Privacy at Orarium

• Orarium records your workplaces and your arrival and departure times, never your route.
• Detection is done by your phone's system. Your continuous location is neither recorded nor sent.
• Your account, your places, your clock-ins and your weekly timesheets are hosted in Switzerland. An encrypted backup of this data is kept every day in the European Union.
• Your hours are shared with a company manager only if you accept their invitation on Orarium Pro, and only your attendance hours in that company's zones.
• No ads or selling of data. Public visits are measured only with your consent.
• You can delete your account at any time, from the app or on the website.

ILYGO Sàrl, Switzerland, UID CHE-135.509.084, is the controller of Orarium's data. For any question about your data, write to info@ilygo.ch.

ILYGO Sàrl's general privacy policy remains available on ilygo.ch (in French).

• Your account: your email address, your password, the language you chose and, if you provide one, a display name. The password is never kept in plain text: only a hash computed with argon2id is stored.
• Your workplaces: the name you give them, the point chosen on the map (its coordinates) and the radius of the zone.
• Your clock-ins: each arrival and each departure, with the place, the date and the time, and how it was recorded, detected or entered by hand.
• Your weekly timesheets: each version of a week's timesheet, with its date, its origin (automatic calculation, change on the website or submission) and the comment you add. A version is never overwritten: each change adds a new one.
• Your membership of a company, if you accept an Orarium Pro invitation: the company, the date you accepted, the version of the information text shown to you, the versions of the zones you approved and, for each week you submit, the submitted version and its date.
• If you manage a company on Orarium Pro: its name, its zones (name, point and radius), the email addresses of invited people and the status of its subscription.
• Your login sessions: a random token keeps you logged in. Only a hash of this token is stored, never the token itself.
• The security log: logins and changes made to your account, including changes to and submissions of timesheets, with their date and the IP address the request came from. It contains no password, no token and no coordinates.
• Your improvement suggestions, if you send any: the type and area chosen, your message, the page language and, if you provide them, your email address, your agreement to be contacted, and the app's platform and version. A hash of your IP address is used to limit abusive sending. A suggestion sent while logged in is linked to your account.

• Your route, your stops, your speed.
• Your location throughout the day, at your places or anywhere else.
• Your location when you open the map in the app: only the point of the place you drop is kept.

The phone's system monitors the edge of your zones and tells Orarium when you cross it, even when the app is not open. Only the time and the place of that crossing are recorded. The app's diagnostic log contains no coordinates.

On iPhone, the indicator on the lock screen and in the Dynamic Island shows the place and the duration of the current session. It is kept up to date by the iPhone itself, from the app's data, and sends nothing.

Orarium Pro is the platform for companies. A manager defines the company's zones there (name, point and radius) and invites staff by email. The invitation states who is inviting, for which company, the zones concerned and what will be shared.

Nothing is shared without your consent. Sharing only starts if you explicitly accept the invitation, logged in with the account of the invited address. Your acceptance is recorded, with its date.

• What is shared: your attendance hours in the company's zones, that is your arrivals, your departures and the resulting totals, from your acceptance until you leave the company or the manager removes you, as well as the weeks you submit, limited to those zones and that period.
• What is never shared: your personal places and time spent elsewhere, your routes and movements, and nothing from before your acceptance or after sharing ends.

The manager views these hours on the Orarium Pro platform and can export them. If a zone changes, you are informed: the new version only applies once you have approved it on the platform.

On the website, you can submit a week's timesheet. The submitted version is kept as it is; the manager sees it as validated, with the history of the versions you have submitted and the comment you add to a submission. If you change the week after submitting it, the manager keeps the last submitted version and sees that a change followed; you can submit it again.

You can leave the company at any time, from the Company tab of your account. Sharing stops immediately and the manager is notified. Hours already shared remain visible to the manager; to resume sharing, a new invitation is needed. The manager can also end sharing on their side.

The company that receives your attendance hours decides how it uses them and is accountable to you for that use.

On your phone. Arrivals and departures are detected by the phone's system, on the device. Your places and clock-ins are first recorded in the app.

In Switzerland. Orarium's application and database are hosted in Switzerland, by Infomaniak in Geneva, and operated by ILYGO Sàrl. Your data is sent there over an encrypted connection (HTTPS).

In the European Union, for the backup. A backup of Orarium's database is made every day. It is encrypted before it is sent, then kept by ILYGO Sàrl on an OVH server located in the European Union.

At Apple. Apple distributes the iPhone app (TestFlight today, the App Store later) and shows the map of places with Apple Maps. The app is free: Apple collects nothing for Orarium. These services are covered by Apple's privacy policy.

At Google, for the Android app. The Android app will be distributed through Google Play. On Android, arrivals and departures are detected through Google Play location services, which are covered by Google's privacy policy. The map of places in the Android app is displayed on swisstopo base maps: the phone downloads them from swisstopo's servers, which then see its IP address, without any account data.

At Stripe, for managers who buy licences. Payment for Orarium Pro licences goes through Stripe, our payment provider, on its own pages. Stripe receives the manager's name, billing address, email address and payment method; Orarium never keeps a card number. Invited staff pay nothing and nothing about them is passed to Stripe. This data is covered by Stripe's privacy policy, and Stripe may process it outside Switzerland.

At swisstopo, for the Orarium Pro map. On the Orarium Pro platform, the map of zones is displayed on base maps from the Federal Office of Topography swisstopo: the browser displaying the map downloads them from swisstopo's servers, which then see its IP address, without any account data. Address searches go through Orarium's server, which queries OpenStreetMap's Nominatim service, located outside Switzerland, without passing on your identity.

Syncing between the app and your account works both ways. The app sends your places and clock-ins right after each clock-in, on iPhone and Android alike, and also when you open the app on iPhone. In return, it receives what has changed in your account.

• On a new phone, after reinstalling the app or when switching from iPhone to Android (or the other way round), log in with the same account: your places, their radius and your history come back to the app.
• A change made on the website, such as deleting a place, reaches the app at its next sync. The app then stops monitoring a deleted place.
• A place or clock-in you delete in the app disappears from the website too.

So that each deletion reaches all your devices, a deleted place or clock-in is not erased from Orarium's database: it stays there, marked as deleted, until you delete your account. Clock-ins already recorded for a deleted place stay in your history.

The website shows your days, sessions and places, and offers CSV export. The website does not create places; it lets you adjust each week's timesheet, and every version is kept.

Your data is used to provide the service you ask for: detecting your arrivals and departures, calculating and displaying your hours, and managing your account. The security log and sessions are used to protect your account. The use of your location is based on your consent, given through the phone's location permission. Sharing your hours with a company is based on your consent, given by accepting its invitation and revocable at any time. Managers' billing data is used to collect payment for Orarium Pro licences and to issue receipts.

The weekly timesheet and the Monday recap are used to check and adjust your hours; the timesheet's versions are kept so that every change remains available. Improvement suggestions are used to develop Orarium and, if you agree, to reply to you.

Orarium writes to you to manage your account: sign-up confirmation, password reset or change, deletion confirmation. With Orarium Pro, these are joined by a company's invitation, notice of a changed zone and the end of sharing; the manager receives notice of an accepted or declined invitation, of someone leaving the company and of a failed payment.

Every Monday, if you had some activity the previous week, Orarium sends you that week's recap: your totals and the names of your places, never a location. The recap is on by default; you can turn it off in your account, or with one click from the email. If you send an improvement suggestion with your address and agree to be contacted, you receive an acknowledgement.

Emails are sent in your account's language. ILYGO sends them from a sending address that does not receive replies. To write to us, use info@ilygo.ch.

On the public pages of Orarium and Orarium Pro, you can accept or reject Google Analytics 4. No Analytics script, cookie or request is loaded before consent or after rejection. Your choice applies independently to each website and is stored in your browser's local storage for 180 days. Use « Privacy choices » in the footer to change it or withdraw consent. Withdrawal removes accessible Analytics cookies for this website and reloads the page.

After consent, Google receives the public page visited without query parameters or fragments, the origin of the previous website, browser and device information, and necessary connection information including the IP address. Account, login, invitation and payment pages, signed-in areas and URLs with query parameters are not measured. Orarium sends no time records, workplaces, email addresses, names or form content to Analytics. Enhanced measurement, Google Signals and advertising personalisation are disabled. Do Not Track and Global Privacy Control are respected.

Analytics cookies apply only to this website and expire after 60 days, without renewal on each visit. User and event data retention in Analytics is set to two months. Google may process this data on infrastructure outside Switzerland; see Google's privacy policy.

Orarium shows no ads. ILYGO Sàrl does not sell or rent your data. Account areas keep their session cookie; language preferences stay in local storage. Orarium Pro also uses swisstopo base maps and Stripe payment pages.

You, from the app and the website. ILYGO Sàrl's operations team can access it for support and security; it also reads improvement suggestions. A company manager, only if you have accepted their invitation on Orarium Pro: they see your attendance hours in their company's zones and the weeks you submit, within the limits described above, and nothing else. Without an accepted invitation, you choose what you pass on, for example a CSV export.

• Your account, places, clock-ins, including the ones you deleted (kept with a deletion mark for syncing), and timesheet versions: as long as your account exists.
• A login session: at most 30 days on the website, at most 180 days in the app.
• The security log: 90 days.
• Hours shared with a company, and the weeks you submitted to it: visible to its manager while sharing lasts, then, for the period already shared, as long as your account exists.
• Improvement suggestions: as long as needed to follow them up.
• Invoices for Orarium Pro licences: at Stripe, and in ILYGO Sàrl's accounts for the period required by law.

An encrypted backup of Orarium's database is made every day and kept in the European Union. Existing backups are not rewritten after a deletion.

You can delete your account from the app, in the Account tab, or on the website, from your account page. Deletion removes your account, places, clock-ins and timesheets from Orarium's database and closes your sessions. To erase the data left on the phone too, delete the app.

Existing backups are not rewritten after a deletion. Security log entries are erased at the end of their 90 days.

Delete my account

The Federal Act on Data Protection (nFADP) gives you the right to access your data, to have it corrected and to have it deleted. To exercise these rights, write to info@ilygo.ch.

You can also remove location access in the phone's settings at any time: automatic detection then stops. Your hours can still be corrected by hand, in the app and on the website.

You can withdraw your consent to sharing with a company at any time: leave the company from the Company tab of your account. The Monday recap can be turned off in your account.

• Password stored as an argon2id hash, never in plain text.
• Session tokens stored as a hash.
• Encrypted connections between the app, the website and the server (HTTPS).
• Backups encrypted before they are sent.

This page may change as Orarium evolves. The date of the latest update is shown at the top of the page. A question? Write to info@ilygo.ch.