Privacy policy for RonaGuard
Last updated: 8 October 2026
1. Scope
This privacy policy applies to the “RonaGuard” app for iPhone and iPad, Mac and Android (the “App”) and to the pages on which it is published. It is based on the Swiss Federal Act on Data Protection (FADP) and, where applicable, the EU General Data Protection Regulation (GDPR).
The current version is available at https://sites.google.com/view/ronaguard-datenschutz/privacy, and on the same site in German, French and Italian. The German version prevails.
2. Controller
Schweizerpunkt GmbH, Gotthelfstrasse 41, 8172 Niederglatt, Switzerland
Email: datenschutz@schweizerpunkt.ch
We are not responsible for the contents of your vault: you are, or the organisation that runs a shared vault. We never receive these contents. We are responsible for the wake-up service (sections 4.5 and 4.6), for emails sent to us and for the pages on which this policy is published (section 5).
3. Summary
• There is no account and no server for your vault. We never see your entries, your keys, your master password or your protocol.
• Your vault is an encrypted folder in storage you choose: on the device, in the folder of a cloud app (for example iCloud Drive, OneDrive or Dropbox), directly in Google Drive or via WebDAV (for example Infomaniak kDrive or Nextcloud). The provider only receives encrypted files.
• The App contains no analytics, no tracking, no advertising and no telemetry, and sends us no crash reports.
• Our only service is the optional wake-up service on servers in Switzerland. The App only uses it if you switch on instant notifications or set up emergency access. It sees neither names nor vault contents.
• Autofill data stays encrypted on your device.
• The leak check is off until you switch it on. It then sends only 5 characters of a hash to “Have I Been Pwned”.
4. The App
4.1 Your vault in your storage
• Entries (for example logins, cards, identities, notes, SSH keys, passkeys, 2FA codes), attachments and the protocol are encrypted on your device before they are stored (Argon2id, XChaCha20-Poly1305). The keys are created on and stay on your devices. Your master password is not stored anywhere. If you lose both your master password and your emergency kit, nobody can restore your vault, including us.
• Your storage provider sees encrypted files with random names, their number, size and modification times, your account and IP address when syncing, for shared vaults the accounts the folder is shared with, and technical encryption parameters (without names or contents). Because viewing an entry is also logged, the provider can see when a device is active.
• You have your own contract with the provider, and its privacy policy applies. If it belongs to a US group (for example Apple, Google, Microsoft or Dropbox), these technical details may reach the United States; the contents stay encrypted. For business use you need a data processing agreement with the provider.
• If the vault is on the internet or with a file provider on iPhone, iPad or Android, the App keeps an encrypted copy on the device so that the vault also opens without a connection. This copy is excluded from device backups and is deleted when you remove the vault from this device in the App.
4.2 Signing in to Google Drive
If you store the vault directly in Google Drive, you sign in to Google in your system browser (OAuth). Google is then your own storage provider.
• The App never sees your Google password. It only gets access to files it created itself (the “drive.file” permission), not to your other files, and it asks for neither the name nor the email address of your Google account.
• The access token is kept only in your device’s keychain or keystore. If you disconnect the storage in the App, it revokes the access at Google.
• RonaGuard uses data from Google APIs only to store and sync your encrypted vault and to remove deleted copies, and shares it with no one. RonaGuard’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
4.3 The protocol
The protocol is the vault’s activity log.
• Recorded: which member (as a random identifier), when, on which device, which action, on which entry, and which fields were affected. This includes unlocking, viewing, copying and autofilling.
• Not recorded: passwords, field contents, websites, IP addresses and locations.
• The protocol is encrypted and lives in your vault. In shared vaults the members can read it. Times come from the clock of the device concerned.
4.4 Shared vaults and invitations
You hand over invitations, replies, key cards and emergency access codes yourself, for example via the share menu or an email draft. The App sends nothing on its own, and the codes contain no password.
If an organisation (for example your employer) runs a shared vault, it is the controller of that processing. It decides on members, roles and policies and on how long the protocol links events to people, and it must inform you. For access, erasure and your other rights, please contact that organisation.
4.5 Instant notifications (wake-up service)
When someone shares something in a shared vault or adds you to one, RonaGuard can notify you instantly, even when the App is closed. For this we run a wake-up service on servers in Switzerland.
• Optional: the feature is off. The App asks once, when you create your first shared vault or accept an invitation, and only registers your device after you choose “Turn on” and the system allows notifications. Everything works without the wake-up service; shared items then appear at the next sync.
• What the service stores: your device’s push token with its platform (encrypted), a check value of a random secret of your installation, random channel identifiers derived from keys with their access keys (encrypted), a tag that groups the devices of one person, and the day of registration and of the last renewal.
• What the service does not see: names, email addresses, vaults, entries and contents. The text of the notification is end-to-end encrypted and only decrypted on your phone. The service can only tell which installations form a group and when a wake-up happens.
• IP addresses: only in memory, as a check value (HMAC) with a key that changes daily, to prevent misuse and for no longer than 24 hours; never in the service’s log files. These contain only event types, status codes and counters.
• Delivery: Apple (Apple Push Notification service) or Google (Firebase Cloud Messaging) delivers the message. They receive the push token, time, size and the encrypted text, which they cannot read. On Android the App includes Google’s Firebase Messaging component for this. It only starts once you switch notifications on, sends no analytics or crash data and reports an installation identifier to Google, which is needed for the push token. Devices without Google services do not receive instant notifications.
• Display: with “Show names and titles” (on, can be switched off) the phone shows who shared what; otherwise a neutral text. On the lock screen Android only shows the neutral text.
• Mac: the Mac is not registered with the service; it shows local notifications while RonaGuard is running and the vault is open. If you share something and have notifications switched on, your device (the Mac too) calls the service to wake the other members. Nothing is stored in the process.
• Legal basis: your consent (where the GDPR applies: Art. 6(1)(a) GDPR). You can withdraw it at any time: switching off under “Settings” › “Notifications” unregisters your device and deletes the registration at the service immediately.
• Retention: until you switch off, until Apple or Google report the token as invalid, at the latest 90 days after the last renewal. We keep encrypted backups of the service for no longer than 14 days.
4.6 Emergency access with a waiting period
You can name a trusted contact who can request access to a personal vault in an emergency. If you do not decline within the waiting period (1 to 30 days, 7 days by default), they get it, depending on the level you chose: “View” (read and copy entries) or “Take over” (also copy everything into their own vault or continue the vault with a new master password). Our wake-up service enforces the waiting period.
• Optional: the feature is off until you set up a trusted contact. You consent when setting it up; the trusted contact consents when keeping the emergency access code.
• What the service stores per trusted contact: a random identifier, three public keys for checking commands, the waiting period and level, a part sealed to the trusted contact that only opens anything together with a file in your vault folder, the channel identifiers for notifications, the state with the times of request, refusal and release, and encrypted messages until they are sent.
• What the service does not see: names, email addresses, vaults, storage locations, contents and your vault key. It can only tell that two groups of installations are linked by an emergency access and when access was requested, declined or released.
• The apps of both people ask the service for the current state. The service handles IP addresses as described in section 4.5.
• Legal basis: the consent of both people (where the GDPR applies: Art. 6(1)(a) GDPR). Withdrawal: if you remove the trusted contact, the service deletes the deposit immediately. If the trusted contact removes the emergency access code, their app stops asking the service.
• Retention: until removal, otherwise 730 days after the last valid command. Encrypted backups for no longer than 14 days.
• After release, the trusted contact has access to your vault; what they see or copy then stays with them. For the waiting period to be kept, you rely on our service.
4.7 Autofill
• Autofill is off until you switch it on in RonaGuard and select RonaGuard for it in your system settings.
• For the vaults you offer, the App keeps encrypted autofill data on the device (titles, usernames, addresses, passwords, 2FA keys and passkeys). It never leaves the device and is excluded from backups. You confirm every fill with biometrics, or with the device passcode if you allow it.
• The system tells the App which website or app to fill in. This stays on the device and is not recorded in the protocol. On Android, RonaGuard reads the name, signing certificate and installing store of that one app, never a list of your apps.
• On Apple devices, usernames and websites are also kept in the system autofill store while “Suggestions above the keyboard” is on.
• The only network access: if on Android you sign in to an app with a passkey and that app is not linked to the entry, RonaGuard fetches the file /.well-known/assetlinks.json from the website of the service concerned, to check that the app belongs to that service. The service sees your IP address; no cookies are sent, and the result is kept in memory only. On Apple devices the autofill extension has no network access.
4.8 Leak check
Only if you switch on the leak check (off by default) and choose “Check now” in vault health, never in the background: the App sends the first 5 characters of the SHA-1 hash of a password to api.pwnedpasswords.com (“Have I Been Pwned”) and compares the answer on your device. The service sees your IP address, but neither your password nor its full hash. It is operated outside Switzerland and the EU, under its own terms. The result is kept in memory only.
4.9 Connections made by the App
The App only connects to:
1. your storage and, for Google Drive, Google’s sign-in service, also to remove copies of deleted data at the provider (section 4.11);
2. our wake-up service and, on Android, Google’s Firebase, only with your consent (sections 4.5 and 4.6);
3. “Have I Been Pwned”, only if you switch it on and start a check (section 4.8);
4. only on Android and only for passkeys in apps: the website of the service concerned (section 4.7).
There are no other connections: no update check, no advertising, no analytics, no fonts and no website icons from the internet (the App shows the initials of each entry instead).
4.10 Permissions
• Face ID, Touch ID or fingerprint: only if you turn on unlocking with it. The App only receives the result from the operating system; biometric data never leaves the device’s protected area.
• Files and folders you choose: for the vault and for import and export.
• Network: for the connections in section 4.9.
• Notifications: only once you switch notifications on.
• Autofill: only if you switch it on (section 4.7).
RonaGuard does not ask for your location, your contacts or your advertising ID, and uses neither the camera nor the microphone.
4.11 Deletion and retention
• Data stays in your storage until you delete it. Deleted entries remain in the bin for 30 days. After that, or when you empty the bin, the entry’s key is deleted; its content can then no longer be read, also in older protocol records. The protocol only keeps the fact that the entry existed and what happened to it.
• Where your provider’s interface allows it (Nextcloud, Google Drive), the App also removes the copies in the provider’s bin and older versions after deleting for good (“Also empty the provider’s bin”, can be switched off per vault). Otherwise it shows what stays there and for how long.
• Backups of your devices and exports you created may still contain data. CSV and JSON exports are not encrypted; the App warns you about this.
• In shared vaults, former members can be pseudonymised; their name can then no longer be read.
• The App deletes autofill data when you switch autofill off, exclude a vault from it or remove the vault from the device.
• On Apple devices, keychain items can survive uninstalling an app. Remove your vaults in the App before uninstalling it.
• For the wake-up service, see sections 4.5 and 4.6.
5. These pages and the website
5.1 Google Sites
We publish this privacy policy with Google Sites (https://sites.google.com/view/ronaguard-datenschutz). When you visit these pages, Google processes data under its own privacy policy. The App does not use Google Sites.
5.2 RonaGuard website
RonaGuard’s own website is not yet released. It is built to set no cookies, use no analytics or tracking services and load no content from third parties. If you switch the language there yourself, your browser remembers the choice in local storage (localStorage) without sending it to us. Before the website goes online, we will add here which web host runs it, where the host is based and how long it keeps access logs.
6. Contacting us by email
If you contact us by email, we process your email address and the content of your message in order to answer your request. Where the GDPR applies, we rely on Art. 6(1)(b) GDPR (contract or pre-contractual measures) or Art. 6(1)(f) GDPR (legitimate interest in answering enquiries). We delete this data as soon as it is no longer needed, unless statutory retention obligations apply. Please never send us passwords, vault files or your emergency kit.
7. App stores and operating system
If you download the App from the App Store or Google Play, Apple or Google process data under their own terms. We only receive aggregated statistics from them, such as the number of installations. We only receive crash reports if you have allowed your operating system to share such reports with app developers; we use them only to fix errors. Operating system services such as the keychain, biometrics, autofill, the clipboard, notifications and backups are not part of RonaGuard; Apple’s or Google’s terms apply to them.
8. Recipients and transfers abroad
• Wake-up service: the host in Switzerland processes the data on our behalf. For delivery, Apple and Google receive the push token, time, size and the encrypted text, and on Android also the Firebase installation identifier. They may process this data in the United States. The transfer is based on the Swiss-U.S. or EU-U.S. Data Privacy Framework, where the companies are certified under it, and otherwise on standard contractual clauses. They cannot read the content of the notifications.
• Under their own responsibility, data is processed by your storage provider, “Have I Been Pwned”, the app stores, Google for these pages and the websites of services whose passkeys you use in apps on Android. This happens partly outside Switzerland and the EU, for example in the United States.
• We do not sell data, show no advertising and create no profiles.
9. Your rights
Under the FADP and, where applicable, the GDPR, you have in particular the following rights:
• Access to your personal data
• Rectification of inaccurate data
• Erasure
• Restriction of processing
• Objection to processing
• Data portability
• Withdrawal of consent with effect for the future
We do not hold the data in your vault. You exercise these rights there directly in the App, for example with export and deletion; for shared vaults, contact the organisation that runs the vault. We cannot link the data held by the wake-up service to a person (no account, no names). You therefore delete it in the App: switching off notifications deletes your registration immediately, removing a trusted contact deletes the emergency access deposit. For everything else: datenschutz@schweizerpunkt.ch
You also have the right to lodge a complaint with a data protection supervisory authority. In Switzerland, this is the Federal Data Protection and Information Commissioner (FDPIC). In the EU and EEA, it is in particular the supervisory authority where you live.
10. Children
RonaGuard is not directed at children. There is no account, no advertising and no chat. The App asks for neither age nor name; the optional wake-up service only stores the technical details listed in sections 4.5 and 4.6.
11. Security
Encryption happens on your device, so your protection also depends on you. We recommend a master password of at least five random words, a device lock and an emergency kit kept in a safe place. Please report security vulnerabilities to datenschutz@schweizerpunkt.ch with the subject “Security RonaGuard”.
12. Changes
We update this privacy policy when the App or legal requirements change. The current version applies and is available at https://sites.google.com/view/ronaguard-datenschutz/privacy.