1. Who is responsible
This website is operated by the Association for Risk Mitigation, Safety Management and Analysis (ARMSMA), an independent non-profit association under Articles 60 et seq. of the Swiss Civil Code, with its registered seat in Carouge, Canton of Geneva, Switzerland.
For any question about your data, write to [email protected]. A person reads that address.
Internal data protection contact: Illia Usachov, Principal Founder (Statute, Art. 19.2), at [email protected], until a dedicated officer is appointed. If a breach is likely to put your rights at high risk, we notify the Federal Data Protection and Information Commissioner (FDPIC) and, where required, you, without undue delay.
2. The law we apply
We process personal data under the Swiss Federal Act on Data Protection (FADP) and, where it applies to you, the EU General Data Protection Regulation (GDPR). Where the two differ, we follow whichever gives you more.
3. What we record, and for how long
The table below is the complete list. It is not a summary: if something is collected by this website, it is in this table.
The retention windows are enforced by a scheduled job that deletes older records automatically. They are not aspirations.
| What | Why | Legal basis | Kept for |
|---|---|---|---|
| Account details — name, email, date of birth, password (stored as a bcrypt hash, never in readable form) | To run your member account | Contract | While the account exists |
| Two-factor secret, encrypted at rest | To protect your account at sign-in | Contract | Until you switch 2FA off |
| Sign-in telemetry — time, IP address and browser of your last sign-in | So you and we can notice a stranger using your account | Legitimate interest | Overwritten at each sign-in |
| Security trail — sign-ins, failed attempts, role changes, admin actions, with IP address | To investigate abuse and account takeovers | Legitimate interest | 12 months |
| Contact form — name, email, message, plus sender IP address and browser string | To answer you, and to recognise automated spam | Legitimate interest | 24 months |
| Newsletter address | To send you the newsletter | Consent | Until you unsubscribe |
| Website analytics — page, language and country. No IP address is stored | To see which pages are read and in which language | Consent | 14 months |
| QR code scans — time, country, device type and a one-way hash of the browser string. No IP address in any form | To know whether a printed code is being used | Legitimate interest | 12 months |
| Server error log — error, page, IP address and browser string | To find and fix faults | Legitimate interest | 3 months |
| Push notification registration — the address your browser's push service gives us, its encryption keys, and a device name such as “Chrome on Android” | To send alerts to your device when you ask for them | Consent | Until you switch notifications off or the browser is gone |
| What you submit — event registrations, volunteer applications, course results, certificates, location alerts | To provide the thing you asked for | Contract or consent | While it remains relevant, or until you delete it |
| What you publish — forum posts, replies and comments, with your display name | The discussion itself | Consent | Until you or a moderator removes it |
4. What we deliberately do not do
There are no advertising trackers on this site, no cookies for statistics — the only count of visits is Cloudflare Web Analytics, which records page views without cookies and without identifying you — no cross-site tracking and no profiling. We do not sell or rent personal data, and we never will — a non-profit that funds itself by selling its members' details has stopped being one.
Two choices are worth naming because they cost us information we could have had. QR code scans store no IP address at all, not even briefly: the address is used in memory to limit abuse and is then gone. And the browser string of a scan is stored only as an irreversible hash, enough to notice the same device twice, useless for anything else.
Uploaded images are re-encoded on arrival, which strips EXIF metadata — including any GPS coordinates your camera recorded.
5. Who else sees it
The site runs on Hostinger's infrastructure in the European Union, which is where the database lives. Cloudflare sits in front of it and sees the traffic in transit, as any content network does. Email leaves through Hostinger's mail service.
The map is the one place where your browser talks to somebody else directly. Depending on the map type you choose, tiles come from OpenStreetMap, CARTO, Esri (satellite imagery) or OpenTopoMap, and place search from OpenStreetMap’s Nominatim service — so the provider you are using sees the IP address of whoever is looking at the map, exactly as they would if you visited their own site. We send them nothing about you, and none of them is used anywhere else on this site. The Geneva layers and the hazard events are fetched by our server from the canton’s SITG, GDACS and the USGS; your browser never contacts those three and they learn nothing about you. A lesson video plays from YouTube (in its no-cookie mode) or Vimeo only when you press play.
That is the complete list of processors. No data is passed to advertising networks, data brokers or social platforms.
Paravigil (paravigil.armsma.org) works the same way. Aircraft, satellite, fire, imagery, weather, conflict and wanted-persons data are fetched by our server — from OpenSky, adsb.lol, CelesTrak, NASA, EUMETSAT, Open-Meteo, UCDP and the authorities’ own sites — and cached; your browser loads only base-map tiles (OpenFreeMap, Esri, OpenStreetMap, OpenTopoMap). The wanted-persons pages republish only what authorities publish themselves to obtain the public’s help, each with a link to the source, and change when the source changes. The photo tools (metadata, hashes) run entirely in your browser: the photo is not uploaded.
6. Where your data is, and transfers abroad
Data is stored in the European Union. Switzerland, where ARMSMA is registered, is recognised by the European Commission as providing an adequate level of protection, so transfers between the two need no further safeguards.
7. Your rights
You may ask what we hold about you, ask for it to be corrected, ask for it to be deleted, ask for a copy in a portable form, object to processing based on legitimate interest, and withdraw any consent you gave — withdrawing does not undo what was lawful before.
Write to [email protected]. We answer within 30 days. If you are unhappy with the answer you may complain to the Swiss Federal Data Protection and Information Commissioner (FDPIC), or to your national supervisory authority in the EU or EEA.
You can also delete your account yourself, at any time, from your dashboard settings. That removes your personal data; content you published in the forum is anonymised rather than erased, so conversations others took part in are not left full of holes.
Two rights are worth naming separately because they are easy to overlook. Where we process something because you agreed to it — statistics, the newsletter, hazard alerts — you may withdraw that agreement at any time, as easily as you gave it, and the processing stops; what was lawful before the withdrawal stays lawful. And you may ask for the data you gave us in a structured, machine-readable file, or ask us to send it directly to another organisation where that is technically possible.
8. How it is protected
Passwords are hashed with bcrypt and never stored in a readable form. Two-factor secrets are encrypted with AES-256-GCM, and one-time tokens for password resets and email verification are stored only as hashes — all three stay unreadable even to someone holding a copy of the database. The database itself is not reachable from the internet: it listens only on the server's own loopback, and administrative access reaches it through an encrypted SSH tunnel. Sign-in attempts are rate-limited, forms carry anti-forgery protection, and administrative actions are recorded in the security trail described above.
No system is perfect. If we ever discover a breach affecting your data, we will inform you and the competent authority as the law requires.
9. Automated decisions and profiling
We take no decisions about you by automated means alone, and we do not profile you. Nothing on this site scores, ranks or categorises a person; no membership, volunteer application or certificate is granted or refused by software. A person reads and decides.
The two places where software acts on its own are anti-abuse measures — rate limiting on sign-in attempts and the anti-bot check on forms — and geographic alerts, which compare a point you chose yourself against a published event. Neither produces a decision with legal or similarly significant effects for you.
10. Children
This site is not aimed at children. Accounts are intended for adults; where a person under 16 wishes to take part in a course or volunteer, we ask that a parent or guardian contacts us first, and we process that person’s data only with their agreement.
We ask for a date of birth because some activities have age requirements and because certificates must name a real person. It is used for that and nothing else.
11. Complaints
If you think we have handled your data wrongly, tell us first at [email protected] — most problems are a misunderstanding or an error we can correct quickly, and you lose no right by asking us.
You can also complain to a supervisory authority at any time, without going through us. In Switzerland this is the Federal Data Protection and Information Commissioner (FDPIC), Feldeggweg 1, 3003 Bern, edoeb.admin.ch. If you are in the European Union or the EEA, you may complain to the data protection authority of the country where you live, where you work, or where you believe the problem occurred.
12. Changes
When this policy changes, the date at the top changes with it. Material changes will be announced on the site rather than slipped in quietly.