Privacy policy (revFADP)

Controller and scope

The controller responsible for processing your personal data is: CooHood Betreiber, Birmensdorferstrasse 315, 8055 Zürich, Switzerland — hello@coohood.com

This policy covers the CooHood mobile app and the coohood.ch website. The revised Swiss Federal Act on Data Protection (revFADP) applies. Where the European GDPR applies to you, the rights it grants apply in addition.

Version: 2026-09-Safety-and-Sharing

What data we process

Depending on how you use CooHood, we process the following categories of personal data:

• Account data: first and last name, email address, chosen language, and — when you register with email — a password managed solely by Firebase Authentication that we never see in plain text.
• Address and building data: street, house number, postal code, town, municipality, the federal building identifier (EGID), and the coordinates of the selected building. This determines which Hood and which building you belong to.
• Location data: your device's GPS coordinates, only while the app is open (see the residency verification section).
• Profile data: optional profile photo, optional phone number, skills and willingness to help, items shared in the building basket, and your visibility settings.
• Content and communication: feed and notice-board posts, chat messages, images and voice messages, free-marketplace listings, place reviews, and any reports you submit about other content.
• Consent record: the time you accepted the terms of use and the corresponding version number.
• Push token: a device identifier together with the platform, so we can deliver notifications. It is removed when you sign out.
• Technical data: when you visit the website, our hosting provider processes standard connection data such as IP address, timestamp, and browser identification in server logs to keep the service running and secure.

Purposes and legal bases

We process your data to run your account, assign you to the right building and Hood, provide the community features, prevent abuse, and meet legal obligations. Processing is based on performance of the user agreement with you, on your consent — in particular for access to location data and for push notifications — and on our overriding interest in a safe, abuse-free platform.

We do not sell your data and do not share it for advertising purposes.

Residency verification and location data

To ensure security, abuse protection, and mutual trust in your building, CooHood verifies your residency with a one-time GPS check at your registered address (within 50 metres). The app accesses your GPS coordinates only in the foreground, that is, only while the app is actively open.

CooHood does not record movement profiles, routes, or persistent background locations. Background location access and geofencing are disabled in the app. You can revoke location permission at any time in your device settings; without verification, however, the protected building and Hood features are not available to you.

For address search and the map view, coordinates are transmitted to the map services named in the Impressum. For free-marketplace listings, the pickup spot appears exactly as you place it — so choose deliberately how precisely you mark it.

Who can see your data

By default your profile is not publicly visible to your building, and shared items do not appear on the Hood map. You enable both yourself in settings and can switch them off again at any time.

Content you publish in the feed, on the notice board, or in the building basket is visible to verified members of your Hood or building. Chat messages are visible only to the participants. Free-marketplace listings are shown to people nearby. People you block no longer see your posts, and you no longer see theirs.

Please note: whatever you share publicly in your Hood can be read, copied, or passed on by others. Do not share anything you would not pin up in your stairwell.

Processors and third-party providers

We use carefully selected service providers who may process data only on our instructions:

• Google Firebase as our core infrastructure. Our Firestore database, file storage, and Cloud Functions are located in Google's europe-west6 region in Zurich, Switzerland. Firebase Authentication, which manages your login credentials, is operated by Google exclusively in data centres in the United States; restricting it to Switzerland is technically not possible.
• Expo Push Service together with the Apple Push Notification service and Firebase Cloud Messaging to deliver notifications. Push delivery necessarily runs through Apple's and Google's international infrastructure and is not confined to Switzerland.
• Apple and Google, if you register with “Sign in with Apple” or “Sign in with Google”. We receive your name and email address; your password stays with the provider.
• Map services and open data sources (swisstopo, opendata.swiss, City of Zurich OGD, OpenStreetMap, Google Maps on Android, Apple Maps on iOS). When maps and neighbourhood data load, your IP address is transmitted to the respective provider.
• Resend (Resend, Inc.) to send the website contact form for municipalities and organisations. The details you enter in the form are transmitted. Data may be processed outside Switzerland.

No tracking, no advertising

The app contains no analytics, tracking, or advertising SDKs. We do not build usage profiles for marketing and pass no data to ad networks. The website serves its fonts from its own server.

Website: consent and analytics

The website source code does not set cookies. Language, navigation and the map work without a cookie. We store your choice locally in the browser under the key coohood-consent. This is local consent-preference storage, not a cookie. Purpose: remember your selection. Category: necessary. Retention: until you delete or change it. No transfer to third parties.

After explicit analytics consent we load Vercel Web Analytics (script /_vercel/insights/script.js, provider Vercel Inc.). Purpose: page views and the events coofridge_open and coofridge_download_click. Category: analytics. In the reviewed code this script does not set its own cookie. It is not loaded without consent. Data goes to Vercel and may be processed in the United States. Withdrawal stores analytics=false; future events are not sent.

Google Analytics, Google Tag Manager, Meta Pixel, Firebase Authentication and Google Maps are not embedded on the website. The Leaflet map loads swisstopo tiles and stays usable regardless of consent.

The contact form for municipalities and organisations sends your details to our contact address. Delivery uses Resend. The legal basis is your consent via the form.

Disclosure abroad

Your content, your profile, and your files are processed in Switzerland (Google's europe-west6 region in Zurich). Some services cannot be confined to Switzerland: Firebase Authentication, which processes your login credentials exclusively in the United States, as well as push notification delivery, map services, and the hosting of this website, which run through the respective providers' international infrastructure. Because some of these providers belong to groups headquartered in the United States, data is processed outside Switzerland and the EEA in those cases. Such disclosure is based on the providers' data processing addenda, including the EU standard contractual clauses, or on adequacy decisions recognised by the Swiss Federal Council.

Retention and deleting your account

We keep your data for as long as your account exists and to the extent needed for operation, security, or statutory retention obligations.

You can delete your account at any time directly in the app. This removes your profile, your address and location data, your inventory, your building-basket items, borrow requests, and your push tokens. Posts and conversations that involve other neighbours remain in anonymised form: authorship is replaced with an anonymous placeholder so that exchanges stay intelligible for the remaining participants.

If you would like specific content deleted entirely, contact us at hello@coohood.com.

Data security

Transmission is encrypted and data is stored encrypted at our infrastructure provider. Server-side access rules ensure that building and Hood content is available only to verified members of that Hood. Despite every measure, no transmission over the internet can be guaranteed absolutely secure.

Your rights

You have the right to obtain information about the data we process about you, and to have it corrected, deleted, handed over, or transferred. You may object to processing and withdraw consent at any time with effect for the future.

Please contact hello@coohood.com. For security reasons we may ask you to prove your identity. You also have the right to lodge a complaint with the Swiss Federal Data Protection and Information Commissioner (FDPIC) in Bern.

Minimum age

CooHood is intended for people aged 16 and over. We do not knowingly process data from younger children. If we learn of such an account, we delete it.

Changes to this policy

We update this policy when the app, our service providers, or the legal framework change. The most recently published version applies. We will notify you in the app about material changes.