ExoLog Privacy Policy

Last updated: September 23, 2026

This Privacy Policy describes what personal data the ExoLog app (the "App") collects, for what purposes it is processed, and what rights you have. The data controller is the developer of the ExoLog app.

1. Data controller

The controller of your personal data is the developer of the ExoLog app (a natural person).

For matters concerning personal data, you can contact us at: krystian.gagracz@gmail.com.

2. What data we collect

Depending on how you use the App, we process the following data:

• Account data: email address and password (stored and secured by Firebase Authentication — we have no access to your password in plain text).
• When signing in with Apple or Google: your account identifier with that provider, your email address, and your name if you choose to share it. Apple lets you hide your email address — in that case we only receive a relay address generated by Apple.
• Profile data: display name, bio, profile photo and cover photo, profile visibility setting.
• Data about your collection: information about your animals (species, name, parameters), feedings, events (molts, matings, cocoons), notes, photos and CITES documents.
• Community data: friend requests, friendships, follows, posts (photos and descriptions), questions and answers, likes, as well as content reports and user blocks you submit.
• Subscription data: plan status (active/expired), billing period type and renewal date — received from the store via RevenueCat. We do not process payment card data.
• Push notification token (Expo Push Token) — if you consent to notifications.
• Technical session data stored locally on your device (sign-in status, time of last activity).

Summary in the format required by app stores:

The App does not collect location data, contacts, calendar, audio files or web browsing data. We do not show ads and do not use data for marketing purposes.

3. Purposes and legal bases of processing

We process your data for the following purposes:

• Creating and maintaining your account and providing the App's features — performance of a contract (Art. 6(1)(b) GDPR).
• Community features (public profile, follows, posts, contests) — our legitimate interest and your actions in the App (Art. 6(1)(f) GDPR).
• Sending push notifications — based on your consent (Art. 6(1)(a) GDPR), which you can withdraw in the settings.
• Ensuring security and preventing abuse — legitimate interest (Art. 6(1)(f) GDPR).

4. Data recipients and processors

We use trusted service providers who process data on our behalf:

• Google (Firebase: Authentication, Cloud Firestore, Cloud Storage, Cloud Functions) — storing your account, App data and files.
• Apple and Google — signing in with an Apple account (Sign in with Apple) or a Google account, if you choose that sign-in method.
• Expo — push notification delivery service.
• RevenueCat, Inc. — subscription handling: validating purchases in the App Store / Google Play and passing the plan status to the App.
• Apple and Google — processing payments for in-app purchases; the store is a separate controller of the transaction data.

5. Payment and subscription data

Payment for the Breeder plan is processed by the store (App Store or Google Play). We have no access to payment card data or full billing data — the App only receives the plan status (active/expired) and the renewal date.

To assign the subscription to the correct account, we pass your App account identifier (Firebase uid) to RevenueCat. The legal basis for this processing is performance of a contract (Art. 6(1)(b) GDPR).

RevenueCat, Inc. is based in the USA, so this data may be processed outside the European Economic Area — on the basis of standard contractual clauses approved by the European Commission.

We store the subscription status in your profile for as long as you have an account; after the account is deleted, it is removed together with the rest of your data.

6. Visibility of data to other users

If you set your profile to public, other signed-in users can find your profile and see your animals and posts. Your email address and push notification token are not visible to other users — we store them separately, in a part of your profile accessible only to you.

CITES documents are private and visible only to you. You can change your profile visibility at any time in the settings.

6a. Temporary account (guest mode)

When you use the App without creating an account, you receive a temporary account. We do not collect an email address or any contact details — only an anonymous identifier tied to this installation of the App is created.

Data entered in guest mode (animals, feedings, events, notes and up to 3 animal photos) is stored on our servers just like data from registered accounts and is linked to that identifier. It is, however, not linked to your identity in any way.

A temporary account profile is always private: it does not appear in user search, does not publish posts to the feed and is not visible to other people.

We do not register a push notification token for temporary accounts.

Because a temporary account has no login, we cannot verify your identity — in practice, if you lose access to the installation, we cannot fulfil a request to access, rectify or port your data. Creating a full account keeps your existing data and restores these rights in full.

You can delete a temporary account yourself in Profile → "Delete account"; we then delete all data assigned to it.

7. Data retention

We keep your data for as long as you have an account. After the account is deleted, your data (account, profile, animals, photos, posts together with the comments under them, custom events, community connections, likes, blocks and reports you submitted) is permanently removed from our systems.

Exceptions: answers and comments you left under other people's posts are anonymised — we remove your name and identifier, and the entry shows "Deleted account"; the text stays so that other people's threads keep their meaning. In the history of an animal you transferred, only the transfer date remains, without your name. Reports about your account submitted by other users are kept until moderation has reviewed them.

We keep data from temporary accounts until they are deleted in the App, but no longer than 12 months after the App was last opened. After that, the temporary account is deleted automatically together with all its data and photos — this does not apply to registered accounts.

Billing data related to purchases may be retained by the payment provider (App Store / Google Play / RevenueCat) for the period required by tax and accounting regulations.

8. Your rights

In connection with the processing of your data, you have the following rights:

• The right to access your data and obtain a copy of it.
• The right to rectify (correct) your data.
• The right to erasure — you can delete your account yourself in the App (Profile → Delete account).
• The right to restrict processing and to data portability.
• The right to object to processing based on legitimate interest.
• The right to withdraw consent (e.g. to push notifications) at any time.
• The right to lodge a complaint with a supervisory authority — in Poland, the President of the Personal Data Protection Office (UODO).

9. Account deletion

You can delete your account at any time in Profile → "Delete account". The operation is irreversible and permanently deletes your data, including animals, photos, posts and your profile — with the exceptions described in section 7.

If you want the text of your answers and comments under other people's posts removed as well, delete them in the App before deleting your account or contact us — we will remove them on request.

The procedure is described in detail on the data deletion page.

10. Security

We apply technical and organisational measures to protect your data, including access rules at the database and file storage level, which ensure that only your account can access your private data.

All data is transmitted over an encrypted connection (HTTPS/TLS).

11. Children

The App is not directed at people under the age of 16. If you are a parent or guardian and believe that a child has provided us with data, contact us to have it deleted.

12. Changes to this Privacy Policy

We may update this Policy. We will announce material changes in the App. The date of the last update is given at the top of the document.