Discretion matters to us

In detail

• Who you are, if you only browse. Every search and every profile works without an account, and who you are is left nowhere. If a search finds nothing, what was searched for stays for 30 days – without anything that could point to you; more on that below. You only need an account to save something or be notified – and then we hold only what you put there yourself.
• Who you contacted. Calls and messengers go direct. The contact form forwards your message once and keeps nothing – all we keep is the number of messages per profile per day.
• Whether anything happened at all. We do not handle any money, so we never have a reason to ask.
• Where you come from and where you go. We count page views as daily totals, including the website they came from and how often an external portal was clicked on a given day – no IP address, no history. Since 29.9.2026 one cookie is part of it, besuch: it holds the day of your last visit, and from it we count, as a daily total, how many devices arrive for the first time and how many come back. If you choose “Do not count this browser” below, you get the cookie zaehlen instead, and your browser is no longer counted at all. Every cookie this site sets is in the list below. Which external listing was clicked we do count since 29.9.2026, as a daily figure per listing – under an internal identifier, for 30 days, visible only to us. Likewise, which country a view came from according to Cloudflare. For venues we count which venue page was viewed and how often – per venue, never together with device, language or referrer. Four kinds of clicks we also record one by one, with date and time: a click on an external portal or a venue’s website, which external listing it was, a view of a venue page and a view of a profile – for 30 days, visible only to us, with roughly the device (mobile or desktop) and the country and, if you came from the search, the filters you searched with (only ticked values, never typed text), but nothing that says who you are. Each of these rows is thus a small profile of your preferences on that visit: when only a few visitors are around on a given day, the order lets someone piece together what a person searched for and clicked one after the other, and device and country make that easier – not who it was. Advertising only clearly labelled and sold directly by us – no ad networks, no advertising trackers and no analytics by another company. How often an ad was shown and clicked we count per ad as a daily total – without recording anything about the people who see it. Page views do pass through Cloudflare, a company based in the USA – what it sees along the way is set out below.
• Your payment details. There is no balance, no subscription and no card number – nowhere in this house.

Why we don’t know it

Anyone who holds and forwards money must, under Swiss law, identify every customer – ID, name, documented and kept on file. “Anonymous” and “we handle the money” rule each other out, so rosalon never touches money. Not out of restraint, but because only that restraint makes this sentence true: we don’t know who you are, who you called, or whether anything happened at all – not because we delete it, but because we never had it.

What we do have

A discretion page that hides its own traces is advertising, not information. So here is the full list of what a visit to us leaves behind:

• Your chosen colour theme, in a cookie – for a year, or only for this session if discreet mode is on.
• If you have never chosen a colour theme: the one we drew at random for this session, in a cookie that disappears when you close the browser. It holds only the name of the theme, no identifier. If you choose one yourself, we delete it.
• That discreet mode is on, in a cookie that disappears when you close the browser.
• That you passed the age barrier in front of those photos of a profile that are not shown openly, in a cookie holding the fixed value “ab18” – for a year, or only for this session if discreet mode is on. No name, no date of birth, no identifier.
• That you are signed in on the provider side, in a cookie only the server can read – only if you have an account there.
• That a device is left out of our statistics, in a cookie with the value “nein” and no identifier – only on a click, for one year. You get it if you choose “Do not count this browser” below, never otherwise.
• The day of your last visit, in a cookie, for six months – plus a random value we store nowhere. From it we count, as a daily total, how many devices arrive for the first time and how many come back; there is no history. With the switch below you do not get it, and in a private window it goes when the window does.
• The feedback on the last entry in our admin area, for a few minutes in a cookie – only in the admin area, for ourselves. If you just visit the site, you never get it.
• Only if you sign in with Google, Apple or Microsoft: which sign-in your browser started, in a cookie, for ten minutes – it disappears as soon as you are back.
• Only if someone signs in with the code they received when confirming a profile created for them: a key in a cookie only the server can read, for half an hour.
• A provider’s email address, once she opens an account here – never public, never used for advertising.
• A starting point you choose, rounded to about one kilometre – only in the page address and so in your browser history, not with us. To avoid that, type a postcode.
• The title in your browser tab and history: it names the page you are on, and it calls things by their name – a place page reads “Sex in the canton of Zurich”, a venue page “Club Zeus in Zürich”. On a shared device that stays visible even when nobody is looking at the page.
• The suffix “utm_source={projekt}” on the address a click takes you to: the target site can see the visit came from us. The same for every visitor – no number, no timestamp, nothing that marks you. It therefore also appears in your browser history, and you can delete it in the address bar.
• What you type into the search field at the top – a name, a place, a venue, a service: for at most 20 minutes in our server’s memory and in no address. Since 8.10.2026, what was searched for stays for 30 days as a daily figure, with no link to you; phone numbers, e-mail addresses, street addresses and web addresses only as “occurred”. If it is a name and the search finds someone, we count since 29.9.2026 as a daily figure how often that name was searched for – for 30 days, with no link to you; if it finds nobody, it stays for 30 days in the diagnostic log below. In addition, since 4.10.2026 we count every typed name as a daily figure, with or without results – phone numbers, e-mail addresses and links replaced, for 90 days, with no link to you.
• What you searched for when nothing was found – for 30 days, so that we can find the fault: the time, the kind of search and your input, and for a name search the name as well. The row is tied to nothing: no account, no session, no IP address, no cookie, no device. If the search finds something, none of it is kept.
• When an external portal, a venue’s website, an external listing, a venue page or a profile was clicked – date and time to the second, the kind of click, the target, roughly the device (mobile or desktop) and the country and, if the click came from the search, which filters you searched with (only the values you ticked, never typed text, no postcode), for 30 days, visible only to us. The row holds nothing that says who you are: no IP address, no device ID, no browser, no cookie, no account, no running number. Each row is, however, a small profile of your preferences on that visit: with only a few visitors around, the order of the rows lets someone piece together what a person searched for and clicked one after the other, and device and country make that easier – not who it was.
• When you searched, compared prices or typed something into the free-text field – date and time to the second, the kind, the language of the page, the filters you set (only values from our lists, no postcode – only its first two digits –, never ethnicity) and how many results there were; for the free-text field, what the search recognised and, for a venue, place, service, feature or “nothing found”, the word in simplified spelling – never a searched name, never a number or address. For 30 days, visible only to us. Nothing in it says who you are: no IP address, no device, no country, no cookie, no account, no running number. With only a few visitors around, the order still lets someone piece together what a person searched for and clicked one after the other – not who it was.
• Your IP address and the page you open are seen by Cloudflare, Inc. (USA) as it passes your request on: the site is connected through a Cloudflare tunnel, soon also through its DNS. We are still checking what Cloudflare records of this. Our application itself keeps no access logs.

The quick exit

At the top of every page, and with Escape pressed twice: one click leaves rosalon instantly, with no entry in your history, clears your colour theme and discreet mode, and empties this site’s storage. If you are signed in to the advertiser area, you stay signed in – sign out there yourself. What your browser already synced with an account or another device stays untouched – no single website can delete that.

Discreet mode

Your chosen colour theme normally survives the visit – on a shared device, a clue if someone looks afterwards. With discreet mode, the colour lasts only for this session, and the quick exit clears both away.

Counting visits

To know how many people are here, we count every day how many different devices visited the site. To do that we compute a mark from your internet address and your browser identifier – the key changes every night, so tomorrow your device is no longer the same one. The internet address itself is never stored. Your browser also keeps a small cookie holding nothing but the day of your last visit; from it we count how many arrive for the first time and how many come back – as a sum, never as a history.

In a private window every visit counts as new, by the way: the cookie goes when the window does.