Privacy Policy

01 Who operates Carbonuxis

Carbonuxis is developed and operated by ENODEUS, an individual founder based in Spreitenbach, Switzerland. ENODEUS is not a registered company — for the purposes of EU and Swiss consumer law, ENODEUS is a private individual offering this app, not a commercial trader in the formal sense. Carbonuxis shares its verification infrastructure with the ENODEUS inspection platform, operated by the same person.

02 Data the app collects

Carbonuxis collects the minimum needed to run the app and, only if you choose to generate a shareable report, to make that report independently verifiable.

Stored only on your device — never sent anywhere

Collected only if you generate a verifiable report

By default, the app works fully anonymously. If you tap Generate Report for the first time, Carbonuxis asks you to verify an email address (and password) — this is what lets anyone who receives your PDF confirm it's authentic at enodeus.ch/verify.html.

Until you verify with an email, the app signs you in anonymously (via Firebase Anonymous Authentication) so it can function without any account at all. This creates a random technical identifier with no personal information attached.

03 Data the app never collects

04 How this data is used

We do not use any of this data for advertising, profiling, or any purpose beyond what's described above.

05 Where your data lives

Your questionnaire answers, name, and photo are stored locally in the app's private storage on your iPhone, protected by Apple's standard device-level encryption. They are never transmitted to ENODEUS or anyone else unless you personally export and share a PDF report through iOS's share sheet — at which point you control exactly where it goes.

Your email account and report verification records are stored using Firebase (Google Cloud infrastructure), the same backend that powers the ENODEUS inspection platform's verification system.

06 Sharing with ENODEUS Verify

Carbonuxis and the main ENODEUS inspection app share one verification database so that anyone — a colleague, a client, an auditor — can confirm a PDF report is genuine at enodeus.ch/verify.html without needing an account themselves. Only the verification record described in Section 2 is shared this way — never your questionnaire answers, name, or photo.

07 Retention & deletion

• Questionnaire data, your name and photo stay on your device until you delete the app, use the in-app Retake options, or remove your photo in Settings.
• Generated PDF files are automatically cleared from the app's temporary storage after about an hour.
• Your verification account and report records persist until you request deletion (see Section 8) — reports need to remain checkable for as long as someone might reasonably want to verify them.

08 Your rights (GDPR)

If you're in the EU, UK, or Switzerland, you have the right to:

• Access the data we hold about you
• Correct inaccurate data
• Delete your account and associated verification records
• Export your data in a portable format
• Object to or restrict certain processing
• Withdraw consent at any time, without affecting past lawful processing

To exercise any of these, email us using the contact details in Section 13 — we'll respond within 30 days.

09 Security measures

• Profile photos are compressed and stored as local files rather than in shared app preferences.
• Passwords are never handled or stored by Carbonuxis directly — authentication is delegated entirely to Firebase Authentication.
• Report verification writes are restricted by server-side security rules requiring a matching authenticated account, an immutable report ID, and a fixed initial status.
• Generated PDF files are automatically purged from temporary storage.
• Debug logging is disabled in the version of the app published to the App Store.

10 Children's privacy

Carbonuxis is not directed at children under 16. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, contact us and we'll delete it.

11 International transfers

Firebase (Google Cloud) may process data on servers outside Switzerland or the EU. Google maintains Standard Contractual Clauses and other approved safeguards for these transfers. Because your questionnaire answers, name, and photo never leave your device, this mainly concerns your email address and verification records.

12 Changes to this policy

If this policy changes in a way that affects how your data is handled, we'll update the "Last updated" date above and, for material changes, notify you inside the app.

13 Contact