Security and privacy, in plain words.
A health record is a matter of trust. Here is, without jargon, where your data lives, who can access it and what we deliberately do not do.
Where the data lives
Database, sign-in and photos are stored on servers in Frankfurt am Main. The app is delivered through Vercel. Both providers work for us under a data processing agreement with the EU standard contractual clauses. There are no other service providers.
Who can access a record
Access rights are enforced in the database itself, not only in the app. A record is visible to members of the space or to holders of a valid pet pass link, and to nobody else. An automated test suite checks these rules on every change: strangers read nothing, write nothing, revoked shares are dead immediately.
Passwords and sign-in
Passwords are stored only as hashes; even we cannot read them. They need at least 8 characters with lower and upper case letters, a digit and a symbol. Confirmation links are valid for 24 hours, plus a code to type in for mailboxes that open links in advance.
Sharing without side effects
A pet pass link shows only the sections you release, until the expiry date or until you revoke it. The links consist of 72 bits of randomness, guessing is practically hopeless, and a brake stops robots that try anyway. The pages are blocked for search engines. When you hand a record over, your personal notes stay with you.
What we do not do
No advertising in the app, no tracking, no analytics services, no sharing with third parties, no photos or reports sent to an artificial intelligence. We set only the cookies needed for sign-in, language and time zone; that is why there is no cookie banner.
What stays in your hands
You export all spaces, pets and entries as a file and photos per pet as a ZIP at any time. You delete your account yourself in the settings, permanently, with everything that belongs to it. Shared links you revoke with one tap.
If something happens
Should a data breach occur nonetheless, we inform the supervisory authority within 72 hours and, where the risk is high, you as well, as the GDPR requires. We wrote down the procedure beforehand, not in the emergency.
The full privacy policy is at Privacy.