Privacy Policy
This policy describes what data LawFive processes and how it is protected. The controller is the operator named in the Impressum. Processing is governed by the Swiss Data Protection Act (DSG) and, where applicable, by the EU General Data Protection Regulation (GDPR).
Controller
The controller responsible for data processing is Mauchle Digital, Sandro Mauchle, Hochackerstrasse 6, 9032 Engelburg, Switzerland. For questions about data protection or to exercise your rights, contact us at info@lawfive.ch.
What data we process
To operate the app, we process account data (display name, email address, and date of birth), your quiz results, statistics and XP, and an optional profile picture. When data sharing is enabled, your statistics and assignments are visible to your friends. In addition, technical data such as the IP address and server logs arise, which are processed by the hosting and analytics providers in order to operate and secure the website.
Waitlist on lawfive.ch
If you sign up for the waitlist on the home page, we store your email address (required) and, optionally, your association, your preferred language (DE/FR/IT/EN) and your explicit consent. The sole purpose is to send you a one-time notification once you can use LawFive; this email is sent via Infomaniak (a Swiss email provider). To protect against spam and abuse, we store only a non-reversible SHA-256 hash of the IP address and never the raw IP address. The legal basis is your consent, which you can withdraw at any time via the address given in the Impressum; the waitlist data is deleted after that notification has been sent, at the latest within 12 months.
Data sharing with friends
As soon as a friend request is accepted, your statistics and your assignments (depending on your visibility setting, either from the start of the friendship or all of them) become visible to that person. This sharing is active by default and can be disabled at any time in the settings under «Data sharing». People can be blocked.
Profile picture
An uploaded profile picture is stored in publicly readable storage and is removed when the account is deleted.
Age declaration
We ask you for your date of birth and for your acceptance of the Terms of Service as soon as we need that information – and again whenever the Terms of Service or the age question change. We store the date of birth you gave, whether you were 16 or older at that time, when you made the declaration, the version of the Terms of Service you accepted, the version of the age question, the language you chose, as well as where in the app you made the declaration (for example when starting the app or in the settings). The purpose is to comply with the age rule for paid subscriptions (at least 16, see the Terms of Service) and with the app stores' requirements for an audience that also includes minors. This entry is a record of your declaration: it is not overwritten, and you cannot delete it yourself. If you correct your date of birth in the settings, a new entry is created and the most recent one applies; the earlier ones remain as a record. All of these entries are deleted when your account is deleted.
Purposes of processing
We process data in order to provide and improve the app, to communicate with you, to send the one-time waitlist notification, and for the purposes of security and preventing abuse. We also process data where this is necessary to comply with legal requirements.
Legal bases
We base our processing on your consent (waitlist and data sharing with friends) as well as on our legitimate interest or the performance of a contract in operating the app. You can withdraw any consent you have given at any time with effect for the future.
Recipients and processors
We use carefully selected processors: Supabase for database hosting, Vercel for web hosting including the privacy-friendly usage analytics «Vercel Analytics», and Infomaniak for sending the waitlist notification. Data may also be disclosed to authorities where required by law.
Processing abroad
Your data may also be processed abroad where the service providers we use are based. Where a country does not offer an adequate level of data protection, we take appropriate measures (such as standard contractual clauses or equivalent safeguards) to ensure an adequate level of protection and compliance with applicable law.
Retention
We keep account data for as long as your account exists. Waitlist data is deleted after the waitlist notification has been sent, at the latest within 12 months; the hash of the IP address is stored only briefly, and technical logs are kept only for a short period. After your account is deleted, technical logs of subscription events holding a pseudonymous user id, and log entries about administration actions without your id, remain; the details are set out under "Delete account".
Delete account
You can delete your account in the settings; this removes your profile data and your profile picture.
Your rights
You have the right to access, rectification, erasure, data portability and to withdraw any consent you have given. Contact via the address given in the Impressum.
Right to lodge a complaint
You have the right to lodge a complaint with a data protection authority. In Switzerland, this is the Federal Data Protection and Information Commissioner (EDÖB); in the EEA, the local data protection authority responsible for you.
Cookies and analytics
We use only necessary cookies or local storage (login/session, chosen language and stored consent) as well as Vercel Analytics for aggregated, privacy-friendly usage statistics.
Changes
We may amend this policy; the version published here is the authoritative one. Last updated: 22 September 2026.
Subscriptions and payments
To manage subscriptions we use RevenueCat, Inc. (USA) as a processor; only a pseudonymous user identifier (app_user_id) and your purchase/subscription status are transmitted — no names, email addresses, or payment data. Payments are processed via the Apple App Store, Google Play, or (on the web) Stripe; these providers handle your payment data under their own responsibility. Processing may take place in the USA; we apply appropriate safeguards (standard contractual clauses).