Privacy policy

The principle

At Vexalo, protecting your data is the highest priority. Our apps and services are developed according to the 'privacy by design' principle: we process only data that is genuinely required to operate our website or our apps — as much as necessary, as little as possible. This does not mean that no data is involved at all; it means every processing activity serves a specific purpose. Which data that is in each case, and why we need it, is set out below.

This website

When you visit our website, our hosting provider processes technically necessary connection data (e.g. IP address, date and time of access, browser type, and operating system) in server logs to ensure the secure and reliable operation of the website. This data is processed exclusively for technical purposes and deleted after a reasonable period. We do not use advertising cookies or cross-site tracking. How we analyze website usage is described in the following section.

Web analytics

To understand how our website is used, we use Vercel Web Analytics, a service provided by Vercel Inc., 440 N Barranca Ave #4133, Covina, CA 91723, USA. The service works without cookies and stores no data on your device. Only aggregated information is collected, such as the page visited, the referring page, approximate region, device type, and browser. A hash value that changes daily is derived from this technical information; your IP address is not stored and no cross-site or persistent identifier is created. We are therefore unable to link this data to you personally. The legal basis is our legitimate interest in a privacy-preserving analysis of website usage (Art. 6(1)(f) GDPR and Art. 31 FADP respectively). Further information: https://vercel.com/legal/privacy-policy.

Our apps

Apps developed by Vexalo store data locally on your device by default. Depending on the app, optional features such as cloud synchronization or cross-device use may be offered. In that case, your data is synchronized exclusively via the platform services used (e.g. Apple iCloud / CloudKit). Where technically provided, we have no access to your encrypted content.

Calm Flight Buddy (iOS app)

Calm Flight Buddy is a companion for people with a fear of flying. The app works without registration and without a user account. It contains no advertising, no tracking and no analytics tools. The app is not a substitute for medical or therapeutic treatment. The app is currently available in German only.

Data on your device: your flights, checklists, chat history, breathing exercises, name and settings are stored on your iPhone. If iCloud is enabled, Apple synchronizes this data to your private iCloud database. Vexalo has no access to it.

Answers from Sky: the answers of the chat companion “Sky” are produced in two ways. First, via OpenAI (OpenAI, USA), relayed through a dedicated Vexalo server (a Cloudflare Worker, Cloudflare Inc., USA). This route is switched on by default; you can switch it off during onboarding and at any time under “Ich → Datenschutz & Sicherheit” (Me → Privacy & Security). Second, with Apple Intelligence directly on your iPhone, if your device supports it (iPhone 15 Pro, iPhone 15 Pro Max and later models). In that case nothing leaves your device. If the OpenAI route is switched off, Sky answers exclusively this way; if it is switched on, Apple Intelligence steps in when OpenAI cannot be reached.

What is sent to OpenAI: your chat messages (the last up to 20 messages of the history as context) and Sky's instructions. Your name is never sent to OpenAI. Two further pieces of information are only sent to OpenAI with your explicit consent, each via its own switch that is off by default: your flight details (route, departure time and checklist progress of your next flight) and your personal topics, i.e. what troubles you about flying, for example panic attacks. These are sensitive details about your health. Because requests come from the Vexalo server, OpenAI sees neither your IP address nor an identifier of your device. The Vexalo server does not store any messages; it only passes them on. According to OpenAI, data from the API is not used to train models by default and is retained for up to 30 days for abuse monitoring: https://developers.openai.com/api/docs/guides/your-data.

The legal basis for the transfer to OpenAI is your consent (Art. 6(1)(a) and Art. 9(2)(a) GDPR and Art. 6(6) and (7) FADP respectively). You can withdraw it at any time using the switches mentioned. OpenAI and Cloudflare are based in the USA; your data is therefore transferred to the USA, a country that may not offer a level of data protection equivalent to Swiss or European law. The transfer is based on your consent and on the providers' standard contractual clauses.

Daily limit: so that the service can remain free, answers via OpenAI are limited to 30 per day. For this, the app generates a random identifier once and stores it in your iPhone's keychain. This identifier is not linked to any person and is not passed on to OpenAI. The Vexalo server only stores a counter of the current day's requests; it is deleted every day at midnight (UTC). To protect against abuse, the server also limits requests per IP address and minute. This happens transiently at Cloudflare, without Vexalo storing IP addresses.

Deletion: when you delete the app, the data on your iPhone is removed. You can delete data in iCloud in the iOS Settings under [your name] → iCloud → Manage Storage. Beyond that, Vexalo holds no personal data about you that could be deleted; the daily counter expires every day anyway.

User account

Some features may require a user account. Depending on the sign-in method, data such as your Apple ID, a user identifier provided by Apple, or your email address may be processed. This data is used exclusively for authentication and to provide your user account.

Subscriptions & purchases

Paid features and subscriptions are handled via the Apple App Store. We do not receive payment data such as credit card information. To unlock your purchased features, information about the status of your subscription or purchases may be processed (e.g. product identifier, expiration date, or transaction status).

Diagnostics & stability

To improve the stability of our apps, technical diagnostic and crash data may be processed, provided you allow this on your device or the respective service provides for it. This information is used exclusively for error analysis and to improve our applications.

Support requests

If you contact us by email, we use your email address and the content of your message exclusively to process your request. This data is not shared with third parties and is only stored for as long as necessary for processing or as required by statutory retention obligations.

Your rights

You have the right to access, rectification, erasure, restriction of processing, and — where applicable — data portability. You may also withdraw any consent you have given at any time and lodge a complaint with a competent data protection supervisory authority. For users in Switzerland, the provisions of the Swiss Federal Act on Data Protection (FADP) apply; for users in the European Economic Area, the General Data Protection Regulation (GDPR) additionally applies. The controller responsible for data processing is Vexalo Mobile Development Büchler. Contact: info [at] vexalo [dot] ch.