Privacy
in Findus.

01 / Controller

Who processes your data.

The controller for processing personal data in Findus is Erik Lelek, trading as Extraara.

This notice applies to the Findus app, the associated Findus service and this information page. Services from Apple or other providers you choose are also subject to their own privacy notices.

02 / Account & diary

Your diary in your Findus account.

Findus helps you document your dog’s daily life and health history. It processes information you enter: dog profiles, observations, feeding, appointments, medication, notes and documents, photos or videos you save. Free text, documents and recordings may also contain personal information about you or other people.

Sign in with Apple

The app requests neither your name nor your email address from Apple. To sign in, it sends an Apple account identifier associated with Findus and authentication evidence to the Findus server. These are checked there and used to associate your account. The account identifier is not anonymous data.

Your Findus session credentials are stored in the iOS Keychain and allow access to your account. Signing out ends use of that session but does not delete your server account.

Storage and encryption

Saved entries and explicitly uploaded media are stored in your own account area on the Findus server. The connection and stored database are encrypted. The service can decrypt data to process your requests.

Without the necessary login and connection information, Findus cannot provide a hosted account. You decide which additional content to enter.

03 / On your device

Local data and app lock.

Findus caches loaded content on your device and keeps changes not yet synchronised. New unsaved entries remain local drafts. Only when you choose “Save” do they become diary entries synchronised with the Findus service. You can continue or discard drafts; they are not automatically uploaded or backed up to iCloud.

Your personal profile photo, theme, dashboard, named layouts and saved diary searches stay on the device. Searches and layouts are separated by dog and account and can be exported separately. They are not part of the server backup.

You control protection on your device

Through the More → Security you can enable an app lock. iOS confirms access using Face ID, Touch ID or the device passcode. Findus receives neither biometric data nor your passcode. The setting and delay apply only to that device.

A neutral app preview hides content when leaving the app unless you disable this option. Taking your own screenshots remains possible. Widget content can be hidden separately; iOS controls when widgets update. Notification settings are managed independently.

04 / Recordings & notifications

You choose what to share.

Select photos and files individually through the system picker. Selection alone uploads nothing. Documents and recordings relating to health history or episodes are transferred only when you explicitly save them. Your personal profile photo is not uploaded.

Health photos are prepared as smaller JPEG files without original image metadata. Videos are recreated locally as MP4; original location and description metadata are not retained. What is visible or audible remains part of the recording. Documents may still contain personal information within them.

Scanning and reminders

Findus requests camera access only for a document scan you initiate. Text recognition runs on your device. Check recognised text before saving it.

Local reminders require your permission. Depending on iOS settings, content may appear on the lock screen. Widgets use a protected storage area shared with the app. You can change permissions in device settings.

05 / Findus Plus

Purchases are separate from the diary.

Findus Plus uses Apple in-app purchases and RevenueCat. A connection to RevenueCat starts when you open Findus Plus or have previously activated purchase management. Purchase status may then be checked again.

RevenueCat processes purchase history and entitlements, a random app user identifier, the device-related vendor identifier IDFV and technical information about the device, system, app version, language and store country. The connection also exposes the IP address. Purchase information is used to provide, verify, restore and analyse purchase management.

Dog profiles, health history, credentials, photos and contacts are not sent to RevenueCat as customer attributes. Apple processes payment. Findus receives no card or bank details.

Findus contains no advertising, uses no advertising identifier and does not track across other apps or websites.

Further information: RevenueCat privacy information and Apple privacy information.

06 / Backup & export

Your own copy.

Through the More → Your data you can export backups and CSV files. Health reports and recordings can be shared separately. There is a separate export for entries not yet synchronised in the Synchronisationsection. When exporting, you choose the storage location or recipient. Unencrypted files there are not protected by the Findus server’s encryption.

Optional encrypted backup

Through Encrypted backup the app creates an additional AES-GCM-encrypted file on your device. You choose a password or recovery key and save the file yourself, for example on your device, in iCloud Drive or with another file service. There is no automatic iCloud upload or continuous iCloud synchronisation.

A recovery key is stored in the synchronisable iCloud Keychain only if you choose this separately. Its transfer depends on your iCloud settings. Neither the password nor the backup key is sent to the Findus server or RevenueCat. Without the matching key or password, the file cannot be opened.

What happens during restoration

Decrypted content is first sent for validation to your currently connected Findus storage. You then separately confirm replacing the diary. Encrypting your backup file does not change the fact that the running Findus service can decrypt account data for processing.

07 / Deletion & retention

Remove entries or delete your account.

You can remove entries, episodes, plans and media in the app. Under Your account you can delete your hosted account, including diary data, after confirming again with Apple. Signing out or uninstalling the app does not delete the account.

You manage and delete exported files and personal iCloud backups wherever you stored them. Deleting an account does not remove these copies or refund App Store purchases.

How long data is retained

We distinguish between your active account, backups and data needed for purposes such as support or purchase restoration. Our operation uses the following retention periods and deletion criteria:

Account and diary

Saved content remains while your account exists or until you remove individual items. Account deletion removes the active account database, associated local server backups and login sessions. If technically interrupted, the service continues the process afterwards.

Operational and external backups: no more than 30 days

We set a maximum backup retention period of 30 days from creation. Older content may therefore remain in a separate backup until this period ends after account deletion. Backups serve recovery after technical failures, not continued use of deleted accounts.

Operational and error logs: no more than 14 days

Technical logs we manage are retained for no more than 14 days from recording. If an entry is needed to investigate a specific security incident, we retain only the relevant extract until the investigation ends. Any longer retention follows the exceptions described below.

Support: six months after closure

We delete your message, contact details and supplied documents no later than six months after your enquiry closes. Attachments no longer needed may be removed earlier. The exceptions below apply where messages are also business records subject to retention duties or evidence in a specific dispute.

Purchase data and Findus Plus

Evidence of a purchased Plus entitlement is needed while the purchase allows activation or restoration. For purchase-management profiles without an associated purchase, we set deletion no later than twelve months after the last activity in purchase management. Deleting your diary account does not automatically delete separate purchase data. You can request its deletion through our privacy contact ; we will establish a secure association with you. Apple payment records are additionally subject to Apple’s retention duties.

Technical deletion receipts: 24 hours

A pseudonymised receipt lets the app retrieve the account-deletion response again after an interrupted connection. It is valid for 24 hours and removed at the next maintenance run afterwards. It contains no diary content and grants no access to the deleted account.

Pending deletions and Apple revocations

If deletion or revocation of Apple sign-in is not complete, the necessary technical jobs remain until successful completion. Apple revocation jobs are encrypted and retried after temporary failures. Each job is deleted after Apple confirms it. An Apple outage does not preserve access to an already deleted diary account.

Exceptions and your own copies

We retain records subject to statutory retention duties for the required period. If particular data is needed to resolve a specific legal claim, only the necessary information is retained until final resolution or expiry of the relevant limitation period. These exceptions do not justify blanket retention of your diary.

These periods concern our operation. You determine retention of your own exports. Processing by the website’s upstream Cloudflare service is explained in the section on this website.

08 / Legal bases

Why we need the data.

The following allocation concerns personal data insofar as it is processed during use.

Your account and selected features

Login, storage, synchronisation and exports you request provide the Findus service: Article 6(1)(b) GDPR.

Activation and restoration of Findus Plus

Checking purchase status and providing and restoring purchased features fulfil the purchase contract: Article 6(1)(b) GDPR. Measures against fraudulent purchase evidence rely on our legitimate interest in fraud prevention under Article 6(1)(f) GDPR.

Analysis of purchase management

Alongside purchase verification, RevenueCat provides purchase histories and statistics. We assign purchase-related analysis for checking entitlements and refunds and planning economic operation to our legitimate interest under Article 6(1)(f) GDPR. This is a separate purpose and is not generally necessary for contract performance. Diary content is not sent to RevenueCat for it. Your right to object is described under Your rights.

Secure and reliable operation

Technical diagnostics, abuse prevention, backups and necessary security logs rely on our legitimate interest in keeping the service available and preventing unauthorised access: Article 6(1)(f) GDPR. These logs are not used to analyse your diary or create advertising profiles.

Your enquiry

Contract-related support relies on Article 6(1)(b) GDPR; other enquiries rely on our legitimate interest in answering your concern under Article 6(1)(f) GDPR.

Consent and legal duties

Where consent is required, Article 6(1)(a) GDPR applies. Legally required processing relies on Article 6(1)(c) GDPR.

A device permission, such as camera access, allows that access. It does not automatically constitute consent to all further data processing.

Technical integration of a service alone is not a legal basis. Where additional analysis or access to your device requires consent, neither merely using the app nor referring to legitimate interests can replace it.

09 / Providers & transfers

Which services are involved.

Server operation at Contabo

The Findus app service and this website run on servers provided by Contabo . The Findus app service’s server location is France. For the app service, this includes stored accounts, diary content, uploaded files and technical data needed for operation. We have a data processing agreement with Contabo.

Our own email service

We operate the email service for [email protected] ourselves. If you write to us, we process your sender address, message, attachments and technical delivery information. We use this data to handle and answer your enquiry. Retention follows the support-enquiry retention periods.

Apple

Apple provides Apple sign-in, App Store payments and iCloud features you choose. These services are additionally subject to Apple’s privacy information. Details about sign-in are available under Sign in with Apple & Privacy.

RevenueCat and purchase management

RevenueCat, Inc. processes the purchase and device data described above as a processor, using infrastructure in the USA among other locations. Under section 4.2 of the RevenueCat terms of service the data processing agreement forms part of the contract. For transfers to countries without an applicable adequacy decision, it provides for the European Commission’s standard contractual clauses.

Cloudflare and the website

Cloudflare, Inc. is used upstream to deliver and protect this website. Connection data may be processed through its global network, including in the USA. Cloudflare incorporates its data processing agreement into its standard customer contracts. The agreement provides for the EU–US Data Privacy Framework for covered US transfers and EU standard contractual clauses for other restricted transfers.

The linked contractual documents explain these safeguards and the use of other providers. If you have questions about a transfer or its safeguards, write to us.

10 / Your rights

Access, correction and deletion.

Subject to the GDPR, you may request access to your personal data, correction of inaccurate details, erasure, restriction of processing and portability.

Where processing relies on legitimate interests, you may object on grounds relating to your particular situation. You may withdraw consent for the future. The lawfulness of previous processing is unaffected.

Write to [email protected]. If needed to establish entitlement, we will clarify how you can demonstrate it. Do not send passwords or recovery keys.

You may also complain to a data protection authority, particularly in your usual place of residence, workplace or the location of a suspected infringement. An overview is provided by the European Data Protection Board.

Findus makes no solely automated decisions about you with legal or similarly significant effects. Displaying observations in a dog diary is not such a decision.

11 / This website

Privacy when reading this page.

This information page contains no contact form, advertising or analytics tools, or embedded media. Fonts and the logo load from the same webserver. Reading the page does not retrieve diary data from your app.

Hosting at Contabo

This website is hosted on servers provided by Contabo . Contabo processes data necessary for operation on our behalf under our data processing agreement.

Delivery and protection through Cloudflare

We use Cloudflare as an upstream service to deliver and protect the website. Visits involve processing connection and request data, including your IP address, requested URL, access time and technical browser information. This provides the page and protects against malicious access, based on our legitimate interest in a secure, reliable website under Article 6(1)(f) GDPR.

Cloudflare operates a global network, so processing may take place outside the European Economic Area. Further information is in the Cloudflare privacy policy.

Logs and retention

Technical logs we manage on our own webservers are subject to the maximum period of 14 days. They support troubleshooting and investigation of malicious access. The described exceptions apply only to a specific incident.

This period is not a general commitment for Cloudflare’s own systems. Cloudflare sets retention according to the service, necessary security measures and legal duties; the criteria are described in section 11 of the Cloudflare privacy policy. You can also contact us with access or deletion requests relating to your visit to this website.

External provider links open only when you select them. An email link opens your mail application; clicking alone does not send a message.