Kedvencem App Privacy Policy

Controller: Mozaik Média Kft. (operator of the Kedvencem App)
Registered office: 1193 Budapest, Bem utca 33., Hungary
Company registration number: 01-09-345120
Tax number: 26792930-2-43
Email: [email protected]
Privacy contact: [email protected]
Telephone: +36 70 433 2808

This Policy applies to the Kedvencem mobile app, its account system, public pet and provider pages, NFC/QR tags, lost-pet and finder features, maps, chats, community functions, reminders, health records, shop, customer support, the public dog-control-facility directory, the voluntary microchip-reader helper registry and related websites.

• • Account and contact data: user ID, email address, display name, nickname, telephone number, profile image, addresses, preferences and authentication-provider identifiers.
• • Pet and health-related data: pet details, photos, NFC or QR-coded tag identifiers, a microchip number entered by the user, vaccinations, treatments, measurements, veterinary records and uploaded documents.
• • Location data: lost-pet locations, sightings, search presence and route points, nearby alerts and location selected for map-based functions. Precise location is used only where the relevant feature and permission require it.
• • Microchip-reader helper data: name, telephone number, helper role, optional organisation, city, chosen map point, availability note, review status and consent timestamps.
• • User content: posts, comments, reviews, reports, chat messages, support messages and attachments.
• • Commerce data: orders, products, prices, coupons, delivery and billing data, SimplePay transaction identifiers, legacy Stripe identifiers, and Apple/Google purchase-verification identifiers. We do not receive full payment-card details.
• • Supporter Circle data: a random purchase-account identifier, support product and quantity, payment date, amount and currency, renewal, expiry and refund status. Store purchase identifiers are stored encrypted. The random identifier is sent to Apple or Google to bind a verified purchase to your account.
• • Dog-control-facility verification data: public organisational and contact details, submitted corrections, the previous-data snapshot, authorisation/privacy declarations, outreach opt-out, review status and limited security metadata such as user agent and, where configured, a non-reversible IP hash.
• • Device and usage data: push tokens, device and operating-system information, IP address, browser/user-agent data, security logs, app interactions, screen views, diagnostics and analytics settings.
• • Camera and media: photos or scans you choose to capture or upload for profiles, documents, reports, chat, QR or barcode functions. Access is permission-based.

Prior choice in build 366 and later. Optional usage measurement is off by default. Waiting for a decision, first opening the app or accepting this Policy does not enable measurement. Both Google and Kedvencem usage analytics start only after an explicit opt-in choice; you can also use the app after declining. Automatically enabled measurement in an older version does not itself count as new consent.

Purpose and data. With consent, we analyse app use, feature reliability and campaign results: screen views and time spent in the foreground; predefined action types and outcomes; app version, build and platform; timestamps, technical response times and successful/failed operations; notification opens, notification-content views and use of notification buttons. Our own system links a campaign only after server verification of a known campaign identifier. Acceptance of a push send does not by itself prove device delivery or that a person read it. Consent-gated Firebase Cloud Messaging delivery measurement may export technical message and delivery metadata to Google BigQuery; notification opens are measured separately as usage events.

Identifiers and limits. Google Analytics may process app-instance and other pseudonymous technical identifiers; we do not set a Google Analytics user ID. Our own system uses random session and submission identifiers to connect events and prevent duplicates. The live dashboard counts active app sessions, not identified people. These data can be pseudonymous; we do not describe the entire measurement system as anonymous.

The usage-event payloads we construct do not include your name, email, telephone number, account ID, precise location, pet identifiers, health content, messages, search text, full URLs or network-request contents. Google's SDK may also process technical data needed for its service under its own privacy information. Account, payment, security and delivery processing necessary to operate the app is separate.

Sales measurement. Opening a payment sheet or starting checkout is not verified revenue. Purchase outcomes use store- or server-verified status; analytics may contain product, amount, currency and a pseudonymous transaction identifier. Business records needed for payment and in-app purchase verification follow the commerce and retention provisions of this Policy; disabling usage analytics does not delete those records.

Withdrawal. You can change your choice at any time under Settings → Usage analytics. Turning it off stops both optional measurement channels and discards unsent events in our own queue. Previously lawfully processed data remains subject to retention rules and your rights. In build 366, Meta automatic marketing-event collection and advertising-identifier collection are disabled, and the TikTok marketing SDK is not started. Enabling usage analytics does not grant separate marketing consent to Meta or TikTok. This description does not retrospectively change how older app versions operated.

A separate voluntary choice. App campaign measurement for Meta (Facebook/Instagram) and TikTok is off by default. It starts only after explicit consent under Settings → Ad measurement or the separate consent prompt. Usage analytics, push permission and account creation do not enable it. Declining does not prevent use of the app. On iPhone, Apple tracking authorisation is also required; if declined, we do not start this marketing transmission.

Purpose and data. We measure app use and purchase journeys following ads: app open, registration, product view, add to cart, checkout started, and purchases verified by our server or the store. Fixed product category, quantity, amount and currency may accompany events. Native SDKs may also process technical app, device, operating-system and network data, IP address, pseudonymous app-instance identifiers, and advertising identifiers where permissions allow. This is not fully anonymous measurement. Attribution is limited by platform behaviour and permissions; a store click is not a verified installation.

The business fields we pass to Meta/TikTok do not contain a name, email, telephone number, account or pet identifier, transaction identifier, precise location, health content, messages or free text. We retain local transaction hashes to prevent duplicate purchase observations; these are not forwarded to marketing SDKs. Browser shop measurement and necessary payment processing are separate data paths.

Withdrawal and recipients. You can withdraw consent under Settings → Ad measurement. The app then passes no new marketing events. Withdrawal does not automatically delete data already accepted by an SDK or sent to a provider. In-flight transmission may complete; a provider SDK may retry previously accepted events after renewed consent. Provider rules also apply to retention and your rights concerning previously processed data. See the Meta Privacy Policy and TikTok Business Products Privacy Policy. The international-transfer safeguards in section 5 and rights in section 8 also apply.

Our own website usage measurement starts only after you explicitly allow statistics in Cookiebot. Withdrawing that choice stops submissions, discards queued observations and clears our browser session data. The last observation may remain in the live view until its 90-second activity window expires.

We record predefined page groups, time spent on a visible page, technical timestamps and action types such as product, cart and checkout interactions. Own usage events do not contain full URLs, search text, form contents, email addresses, pet identifiers or order identifiers. Random session and submission identifiers link observations and prevent duplicates. The browser-tab session renews after 30 minutes of inactivity or a maximum age of two hours. A short-lived secure technical cookie and request checks protect submission. Sessions are not identified people.

Google Analytics and our own website analytics are separate data paths. Cookiebot choices control Google storage and advertising settings through Consent Mode. Depending on the Google implementation, denied storage may still produce technical signals without cookies; our own detailed measurement does not start without statistics consent. See our cookie information.

The private sales overview aggregates necessary order, point-of-sale and store-verification records by currency. An invoice and its underlying payment are not counted as two sales. Cancellation or entitlement revocation alone does not establish a refund; missing price or refund evidence is shown separately. This business summary does not establish revenue from optional browser observations or automatically forward all financial records to Google.

• • To create and operate your account and provide requested features: performance of a contract (GDPR Art. 6(1)(b)).
• • To process orders, invoices and legal requests: contract and legal obligation (Art. 6(1)(b), (c)).
• • To provide optional Google/Firebase and Kedvencem app usage analytics: separate, freely given consent (Art. 6(1)(a)), withdrawable at any time and not a condition of app use. Other marketing and permission-based functions require their applicable separate choices.
• • To register, review, map and enable telephone contact with volunteer microchip-reader helpers: the helper's explicit, withdrawable consent (Art. 6(1)(a)).
• • To maintain accurate public dog-control-facility information, securely review corrections and direct users to the appropriate facility: legitimate interests (Art. 6(1)(f)). Lost/found-pet facility notifications require separate consent.
• • To prevent fraud, secure the service, handle incidents, improve reliability and protect users: legitimate interests (Art. 6(1)(f)).
• • Health-related pet information concerns animals, but attached documents may contain personal data; we process such content only to provide the user-requested record function.

We do not sell personal data. Data may be processed by: Google/Firebase (authentication, database, storage, messaging, functions, App Check and analytics); Apple and Google (sign-in, distribution, platform purchases and verification); Meta/Facebook where Facebook sign-in or SDK functionality is used; SimplePay (payment infrastructure) and Stripe for legacy payment records; hosting, email, delivery and customer-support providers; and authorities where legally required. Our own app analytics runs in the Kedvencem backend. Google Analytics for Firebase is a Google service with its own processing and international-transfer terms; see Firebase privacy information. Providers act under their own terms and/or data-processing arrangements. International transfers use applicable safeguards, including adequacy decisions or standard contractual clauses where required.

Google Analytics data sharing. Our Analytics account enables sharing for “Google products & services”. Google may also use Analytics data shared under that setting to improve its own products and services; for that use Google acts as an independent controller under the Google Measurement Controller-Controller Data Protection Terms. Aggregated modelling contributions and business insights, technical-support access and business recommendations are also enabled in the account. These settings do not grant consent to personalised advertising. See Analytics data-sharing settings and how Google uses data from partner apps.

Photo-based animal search in ChatGPT. When you request it, we send a resized, metadata-free version of your uploaded photo and selected photos from public, active lost/found animal reports to the OpenAI API for visual comparison. Kedvencem processes the search image in memory for the request; the search does not create a new report or permanently save the upload. We disable API response storage, which does not mean zero data retention: OpenAI's own API data controls apply. OpenAI does not use API data for model training by default, except where data sharing is explicitly enabled. Abuse-monitoring logs may normally be kept for up to 30 days, or longer for legal or safety reasons. Separately approved retention controls and image safety screening have their own conditions. See OpenAI API data controls.

Information you deliberately publish—such as a public pet page, lost-pet alert, provider profile, community post or review—may be visible to other users and search engines. Public organisational and contact details of dog-control facilities may also be shown in the directory after review. A microchip-reader helper's name, role, telephone number, selected location and availability note may become visible to Kedvencem App users only after review and explicit publication enablement based on the helper's consent. The app identifies the information before publication and provides controls appropriate to the feature. Do not publish sensitive information you do not want to be public.

Supporter recognition is public by default for new supporters: other users may see your blue, purple or gold paw beside your name, your rank and your active monthly supporter status. You can hide recognition at any time on the supporter screen. Previously selected visibility settings are preserved. Support amounts, payment details and purchase identifiers remain private.

• • Account, profile, pet, chat and uploaded content: normally until you delete it, close the account or submit a valid deletion request.
• • Microchip-reader helper data: until consent is withdrawn or the entry is deactivated; personal data in rejected or withdrawn entries is deleted within 180 days unless a shorter, purpose-limited security or legal need applies.
• • Public dog-control-facility organisational data: while the facility operates or the directory needs it; correction submissions and review logs only as long as needed for verification, security and legal claims. Outreach opt-out is retained as long as needed to respect the choice.
• • Push tokens: until invalid, replaced or the account is deleted.
• • Orders, invoices and accounting records: for statutory retention periods.
• • Supporter profiles and public recognition: until account deletion. Pseudonymous transaction records without the profile link may be retained as necessary for statutory retention, refunds and preventing the same purchase from granting recognition to another account.
• • Our own website and app analytics uses deletion thresholds of 90 days for detailed events, 2 days from last activity for session records and 7 days for duplicate-prevention submission receipts; daily aggregates without session identifiers are deleted when their day is more than 400 days old. The scheduled daily cleanup removes records that have crossed these thresholds.
• • These 90/2/7/400-day thresholds apply only to Kedvencem website and app analytics. Google Analytics retention follows Google's service terms and the Analytics property's settings; BigQuery exports follow the associated project and dataset settings. Our 90/2/7/400-day thresholds do not apply to those Google systems. See Google Analytics data retention.
• • Security and technical logs: only as long as reasonably necessary for security, diagnostics and legal claims.
• • Backups may retain deleted data for a limited technical cycle before automatic overwrite.

You can initiate full account deletion in the app or use the public deletion page.

Depending on applicable law, you may request access, correction, erasure, restriction, portability, or object to processing, and withdraw consent at any time. You can manage operating-system permissions for location, camera, photos and notifications, and withdraw optional usage-analytics consent under Settings → Usage analytics. Contact [email protected]. We normally respond within one month. You may lodge a complaint with the Hungarian National Authority for Data Protection and Freedom of Information (NAIH) or your local supervisory authority.

The service is not directed to children under 13. Users below the locally applicable digital-consent age may use it only with authorization and supervision from a parent or guardian. We do not knowingly collect children’s data contrary to applicable law. See our Child Safety Standards.

We use access controls, authentication, encrypted network transport, platform security services, backups and monitoring appropriate to the risk. No system is completely secure. We may update this Policy when features, providers or law change. Material changes will be communicated through the app, website or email where appropriate.