Privacy policy
Last updated: July 2026
Controller
The person responsible for data processing at Locobox is Yannik Gartmann, Switzerland. The contact details are listed in the imprint.
Legal bases
Processing follows the Swiss Federal Act on Data Protection (FADP). Where the EU GDPR applies, it relies on Art. 6(1) lit. b GDPR (performance of a contract: account, collection, subscription), lit. f GDPR (legitimate interest: secure operation of website and app) and, where consent has been given, lit. a GDPR.
What Locobox does not do
Locobox itself sets no cookies and uses neither tracking nor analytics tools. There is no profiling, and no data is shared for advertising purposes.
Account and sign-in (Auth0)
Sign-in runs through Auth0 (Okta) on an EU tenant. During that process Auth0 sets session cookies on its own domain; no cookies are set on locobox.ch. Locobox itself never stores passwords; the account keeps only the email address as identity.
Collection data
Articles, trains, decoders, categories and your own photos are stored at Supabase in the Zurich data centre; backups also run through Supabase. A data processing agreement is in place.
Premium subscription and payment
Payment for the Premium subscription runs through Stripe. Card and payment data is processed directly by Stripe; Locobox never stores it. The only thing recorded is whether and for how long a subscription is active.
Website and hosting
This website is static and hosted with StaticHost in the EU; a data processing agreement is in place. StaticHost processes visitors' IP addresses only transiently to deliver the pages and stores no visitor data. Its hosting subprocessors are Hetzner (Germany) and bunny.net (Slovenia), both in the EU.
Data security
Website and app use TLS encryption; transmitted data cannot be read in transit. Complete protection is not possible on the internet, however, for example when communicating by email.
Local settings in the browser
This website stores two voluntary settings in the browser's local storage: the chosen language and the larger text size. These values stay on your device and are never transmitted.
Contact by email
When you get in touch by email, the transmitted details (address, name, content) are processed to answer your inquiry and deleted once they are no longer needed for it.
Data locations
Sign-in runs on an EU tenant of Auth0, and collection data is stored in the Supabase data centre in Zurich. Only Stripe processes payment data in the USA as well; that transfer is covered by data processing agreements and standard contractual clauses. US authorities may demand access to such data under US law; Locobox has no influence on that.
Recipients and third parties
Data is processed exclusively at Auth0/Okta (sign-in), Supabase (app data and backups), Stripe (payment) and StaticHost (website hosting). No data is passed on to any other third parties.
Your rights
Under the Swiss Federal Act on Data Protection (FADP), you have the right to free access, rectification, erasure and restriction of the processing of your personal data, as well as data portability. This also covers the deletion of your account and collection data. For reasons arising from your particular situation you may object to processing, and you may withdraw a given consent at any time. The contact details for this are listed in the imprint.
Right to complain
For complaints about data processing you can contact the Federal Data Protection and Information Commissioner (FDPIC) of Switzerland.