizon" consent)
• Anonymised urban statistics: contributing to collective statistics about urban life in Geneva (only if you have enabled the "Urban statistics" consent)
• Security and abuse prevention: protecting the service and its users against misuse

No data is sold to third parties.

5. Legal bases

Data processing is based on the following legal grounds:

• Performance of a contract (art. 31 para. 2 let. a nFADP): processing necessary for the operation of the core application features (briefing, ASK, notifications, account management)
• Consent (art. 31 para. 1 nFADP): optional processing (service improvement, urban statistics), which you can enable or disable at any time
• Legitimate interests: security of the service and prevention of abuse

6. Recipients and processors

Your data may be shared with the following processors in connection with the operation of the service:

• Anthropic (Claude API) — ASK chatbot and briefing summaries — Data transmitted: messages and urban context — Location: USA
• Expo Push — Push notification service — Data transmitted: push tokens and notification content — Location: USA
• RevenueCat — Subscription management — Data transmitted: subscription events and user identifier — Location: USA
• Sentry — Error monitoring (optional) — Data transmitted: error traces and device information — Location: EU
• Infomaniak SMTP — Transactional emails (verification, password reset) — Data transmitted: email address and message content — Location: Switzerland

The following third-party services are used to obtain public data and do not receive any personal data: Open-Meteo, MeteoSwiss, WAQI, OpenTransport, TPG, OpenAgenda, Football API.

7. Transfers abroad

Certain data is transferred outside of Switzerland:

• USA: Anthropic, Expo Push, RevenueCat — on the basis of standard contractual clauses compliant with nFADP requirements
• EU: Sentry — on the basis of the Federal Council's adequacy decision

Your data is stored primarily in Switzerland, with Infomaniak (Geneva datacenter, GE1).

8. Retention periods

• Application interactions: 90 days then automatic deletion
• ASK messages: 30 days then automatic deletion
• Briefing logs: 30 days then automatic deletion
• Place reports (user identifier): 24 hours then anonymisation
• Place reports (complete data): 7 days then deletion
• Real-time signals: 24 hours after expiry
• Email verification token: 24 hours
• Password reset code: 24 hours
• Sessions: 30 days
• Export cache: 1 hour
• User account: retained until deletion by the user

9. Automated individual decisions

The ASK chatbot and morning briefing use artificial intelligence (Anthropic Claude) to generate personalised content.

These processes produce informational recommendations only. They do not produce any decisions having legal effects or significantly affecting the user within the meaning of art. 21 nFADP.

You can modify your preferences, profile and interests at any time to influence the recommendations.

10. Data security

We implement the following technical measures to protect your data:

• Passwords hashed with bcrypt (factor 12)
• JWT access tokens valid for 15 minutes, refresh tokens valid for 30 days
• Mandatory email address verification
• Hosted by Infomaniak, Geneva datacenter (Switzerland)
• All communications encrypted via HTTPS (TLS)

11. Your rights

In accordance with the nFADP (art. 25 to 28) and, where applicable, the GDPR, you have the following rights:

• Right of access: you can export your data in JSON format directly from the application
• Right to rectification: you can modify your profile and information in the application
• Right to erasure: you can delete your account from the application, which triggers a cascading deletion of all your data
• Right to data portability: you can export your data in JSON format
• Consent management: you can enable or disable the "Improve Horizon" and "Urban statistics" options at any time

To exercise your rights: contact@gvahorizon.ch

Response time: 30 days.

12. Right to lodge a complaint

You have the right to lodge a complaint with the competent supervisory authority:

Federal Data Protection and Information Commissioner (FDPIC)

www.edoeb.admin.ch

13. Cookies and similar technologies

GVA Horizon is a native mobile application. It does not use cookies.

Local data is stored using the device's native mechanisms (AsyncStorage).

14. Changes

GVA Horizon reserves the right to modify this privacy policy.

In case of a material change, you will be notified by push notification.

Continued use of the service after notification constitutes acceptance of the modified policy.

15. Contact

GVA Horizon

Geneva, Switzerland

contact@gvahorizon.ch