Privacy

This notice describes the data processed when you use the public pages and tours. The public pages do not use advertising cookies and do not require an account. Your chosen language appears in the URL.

Controller

Once Upon Here

QR scans and visitor statistics

When a short link associated with a QR code is opened, we record the scanned code and its medium, the language, the time rounded down to the hour, and the device family (iOS, Android, or other).

To count visitors per day, the server calculates a daily HMAC value in memory from the IP address, browser data, and a random key renewed each day. The daily value is stored with the scan; the IP address, browser data, and key are not stored in the scan record. The key is erased from memory after the day changes. Scan records have no planned deletion date so statistics can be compared across years.

When you start an audio story or open the rest of a text, the page reports it to the server without a cookie: we record only the place, the tour, the language, and the time rounded down to the hour. Browser data is used at that moment to recognise known bots (search engines, link previews) and leave them out of the statistics; it is not stored.

Tour map and location

The map is loaded only when you open it. Your device then downloads map data directly from swisstopo (vectortiles.geo.admin.ch), which receives your IP address. For tours outside swisstopo's coverage, we use OpenFreeMap (OpenStreetMap data), which also receives the IP address. The short notice beside the map identifies the provider used.

Your location is requested only when you tap “Show my location”. It stays on your device and is not sent to us. The “Directions” button opens your device's map app; that provider handles data under its own privacy notice.

Progress saved on your device

Your browser stores on your device the tour you are following, the stops you have seen and, in a treasure hunt, the stops you have unlocked. This information is not sent to our server and is used only to let you resume your tour: if, within 24 hours, you scan the plaque of a place that belongs to it, the tour opens at that stop. The “Clear my progress” button at the bottom of every tour page removes it. Without this storage (private browsing), every page remains readable; only resuming is lost.

Hosting and access logs

The pages and application data are hosted in Switzerland. For security, the hosting provider may keep access logs containing IP addresses.

The platform uses Microsoft Azure in the Switzerland North region. Microsoft is a US company. Choosing a Swiss Azure region describes where the deployed resources are located, but does not by itself describe all support operations or subprocessors. Microsoft's contractual data-protection terms and current subprocessor list apply.

Your rights

For questions or to exercise your rights under the Swiss Federal Act on Data Protection (FADP), contact the controller listed above. You may also contact the Federal Data Protection and Information Commissioner (FDPIC).

Last updated: 10/18/2026