Diego keeps your animals’ data on your device first. If you create an account, it is additionally stored in the EU (Supabase, Ireland) – as a backup, for use across several devices and for sharing. We sell nothing, run no advertising and build no profiles. Only the data needed for the features you actually use is processed. On our public home page we measure reach anonymously with Google Analytics – and only with your explicit consent; inside the app there is no measurement at all.

Animals, feedings, medication, appointments, vaccinations and walks are stored locally on your device (on the web, in your browser’s local storage). This data does not leave your device unless you create an account.

Information about your animal’s health is not health data within the meaning of Art. 9 GDPR, because it does not relate to a person.

Legal basis: Art. 6 (1) (b) GDPR (providing the features you asked for). Storage on your device is technically necessary (§ 25 (2) no. 2 TDDDG) and therefore does not require consent.

The web app is delivered by Cloudflare (Cloudflare Germany GmbH / Cloudflare, Inc.). When you open it, Cloudflare processes technically necessary connection data such as your IP address, date and time, the address requested and details about your browser and operating system. This serves secure and stable operation.

Legal basis: Art. 6 (1) (f) GDPR (secure operation).

If you create an account, we process your email address and a random account identifier. Signing in works via a magic link – we store no password.

Legal basis: Art. 6 (1) (b) GDPR. Signing in is not possible without an email address.

Once you are signed in, the data you enter in the app is stored not only on your device but also with our database provider Supabase (Ireland, EU region) and synced between your devices. This gives you a backup, lets you use Diego on several devices and lets you share data with other people.

Legal basis: Art. 6 (1) (b) GDPR (providing the account features you asked for, such as backup, multi-device sync and sharing). The data is stored in the European Union.

You decide which people may see which data about which animal. To do so, you store that person’s name and email address; we send them an invitation by email (delivered via Resend, see above). If they accept the invitation with the same email address, they are shown exactly the data you shared – depending on the share, they may additionally check off meals and doses or record walks. You can revoke a share at any time; the person then loses access. Please only invite people who agree to this.

Legal basis: Art. 6 (1) (b) GDPR.

A walk is only recorded when you explicitly start it, and recording ends as soon as you stop it. So that the full route can be measured, the app keeps recording when you send it to the background or lock the screen – that is what the “Always allow” permission is for. If you do not grant it, the app only measures while it is open. The recorded route stays on your device. We do not transmit any location data to ourselves.

To display the map, map tiles are loaded from OpenFreeMap. Your IP address is transmitted to that provider in the process. Map data © OpenStreetMap contributors.

Legal basis: Art. 6 (1) (a) GDPR (your consent given through the location permission); you can withdraw it at any time in your system settings.

When you photograph a vaccination record and have it read, the image is transmitted to our server and from there to Anthropic PBC (USA) to extract the text. The image is used for that single analysis only and is stored neither by us nor for training models. This transmission happens exclusively when you trigger the scan yourself.

Legal basis: Art. 6 (1) (a) GDPR. The transfer to the USA is based on the European Commission’s standard contractual clauses (Art. 46 (2) (c) GDPR). A level of protection equivalent to European law cannot be guaranteed there to the same extent – only use this feature if you are comfortable with that.

When you start a check of your medication plan, the details of your animal (name, species, breed, date of birth, weight and any conditions you entered) as well as all entries of the medication plan (name, dosage, times, reason for use and notes) are transmitted to our server and from there to Anthropic PBC (USA). The data is used for that single analysis only and is stored neither by us nor for training models. The transmission happens exclusively when you trigger the check yourself. If the service is unreachable, the app analyses offline on your device without transmitting anything.

Legal basis: Art. 6 (1) (a) GDPR. The transfer to the USA is based on the European Commission’s standard contractual clauses (Art. 46 (2) (c) GDPR). A level of protection equivalent to European law cannot be guaranteed there to the same extent – only use this feature if you are comfortable with that.

Reminders for feedings, medication and appointments are scheduled as local notifications directly on your device. No data is transmitted to us for this.

Premium is handled through Apple’s App Store or Google Play. We do not receive payment data – we are only told whether a valid purchase exists for your account.

Legal basis: Art. 6 (1) (b) GDPR.

On our public home page (diego-app.com) we use Google Analytics 4 to understand which content is read and where visitors drop off. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.

This only happens if you tap “Accept” in the consent banner. Before that, no Google script is loaded and no cookie is set. Your decision is remembered locally in your browser; you can change it at any time with effect for the future via “Cookie settings” in the footer.

The following is processed: truncated IP address, pages visited and time spent, referrer, approximate location at country or city level, device type, browser and operating system, plus a random identifier in the cookie. We have switched off Google’s advertising and personalisation signals and enabled IP truncation. We transmit no data about your animals, no health data and no email addresses to Google.

Legal basis: § 25 (1) TDDDG and Art. 6 (1) (a) GDPR (consent). A transfer to the USA cannot be ruled out; it is based on the European Commission’s standard contractual clauses and on the EU-US Data Privacy Framework, which Google LLC has joined. A level of protection equivalent to European law cannot be guaranteed there to the same extent. Google’s privacy policy: policies.google.com/privacy

There is no reach measurement in the installed app (iOS/Android). We use no ad networks, no social media plugins and no profiling anywhere.

You have the right of access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and objection (Art. 21 GDPR). You can withdraw any consent you have given at any time with effect for the future.

Just write to us at hallo@labraful.com.

You can lodge a complaint with a data protection supervisory authority. The authority responsible for us is the Bayerisches Landesamt für Datenschutzaufsicht, Promenade 18, 91522 Ansbach, Germany.