Privacy Policy for the DoggoMeal App (Android)

1. Controller

2. Which data we process in the Android app

• Account data: e-mail address, login data, session information and security-related authentication data.
• Profile and dog profile data: e.g. the dog’s name, breed, age or date of birth, weight, activity level, allergies, bio, visibility settings and feeding and recipe references.
• Community and communication data: posts, comments, likes, follows, direct messages, notifications and other interactions within DoggoMeal.
• Upload and media data: images you select for your profile picture, cover, dog profile, profile posts or Dog of the Month entries.
• Subscription and status data: plan status, terms, renewal status, product assignment and technically necessary details about Google Play subscriptions.
• Technical data: app version, Android version, language, time zone, error and security logs, device token and technically necessary delivery information.

3. Local storage and device features on Android

• Encrypted local storage: session, account bundle, subscription summary, favourites and certain restore states are stored locally via EncryptedSharedPreferences.
• Photos / media selection: DoggoMeal only accesses images that you actively select and want to upload via the Android photo picker or the respective selection feature.
• Push notifications: if you allow notifications, DoggoMeal processes a technical FCM device token to deliver system-wide notifications.
• Local recipe reminders: reminders you enable are scheduled locally on the device and set up again after a device restart so that they keep working.
• Android permissions: DoggoMeal uses in particular POST_NOTIFICATIONS for notifications and RECEIVE_BOOT_COMPLETED to restore local reminders after a restart.

4. Purposes and legal bases

• Performance of a contract, Art. 6(1)(b) GDPR: provision of your account, your recipes, dog profiles, community, messaging and Premium features.
• Legal obligations, Art. 6(1)(c) GDPR: retention of legally required records, in particular for billing, tax and legal defence.
• Legitimate interests, Art. 6(1)(f) GDPR: stability, fraud and abuse prevention, error analysis, IT security, support and product operation.
• Consent, Art. 6(1)(a) GDPR: where required for optional notifications and system permissions.

5. Services used and recipients

6. Third-country transfers and no ad tracking

7. Storage and deletion

• We generally store account and profile data for the duration of active use.
• After account deletion, active account, profile, community, upload and push data are deleted or anonymised, unless legal obligations or legitimate record-keeping interests prevent this.
• A minimised deletion record may be kept separately for up to 12 months.
• Billing-relevant data may generally be kept for up to 10 years, transaction and e-mail related records for up to 6 years and legal or consent records for up to 3 years.
• Push tokens and local device assignments are removed when notifications are disabled or accounts are deleted.
• An active Google Play subscription is not automatically ended by deleting your account. It is managed or cancelled at play.google.com/store/account/subscriptions.

8. Your rights

• the right of access (Art. 15 GDPR),
• the right to rectification (Art. 16 GDPR),
• the right to erasure (Art. 17 GDPR),
• the right to restriction of processing (Art. 18 GDPR),
• the right to data portability (Art. 20 GDPR),
• the right to object to processing based on Art. 6(1)(f) GDPR (Art. 21 GDPR),
• the right to withdraw consent with effect for the future (Art. 7(3) GDPR); the lawfulness of processing carried out before the withdrawal remains unaffected,
• the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR).

9. Notifications and app settings

10. Changes