Privacy Policy

Last updated: 30 October 2026

Fenzly is built on a simple promise: the people you share your location with should be the only ones who can see it. This policy explains what little data we process, what we deliberately cannot see, and the rights you have.

1. Who is responsible

The data controller for Fenzly is Logil Sàrl (“we”, “us”), Chemin de l’Eglise 4, 1233 Bernex, Switzerland (company no. CHE-435.741.642).

For any privacy question, contact us at [email protected].

2. Our core principle: end-to-end encryption and a “blind” server

Fenzly encrypts your locations, places, and messages on your device using the Double Ratchet protocol (Olm), individually for each recipient. Our servers only ever relay opaque encrypted data. As a result, we cannot read:

  • your GPS coordinates or movements;
  • the names, coordinates, or radius of your places;
  • the content of your messages;
  • who is in your circles, or your address book.

This is by design, not by policy: even if compelled, we cannot produce data we are not technically able to read.

3. Data we process

Account data. To create an account you provide either an email address or a phone number (one is sufficient). Fenzly does not use passwords: every sign-in is verified with a one-time code sent by email or SMS, so there is no password for us to store, and none to lose. We also store a display name and your language preference (used to localize the emails and SMS we send you). Phone numbers are stored in international format and verified by a one-time code. For optional contact discovery, we store one-way SHA-256 hashes of email/phone numbers, never the values in clear.

Last connection time. We record when your device last contacted our servers, as a single timestamp that each new contact replaces. People who already know your account’s technical identifier, in practice your contacts and the members of your circles, can read it: their app uses it to warn them when your phone has had no connection for several hours. It is a safety signal, so hiding your online status in chats does not hide it.

Connection and technical data. Like any online service, our servers see the IP address of each connection. We use it, together with your account identifier, to limit abuse (for example the number of codes that can be requested per hour). Our server logs record technical events (time, request path, response status, errors, account identifiers, IP addresses) to keep the service running and secure; requests are logged without their parameters, and the logs never contain a position, a place, an address search, or the content of a message. The app also tells our servers its platform and version number, so that we can tell you when an update is required; we only count how many users run each version, never which version is yours.

Device data. A push notification token (Firebase Cloud Messaging) and basic device information, used solely to deliver notifications. Notifications reach your phone through Google Firebase Cloud Messaging and, on iPhone, Apple’s push notification service: a message notification carries the sender’s display name and a generic text, an SOS notification carries the sender’s display name; positions and message contents never travel unencrypted in a notification. If you enable arrival/departure notifications for a shared place, we additionally store a coarse notification preference (which place, and whether you want arrivals or departures) so we can wake your device, never which member you follow; that filter stays on your device.

Cryptographic material. Your public encryption keys (Curve25519 identity key, Ed25519 signing key, signed keys and one-time keys), needed so others can start an encrypted session with you. These are public by design and reveal nothing about your activity.

Encrypted content we relay (but cannot read). Encrypted location updates, place definitions, zone-crossing events, and messages transit our servers temporarily (e.g. via short-lived queues) so they can be delivered when a recipient comes online. They are stored encrypted and expire automatically (see Retention). Profile pictures (for users, circles, and places), photos sent in a chat and the details of a shared trip (route, speeds, elevation) are stored as opaque encrypted blobs: the decryption key travels end-to-end encrypted between your devices and your contacts, so we cannot view them. When you invite someone with a circle code, we keep the code, who created it, its expiry date and how many times it was used, never which circle it opens.

Backups. If you enable backups, your data is encrypted on your device before it leaves it, in one of two ways:

  • In your own cloud (Google Drive or Apple iCloud): we use a split-key scheme. We hold only a random key share; your cloud holds the encrypted backup and the other share: neither part alone can decrypt anything. If saving to your cloud keeps failing, a small encrypted copy of the essential part is also kept on our storage, which our share alone still cannot open.
  • On Fenzly’s storage, in Switzerland: the key comes from a recovery code generated on your device and shown only to you. We store only encrypted data and never receive the code. If you allow it, the app also keeps the code in your Apple iCloud or Google account, so that a new phone can find it.

Licensing data. If you subscribe to a plan, we keep minimal receipts: the plan, its status and validity period, and whom you assigned licenses to (technical identifiers). Subscriptions are bought through the App Store or Google Play, which handle the payment: we never see your card or bank details. To activate your plan we check the purchase with Apple or Google and keep the identifiers they give us (transaction and product identifiers, dates, renewal status), linked to your account so that the subscription follows you from one phone to another. These receipts are never linked to positions or circles. For a child account we keep a parental-consent receipt (guardian and child identifiers, method, date), the legal proof of consent, nothing more.

SOS alerts. When you send an SOS alert, the members it reaches receive your position and then follow it live, end-to-end encrypted like every position. This live sharing overrides your sharing settings (“Position sharing” switched off, a circle set to “Off”, “Geolocation” switched off) and switches Offline mode off, which stays off afterwards. It stops when you cancel the alert, 30 minutes after someone takes charge, or 4 hours after the alert if nobody does; apart from cancelling the alert, nobody can end it sooner. So that the alert keeps ringing until someone takes charge, our server holds an SOS session for 30 minutes at most: the alert’s identifier, your identifier and those of the alerted members, the times, and who saw it, took charge of it or cancelled it; never the location. If an alerted member has still not seen the alert after about two minutes and has a verified phone number, we send them one SMS through our SMS provider (see section 6): it carries your display name and says that your position is in the app, never the position itself.

Diagnostic data. Crash reports and technical logs (via Firebase Crashlytics) to detect and fix bugs. These do not contain your location or message content.

Support requests. When you write to us through the contact form of help.fenzly.app or through “Report a problem” in the app, we receive what you type and your email address. A report from the app adds your account identifier if you are signed in, a technical description of your device (model, system and app versions, language, connectivity, permission states), the app’s recent log if you leave that option on, after the app has masked email addresses and phone numbers, replaced the names of places and members and removed coordinates, and the screenshots you choose to attach (a screenshot can show your map). Our servers forward all of this as one email to our support mailbox and keep no copy. That email, attachments included, stays in the mailbox for 12 months after your request is closed, then is deleted.

4. Data we do not have

We never receive your address book, your coordinates, or your place names: these stay on your device or are encrypted end-to-end. We do not hold the membership of your circles: to deliver a message, our servers only see the identifiers of its sender and recipients, for as long as the delivery takes.

Where the GDPR applies, we rely on: performance of a contract (Art. 6(1)(b)) to provide the service; your consent (Art. 6(1)(a)) for optional features such as contact discovery or phone-based discoverability; the protection of vital interests (Art. 6(1)(d)) of the person who sends an SOS alert, for the live sharing and the SMS that follow it; and our legitimate interests (Art. 6(1)(f)) in keeping the service secure and functioning. Where Swiss law applies, processing is carried out in accordance with the Federal Act on Data Protection (FADP/nLPD).

6. Service providers (processors)

We rely on a small number of providers, chosen with privacy in mind:

  • Infomaniak (Switzerland): hosting of our servers, databases, encrypted media and backup storage, and of their technical backups; sending of our emails (sign-in and verification codes, account notices); our support mailbox. Data hosted in Switzerland.
  • mailomat (mailXpert GmbH, Zurich, Switzerland): backup email delivery, used only when sending through Infomaniak fails; it then receives the recipient’s address and the content of the email.
  • ASPSMS (Switzerland) and Twilio (United States): sending of SMS. They receive the phone number and the text: a sign-in or verification code, or the SOS alert SMS described in section 3. ASPSMS sends to numbers in Switzerland and most European countries, Twilio to the rest of the world; each one takes over when the other fails to deliver a message.
  • Google Firebase (Cloud Messaging and Crashlytics) and, on iPhone, Apple’s push notification service: push notifications and crash reporting.
  • MapTiler (Switzerland): maps and address search. Your device loads the map tiles directly from MapTiler’s delivery network, which therefore sees your IP address and the area displayed; MapTiler has confirmed to us in writing that the IP address stays at most 20 minutes in that network’s memory and is not passed on to its servers. Address searches go through our servers: MapTiler receives the text or the coordinates to look up, never your IP address or your account, and neither we nor MapTiler store them.
  • Grafana Labs (Grafana Cloud, data stored in Switzerland): our servers’ technical logs and metrics (see “Connection and technical data” in section 3).
  • Apple (App Store) and Google (Google Play): sale and billing of subscriptions; they process your payment under their own terms.
  • Google Drive / Apple iCloud: only if you enable backups; your encrypted backup, or the recovery code if you allowed it, is stored in your own cloud account.
  • Cloudflare (United States): hosting of our websites fenzly.app and help.fenzly.app and of the fenzly.app domain; it sees the IP address of website visitors. Our websites set no cookies and use no audience measurement.

7. International transfers

Our core infrastructure (servers, databases, storage, technical logs) is hosted in Switzerland. Some providers process limited data outside Switzerland and the EU, mainly in the United States: Twilio (SMS to numbers outside Europe, or as a backup), Google (notifications, crash reports, Google Drive, Google Play), Apple (notifications, iCloud, App Store) and Cloudflare (websites); Grafana Labs, a US company, stores our logs in Switzerland. Such transfers are governed by appropriate safeguards (e.g. EU Standard Contractual Clauses).

8. Retention

  • Encrypted messages queued for offline delivery: up to 30 days, then deleted automatically. Encrypted zone-crossing events and delivery/read receipts: up to 7 days.
  • Encrypted location updates, including the live position of an SOS alert: kept only for the duration of the share, then expire.
  • SOS session: 30 minutes at most.
  • Address searches: not stored, neither by us nor by MapTiler.
  • Encrypted photos sent in a chat: 90 days on our servers. Encrypted details of a shared trip: 30 days. The copies already received stay on the recipients’ devices.
  • Encrypted profile pictures: kept until you replace or remove them, or delete your account.
  • Circle invitation codes: deleted at the latest 30 days after they expire.
  • Backups: the most recent versions are retained; older versions are pruned automatically.
  • Technical logs and metrics of our servers: 14 days.
  • Support requests (contact form and reports from the app, with their attachments: log, device description, screenshots): kept in our support mailbox for 12 months after the request is closed, then deleted.
  • Account data: kept until you delete your account: deletion is immediate and permanent, and the copies in our technical backups disappear within 30 days. We then keep, for 12 months, a minimal deletion record (technical identifier + date, nothing else): it lets your devices detect the deletion and clean themselves, and is then purged in turn.

9. Your rights

You have the right to access, rectify, delete, restrict, or object to the processing of your personal data, and to data portability. These rights are exercised directly in the app, with no human in the loop and immediate effect:

  • Export your data (Settings → Personal data → Download my data): a readable copy of your local data (profile, places, trips, history, settings, your data only, never your circle members’) plus the server side, near-empty by design, the demonstration of our architecture.
  • Delete your account (Settings → Personal data): deletion is verified with a one-time code and immediately, permanently erases your data from our servers and from your device; your other devices clean themselves the next time Fenzly opens. You can also delete your account without the app, at fenzly.app/delete-account. Deleting a child account requires a guardian’s approval (the code goes to their verified channel).

Note: data you already shared with your contacts (e.g. your past positions in their app) lives on their devices, beyond our reach, inherent to end-to-end encryption, like a message already delivered. You may withdraw consent for optional features at any time. You also have the right to lodge a complaint with a supervisory authority: in Switzerland, the Federal Data Protection and Information Commissioner (FDPIC); in the EU, your national data protection authority.

To exercise your rights, contact [email protected].

10. Security

We protect your data with end-to-end encryption (Double Ratchet, Olm), device-bound key storage (Keychain/Keystore), TLS in transit, and Swiss hosting. No system is perfectly secure, but our architecture is designed so that the most sensitive data is never readable by us in the first place.

11. Children

Fenzly is not directed to children under 13 outside the family mode. Where required by law, under the GDPR for users below the age of digital consent in their country (which varies between 13 and 16), and under the U.S. COPPA for children under 13, processing a minor’s personal data requires verifiable parental consent. Fenzly provides a guardian-managed family mode: a member can only be designated as a child after verifiable parental consent (a code sent by SMS to the guardian’s verified number), of which we keep a minimal receipt (identifiers, method, date). Guardians can review and withdraw this consent at any time in the app, and deleting a child account requires their approval. If you believe a child has provided us personal data without the required consent, contact us at [email protected] and we will delete it.

12. Changes to this policy

We may update this policy from time to time. Material changes will be announced in the app or by email. The “last updated” date above always reflects the current version.

This policy is available in several languages. In the event of any discrepancy between the versions, the French version prevails.

13. Contact

Logil Sàrl · Switzerland · [email protected]