Privacy Policy of the App
This page explains which personal data the hotmilk app for iOS and Android processes, why, and what rights you have. It follows the Swiss Federal Act on Data Protection (FADP) and, where it applies, the EU General Data Protection Regulation (GDPR). The website hotmilk.ch has a privacy policy of its own.
Last updated: October 2026
Controller and contact
Stephan Mathys
Switzerland
dive@hotmilk.ch
hotmilk.ch, the website and the app, is a private project. Write to the address above for any question about your data.
In short
- The app shows no advertising and contains no tracking, no analytics and no crash reporting of third parties.
- There are no payments and no purchases in the app.
- The app asks for no permission other than access to the internet. It does not use your location, contacts, camera or photos.
- You can use the calculators without an account. The app sends your inputs to the server of hotmilk.ch, which calculates the result and sends it back. The inputs are not stored, apart from the server logs described below.
- hotmilk.ch does not sell your data or use it for advertising.
Account and login
The website and the app use the same account. If you register, hotmilk.ch stores:
- your first and last name and your email address,
- your password, only as a salted hash,
- your dive organisation and level, if you enter them,
- what you save in your settings: tanks with their inspection dates, planner profiles and filling stations with their prices.
An administrator reviews every registration before the account becomes active. The data is used to run your account and the features you use with it (Art. 6(1)(b) GDPR). It is kept as long as your account exists. If you ask for your account to be deleted, it is deleted together with everything you saved in it.
Login on your device
When you sign in, the app gets two login tokens from the server: an access token that is valid for 15 minutes and a refresh token that is valid for 30 days and is used to get new tokens. The app keeps them in the secure storage of your device, the Keychain on iOS and storage encrypted with the Android Keystore on Android. The server keeps only a fingerprint (hash) of the refresh token, so that it can end it.
Signing out in the app removes both tokens from the device and ends the refresh token on the server. Changing your password ends the tokens on every device. A refresh token that is never used again runs out after 30 days. The app stores nothing else on your device.
Mails
When you register, your details go by mail to the administrator, who approves or rejects the registration. You then get a mail with a link to set your password, or a mail with the reason for the rejection. You also get a mail when you reset your password. The mails go out through the mail service of Google Workspace (Google Ireland Limited and Google LLC, USA), which processes your email address and the content of the mail on behalf of hotmilk.ch.
Links to the website
Links to hotmilk.ch in the app open in the browser of your device. The website is then subject to its own privacy policy.
Deleting your account
To have your account deleted, write to the address above. It is deleted together with everything you saved in it, on the website and in the app alike. Deleting the app does not delete your account.
Hosting and server logs
The website and the interface the app talks to run on Amazon Lightsail of Amazon Web Services in Frankfurt, Germany. For every request the server logs your IP address, the date and time, the requested address, the response status, the referring page and the browser or app you use. The logs serve to operate the website and the app, to find errors and to defend against attacks (legitimate interest, Art. 6(1)(f) GDPR). They are deleted after 14 days at the latest.
Disclosure abroad
The data is stored in Germany, which offers an adequate level of data protection. Google and Amazon Web Services are groups with headquarters in the USA, so data may be accessed from there. Where this is the case, the transfer is based on the EU-U.S. and Swiss-U.S. Data Privacy Framework or on the standard contractual clauses of the European Commission.
Your rights
You have the right to:
- know which data about you is stored,
- have wrong data corrected,
- have your data deleted,
- restrict or object to its processing,
- receive your data in a common electronic format.
Write to the address above. You can also lodge a complaint with the Federal Data Protection and Information Commissioner (FDPIC) or, in the EU, with the data protection authority of your country.
Changes
This policy changes when the app starts processing data in a new way. The date at the top shows the last change.