Privacy Policy

This privacy policy applies to the website kahuno.app, the Kahuno app and our Instagram profile.

1. The key points at a glance

• We do not use cookies or any advertising or tracking services.
• Fonts and images are hosted on our own server.
• Only if you sign up for the newsletter does our mailing service, Brevo, process your email address.
• In the app, you sign in with an email and password, your Google account or your Apple account. Your dog profiles and entries are stored on our server in Germany.
• Only if you use photo recognition does the app send the photo to Google Gemini. We do not store it.
• We run an Instagram profile. There, Meta processes your data. For the statistics on the profile, we are jointly responsible with Meta.

2. Controller

Nicolas Goldstrass
Wackersbergerstr. 33
81371 München
Germany
Email: hello@kahuno.app

3. Hosting and log files

The website and the app's backend are hosted on servers of Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany. The servers are located in Germany. The legal basis is our legitimate interest in reliable operation (Art. 6(1)(f) GDPR) and, for the app, also the performance of the user agreement (Art. 6(1)(b) GDPR).

When you visit the website or use the app, the server stores technical details in log files: the page or feature accessed, date and time, status code, amount of data, referrer, browser and operating system or app version and device type, and your IP address in shortened form (for IPv4 the first two of four blocks, for IPv6 the first 32 bits). We use them only for troubleshooting and security and delete them after 7 days (Art. 6(1)(f) GDPR).

4. Cookies and saved language choice

We do not set any cookies on the website. Only if you switch the website's language yourself does your browser save your choice locally on your device (in what is called localStorage, under the name “kahuno-sprache”), so the website appears in that language on your next visit. This information is not transmitted to us. You can delete it at any time in your browser settings. The legal basis is § 25(2) no. 2 TDDDG, because storing it is strictly necessary for the feature you requested. That is why there is no cookie banner on this website.

5. Newsletter

For the newsletter, we use Brevo, a service of Brevo GmbH, Köpenicker Straße 126, 10179 Berlin, Germany.

When you sign up, Brevo stores your email address, the time of sign-up and of confirmation, and the IP address used. You only receive the newsletter once you click the link in the confirmation email (double opt-in). The legal basis is your consent (Art. 6(1)(a) GDPR).

When it loads, the sign-up form loads a script and a stylesheet from Brevo (sibforms.com). In the process, Brevo receives your IP address. The legal basis is our legitimate interest in a working sign-up form (Art. 6(1)(f) GDPR).

With your consent, Brevo records whether you open the newsletter and which links you click. We only use this in aggregated form (Art. 6(1)(a) GDPR, § 25(1) TDDDG).

Brevo may transfer data to countries outside the EU, in particular to the USA and India. For this, Brevo relies on the European Commission's standard contractual clauses (Art. 46 GDPR) and, for the USA, where applicable, on the EU-US Data Privacy Framework.

We store your data until you withdraw your consent, via the link at the end of every newsletter email or by emailing us. After that, we delete it. Your email address may remain on a blocklist so that you no longer receive the newsletter (Art. 6(1)(f) GDPR).

6. App

The controller is the one named in Section 2. The account and dog profile details are required to use the app; without them, we cannot provide the app. Photo recognition is optional.

Download

When you download the app, the Apple App Store and Google Play process data such as your account, your email address, payment details and a device identifier. We have no control over this. The respective store operator is responsible.

Account and sign-in

You sign in with your email address and a password, with your Google account (Google Ireland Limited, Dublin, Ireland) or with your Apple account (Apple Distribution International Ltd., Cork, Ireland).

If you sign in with email, we store your email address, your name and your password, the password only as an irreversible hash. To confirm your address and to reset your password, we send you a code by email.

If you sign in with Google or Apple, we receive only your email address (with Apple, possibly the anonymized relay address), a unique identifier and a token that confirms the sign-in.

The legal basis is the performance of the user agreement (Art. 6(1)(b) GDPR).

Dog profiles and shared profiles

We store what you enter in the app: details about your dog (e.g. name, breed, date of birth, weight, photo), feeding entries and notes. The data is stored with Hetzner in Germany. If you share a profile with others, they get access to the entries for that dog. The legal basis is the performance of the user agreement (Art. 6(1)(b) GDPR).

Photo recognition with Google Gemini

If you use photo recognition, we send the photo of the food packaging to Google Gemini (Google Ireland Limited, Dublin, Ireland) and receive the recognized details back. Google stores the photo and the response for 30 days and does not use them to train its models. We do not store this photo. Google may transfer data to the USA. The basis for this is the EU-US Data Privacy Framework (Art. 45 GDPR). The legal basis is the performance of the user agreement (Art. 6(1)(b) GDPR).

Purchases with RevenueCat

For subscriptions, we use RevenueCat, Inc., San Francisco, USA. RevenueCat receives your user identifier, the status of your subscription and the purchase receipts from Apple or Google in order to verify purchases. Payment is made through your Apple or Google account. The transfer to the USA is based on the European Commission's standard contractual clauses (Art. 46 GDPR). The legal basis is the performance of the user agreement (Art. 6(1)(b) GDPR).

Data on your device

The app stores on your device only what it needs to work, such as your sign-in status and cached entries. We do not use any analytics or advertising services in the app.

Retention period and deletion

We store your data for as long as your account exists. You can delete dog profiles and entries individually in the app, and your account under “Account” → “Delete account”. We then immediately delete your account, your dogs with all their entries, your foods and your photos. Dogs you share with others disappear for them too. Entries you made for other people's dogs remain there without your name. While a subscription is active, cancel it first in the App Store or on Google Play. You can also request deletion by email to hello@kahuno.app. All options are listed at kahuno.app/konto-loeschen.

Deleted data may remain in backups for up to 30 days and is deleted after that. Statutory retention obligations remain unaffected.

7. Instagram

We run an Instagram profile: @kahuno_de. The provider is Meta Platforms Ireland Limited, Merrion Road, Dublin 4, Ireland (“Meta”). For more, see Instagram's privacy policy.

When you visit our profile, Meta processes data about you, such as your IP address, device information and usage behavior, even if you are not logged in. We have no control over this.

We ourselves see your username and your content when you follow us, comment or message us. We reply to messages and delete them 6 months after the request is closed. If a message concerns a contract with us, we keep it until the limitation period expires. Meta also provides us with anonymized statistics about our profile. For this, we are jointly responsible with Meta (Art. 26 GDPR). Meta takes on primary responsibility for fulfilling your rights. You can find the agreement here: Page Insights Controller Addendum.

The legal basis is our legitimate interest in public relations and in exchanging with interested people (Art. 6(1)(f) GDPR), and for requests about a contract with us, Art. 6(1)(b) GDPR. Meta may transfer data to the USA and is certified under the EU-US Data Privacy Framework (Art. 45 GDPR).

8. Contact by email

If you send us an email, we process your address and the content to answer your request (Art. 6(1)(f) GDPR, for questions about a contract (b)). Our mailboxes are hosted with Google Workspace (Google Ireland Limited, Dublin, Ireland). This may involve a transfer to the USA; the basis is the EU-US Data Privacy Framework (Art. 45 GDPR). We delete your request once it has been dealt with and no statutory retention periods prevent this.

9. Links to other providers

Our pages link to other websites, such as sources, the App Store and Google Play, or our Instagram profile. Data only reaches the respective provider once you click such a link. Their privacy policy applies there.

10. Encryption

The website is only accessible via HTTPS. Anything you send to us or to Brevo is encrypted in transit. The app also communicates with our servers only in encrypted form.

11. Your rights

You have the right to

• access to your stored data (Art. 15 GDPR),
• rectification (Art. 16 GDPR) and erasure (Art. 17 GDPR),
• restriction of processing (Art. 18 GDPR),
• data portability (Art. 20 GDPR),
• withdraw consent with effect for the future (Art. 7(3) GDPR).

Right to object: If processing is based on our legitimate interest (Art. 6(1)(f) GDPR), you can object to it at any time on grounds relating to your particular situation (Art. 21 GDPR).

An email to hello@kahuno.app is all it takes. You can also lodge a complaint with a data protection supervisory authority; in Bavaria, that is the Bavarian Data Protection Authority (Bayerisches Landesamt für Datenschutzaufsicht).