Privacy policy
Last updated: 28 October 2026
ThingMetrics is an experimental beta, run by one person for a small number of invited libraries, with no guarantee of any kind (see the legal notice). Only use it with data you are comfortable putting in an experimental service, and keep your own copies. This does not change how personal data is handled: it is treated as described below.
1. Who we are
ThingMetrics is a dashboard that helps libraries of things understand their loans, members and environmental impact. It is run by Thomas Lashbrooke, Avenue de Tourbillon 41, 1950 Sion, Switzerland (“we”). Contact: contact@thingmetrics.ch.
2. Two different roles
- Data that a library imports about its members and loans: the library decides what is processed and why. It is responsible for that data (the “controller”), and we process it on the library’s behalf, under an agreement with it. If you are a member of a library, please contact your library first; we help it answer your request.
- This website, staff accounts on the app and security logs: we are responsible ourselves.
3. This website (thingmetrics.ch)
No cookies, no analytics, no advertising and no third-party content (no external fonts, scripts or videos). The server does not keep a log of visits to this website.
4. The app (app.thingmetrics.ch)
Staff accounts
For the people who use the app on behalf of a library: name, username, e-mail address (optional), role and library; the password, stored only in scrambled form (a bcrypt hash); failed sign-in attempts, to lock an account for a while after too many; and when the person last signed out.
One cookie
When you sign in, the cookie thingmetrics_session keeps you signed in for up to 7 days. It is strictly necessary for signing in, and is deleted when you sign out. There are no tracking or advertising cookies.
Access log
For security (detecting attacks, fixing errors), the server records each request to the app: IP address, date and time, the address requested, the response and the type of browser. This log is kept for 14 days, then deleted.
5. Data imported by libraries (members and loans)
From the files a library exports from its lending system, ThingMetrics keeps only what it needs for the library’s statistics:
- the member number, the username in the lending system and the postal code;
- loans and returns: the item, date and time, site, type of transaction and the item’s replacement value;
- the inventory: items, weights, prices and materials (no personal data);
- membership reports: monthly counts (no personal data);
- answers to the library’s satisfaction survey: ratings and comments (e-mail and IP address columns are removed).
Names, e-mail addresses, postal addresses, phone numbers, payment details and free-text notes are removed when a file is imported, and the uploaded file itself is deleted once it has been imported.
Purpose: to show the library its loans, members and an estimate of its environmental impact. No profiling, no automated decisions about individuals, no advertising; data is never sold.
Who sees it: only the library’s own team, and we when maintaining the service. A library may choose to show its figures in a combined “global view” with other libraries; that view shows only totals and item statistics, never individual members.
6. Where the data is stored
On servers in Switzerland, hosted by Infomaniak Network SA (Geneva). We do not transfer personal data abroad. HTTPS certificates come from Let’s Encrypt, which receives no personal data. The app’s source code is kept on GitHub; it contains no personal data.
7. How long data is kept
- A library’s data: as long as the library uses ThingMetrics. It is deleted within 30 days after the library stops using it or asks us to. Library administrators can also delete their data themselves at any time.
- Staff accounts: until they are deleted by the library or by us.
- Access log: 14 days.
- Backup copies, stored in Switzerland: at most 30 days.
8. Security
All connections use HTTPS. Passwords are stored only in scrambled form, and accounts are locked for a while after repeated wrong passwords. Each library can see only its own data. Access to the server is restricted to us, with key-based logins.
9. Your rights
Under the Swiss Federal Act on Data Protection (FADP) and, where it applies, the EU or UK General Data Protection Regulation, you can ask for access to your data, its correction or deletion, a copy of it, and object to its processing. Library members: please contact your library first. You can reach us at contact@thingmetrics.ch.
You may also complain to the Swiss Federal Data Protection and Information Commissioner (edoeb.admin.ch) or, in the EU or UK, to your local data protection authority.
10. Changes
We may update this policy, for example when the service changes. The date at the top shows the latest version.