Privacy policy

Last updated: 9 October 2026

1. Who we are

Tachly (tachly.app) is operated by Pascal Lanz, Bombachhalde 8, 8049 Zürich, Switzerland ("Tachly", "we"). Pascal Lanz is the controller for the processing described in this policy, except where we process data on behalf of a club (see section 3).

Privacy contact: info@tachly.app

We apply the Swiss Federal Act on Data Protection (FADP). Where the EU General Data Protection Regulation (GDPR) applies because we offer our service to people in the EU, we apply it as well.

2. What we process, why, and on which legal basis

a) Visiting our website

When you open tachly.app, our hosting provider processes:

• your IP address;
• the requested page, date and time;
• the referring page;
• browser and device information.

We need these to deliver the website and keep it secure. Legal basis (GDPR): legitimate interest in operating a secure website (Art. 6(1)(f)).

b) Usage statistics

We use Vercel Web Analytics and Speed Insights to count page views and measure loading speed in aggregate. They do not set cookies or store anything on your device. Visitors are counted using a hash of the request, which is discarded after 24 hours. We see only aggregated figures: page, referrer, country, device type, browser and operating system. Legal basis: legitimate interest in understanding and improving our website.

c) Contact form and email

If you write to us, we process your name, email address and message to answer you. Messages from the contact form are delivered to us by email through Resend. We keep them as long as needed to handle your request, unless they become part of a customer relationship. Legal basis: your request (Art. 6(1)(b) GDPR) and our legitimate interest in answering.

d) Your account

To create and use an account we process:

• your email address and password (stored only as a hash by our authentication provider);
• passkeys, if you register one;
• your name;
• optional profile details you enter: phone, address, licence number, date of birth.

We use them to sign you in, to show your name to your club, and to send service emails such as invitations, password resets and invoices from your club. Legal basis: contract (Art. 6(1)(b) GDPR).

To protect sign-up, sign-in and password forms against bots we use Cloudflare Turnstile. It processes your IP address, browser information and technical signals. So that the check loads quickly, your browser may already connect to Cloudflare when you open our website. Legal basis: legitimate interest in security.

e) Push notifications

If you allow notifications, we store your browser's push subscription (an endpoint address and keys). Notifications are delivered through your browser vendor's push service (for example Google, Apple or Mozilla); their content is end-to-end encrypted. We also keep a feed of your notifications in the app for 90 days. You can switch push notifications off at any time in your browser. Legal basis: your consent.

f) Integrations you switch on

• If you connect capzlog.aero, we send your flights to your capzlog logbook: times, airports, block times, pilot function, and pilot-in-command and instructor names. capzlog.aero AG is based in Switzerland. Your capzlog token is stored encrypted.
• If you subscribe to the calendar feed, your calendar app retrieves your club's reservations.
• The LogTen export opens on your own device; no data passes through us.

Legal basis: contract and your instruction.

g) Error monitoring

To find and fix errors we use Sentry, with data stored in Sentry's EU region (Frankfurt, Germany). When an error occurs, Sentry receives technical details (error message, stack trace, browser, operating system), the page address, your IP address and recent console messages.

Sentry also records a replay of how the page was used, for every session in which an error occurs and for a random sample of about 10% of other sessions. All text and form inputs are masked and images are blocked in your browser before anything is sent, so the replay shows the page layout and clicks, not what you typed or read.

If you use "Report this issue" on an error page, we also receive what you enter there. Legal basis: legitimate interest in a stable and secure service. Sentry keeps this data for 30 days.

h) Change log

To trace changes and investigate misuse, we log changes to flights, maintenance records, reservations and similar data: who changed what, and when. We delete log entries after 365 days. Legal basis: legitimate interest in security and traceability.

3. Data we process on behalf of clubs

Clubs and aircraft partnerships use Tachly to manage their members, flights, maintenance, reservations and billing. For this data, the club is the controller, and we process it on the club's behalf as its processor. That includes members' names, contact details, dates of birth and licence numbers entered by a club administrator, flight records including GPS tracks, fuel and oil entries, defect reports, invoices, fuel receipts and the optional accounting module.

We process this data only to provide Tachly to the club and on the club's instructions. If you have questions about how your club uses your data, or want to exercise your rights, please contact your club first. We will support it.

4. Service providers

We use the following service providers. They process data on our behalf and under contract:

We do not sell your personal data or share it for advertising.

5. Transfers abroad

Most of our data is stored in Switzerland (Zurich) and the EU. The EU countries listed above have adequate data protection according to the Swiss Federal Council. Some providers are based in, or may access data from, other countries:

• USA: Vercel, Sentry and Cloudflare rely on the EU-U.S. Data Privacy Framework and its Swiss counterpart and/or on the European Commission's standard contractual clauses, as adapted for Switzerland. Resend uses the standard contractual clauses for Swiss data.
• Singapore: Supabase uses the standard contractual clauses with a Swiss addendum.

6. Cookies and local storage

We use only what the service needs or what you ask for:

• a sign-in cookie;
• a cookie that remembers your last club;
• settings stored in your browser: colour theme, table columns, a dismissed install hint;
• the app's offline cache;
• a short-lived marker in your browser tab while an error-monitoring replay is recorded (section 2g).

We do not use advertising or tracking cookies, and our usage statistics work without cookies. You can delete cookies and site data in your browser at any time; you will then have to sign in again.

7. How long we keep data

• Account data: as long as your account exists.
• Club data: as long as the club uses Tachly, then deleted or handed over as agreed with the club.
• Change log: 365 days.
• Notifications: 90 days.
• Error monitoring data: 30 days.
• Visitor hashes in usage statistics: 24 hours.

We keep data longer only where the law requires it.

8. Your rights

You can request:

• access to your data and a copy in a common format;
• correction, deletion or restriction of your data;
• that we stop processing based on legitimate interest (objection).

Where processing is based on consent, you can withdraw it at any time. Write to info@tachly.app; we reply within 30 days. For data a club manages, we may forward your request to the club.

You may complain to the Swiss Federal Data Protection and Information Commissioner (FDPIC, edoeb.admin.ch). If you are in the EU, you may also complain to the data protection authority of your country.

9. Security

Data is encrypted in transit (HTTPS). Access within the app is restricted by role and club through database row-level security. Tokens for third-party services are stored encrypted. We report data breaches as the law requires.

10. Changes

We update this policy when our service changes. The current version is always at tachly.app/privacy.