Privacy

Last updated 19 September 2026.

Apothecount is run by Saurabh Gupta, a private individual in Switzerland, who is responsible for the data it holds. This page says what is stored, why, where, for how long, and what you can do about it. It is written to be read, not skimmed past. The service is built to hold as little as it can and to share nothing.

What is stored

To have an account, Apothecount stores your name, your email address, a hash of your password (never the password itself), your time zone, when your address was confirmed, and a profile picture if you upload one. To do its job it stores what you enter about your medication: names, strengths, doses, pack sizes, the counts, deliveries and adjustments you record, the ordering defaults you choose, and the orders you mark as placed, together with the pharmacy address and customer details you give for them. Some of this is health data in the sense of data protection law, because what you take can reveal a condition. You choose what to enter; the service never asks for a diagnosis, a prescription or anything about your health beyond what you type.

For security the service keeps a log of sign-ins, sign-outs, failed attempts and account changes with the time, the network address and the browser they came from, and it keeps a record of each signed-in browser so you can see and end those sessions. Ordinary server logs record requests without their contents.

Why it is stored

Only to provide the service to you: to sign you in, to work out when you will run out and what to order, to write your order messages, and to send you the few emails the service needs, which are the confirmation of your address, password reset links and a notice when your sign-in address changes. Nothing is used for advertising, profiling, or anything the service does not do for you. The legal basis under Swiss data protection law is your request for the service and your consent to these terms, which you can withdraw by deleting your account.

Where it is stored

On a single server hosted by Infomaniak Network SA in Switzerland. Data is encrypted in transit to and from the server. Emails are sent through a mailbox at the same provider. No other company processes your data, and it is never sold, rented or shared. There are no trackers, no analytics services, no advertising networks and no embedded third-party content on any page. The service uses one cookie, to keep you signed in, and two short-lived helper cookies for form protection and messages; none is used to follow you anywhere.

How long it is kept

For as long as you have an account. Deleting your account, which you can do yourself on the account page, removes your account, medications, history, orders, picture and security log immediately. Sessions end after 30 days unused or 90 days at most, links sent by email expire within a day and are removed after use, and an account whose address is never confirmed is removed after a week. The server keeps a nightly copy of its database for 30 days for disaster recovery; deleted data disappears from those copies as they age out.

Your rights

You can see everything the service holds about you on its pages, and change it there. You can delete it all yourself. If you want a copy in a machine-readable form, or want something corrected or removed that you cannot reach yourself, write to hello@apothecount.com from the address on your account and it will be done within a month. You also have the right to complain to the Swiss Federal Data Protection and Information Commissioner, or to the supervisory authority where you live.

Security

Passwords are hashed with Argon2id. Sessions are held server-side behind a cookie that scripts cannot read. Every form is protected against cross-site requests, sign-in attempts are rate limited, pages carry a strict content security policy, and the server is patched automatically and reachable only over HTTPS. No system is perfect. If you find a weakness, please tell hello@apothecount.com so it can be fixed; if a breach ever affected your data you would be told promptly.

Children

The service is for adults. It does not knowingly hold accounts for anyone under 18; an account found to belong to a child will be removed.

Changes

This page may change as the service does. The date at the top says when. Material changes will be announced on the sign-in page or by email before they take effect.