Family1. Who is responsible
Swisswise GmbH, Weltpoststrasse 8b, 3015 Bern, Switzerland, is responsible for the data processing described here. Privacy questions and requests can be sent using the contact form.
2. Privacy at a glance
The data used depends on your role, the features you choose and whether optional services are enabled. Not every category below is collected for every user.
- Account and sign-in data: email address, account and role identifiers, authentication records and, only if you choose a third-party login option, the identifiers or tokens needed to connect that login.
- Profile and matching data: profile text, languages, country or region, non-smoker status, offered pocket money and currency, photos, discovery choices, and an in-app contact graph of interests, matches and blocks. We do not access your device address book.
- Communication and safety data: messages, report reasons and details, a limited snapshot of a reported message, related identifiers, moderation records and support correspondence.
- Technical and local data: device or app information, security events, bounded server request logs (including filters, status and response time), and information in a local SQLite database or device cache.
- Optional-service data: a device push token and delivery metadata if notifications are enabled, and store transaction, purchase-status and entitlement data for a Family subscription.
3. Website data
This website does not use analytics cookies or marketing cookies. Visiting it may nevertheless create hosting and security logs. Depending on the request, these logs may contain an IP address, request time, requested resource, browser or device information, response status and error information.
These logs are used only to deliver, maintain, troubleshoot and protect the website. Hosting and security providers may process them to the extent needed to provide those services. They are retained only for as long as needed for those purposes or applicable legal requirements.
Cloudflare provides hosting, website delivery and security services and can process connection and request data for those services. Its network operates internationally; website data may therefore also be processed outside Switzerland. Cloudflare privacy information.
If you use the contact form, we process your reply email address, optional name, selected topic and message to answer your request or handle account, privacy or safety concerns. Your browser sends the form directly over HTTPS to Web3Forms, operated by Web3Creative, which processes it on our behalf and forwards it to our support mailbox. The provider also receives request metadata, including your IP address, for delivery and spam prevention.
Web3Forms operates from India and uses international infrastructure and spam-filtering providers that may receive your email and IP address. Its policy states that form submissions may be retained for up to three years, unless a shorter period applies or they are deleted earlier. Its Privacy Policy and Data Processing Agreement describe its processing and international-transfer safeguards.
The form accepts no attachments, sends no automatic reply and does not subscribe you to marketing. Our support correspondence is retained only as long as needed to resolve the request or meet a legal or dispute-related obligation; provider retention is separate. Do not send passwords, full identity-document numbers or unnecessary sensitive information.
4. App data, device storage and optional services
The app uses a local SQLite database and device caches for information such as discovery filters, skipped profiles and app or session state. Some locally stored information may remain on a device until you sign out, remove the app or the operating system clears it. A server-side account deletion and deletion of a local device copy are therefore separate steps.
Gender entry: this update includes a one-time administrative completion for existing au pair profiles whose entry is missing. The administrative value is “Female”; any existing non-empty entry, including “Prefer not to say”, is preserved. The administrative value does not mean that the account owner selected or confirmed it. New au pair profiles have no preselected entry. When creating a new au pair profile, the updated form requires choosing “Male”, “Female”, “Non-binary” or “Prefer not to say”. “Prefer not to say” is a valid response and lets you continue without stating a gender. In the updated form, you can view and change the entry, including choosing “Prefer not to say”. Host-family profiles do not request this entry.
The app asks users not to upload photos in which children’s faces are recognisable. A profile region is supplied by the user; the current design does not track the device’s location.
If you enable notifications, the app and the relevant notification-delivery provider may process a device push token and delivery metadata. Notification previews are also controlled by your device settings. If a host family buys a subscription, the app store handles the purchase under its own terms. Swisswise GmbH receives transaction identifiers, purchase status and entitlement data to provide access, but not full card details.
5. Technical anti-abuse check — not identity verification
A technical duplicate-account and format check may process a document-number input. Under the current design, the plain number is not retained; a salted hash and a masked representation are used. The check does not scan a document, compare a selfie or confirm that an account belongs to a particular person.
This is not identity verification and is not evidence of identity, trustworthiness, suitability or legal status. Users must carry out their own checks.
6. Why data is used
Data is used to create and administer accounts, display profiles, support discovery and mutual contact, enable chat after a match, provide block and report controls, detect misuse, respond to support requests, protect the service and process account deletion.
Where EU or EEA data-protection law applies, service data is processed to provide the functions requested by the user; security, abuse-prevention and service-integrity data is processed where necessary to protect users and the service; consent is used where a feature specifically asks for it; and data may be processed or retained where required by law or to establish, exercise or defend legal claims. Mandatory local rules remain applicable.
7. Who can see or receive data
We store the gender entry with your account to set up and manage your au pair profile. It is not displayed to other app users and is not part of the information visible to them for discovery and contact. The account retention and deletion rules in this policy apply.
Profile information and selected photos are visible to other app users according to the product’s visibility controls. Messages are visible to the people in the relevant conversation. A report can include its reason, timestamps, reporting and reported-account identifiers, the reported message identifier and a limited snapshot of that message so that authorised support or moderation personnel can understand the concern.
Technical providers needed for hosting, authentication, sign-in, security, notifications or support may process data on behalf of Swisswise GmbH only to the extent required for their services. A store or payment provider processes purchase data only when the relevant purchase function is enabled and used. Those providers may also process data as independent controllers under their own terms.
Data may also be disclosed where Swisswise GmbH is legally required to do so. Any international processing must use the safeguards required by applicable law.
8. Retention and deletion
Account data is kept while it is needed to provide the account and app functions. Under the current retention policy, non-paying au-pair and family accounts are eligible for inactivity cleanup only after more than two calendar years of inactivity. Paying accounts, accounts with a subscription or recorded payment history, and accounts with uncertain payment or activity status are excluded from this automatic inactivity cleanup. Cleanup is performed separately and may be delayed; this is not a guaranteed deletion date. A legal, safety or dispute reason may require limited records to be kept longer.
Automatic expiry of older chat content is not yet guaranteed across all released app versions and the live service. We therefore do not currently promise deletion after a fixed number of days. Local app storage and server records are cleaned separately; this does not mean immediate erasure of backups or copies already received by other people. Original contact requests and replies are not automatically included in chat cleanup.
When a user deletes a message, its archived text is normally scheduled for deletion after 30 days. An open or in-review safety report can delay this shorter cleanup. Separately stored moderation evidence can remain after the message or account is deleted and is not automatically included in chat cleanup. Closing a report does not itself trigger automatic deletion of the separate moderation evidence. Such evidence has no fixed automatic deletion period in the current system; it may be retained only as long as necessary for handling the report, safety, an active dispute or a legal duty.
When an account-deletion request is completed, server-side data that is no longer needed is deleted or anonymised. This does not automatically erase every SQLite record or cache already stored on a device, information retained by another conversation participant, or device and cloud backups controlled by the user or platform provider. Sign out and remove the app from devices you control if you also want to remove the local app copy.
Hosting and security logs are kept only for the period needed for their operational or legal purpose. Deleting the app from a device does not by itself delete the account; use the in-app deletion function or use the contact form.
9. Your choices and rights
Depending on the law that applies to you, you may request access, correction, deletion, restriction, objection or a copy of your personal data, and may withdraw consent for future processing where processing relies on consent. You may also complain to the competent data-protection authority.
Send your request through the contact form and, where possible, use the account email address as your reply address. Swisswise GmbH may ask for information reasonably needed to protect the account and confirm the request, but will not ask for your password by email.
10. Security and updates
HTTPS protects data in transit. Chat is not end-to-end encrypted: our backend processes and stores readable messages for delivery, synchronisation and abuse checks. Messages are therefore not stored only on your devices.
Please protect your sign-in details and do not send passwords, full document numbers or unnecessary sensitive information by email. No internet service can guarantee absolute security.
This overview will be updated when the production service, data flows or legal requirements change. The date above identifies the current version.