Privacy policy

PawPlan keeps your data on your own devices. This page explains what the app stores, what can leave your device and when, and who is responsible for what.

Last updated: 14 November 2026

1. In short

• There is no account and no registration.
• We run no server for the app and receive none of your data.
• The app has no analytics, crash reporter or tracking of its own.
• All app data is stored on your device. It is excluded from Android cloud backup and device transfer.
• Nothing is sent anywhere unless you switch on a feature such as sync with other devices, remote storage, backup or sharing, or unless advertising applies (section 6).
• The app is free and shows ads, with a few exceptions. Ads are served by Google AdMob, and Google is responsible for the data it collects for them.

2. Who is responsible

This policy applies to the PawPlan app. The responsible party under the General Data Protection Regulation (GDPR) is:

einfachdima – Dmitrij Kiltau
c/o Online-Impressum.de #5437
Europaring 90
53757 Sankt Augustin
Germany
info@kiltau.com

Because we do not receive the data you enter in the app, we do not process it. You and the people in your household control it. For ads, Google acts as a separate controller (section 6). For remote storage, the operator of the server you choose is responsible (section 5).

3. What the app stores on your device

You decide what you enter. Depending on how you use the app, this can include:

• Pets: name, species, breed and colour, birth date, sex, neutered status, microchip number, notes, photos, nicknames and their stories, target weight and calories.
• Care: log entries (who, when, which device, notes, amounts, ratings, photos), schedules and task assignments, to-dos and the diary.
• Health: weight, vaccinations, treatments, vet visits and costs, symptoms, attachments such as photos and PDFs of vet documents, and symptom alert rules.
• Insurance and registries: insurance contracts (insurer, policy number, premium, deductible, documents), claims, and pet-registry entries with customer numbers.
• Inventory: items, stock events, prices and barcodes you teach the app. Barcodes are never looked up online.
• Household: household name, vet name, phone and address, currency, and the list of paired devices (device name, certificate fingerprint, last seen).
• Owner details on this device only: your name and phone number for the lost-pet flyer, and settings such as country, quiet hours and layout. These are not synced.
• Network data for sync: IP addresses and ports of paired devices, a short sync log (50 lines) and the sync status.
• Secrets: the address, user name and app password of your remote storage, key material, and the backup password. They are kept in files encrypted with an Android Keystore key.
• Ad state, this device only: when the app was first used, until when you are ad-free, and the last-seen clock time. This is not synced and not part of backups.

The health data concerns your pets, not people. Details such as the vet’s contact data or your phone number can still be personal data. Please only enter information about other people if you are allowed to.

The app does not read your location, contacts, microphone, SMS or phone identifiers, and it does not use the Android ID. The device name defaults to the device model, and you can change it.

4. Permissions

• Notifications, exact alarms, start after reboot: for reminders. Depending on your system settings, reminders can show pet names and tasks on the lock screen.
• Camera: for QR codes, barcodes and photos. The app also works without a camera.
• Network access: for syncing over your local network and for the optional remote storage and, where they apply, ads.
• Foreground services: an optional “stay reachable” service for sync, shown with a permanent notification, and short background sync work.
• Bluetooth and nearby Wi-Fi devices: only for the optional Nearby sync. On Android 12L and older, the system also requires location permission for this. The app does not read or store your location.
• Advertising ID: used by Google for ads (section 6).

Home-screen widgets show tasks and a pet. Kitchen display mode keeps the screen on and shows today’s tasks in large type.

5. When data leaves your device

Sync between your household devices

Once paired, devices on the same Wi-Fi sync the household log, photos and attachments directly with each other. Pairing uses a QR code with a one-time token that is valid for 5 minutes. The connection uses mutual TLS with pinned certificate fingerprints. To find each other, the app announces itself on the local network with the service name _pfotenplan._tcp, a port, a hash of the household ID, the protocol version and the first 8 characters of the device ID. Anyone on the same network can see this announcement, but it contains no names or content.

Nearby sync (optional, off by default)

Uses Bluetooth or Wi-Fi Direct through Google Play services Nearby Connections, between your own devices. The stream is protected by TLS. See section 7 for what Google may collect.

Remote storage (optional, off by default)

You can sync through a WebDAV server of your choice. The app uploads encrypted, signed files (AES-256-GCM) over HTTPS only, can pin the server certificate, and refuses redirects. The operator of the server can see the encrypted files, their sizes, timing, opaque file names and your IP address, but not the content. If you remove the storage in the app, the settings are deleted on all devices, but the files stay on the server. Please delete them there.

Pet-sitter access (optional, per invitation)

You choose which pets and tasks a guest sees. If you use the remote storage for this, the guest’s phone receives the storage password and a separate key. The guest cannot read or forge content outside their share, but could delete or corrupt files on the storage. When the stay ends, the app wipes the guest’s local data and deletes the guest’s files on the storage.

Backups

Automatic backup is off by default. When you turn it on, or create a backup by hand, the app writes a .pawplan file to a folder you pick or to the backup/ folder on your remote storage. The file is encrypted with AES-256-GCM using your password (PBKDF2, 600,000 iterations). Keep that password safe: we cannot recover it. Automatic backup keeps the newest 4 files and touches only files it created.

Exports and sharing

When you export a PDF, CSV, ZIP or backup and share it, it goes to the app you pick in the Android share sheet. From then on, that app’s privacy policy applies.

Links and clipboard

Some links open in your browser when you tap them: a Google search for a plant or food name, Wikipedia and Wikimedia pages, and the pet registries Findefix, TASSO, the Austrian register and ANIS. No pet data is put in these addresses, apart from the plant or food name in the Google search. When you open a registry page, the app copies the chip number to the clipboard so you can paste it. Other apps may be able to read the clipboard. Phone numbers open in the dialer, and you confirm the call. Wikipedia pictures are bundled with the app and are not downloaded.

6. Advertising

The app is financed by ads from Google AdMob. They appear as native ads in some lists and as a banner at the bottom of certain screens. They never appear on health screens, safety detail pages, pairing, or the remote-storage credentials screen. There are no app-open ads and no interstitials that appear without your action. Rewarded ads only run when you tap to watch one. In return you get ad-free time (30 minutes, or 1, 3 or 5 days). This time is stored only on your device.

What we do and don’t do

• No pet, health or household data goes into an ad request: no keywords, content URL or extras. The app sets no personalised data.
• The first time ads would be needed, Google’s consent form (User Messaging Platform) is shown. The advertising SDK starts only after that, and only when an ad is about to show or when you open the “Remove ads” sheet.
• During your first 3 days with the app, and while you are ad-free, the SDK is not started and the app does not contact Google for ads. The 3 days are skipped after you restore a backup, and for existing users who set up a new device.
• Ad requests are limited to content rated PG at most. The app is not directed at children, and ads are not configured as child-directed.
• Where the consent framework requires it, the “Privacy choices for ads” row in the ad-free sheet lets you review or change your choice.

What Google collects

The app declares the advertising ID permission. When ads are shown, Google collects the advertising ID, the IP address (which gives approximate location), app interactions and diagnostics. This data is not linked to an account in the app. Google decides on its own how this data is used and is the controller for it. See Google’s privacy policy. You can reset or delete your advertising ID in your Android system settings (usually under Google → Ads).

Legal basis: your consent (Art. 6(1)(a) GDPR and the corresponding rules on access to your device). You can withdraw consent at any time through the privacy choices row, or avoid ads by watching rewarded ads for ad-free time.

7. Other Google components

• Nearby Connections (Google Play services, optional sync): according to Google, this SDK collects usage analytics, which you can switch off under Settings → Google → Usage & diagnostics. See the Nearby Connections overview.
• ML Kit Document Scanner (for scanning documents): the scan runs on your device. Google Play services downloads the scanner module on first use. Google states that ML Kit uses device details for diagnostics and usage analytics. See the ML Kit data disclosure.
• Other libraries used (AndroidX, Hilt, ZXing, Vico) run only on your device.

8. Storage, deletion and retention

• Uninstalling the app deletes all local data. Data on your other household devices, on your remote storage and in backups or exported files stays.
• Deleting an entry in the app hides it and marks it as deleted, so you can undo it. It is not erased. Its content stays in the app’s database and in the change history, on your device and on every device in your household, and backups include it. Photo and attachment files are removed after a grace period once nothing refers to them any more, but the text content stays.
• Removing all your data: uninstall the app or clear its data on every device in your household. Then delete your backups, exported files and the files on your remote storage yourself. The app has no function to permanently erase a single entry.
• Removing a device from the household stops other devices syncing with it, and the household key is rotated. Data the removed device already holds stays on it.
• Remote storage cleanup: the app deletes sync files that all active devices have applied, and files of removed devices. It deletes unreferenced photos after 7 days. Each device keeps its own copy of the history, and everything else on the storage is yours to manage.
• Backups: you decide where they are kept and for how long.

9. Your rights

All your data is on your device, so you already have access to it. You can export it as CSV or PDF, or as an encrypted backup, and you can change or delete entries in the app. Section 8 explains what deleting an entry does and how to remove all your data.

Under the GDPR you also have the rights to access, rectification, erasure, restriction of processing, data portability and objection, and the right to withdraw consent. Because we hold no app data, we cannot access or erase it for you. You exercise these rights yourself in the app and on your devices, as described above. For ad data, contact Google. For files on a remote storage server, contact its operator. You can also complain to a data protection authority, for example in the EU country where you live or work.

10. Children

The app is not directed at children, and ads are configured as not child-directed.

11. This website

This policy covers the app. The legal notice and the privacy policy of the website are at kiltau.com/legal-notice and kiltau.com/privacy-policy.

12. Changes

We update this policy when the app, its features or the set of third-party components changes. The date at the top shows the latest version.

13. Contact

Questions about this policy: info@kiltau.com