NovaSchrank

Cosmetics cabinet with dates from the manufacturer’s own specification

Privacy policy

Last updated: 5 September 2026

NovaSchrank manages your cosmetics and works out how long the manufacturer has specified its product to last after opening. There is no user account and no automated image analysis. Your product list, the dates, the routine and the statistics live solely on your device. The app’s only network connection is a barcode lookup: the barcode number is transmitted to our server so that brand and name do not have to be typed in. What happens in the process is described openly below.

1. Data controller

We have not appointed a data protection officer or an EU representative because we do not reach the relevant thresholds. Please address all requests to the contact above.

2. What data we process

What we explicitly do not collect

• No account, no name, no e-mail address, no password — not even for the lookup
• No transmission of your product list. There is no endpoint on our server that could receive a cabinet.
• No photo: the camera only reads the barcode; no image is stored and none is sent
• No link between a looked-up barcode and your device or your person
• No advertising, no analytics services, no trackers, no location, no address book
• No health data and no access to Apple Health

3. Permissions on your device

The app requests only the following permissions. Each of them can be revoked at any time in your device settings; the app remains usable afterwards, with reduced functionality.

• Camera — Reading the barcode on the packaging so that brand and name do not have to be typed in. No photo is stored and none is sent to a server; only the recognised code number is transmitted. Brand and name can also be entered by hand without the camera.
• Notifications — A reminder 14 days before the end of the manufacturer-specified period. Without this permission the app remains fully usable — the same dates are shown on the main screen.

4. Legal bases

We process personal data under the Swiss Federal Act on Data Protection (revFADP). Where the GDPR applies, we rely on:

• Performance of a contract (Art. 6(1)(b) GDPR) — everything needed for the app to deliver the function you requested.
• Legitimate interests (Art. 6(1)(f) GDPR) — secure and stable operation, abuse prevention, troubleshooting.
• Consent (Art. 6(1)(a) GDPR) — for anything you actively enable in this app: the camera for reading the barcode and notifications for the reminders. Consent can be withdrawn at any time with effect for the future by revoking the permission in your system settings.
• Legal obligation (Art. 6(1)(c) GDPR) — in particular commercial and tax retention duties for payments.

The barcode lookup rests on our legitimate interest and on performance of the contract: you trigger it yourself, it serves only your convenience when entering a product, and it can be avoided at any time by typing brand and name in by hand.

5. Recipients and third parties

We do not sell data and do not disclose it for advertising purposes. Data is disclosed only to the following parties, and only where required for operation:

Authorities and courts receive data only where we are legally obliged to provide it.

Transfers abroad

Some of the recipients listed above process data outside Switzerland and the EEA, in particular in the United States. We base such transfers on the European Commission’s Standard Contractual Clauses with the Swiss adaptations recognised by the FDPIC and, where applicable, on the EU-US Data Privacy Framework. We will provide information on the safeguards in place on request.

6. Retention and deletion

Your cabinet lives on your device alone and disappears entirely once you remove the app. Nothing of it remains on our server, because none of it ever gets there. What does remain permanently are the product records and the gap list of looked-up barcodes — plain product information with no link to a person, forming the database for all users. Technical server logs expire automatically after 14 days.

Step-by-step instructions are available at Delete data.

7. Children and young people

This app is not directed at children. We do not knowingly collect personal data from children under 16. If we learn that such data has been submitted without parental consent, we delete it without delay.

8. Data security

Wherever the app transmits data at all, connections are encrypted via HTTPS/TLS. On the server side we use access restrictions, tenant separation and regular backups. Nobody can, however, guarantee absolute security for data transmission over the internet.

The lookup connection runs exclusively over encrypted HTTPS. Only the barcode number is transmitted — no device identifier, no ID, no content of your cabinet. Your product list lives in the app’s protected folder, which other apps cannot access, and is covered by iOS device encryption.

9. Your rights

• Access to the personal data we process
• Rectification of inaccurate data
• Erasure or destruction of your data
• Restriction of and objection to processing
• Receiving or porting your data in a common format
• Withdrawal of consent with effect for the future

An informal message to info@babala.ch or a call to 076 792 63 50. We normally respond within 30 days. To verify your identity we may request suitable proof. You may also lodge a complaint with a supervisory authority (Switzerland: FDPIC; EU: your competent authority).

10. Changes to this policy

We may adapt this policy when the app or the legal framework changes. The version published on this page, with the date shown above, is the applicable one. We announce material changes inside the app.