Swiss privacy by design: why your scans never leave your iPhone

Why a floor plan is more sensitive than it looks

People are used to thinking carefully about photos and location history, and barely at all about building geometry. But a scan is richer than either. It records the exact layout of a private space: the size of every room, which way the windows face, where the doors are and which way they open. Attach the photos taken during the capture and the address of the property, and you have something no burglar, data broker or advertiser has any business holding.

It is also data you cannot take back. A leaked password is changed in a minute; the floor plan of your home is true for as long as you live there. That asymmetry is the whole argument for handling it conservatively from the start, rather than securing it after the fact.

What "privacy by design" actually means here

Privacy by design is a principle in both the Swiss Federal Act on Data Protection and the GDPR: privacy is supposed to be the default state of a product, built into its architecture, rather than a setting a careful user can go and switch on. In practice that comes down to a simple test — what does the app do if you never touch the settings at all?

For FloorLens the answer is that everything stays on your iPhone. Not because a preference is set that way, but because the app has no reason to move it.

1. Your scan is processed on the device

The scanning itself, the floor plan generation, the measurements, the room detection and the 3D model are all computed on the iPhone using its LiDAR sensor and its own processor. Nothing is uploaded in order to be processed — there is no server in the loop turning your capture into a floor plan, so there is no copy of your home sitting in a processing queue somewhere.

The same is true of everything attached to a scan. The property details you type in, the location, the notes, and the photos you take during a capture all stay on the device with it.

2. An account is optional

You can download FloorLens and use it without ever creating an account or logging in. Scan, measure, edit rooms, generate floor plans, export a PDF or a 3D model — none of it asks who you are. An identity is only needed for one specific thing, described next.

This matters more than it sounds. An app that demands a sign-up before it does anything has, by definition, linked everything you do in it to an identity. Making the account optional means the default state is not just local — it is anonymous.

3. A scan leaves the device only when you send it

There is exactly one path out, and it is deliberately several steps long. To publish a scan to the web viewer you have to create an account, log in, and then explicitly tap the button to upload that particular scan. Then you share the resulting link with whoever you want to see it.

Every one of those is a conscious action. There is no background sync, no "improve the product" telemetry carrying your geometry along with it, and no automatic backup quietly copying your scans somewhere for safekeeping. If you never tap upload, nothing you scan ever exists outside your phone.

4. What you upload stays yours

Sharing is not a one-way door. After a scan is published you keep full control of it, and you can delete it from the cloud at any time, straight from the app — the link stops working and the data goes.

And while it is up, it is not doing anything else. Your scans are never sold, never shared with any other company, and never used for advertising. There are no ads anywhere in FloorLens.

Why we call it Swiss

Switzerland has a long habit of treating privacy as infrastructure rather than as a feature — something you build the walls out of, not something you add to the brochure. That is the tradition FloorLens is built in, and it is why the architecture above came first and the product was designed around it, rather than the other way round.

It is also, frankly, the easier position to defend. Data you never collected cannot leak, cannot be subpoenaed, cannot be sold by a future owner and cannot be lost in someone else's breach. The strongest privacy guarantee any app can give you is that it simply does not have your data — and for a tool that maps the inside of people's homes, that felt like the only defensible place to start.

The short version

• Scans are processed on your iPhone. No upload is involved in making a floor plan.
• Details, location and photos stay with the scan, on the device.
• No account needed to scan, measure, edit or export.
• Nothing is uploaded unless you log in and explicitly tap upload for that scan.
• You can delete anything you uploaded from the cloud at any time, in the app.
• Never sold, never shared, no ads.