Privacy Policy

Effective date: 7 September 2026 Last updated: 10 November 2026

1. Who we are

Safe Paws (the “App”, also available at safepaws.gr) is operated by an individual developer based in Greece, identified as the seller on the App’s App Store and Google Play listings (the “Operator”, “we”, “us”). For the purposes of the General Data Protection Regulation (GDPR) and Greek Law 4624/2019, the Operator is the data controller of the personal data described in this policy.

Contact for anything in this policy: support@safepaws.gr, or the support form at https://safepaws.gr/support.

2. What this policy covers

This policy applies to the Safe Paws mobile app for iOS and Android, the website at safepaws.gr, and the support and child-safety forms on it. It explains what personal data we collect, why, on what legal basis, who receives it, how long we keep it, and what rights you have.

3. The data we collect

3.1 Account and sign-in

• Email sign-up: name, email address, password (stored only as a bcrypt hash) and preferred language.
• Google sign-in: your Google account ID, email address and display name, received from Google after you authorise it. Google also sends a link to your profile picture; we do not fetch or store it, and your avatar in the App is only ever a picture you upload. We never receive your Google password.
• Sign in with Apple: your Apple user identifier, the email address Apple shares with us (which may be a private relay address that forwards to your real one) and, if you choose to share it the first time, your name. We never receive your Apple password.
• Email verification: the time your address was verified.
• Session data: access and refresh tokens, and an app-generated install identifier that lets you sign out of one device without affecting others.

3.2 Profile and home location

Optional profile fields you may fill in: nickname, avatar picture, address, city, postal code, country, and a “City / Area” point you choose on a map. The point is stored as coordinates and is the centre for nearby alerts (section 5). It is a location you pick, not your live position.

Your City / Area is private. It is shown to other signed-in members, as the area name only, never the point or address, on your profile if you turn on Show on my profile.

3.3 Posts, comments and reactions

• Posts: title, text, up to five photos, post type (general, lost, found or adoption), an area label, a full address and, for lost, found and adoption posts, the coordinates of the place you pin and the privacy radius you choose. Published posts, together with the profile name and avatar of their author, are visible to all signed-in users. Published posts can also be seen in the App without an account (section 3.11).
• Comments and replies: text, the time posted and, for abuse prevention, the IP address and user-agent string of the request.
• Likes and bookmarks: which posts you liked or bookmarked. Who liked a post is shown only to the post’s author and to administrators.
• Resolution: whether and when you marked a post as reunited or adopted.
• Check-ins: a week and three weeks after you publish a lost, found or adoption post, and a week before it would leave the post lists, we send you a notification asking whether the pet is home. We record when each was sent and when you answered “Still looking”.
• Time in the post lists: about 60 days after you publish a lost, found or adoption post, or after you last answered “Still looking”, we tell you it will leave the post lists and the map in a week. If you do not answer “Still looking” within that week, it leaves them. A post you marked reunited or adopted leaves them 60 days after it was published. It is not deleted: you still see it among your posts, and a link to it still opens it.

3.4 Private messages

• Messages, photos and emoji reactions you send in a conversation travel to our servers over an encrypted connection and are stored encrypted. Each conversation is encrypted with its own key, and those keys are protected by a master key kept on our servers separately from the database, so a copy of the database on its own cannot reveal any message. Safe Paws does not read your messages.
• Your devices: because the keys are held on our servers rather than on your phone, your conversations are available on every device you sign in to, and after reinstalling the App or changing phones.
• Conversation metadata: who is talking to whom, when each message was sent, its delivery and read status, whether it carries a reaction and from whom, and connection requests, acceptances and blocks.
• Deleting a message: when you delete a message you sent, its text and photo are removed from our servers for both participants. A record that a message existed (who sent it, when, and that it was deleted) remains, and both of you see a “message deleted” placeholder in its place. The other participant may already have read, copied or saved it before you deleted it.
• Push notifications for new messages carry only the sender’s display name and the identifiers of the conversation and message through Google’s Firebase Cloud Messaging. The message text is not included; the App fetches it from our servers when you open the notification. A notification that someone reacted to your message carries their display name and the same identifiers, never the reaction itself. When a reaction is removed or a message is deleted, a silent notification carrying only the conversation and message identifiers tells the other device to refresh it.

3.5 Push notifications and device information

When you sign in we register your device for notifications, storing your Firebase Cloud Messaging registration token together with: device brand, manufacturer, model, device name, operating system and version, app bundle identifier, app version, the install identifier, and the IP address of the request. This is used to deliver notifications to the right device and to retire tokens for devices you no longer use. Registering does not depend on the notification permission: whether notifications are shown on your phone is up to the permission you give there.

3.6 Usage analytics and crash diagnostics

The App sends us first-party telemetry so that we can understand how it is used and fix crashes. No third-party analytics or crash-reporting service is involved.

• Usage analytics: app opens and closes, which screens you view and for how long, which posts you open, and the type of list shown.
• Crash diagnostics: error messages, technical stack traces, whether the error was fatal, and a short context describing what the App was doing (for example a post or conversation identifier). Message contents are never included.
• Every event carries a random install identifier, a session identifier, platform, app version, operating system version and device model. Events sent while you are signed in are also linked to your account.
• Usage analytics and crash diagnostics are on by default. We rely on our legitimate interest in understanding how the App is used, so that we can improve it and keep it stable. You can turn either off at any time in Settings → Preferences → Usage analytics and Settings → Preferences → Crash reports; from that moment no further events are sent from that device. Your choice is kept on the device and, once you sign in, with your account.

3.7 Location

Section 6 lists exactly when your device location is read and when it is sent to us.

3.8 Support requests and child-safety reports

• Support form / Contact Us: your name, email address, category, subject, message and up to five optional photos or screenshots.
• Child-safety report: name, email address, phone number if you give it, the type and urgency of the report, your description, a description of any evidence and location information.

3.9 Website

When you use safepaws.gr (including the support and password-reset pages) our server keeps standard web-server logs and, for signed-in administrators, a session record with IP address and browser user-agent.

3.10 Geocoding

When you type an address or move a map pin, the address or coordinates are sent to Google’s Geocoding service through our server to find the matching place. Results are cached on our server for up to 30 days. Your account is not sent to Google in this request.

3.11 Browsing without an account

The App can be used to read published posts and the places directory without creating an account. Someone browsing this way sees a post’s text, photos, area label, dates and like and comment counts, the profile name of its author, the name and logo of the place it was made for, if any, and its location rounded to about 1 km. They do not see the comments, the full address, the exact point pinned, the author’s avatar or profile. Messaging, alerts, posting, commenting, liking and saving posts need an account.

No account or profile is created for someone browsing. Their requests carry a device-integrity attestation (Firebase App Check, section 7) instead of an account, and their IP address is used to limit how many requests one address can make; the counters are kept for at most a day. Usage analytics are sent as described in section 3.6, linked to the install rather than to an account.

Posters you make in the App are made on your phone from your own post; we receive nothing about them. Their code links to https://safepaws.gr/p/…, which opens the post in the App or, without the App, shows the store links. That page reads nothing about the post and sets no cookie; standard web-server logs apply (section 3.9).

When you mark a pet home, the App may ask the App Store or Google Play to show its rating prompt, once. We learn nothing about whether or how you rate.

3.12 Places you run or work at

Vets, pet shops, pet salons, trainers and animal rescues in the places directory can be claimed by the people who run them, who can then bring in the people who work there and post on the place’s behalf.

• Claiming a place: we record which place you claimed, your account, the way you chose to prove it is yours and any note you add. If you choose a phone call, an administrator rings the number already listed for the place and asks for you by name. If you choose email, we store the address you give, which must be at the place’s own website, and send a one-time code to it; we keep the code only in scrambled form and count wrong attempts. If you choose a document, we store the photo you upload on a private disk where only administrators can see it. An administrator decides every claim and we record who decided it and when. If the place already has owners, they are told that someone has claimed it, but not who.
• Being part of a place: we record which places you belong to, your level in each (owner, manager or member), who brought you in and when. You join a place only through an invite link that its owner or manager sends you; we keep only a scrambled form of the link. When you join, the place’s owners and managers are told your name.
• Who sees that you belong to a place: your link to a place is not listed on the place’s page or on your profile. It shows only on posts you make for the place, where your profile name and avatar appear next to the place’s name and logo. If someone messages a place from its page, the message goes to one of its owners, who then appears in that conversation by their profile name. Those posts are listed on the place’s page, not on your profile. The place’s owners and managers see its whole team: names, avatars, levels and since when.
• Posts made for a place belong to the place: its owners and managers can edit, mark resolved, take down or delete them, including the ones you wrote. If someone other than you last edited a post you wrote for a place, the place’s own team, but no one else, sees their name as “Edited by”.
• Leaving a place: if you leave or are removed, the posts you made for it stay with the place and stop showing your name. Your private messages stay yours; new messages about those posts go to one of the place’s owners.
• The place’s details: changes an owner or manager makes to the place’s details or logo are reviewed by an administrator before they appear. An animal rescue can choose to show its address exactly, only as an area of about 1 km, or not on the map at all; this applies at once.
• Record of changes: every change to a place’s team (who joined, left or was removed, level changes and who made them) and to its address setting is recorded, and administrators can see it.

4. Why we use your data and on what legal basis

We do not use your data for advertising, we do not sell it, and we do not make automated decisions with legal effects about you. An automatic check may hold a post for an administrator or hide a comment. Neither has legal effects, and you can ask us to look again at support@safepaws.gr.

5. Nearby alerts

When a lost, found or adoption post is published for the first time, we notify users whose chosen City / Area point is within the alert range they picked of the post’s location, provided they have that alert type switched on in Settings → Notifications. The alert range is 5, 10, 15, 20, 25 or 30 kilometres, or All, which alerts you about every such post wherever it is. It is 5 kilometres until you change it, which you do in Settings → Notifications. It is not the radius shown on the post. If you have not set a City / Area point you receive no nearby alerts.

6. When we read your location

The App asks for “while using the app” location permission only. There is no background location and no location history.

Your device location is read when:

• you open the map, to centre it on you;
• you choose “Nearest to me” sorting in a feed;
• you pick a place for a post, or your profile’s City / Area, on a map;
• an administrator uses the field-capture tool.

Your device location is sent to our server when:

• you sort a feed by distance (to rank posts);
• you pan the nearby-posts map (the visible map area is sent, not your position);
• you attach a place to a post or set your City / Area (the point you picked is stored);
• you geocode or reverse-geocode a place (section 3.10).

You can revoke the permission at any time in your device settings. The map and distance sorting then work without your position.

7. Who receives your data

We use a small number of service providers (processors) who act on our instructions:

Google and Apple participate in the EU-U.S. Data Privacy Framework and offer the European Commission’s Standard Contractual Clauses for transfers outside the European Economic Area. OpenAI processes the data it receives under its Data Processing Addendum, which includes the European Commission’s Standard Contractual Clauses, and does not use it to train its models.

We also disclose data:

• to other users, as part of the service: your profile name and avatar next to your posts, comments and messages, your City / Area on your profile if you choose to show it, and your posts’ content and location; next to a place’s name on the posts you make for it; and, to that place’s owners and managers, your level in its team (section 3.12);
• to authorities, when the law requires it, or when a child-safety report or a credible threat to someone’s safety justifies it;
• to a successor, if the App is transferred to a new operator, with notice to you.

We do not sell personal data and we do not allow our providers to use it for their own purposes.

8. How long we keep it

Data that we must keep to comply with the law, to resolve disputes or to enforce our terms may be kept longer, and only for that purpose.

9. Security

• All traffic between the App and our servers uses TLS.
• The App proves to our servers that it is the genuine App before loading the places directory or showing posts without an account, and only connects to our servers through their own certificate authorities (certificate pinning).
• Passwords are stored only as bcrypt hashes. Sign-in, password reset, the public forms and browsing without an account are rate-limited.
• Private messages and photos are encrypted at rest on our servers with AES-256-GCM, with a separate key for each conversation. Those keys are themselves encrypted with a master key held in the server’s configuration, outside the database and never sent to the App.
• The App holds no message keys, so nothing about your conversations is lost with a phone. This encryption protects your messages against a stolen database or a compromised storage system; it does not put them beyond the reach of our own servers, and our commitment not to read them is a promise we make in this policy. The administration tools show no message content.
• Photos you upload are stored on a private disk and served only to signed-in users who are allowed to see the post, conversation or profile they belong to, and, for published posts, to the App used without an account.
• Administrators can see published and pending posts, comments, profiles, reports, claims to places with their proof, and each place’s team. The administration tools show no message content.

No system is perfectly secure. If we learn of a breach affecting your data we will inform you and the Hellenic Data Protection Authority as the GDPR requires.

10. Your rights

Under the GDPR you may:

• access the personal data we hold about you and receive a copy;
• rectify inaccurate data (most profile fields can be edited in the App);
• erase your data (the “right to be forgotten”);
• restrict or object to processing based on legitimate interests, including analytics;
• receive the data you gave us in a portable format;
• withdraw consent at any time, without affecting processing that happened before;
• complain to a supervisory authority.

To exercise a right, email support@safepaws.gr from the address on your account, or use the support form and choose “Personal Data Request”. We may ask you to confirm that you control the account. We answer within one month. If a request is complex we may extend this by up to two further months and will tell you why.

11. Deleting your account

You can request deletion from Settings → Account → Delete account in the App, from the support form at https://safepaws.gr/support (category “Account Deletion Request”), or by email. The request reaches our administrators, who confirm it with you and delete the account within 30 days. Until then the account stays usable, and asking again does not restart the 30 days.

Deletion removes your account, profile, avatar, posts and their photos, comments, likes, bookmarks, your side of every conversation (the messages you sent and your place in it), push tokens and preferences, and your links to places. Posts you made for a place belong to the place and stay on it, without your name (section 3.12). Analytics and diagnostics events are detached from your account and kept only as device-level records until their retention period ends. Support requests and child-safety reports are kept for the periods in section 8, because we may need them to handle complaints or legal obligations, and are no longer linked to an account.

12. Children

Safe Paws is not directed at children. You must be at least 16 years old to create an account. We do not knowingly collect personal data from anyone under 16. If you believe we have, contact us and we will delete it. Our child-safety standards and reporting form are at https://safepaws.gr/child-safety-standards.

13. Users outside the European Economic Area

Safe Paws is designed for use in Greece. If you use it from elsewhere and your local law grants you additional rights, we will honour them on request.

14. Changes to this policy

We will post any change on this page and update the dates at the top. For material changes we will also notify you in the App or by email before they take effect. Continued use after that date means the new policy applies.

15. Contact and complaints

Data controller: the Operator of Safe Paws, an individual developer based in Greece, named as the seller on the App Store and Google Play listings Email: support@safepaws.gr Support form: https://safepaws.gr/support Child safety: child-safety@safepaws.gr

If you are not satisfied with our answer you can lodge a complaint with the Hellenic Data Protection Authority (Αρχή Προστασίας Δεδομένων Προσωπικού Χαρακτήρα), Kifissias 1-3, 115 23 Athens, Greece, +30 210 6475600, contact@dpa.gr, https://www.dpa.gr, or with the supervisory authority of the EU country where you live.