Privacy policy
Kitom is an app that keeps you company in your dog's or cat's wellbeing. Here we explain, with no small print, what data we process, why, who we share it with, how long we keep it and how you stay in control. The Spanish version is the reference version.
In short
- We only process what the app needs to work: your account and what you log about your pets.
- To prepare AI guidance we send Google the data of that check, without your name or email. Google does not use it to train its models.
- We don't sell your data, and there are no ads or cross-app tracking.
- You can download your data and delete your account from the app itself.
1. Who is responsible
The controller of your data is David Zarzavilla Borrego, a private individual resident in Spain who develops and runs Kitom. For any privacy matter, write to dzarzavillaborrego@gmail.com.
This policy applies to the Kitom app and to this website. It is governed by the EU General Data Protection Regulation (GDPR) and the Spanish Organic Law 3/2018 on Personal Data Protection and Guarantee of Digital Rights (LOPDGDD).
2. What data we process and why
| Data | Purpose | Legal basis |
|---|---|---|
| Account: email, password (stored as a hash, never in plain text) or your Google account if you sign in with it (name, email and profile photo). | Create your account, let you sign in and recover access. | Performance of the contract (the terms you accept when using Kitom). |
| Profile: name, time zone, language and the date and version in which you accepted the veterinary notice. | Greet you, know when your pets' day starts and show that you saw the notice. | Performance of the contract; legitimate interest for the notice record. |
| Your pets: name, species, breed, date of birth, sex, weight, neutering, known health conditions, allergies, temperament notes and photo. | Show their profile and personalise the log and the guidance. | Performance of the contract. |
| Daily log: mood, energy, appetite, activity, sleep, vocalisation, social interaction, unusual behaviour, tags, notes and who wrote it. | Day-to-day tracking, history, streaks and achievements. | Performance of the contract. |
| Agenda: reminders (title, type, description, which may include medication, dates and repetition). | Show your agenda and schedule notifications on your phone. | Performance of the contract. |
| AI checks: photo (if you add one), chosen signs, context about the pet and its latest logs, the guidance obtained and your rating. | Prepare and store the guidance (see section 3) and apply the monthly limit. | Performance of the contract. Before sending a photo we ask you to confirm it. |
| Co-owners: the email of the person you invite (only to find their account; we don't store it), their role and relationship to the pet. | Share a pet with other people. | Performance of the contract. |
| Communications: whether you agree to receive tips and news by email. | Send you at most one email a month. | Consent (off by default; withdraw it any time in the app). |
| Technical data: app error reports (phone model and system, app version and what failed) and server logs (IP address, date and type of request). | Keep the app secure, detect abuse and fix bugs. | Legitimate interest in a working, secure service. |
| Support messages: whatever you write to us by email. | Reply and handle your requests. | Performance of the contract; legal obligations when you exercise your rights. |
The health data you log belongs to your pet, not to you. Even so, we treat it with the same care. We don't ask for your phone number, address or payment details: Kitom is free.
People in photos. Photos are of your pet. Please keep people out of them; if someone appears, take the photo again.
3. AI guidance
When you ask for guidance, Kitom sends Google (the Gemini API, through Google AI Studio) only what is needed to prepare it:
- the photo, if you add one;
- the signs you choose;
- pet data: species, breed, age, weight, sex, whether neutered, known health conditions and allergies;
- their latest daily logs, including notes.
We don't send your name, your email or your pet's name. Please don't write personal data in the notes.
We use the paid Gemini API service. In that service Google acts as a processor: it processes the content only to return the response to us, does not use it to train or improve its models and only keeps it for a limited time to detect abuse, under its terms. Kitom doesn't use your photos or checks to train models or for any other purpose either.
The photo, the signs and the guidance are stored privately with the check, so that you and the people who share the pet with you can see it again. The guidance is for information only: it is not a medical assessment and does not replace a vet. You make the decisions; no decision with legal effects is taken automatically.
4. Who we share data with
We don't sell or rent your data. It is only shared with these providers, who act as processors under contracts that require them to protect it and use it only to provide their service to us:
| Provider | Purpose | What they receive |
|---|---|---|
| Supabase, Inc. | Database, accounts, photo storage and server functions. | All account and pet data. Hosted on servers in the European Union. |
| Google (Gemini API) | Prepare AI guidance. | The data of each check (section 3), without your name or email. |
| Google (Sign in with Google) | Sign in with your Google account, if you choose to. | The sign-in request. Google returns your name, email and profile photo to us. |
| Functional Software, Inc. (Sentry) | App error reports. | Technical data about the error. It is configured not to send your email, your name or what you write. |
| 650 Industries, Inc. (Expo) | Build and distribute the app. | None of your data while you use the app. |
| GitHub, Inc. (GitHub Pages) | Host this website. | Technical visit data (such as IP address) that GitHub logs for security. |
People you share a pet with. If you invite someone as a co-owner, they will see that pet's profile, logs, agenda and checks, and your name. You decide who to invite and can remove access at any time.
We will only disclose data to authorities when the law requires us to.
5. Transfers outside the EU
Some providers (Google, Sentry, Expo and GitHub) are US companies or may process data there. Those transfers rely on the EU-US Data Privacy Framework, which they have joined, or on the standard contractual clauses approved by the European Commission. You can ask us for more information at dzarzavillaborrego@gmail.com.
6. How long we keep it
| Data | Period |
|---|---|
| Account and profile | While you have the account. When you delete it, they are erased within 30 days at most. |
| Pets, daily logs and agenda | Until you delete them or delete the pet or your account. |
| Pet photos | Until you change them or delete the pet or your account; then they are removed from storage within 30 days at most. |
| AI checks (photo, signs, guidance and the provider's technical response) | With the check, until you delete the pet or your account. |
| AI usage record (date and status of each check, no content) | While you have the account, to apply the monthly limit. |
| Content sent to Google for guidance | The limited time Google sets to detect abuse; not used to train models. |
| Communication preference | Until you change it or delete your account. |
| Error reports | 90 days. |
| Server technical logs | 90 days at most. |
| Backups | Overwritten within 30 days at most. |
| Support emails | Up to 12 months after the conversation is closed. |
| Rights requests (date, email and reply) | 3 years, to be able to show that we handled them. |
If you delete your account and you owned shared pets, each one passes to a co-owner with edit permission; if there is none, it is deleted with all its data and photos. What you wrote in pets that still exist (someone else's or transferred) stays in their history, no longer linked to you.
7. Your rights
You can exercise these rights over your data at any time:
- Access and portability: in the app, under Profile › Your account and settings › Download my data, you get a JSON file with your data.
- Rectification: you can correct your profile, your pets and your logs in the app.
- Erasure: in the app, under Profile › Your account and settings › Delete account. If you no longer have the app, follow these instructions.
- Objection and restriction: you can object to processing based on legitimate interest or ask us to restrict the use of your data.
- Withdraw consent: turn off "Tips and news by email" under Privacy. Withdrawing it doesn't affect what was done before.
For anything else, write to dzarzavillaborrego@gmail.com from your account email. We will reply within one month at most (extendable by two more months for complex cases, letting you know). It is free.
If you think we haven't handled your data properly, you can complain to the Spanish Data Protection Agency (Agencia Española de Protección de Datos, www.aepd.es) or the authority of your EU country of residence. We'd appreciate it if you wrote to us first so we can try to sort it out.
8. Data on your phone and permissions
- Session: stored in the phone's secure storage.
- Offline mode: the app keeps a copy of your pets, your logs and the breed catalogue on the phone so you can use it without a connection. When you sign out, anything not uploaded yet stays on the phone so it isn't lost; if everything is uploaded, the copy is deleted from the phone. Everything is deleted when you uninstall the app or clear its data in the system settings.
- Notifications: reminders are scheduled on your own phone; we don't use notifications sent from a server.
- Permissions: camera and photos (only when you choose a photo), notifications and, on Android, exact alarms (so notifications arrive on time). You can revoke them in your phone settings.
9. Cookies, ads and tracking
This website uses no cookies, analytics or third-party resources. The app shows no ads, doesn't track you across apps or websites and doesn't share data for advertising.
10. Minimum age
Kitom is for people aged 16 or over. We don't knowingly process data of anyone younger; if you think a minor has given us their data, write to us and we will delete it.
11. Security
Communications are encrypted (HTTPS). Each person can only see their own data and that of pets shared with them: access rules are enforced on the server. Photos are stored in a private space and only shown through temporary links. If a security breach affected your data, we would notify the authority and, where appropriate, you.
12. Changes to this policy
If we change this policy, we will publish the new version here with its date. If the change is significant, we will let you know in the app or by email before it applies.
13. Contact
David Zarzavilla Borrego · dzarzavillaborrego@gmail.com