Privacy & Imprint

Zügle is a private, self-hosted app used by exactly two people. It is not operated by a company. The person responsible for this app (the "controller" under GDPR) is:

• Name: [your name]
• Contact: [your email]
• Address: [your address, if you want one on record]

Zügle is also usable without logging in. An anonymous visitor gets an empty app, types their own income, address, and rent, and gets an evaluation — none of it touches any stored account. Those figures live only in the browser's sessionStorage and are gone the moment the tab closes; nothing is written to this server's data files for a guest.

To compute a result, the figures are sent to the Zügle server transiently, and onward to the same third parties any evaluation uses — ESTV, Flatfox/Homegate, transport.opendata.ch — listed in "Who receives your data" below. The one trace that survives after the tab closes: the ESTV request (income, municipality, relationship, confession, children) lands in the same tax cache every evaluation writes to. Stated plainly — that is a real, if indirect, retention of the numbers a guest typed.

Everything below belongs to your own account — your profiles and your evaluation history — and is stored in a database on the server, readable only by your account. There is no analytics service and no third-party tracking. Fields marked special category get an explicit note underneath.

Your confession (religious denomination) is stored because Swiss church tax depends on it — it directly changes the tax comparison this app exists to make. Under Art. 9 GDPR this is "special category" data, and it is processed only on the basis of your explicit consent (Art. 9(2)(a)). You can set it to "None" at any time in Settings, which stops it being used or stored as anything but the value "none".

Confession: explicit consent (Art. 9(2)(a) GDPR), withdrawable at any time in Settings. Everything else: consent, and/or the legitimate interest of this two-person household in running a tool that compares housing costs for its own members (Art. 6(1)(a)/(f) GDPR).

All of the calls below are made by the server, not your browser — third parties see the server's IP, never yours. The one exception is the background photo: your browser loads it directly from images.unsplash.com, for every visitor, logged in or not — an anonymous visitor's IP reaches Unsplash (US) the moment the photo loads.

• Login sessions: 30 days, then they expire automatically.
• Profile and evaluation history: kept until you delete it.
• Tax cache: purged for a profile the moment that profile's data is erased.
• Operational event log: the most recent 2000 events, oldest discarded automatically.

Any advertisement shown here is first-party: the image and text are stored on this server and served from this domain, and clicking one goes through a redirect on this server. There is no ad network, no third-party script, no iframe and no tracking pixel — this site's Content-Security-Policy blocks all of those outright.

Nothing about you is sent to an advertiser and no profile is built for ad targeting. The only figures recorded are anonymous totals per advertisement — how often it was shown and clicked — held in memory and lost on every restart. Because no advertising cookie or tracker is used, no consent banner is required.

The server keeps a short technical log so faults and abuse can be diagnosed: which API path was called, the response status and duration, rate-limit hits, and login successes and failures. It does not record IP addresses, and query strings are stripped before anything is written — a guest's income travels in the query string on two routes, so the path is stored without it. It also records no account id and no email address: an entry says that a login succeeded, not who logged in. That is why "Delete my data" does not need to touch the log — there is nothing in it that identifies you.

Log entries do carry a visit id, so that a handful of requests can be recognised as one visit and we can see where the app fails. It is a random value generated in your browser, it is erased when you close the tab, it is never stored next to your account or email, and it is never sent to anyone else — there is no analytics service involved. It records which screens were reached, never what you typed.

You have the right to access, rectify, erase, and receive a copy of your data (portability), and to withdraw consent at any time. In practice:

• Access / portability — the "Download my data" button in Settings gives you a JSON file with everything held about you.
• Erasure — the "Delete my data" button in Settings hard-deletes your evaluation history, purges your entries from the tax cache, removes your entries from the operational log, and resets your profile.
• Rectification — edit any field directly in Settings.
• Withdraw consent — set Confession to "None" in Settings, or use Delete my data for everything.

These rights apply to your account's stored profiles and history. A visitor who is not logged in has nothing stored server-side to access, export, or erase — their figures never left the browser to begin with.

Exactly one cookie is used: zugle_session, HttpOnly, SameSite=Strict, valid 30 days. It is strictly necessary to keep you logged in and nothing else — no consent banner is required or shown.

This app is self-hosted on a personal VPS and reached over an encrypted (HTTPS) connection. Server logs (systemd journal) do not record visitor IP addresses.