Alpine Digest

Privacy Policy

1. Who we are

Alpine Digest is operated by Alpine Digest, Shruti Sharma, Avenue Theodore Flourney 11, 1206, Geneva , Switzerland, Switzerland. You can reach us at hello@alpinedigest.ch.

2. Data we collect

Account signup: email address, chosen locale, learning-language preference, an anonymous device ID to merge pre-signup activity (saved words, soft-wall counter).
Device & session security signals: when you sign in, we derive a one-way technical fingerprint from your browser’s request headers (browser and operating-system type, your language preference, and browser “client-hint” metadata) together with a coarse country inferred from your connection. We keep it only as an irreversible hash linked to your account, to detect unauthorised sharing of Pro subscriptions and to protect accounts against fraud. It cannot be reversed to identify you, is never used to track you across other websites, and is never shared. We do not store your IP address.
Pro subscription: when you pay for Pro, Stripe (our payment processor) records your name, billing address, and card details on their systems. We receive only a non-card customer identifier, subscription status, and the renewal date. We never see, store, or have access to your card number.
Vocabulary & reading activity: words you save, sentence-pair clicks, and review verdicts so spaced-repetition reminders can work.
Newsletter signup: email address + chosen locale, if you subscribe.
Push notifications: an anonymous browser endpoint; we cannot identify you from it.
Usage analytics: aggregated, cookie-free analytics via Vercel — no IP storage, no profiling, no cross-site tracking.
Listing submissions: when business owners submit photos or text via /listing/manage, we store the email they enter and the content they share.

3. Why we process it

We process the data above to deliver the service you have asked for (account access, Pro subscription, newsletter, push notifications, listing review) and to bill for the paid tier. Legal basis: performance of contract (Pro subscribers — including the device-security checks that protect your paid subscription), consent (newsletter and push), and our legitimate interest in operating the Service (anonymous analytics, account security, and prevention of fraud and subscription abuse). We do not sell or share your data with advertisers or third parties for marketing.

Automated processing. We use limited automated logic to (a) count your free word-lookups against the daily free allowance and, once you pass it, show an upgrade prompt; and (b) flag likely sharing of a Pro subscription from the device signals described in section 2. These decisions do not produce legal or similarly significant effects, and never remove access you have already paid for. You can email us at any time to query or contest an automated outcome and ask for a human review.

4. Service providers we rely on

Stripe Payments Europe Ltd (payment processing for Pro subscriptions) — Ireland/EU — privacy policy. Stripe is PCI-DSS Level 1 certified; your card details are tokenised by Stripe and never sent to us.
Supabase (database hosting) — EU/US — privacy policy
Vercel (web hosting + analytics) — US/EU — privacy policy
OpenAI (AI-assisted content drafting and translation) — US — privacy policy. We send only the text you submit (e.g. a word + surrounding sentence) for translation; we do not send your email address or account identifier.
Google LLC (Google Gemini — AI-assisted content drafting and translation) — US/EU — privacy policy. As with OpenAI, we send only the text to be processed, never your email address or account identifier.
Serper.dev (Google-search snippets used to fact-check draft articles before publication) — US — only the draft article text being verified is sent; no personal data.
DeepL SE (dictionary-grade translation) — Germany/EU — privacy policy
Resend (transactional email — receipts, magic-link sign-in) — US/EU — privacy policy
Open-Meteo (weather data) — no personal data is sent.
Google Maps / Places (restaurant lookup) — Switzerland/global.

5. Your rights

Under the Swiss Federal Act on Data Protection (FADP) and, where applicable, the EU GDPR, you have the right to:

Request a copy of the data we hold about you
Correct or delete your data
Withdraw consent at any time (e.g. unsubscribe from the newsletter)
Lodge a complaint with the Federal Data Protection and Information Commissioner (FDPIC)

Email hello@alpinedigest.ch to exercise any of these rights.

6. Data retention

Newsletter signups are kept until you unsubscribe. Push subscriptions are kept until you unsubscribe at the OS or browser level. Anonymous analytics are aggregated and retained per Vercel’s policy.

Subscription billing records: when you pay for Pro, Swiss bookkeeping law (Art. 958f OR) requires us to retain billing records for ten years. After cancellation, we keep only the data necessary to demonstrate that payments and refunds were processed correctly. Stripe retains the underlying card-network records per their own policy.

Vocabulary & reading data: kept while your account is active. If you delete your account (email us at the address above), we delete this data within 30 days unless it is subject to the legal retention window above.

7. Cookies & local storage

We use only strictly necessary storage: a sign-in session cookie, your locale and theme preferences, an anonymous device ID kept in your browser’s local storage to link pre-signup activity (saved words and the free-allowance counter), and the irreversible device-security hash described in section 2. We set no advertising, profiling, or cross-site tracking cookies. When you first visit we show a brief notice describing this essential storage and the device-security processing, which you acknowledge to continue; because none of it is advertising or tracking, we do not operate a separate tracking-consent banner. You can clear this storage at any time from your browser settings.

8. Changes to this policy

Material changes will be communicated by email to subscribers and via a notice on this page.

2. Data we collect

Account signup: email address, chosen locale, learning-language preference, an anonymous device ID to merge pre-signup activity (saved words, soft-wall counter).

Device & session security signals: when you sign in, we derive a one-way technical fingerprint from your browser’s request headers (browser and operating-system type, your language preference, and browser “client-hint” metadata) together with a coarse country inferred from your connection. We keep it only as an irreversible hash linked to your account, to detect unauthorised sharing of Pro subscriptions and to protect accounts against fraud. It cannot be reversed to identify you, is never used to track you across other websites, and is never shared. We do not store your IP address.

Pro subscription: when you pay for Pro, Stripe (our payment processor) records your name, billing address, and card details on their systems. We receive only a non-card customer identifier, subscription status, and the renewal date. We never see, store, or have access to your card number.

Vocabulary & reading activity: words you save, sentence-pair clicks, and review verdicts so spaced-repetition reminders can work.

Newsletter signup: email address + chosen locale, if you subscribe.

Push notifications: an anonymous browser endpoint; we cannot identify you from it.

Usage analytics: aggregated, cookie-free analytics via Vercel — no IP storage, no profiling, no cross-site tracking.

Listing submissions: when business owners submit photos or text via /listing/manage, we store the email they enter and the content they share.

3. Why we process it

4. Service providers we rely on

Stripe Payments Europe Ltd (payment processing for Pro subscriptions) — Ireland/EU — privacy policy. Stripe is PCI-DSS Level 1 certified; your card details are tokenised by Stripe and never sent to us.

Supabase (database hosting) — EU/US — privacy policy

Vercel (web hosting + analytics) — US/EU — privacy policy

OpenAI (AI-assisted content drafting and translation) — US — privacy policy. We send only the text you submit (e.g. a word + surrounding sentence) for translation; we do not send your email address or account identifier.

Google LLC (Google Gemini — AI-assisted content drafting and translation) — US/EU — privacy policy. As with OpenAI, we send only the text to be processed, never your email address or account identifier.

Serper.dev (Google-search snippets used to fact-check draft articles before publication) — US — only the draft article text being verified is sent; no personal data.

DeepL SE (dictionary-grade translation) — Germany/EU — privacy policy

Resend (transactional email — receipts, magic-link sign-in) — US/EU — privacy policy

Open-Meteo (weather data) — no personal data is sent.

Google Maps / Places (restaurant lookup) — Switzerland/global.

5. Your rights

Under the Swiss Federal Act on Data Protection (FADP) and, where applicable, the EU GDPR, you have the right to:

Request a copy of the data we hold about you

Correct or delete your data

Withdraw consent at any time (e.g. unsubscribe from the newsletter)

Lodge a complaint with the Federal Data Protection and Information Commissioner (FDPIC)

Email hello@alpinedigest.ch to exercise any of these rights.

6. Data retention

Newsletter signups are kept until you unsubscribe. Push subscriptions are kept until you unsubscribe at the OS or browser level. Anonymous analytics are aggregated and retained per Vercel’s policy.

7. Cookies & local storage