About this policy
This privacy policy is applicable to the PuppyCal app for mobile devices, together with any related services operated by Himnerom (collectively, the "Application"). Himnerom is hereinafter referred to as the "Service Provider".
In short: the Application stores what you record about your dog and a small amount about you, sends food photos for an estimate and keeps them with your log, and does not sell your data, show ads, or track you across other apps.
Data Controller Information
Himnerom acts as the Data Controller responsible for the processing of your personal data.
- Name: Himnerom
- Address: 60 rue Francois 1er, 75008, Paris, France
- Email: [email protected]
For data protection inquiries and to exercise your GDPR rights, please contact the Data Controller using the contact information above.
What the app collects
The feeding log
Meals and treats, what the food was, the portion, and the time it was logged. Barcodes you scan are matched against a food database; the scan itself is a lookup, not a record of your shopping.
Your dog's details and weights
Name, optional breed, age, neuter status, the target weight you set and where it came from, and each weight you enter from your scale. Weight is never estimated from a photograph.
Photos you take
Pictures of food are sent for processing so the app can return an itemised estimate, then kept with the entry you log, so you and the people you share the dog with can look back at them. Pictures of your dog are sent only if you use the optional body condition check. Location metadata is stripped before upload. Photos are not used to train models and are not published anywhere.
Your account and household
An email address to sign in, a display name, and the list of people you share a dog with. Everyone in a household sees the same log, including who logged what and when. That is the point of the feature, and it is worth knowing before you invite someone.
Diagnostics
Crash reports and basic usage counts, so broken screens can be found. No advertising identifiers, no cross-app tracking, no data brokers.
How the information is used
The Service Provider uses this information to run the Application for you: storing and syncing your records, showing them to the people you share a dog with, returning estimates from your photos, sending the reminders you set, and fixing faults.
Registration is needed to sync records between devices and to share a dog with other people. The Service Provider may email you about your account and required notices, such as changes to these documents. It does not send marketing emails, and your data is not used for advertising or sold to anyone.
Legal basis for processing your personal data
Where the GDPR applies, the Service Provider relies on the following lawful bases:
| Data | Purpose | Legal basis |
|---|---|---|
| Account, dog details, feeding log, weights, household | Providing the Application and its sharing features | Contract performance (Art. 6(1)(b)) |
| Food and body condition photos | Returning the estimate or score you asked for, and showing food photos with the entries in your log | Contract performance (Art. 6(1)(b)) |
| Usage counts (Google Analytics for Firebase) | Understanding which screens are used and which are broken | Consent (Art. 6(1)(a)), asked in the app, withdrawable in settings |
| Crash reports (Firebase Crashlytics) | Finding and fixing crashes | Legitimate interest in a working application (Art. 6(1)(f)); can be switched off in settings |
| Account and legal emails | Required notices about your account | Contract performance and legal obligation (Art. 6(1)(b), (c)) |
You may withdraw consent at any time without affecting processing that occurred before withdrawal.
Automated decision-making and profiling
The Application does not make decisions about you that have legal or similarly significant effects, and does not profile you. Estimates, calorie figures and body condition ranges are calculations shown to you, which you can edit or ignore.
What information does the Application collect automatically?
The Application may collect certain technical information automatically: your device model, operating system and version, the Application version, an app-instance identifier generated by Firebase (not an advertising identifier), the IP address used to connect, and, if you have agreed to analytics, which screens and features are used.
Does the Application collect precise real time location information of the device?
This Application does not gather precise information about the location of your mobile device, and location metadata is removed from photos before upload.
Does the Application use Artificial Intelligence (AI) technologies?
Yes, for three features only:
- Food and treat photos: identifying what is in the photo and estimating portion and calories, returned as an itemised, editable list with a range.
- Nutrition labels: reading the figures from a photo of a label when a product is not in the food database.
- Body condition check (optional): estimating a range on the 9-point veterinary scale from two photos and your answer to the rib test.
Who else can see or process your information?
The Service Provider does not sell or rent your data. It shares it only as follows.
People you share a dog with
Everyone in a household sees the full record for the dogs shared with them, including who logged what and when.
Service providers
Providers process data on the Service Provider's behalf, under agreements required by Article 28 of the GDPR, and may not use it for their own purposes.
Apple delivers notifications and, if the Application offers paid features, processes payments under its own privacy policy. The Service Provider receives whether a purchase is active, never your payment details.
Privacy policies of the Google services used: Google Analytics for Firebase and Firebase Crashlytics.
Legal disclosure
The Service Provider may disclose information where required by law, such as to comply with a court order, or where necessary to protect the safety of a person or to investigate fraud.
International Data Transfers
Some providers may process personal data outside the European Economic Area (EEA). Where they do, the transfer is covered by a European Commission adequacy decision, including the EU–US Data Privacy Framework where the provider is certified, or by the Commission's Standard Contractual Clauses. You can request a copy of the relevant safeguards at [email protected].
How long is data kept?
- Your account and records: for as long as you have an account. After you delete it, your data is removed from active systems within 30 days.
- Shared dogs: if you leave a household or delete your account, entries you made stay in that dog's record, shown as made by "former member". If no one else has access to the dog, its records are deleted with your account.
- Food photos: kept with the entry they were logged with, for as long as the entry exists. Deleting the entry deletes its photo within 30 days (the time every phone in the household takes to sync the deletion), as does deleting the dog's records or your account. A photo whose estimate is never logged is deleted within a day, and one in which no food was found is deleted straight away.
- Other photos: nutrition label photos are not kept after the label is read. Body condition photos stay on your device so the next check can show the previous one as a guide.
- Usage counts: up to 14 months. Crash reports: up to 90 days.
- Server logs: up to 12 months.
- Inactive accounts: after two years without sign-in, the Service Provider emails you. If you do not respond within 30 days, the account is deleted.
- Data required for legal compliance: as long as the law requires.
Export and deletion
You can export all of your records from Settings › Export, and delete your account and records from Settings › Delete all data. Uninstalling the Application stops further collection but does not delete your account; use the delete option, or write to [email protected].
How does the Application address children's privacy?
The Application is made for adults who care for a dog. Under 15, the age of digital consent in France (or a higher age where your country sets one), a parent or guardian's consent is required to create an account. The Service Provider does not knowingly collect data from children without that consent and will delete it if discovered. If you believe a child has provided personal information, contact [email protected].
What are your GDPR data protection rights?
Under the GDPR, you have the following rights:
- Right of Access: You can request access to your personal data.
- Right to Rectification: You can correct inaccurate data, most of it directly in the Application.
- Right to Erasure: You can delete your personal data (the "right to be forgotten").
- Right to Restrict Processing: You can request that the Data Controller limits how they use your data.
- Right to Data Portability: You can receive your data in a structured, commonly used, machine-readable format.
- Right to Object: You can object to processing based on legitimate interests, such as crash reporting.
- Right to Withdraw Consent: Where processing is based on your consent, you can withdraw it at any time by toggling it in the Application's settings or contacting the Data Controller.
- Post-mortem instructions: Under French law, you can give instructions on what happens to your data after your death.
What are your California privacy rights (CCPA/CPRA)?
If you are a resident of California, you have the right to know what personal information has been collected about you, to delete it, to correct it, and not to be discriminated against for exercising these rights. The Service Provider does not sell or share personal information for cross-context behavioural advertising and does not use sensitive personal information beyond what is needed to provide the Application.
To exercise these rights, contact [email protected]. You may designate an authorized agent to make a request on your behalf.
How will you be informed of changes to this Privacy Policy?
If this policy changes, the new version will be published here with a new effective date. Material changes will be announced in the Application before they take effect, and anything that requires your consent will ask for it first. Previous versions are available on request at [email protected].
This privacy policy is effective as of 2026-09-21.
How can you contact the Data Controller?
Email [email protected].