Privacy policy

Version of 13 November 2026 · under the Swiss Federal Act on Data Protection (FADP) and, where applicable, the EU General Data Protection Regulation (GDPR)

The German version is authoritative; this translation is provided for your understanding.

In brief

The app itself collects nothing for us: no account, no tracking, no analytics, no advertising. What you enter stays on your device. Data leaves the device only in the cases listed below, and for the add-on services only if you switch them on yourself, and only as much as the service needs. We do not sell any data, do not create profiles and do not make automated decisions about you.

1. Who is responsible

NEXUS ID, Anthony C. Biasio, sole proprietorship, Weidmattstrasse 49, 4415 Lausen BL, Switzerland · support@sessionplaner.app. We have not appointed a data protection advisor or a representative in the EU; for all questions, write to the address given.

Important regarding the allocation of roles: For the data that a coach, a practice or a business keeps about its clients in Session Planer, that provider is the controller, not us. For online booking and encrypted sync, we process data only on its behalf (sections 5 and 6). We are the controller for the website, for emails to us and, in the booking service, for the details about the provider itself.

2. Website

The website sessionplaner.app is delivered via Cloudflare. When the site is accessed, Cloudflare processes technically necessary connection data, such as IP address, time, requested address and browser identifier, in order to deliver the page and protect it against attacks. We do not analyse this data.

No cookies, no tracking, no advertising, no analytics. The website loads nothing from third-party servers: no fonts, no scripts, no images or videos from third parties. The legal basis is our legitimate interest in a secure, functioning website (Art. 6(1)(f) GDPR).

3. App

The Session Planer app is offline-first: your data stays on your device, not on a server of ours. The app contains no tracking, advertising or analytics service and no account. You can export and delete all data at any time in the app.

On the device, the app records which version of the Terms of use and of this policy you confirmed and when. This record stays on the device.

Without add-on services, the app only establishes these connections: it loads the public holidays from openholidaysapi.org; country, canton and year are transmitted, no personal data, and the provider sees your IP address in the process. And if you tap “Maps”, “Google” or “Waze” or open a link, the app passes the address to the chosen app. This never happens on its own. If you tap “Report a problem” in the app, it can open the page sessionplaner.app/problem; what happens there is described in section 8.

4. Purchase through Apple

Purchase, trial week, payment, renewal, refund and offer codes are handled by Apple; Apple is responsible for this, and Apple’s privacy policy applies. The app receives from Apple only the status of your purchase (tier, expiry, whether the trial week is running) and stores it on the device. We do not receive names, email addresses or payment data from Apple. Apple provides us with sales reports without names and, if you have allowed sharing with app developers in your Apple settings, aggregated usage and crash figures.

5. Add-on service online booking (buchen.sessionplaner.app)

Only if a provider switches it on and expressly grants access to a person. The provider is the controller for the data of its clients; we operate the booking service on its behalf and use the data for nothing else.

From the provider: name and email address, its offerings and rules, the booked times without title, names or location. We are the controller for this; the purpose is operating the service for the provider, and the legal basis is the contract (Art. 6(1)(b) GDPR).
From persons granted access: only first name, email address and the status of their credit (number of units); booked and cancelled appointments (time, offering); which version of the terms they confirmed and when; outgoing emails to them (sign-in link, confirmation, cancellation, reminder).
Security: sign-in codes, sessions and secret links are stored only as a hash. The IP address is only counted briefly in memory to limit abuse, and is not stored.
What never goes to the service: surnames, date of birth, notes, session notes, health information, payments.
Cookie: a technically necessary session cookie that scripts cannot read, for at most 60 days. Without it, sign-in does not work; no consent is required for it. No tracking, no advertising, no analytics, no third-party scripts.
Calendar subscription: On request, the service provides the provider’s appointments under a secret link as a calendar, without client names unless the provider switches them on. A new link invalidates the old one. If the provider enters the address of a private calendar, the service reads from it only the start and end of booked times; titles and locations are not stored.

Retention: emails 30 days, undeliverable emails at most 7 days; completed bookings 90 days after the appointment; expired sign-in codes and sessions immediately; a provider who does not confirm its registration, with everything belonging to it, after the confirmation link expires. If the provider removes a person from the access, that person loses access immediately, and their data is deleted from the service. If the provider ends online booking, everything belonging to it is deleted. A daily, encrypted backup of the service is kept for 14 days; deleted data disappears from the backup by then at the latest.

6. Add-on service sync between devices and sharing of calendars

If you set up a recovery key and switch on sync, your devices and the persons with whom you share a calendar synchronise changes via a relay service. It runs on the same server as online booking. Everything is end-to-end encrypted on your device before it leaves the device; only the devices involved have the key, not us.

What the service sees: encrypted data that it cannot read, plus metadata: opaque identifiers for circles and records, public keys, roles, sizes and times of the transfers, and technically the IP address of the connection, which is not stored. No names, no appointments, no client data in plain text. We process this data on behalf of whoever uses the sync.

Retention: The encrypted data remains until the shared calendar is deleted or left. Invitations expire after at most 7 days, pairing codes after 15 minutes.

7. Backup in your own iCloud Drive

The app writes the encrypted backup to the device and, where available, to your own iCloud Drive. Apple’s terms and privacy policy apply there. The backup is encrypted with your recovery key; we have access neither to your iCloud Drive nor to the key.

8. If you write to us or report a problem

If you write to support@sessionplaner.app, your email is forwarded via Cloudflare to the owner’s mailbox. We use it only to reply to you.

“Report a problem” form (sessionplaner.app/problem): The following are transmitted: your email address for the reply (required), your description, optionally your name, device and app version, and up to three screenshots (PNG, JPEG or HEIC, each at most 5 MB). A Cloudflare Worker sends the report once via Cloudflare Email Sending to support@sessionplaner.app, from where it is forwarded to the owner’s mailbox. Nothing is stored on the server. Cloudflare processes your IP address only briefly to limit abuse.

“Notify me at launch” form (home page): Only your email address is transmitted. A Cloudflare Worker sends it once via Cloudflare Email Sending to support@sessionplaner.app; nothing is stored on the server. We write to you once when the app is in the App Store and then delete the email. Cloudflare processes your IP address only briefly to limit misuse.

Please no data of others: Do not upload screenshots that show personal data of third parties, such as names, appointments or notes of your clients. Cover them or describe the problem in words.

Purpose, legal basis, duration: support and troubleshooting; the legal basis is your consent by submitting and, insofar as you use the app, the performance of the contract (Art. 6(1)(a) and (b) GDPR). Emails and reports remain in the support mailbox until the matter is resolved, at most 12 months, unless a statutory retention obligation requires longer. You can withdraw your consent at any time; to do so, write to support@sessionplaner.app, and we will delete your report.

9. Who processes the data of the add-on services

Server: Hetzner Online GmbH, Gunzenhausen, Germany; data centre Nuremberg.
Connection and protection: Cloudflare, Inc., San Francisco, USA. The connection to the website, to the booking service and to the relay service runs via Cloudflare; the server cannot be reached directly from outside. Cloudflare technically decrypts the connection in the process and processes the data as a processor. The sync data remains end-to-end encrypted in the process.
Email sending and forwarding: Cloudflare Email Service; sender buchen@sessionplaner.app; forwarding of support@sessionplaner.app; sending of the reports from “Report a problem” via a Cloudflare Worker.
Backup of the booking service: encrypted at Cloudflare (R2 storage).
Apple: for purchases and for the iCloud backup, as an independent controller.

Transfer to the USA: Cloudflare is certified under the EU-U.S. and Swiss-U.S. Data Privacy Framework. For certified companies, the European Commission has found an adequate level of protection, and the Swiss Federal Council has included the USA for this purpose in Annex 1 of the Data Protection Ordinance. If the certification lapses, the standard contractual clauses of the European Commission apply, which Cloudflare provides for in its data processing agreement. Authorities in the USA may be able to access data under certain circumstances; this is why the sync data is end-to-end encrypted and only the few details listed above go to the booking service.

10. Legal bases

Under the FADP, we process personal data in accordance with the principles of Art. 6 FADP and, as a rule, need no justification for this. Insofar as the GDPR applies, we rely on the performance of a contract or pre-contractual measures (Art. 6(1)(b)), on legal obligations (point (c)) and on legitimate interests, such as security and prevention of abuse (point (f)). As a processor, we rely on the provider’s legal basis. Your agreement to this policy confirms that you have read it; processing is based on consent only where we expressly say so. You can withdraw consent at any time with effect for the future.

11. Security

Encrypted connections; end-to-end encryption of the sync and of the backup on your device using the methods of the operating system (Apple CryptoKit); a server that cannot be reached directly from outside; hashes instead of plain text for codes and links; encrypted backup of the booking service; automatic deletion. Absolute security does not exist. Protect your device with a passcode and keep your recovery key in a safe place.

12. Children and minors

Session Planer is aimed at adults who use it professionally, not at children. If a provider keeps minors as clients, it is responsible for obtaining parental consent; the app supports it with an age gate that remains closed without a date of birth or, under 16 years, without documented parental consent.

13. Your rights

You have the right to access, rectification, erasure, restriction of processing, release or transfer of your data, and to object (Art. 25 et seq. FADP; Art. 15 to 21 GDPR). To exercise these rights, write to support@sessionplaner.app. If it concerns data that a provider keeps about you, it is best to contact that provider; if you write to us, we will forward your request and help the provider implement it. What is stored only on your own device you can export and delete yourself.

You can lodge a complaint with a supervisory authority: in Switzerland with the Federal Data Protection and Information Commissioner (FDPIC), Feldeggweg 1, 3003 Bern, edoeb.admin.ch; in the EU with the supervisory authority of your place of residence, your place of work or the place of the alleged infringement.

14. No profiles, no automated decisions

We do not create profiles, do not engage in profiling and do not make decisions based solely on automated processing that have legal effects on you or significantly affect you.

15. Changes

If the content of this policy changes, it receives a new date, and the app expressly asks you for your confirmation again the next time you open it. The version in force is always published here.