Privacy Policy

1. Who is responsible

Norbo is built and operated as a personal project by an individual indie developer. There is no company behind it — just one person who cares about pets and wants to build a useful tool.

For the purposes of the EU General Data Protection Regulation (GDPR) and the Italian Privacy Code, the Data Controller is:

• Name: Marius Trica
• Status: Individual indie developer (no business entity)
• Country: Italy
• Contact email: trica.assistance.apps@gmail.com

A postal address is available on request for legitimate privacy-related inquiries.

2. Data I collect

I only collect the personal data strictly necessary to provide the service. Here's the full list, grouped by category.

Account data

• Email address and password (stored exclusively as an Argon2 hash, never in plain text);
• Name or nickname (optional), profile photo (optional);
• Preferred language, light/dark theme preference, notification preferences;
• If you sign in with Google or Apple: the unique identifier provided by the provider and the associated email address.

Pet data

• Name, photo, date of birth (which can be approximate), sex, weight, breed or species, optional notes;
• Health and life events recorded on the timeline: vaccinations, vet visits, antiparasitics, weight entries, water parameters for aquatic animals, photos, and free-text notes;
• Attachments to those events: certificates, photos, receipts;
• Reminders and their due dates.

Tool data

Some of the tools and calculators available in the Services section (water intake, caloric calculator, ideal weight estimator, etc.) may save the last calculated result to give you continuity between sessions. In that case, only the inputs you provided (e.g. animal weight, activity level) and the corresponding result are stored, linked to your account and the relevant animal. This data is not shared with third parties or used for any purpose other than the Tool's functionality.

Financial data

• Amounts and categories of the expenses you choose to record in the app;
• Photos of receipts (which may contain tax-related information about the merchant).

Technical data and identifiers

• Push notification tokens (Firebase Cloud Messaging) and the Firebase Installation ID, an identifier generated by Google that is required to deliver notifications;
• An installation identifier: a random code the app generates on your device to tell one installation from another. It is not a hardware identifier — not the Android ID, the IMEI, or the MAC address — and it is regenerated from scratch on every reinstall;
• Operating system and app version;
• IP address and User-Agent, stored alongside your sign-in session for security and abuse prevention;
• Technical access and error logs (IP address, timestamps, request type).

I do not use any advertising identifier: the app does not request Google's Advertising ID and contains no advertising, tracking, or third-party analytics SDKs.

Location

If you open the dog-friendly places map and tap "near me", the app asks permission to access your location in order to centre the map. Your precise location stays on the device: only the map area you are looking at — a rounded bounding box — reaches the server, where it is used to select the places to show you and then discarded. It is never stored, never linked to your account, and there is no background tracking. If you don't use that feature, the permission is never requested.

What I don't collect

I do not collect biometric data, your address book contacts, browsing behaviour outside the app, your social graph, or any payment data (the app has no in-app purchases). I do not track your movements over time and I keep no location history.

3. Purposes and legal bases

Your personal data is processed on the following legal bases under Article 6 of the GDPR.

Performance of a contract — Art. 6(1)(b) GDPR

• Providing the core features of the app: pet records, health timeline, reminders, photos, expenses, tools and calculators;
• Managing your account, authentication, and password recovery;
• Service communications that are strictly necessary (e.g. email confirmation, security alerts).

Legitimate interest — Art. 6(1)(f) GDPR

• Technical security: preventing abuse, fraud, and intrusion attempts;
• Application logging and error diagnostics to keep the service stable.

Explicit consent — Art. 6(1)(a) GDPR

• Sending push notifications (opt-in at the operating system level and within the app settings);
• Any future marketing or promotional communications, always subject to separate opt-in.

Legal obligation — Art. 6(1)(c) GDPR

• Retaining security logs for the time required by applicable law;
• Responding to legitimate requests from judicial or supervisory authorities.

4. Data retention

I keep your personal data only as long as needed for the purposes it was collected for.

• Account and pet data: for the entire lifetime of your account.
• Tool results: for the entire lifetime of your account; automatically deleted when the relevant animal or account is deleted.
• After account deletion: permanent deletion (hard delete) within 30 days.
• Database backups: retained for 30 days on a rolling basis, then deleted.
• Application logs: retained for 90 days, then deleted.
• Security logs: retained for the time required by applicable law.

Some legal obligations (for example tax-related, where applicable) may require longer retention of specific records. In that case, data is kept solely for the purpose required by law.

5. Security

I take reasonable technical and organisational measures to protect your personal data from unauthorised access, disclosure, alteration, or destruction. In particular:

• All communication between the app and the server runs over HTTPS with up-to-date TLS;
• Passwords are stored exclusively as Argon2 hashes, never in plain text;
• Sessions use secure cookies (HttpOnly, SameSite Strict) and refresh tokens with rotation;
• Rate limiting is enforced on sensitive endpoints (login, signup, password reset);
• Database backups are encrypted at rest;
• Infrastructure credentials are kept in a dedicated secrets vault, never in the source code;
• Dependencies are scanned automatically to catch known vulnerabilities.

No system is 100% secure. In the event of a breach that involves risks to your rights, I will notify you within the timeframes set by Article 34 GDPR.

6. Third-party processors

To run the service, I rely on a small number of trusted external providers. They act as Data Processors under Article 28 GDPR. The main ones are:

• Cloud infrastructure provider for hosting servers and databases (e.g. Hetzner, Supabase, Neon, Fly.io, or equivalent) — with EU data residency whenever available;
• Object storage provider for storing photos and attachments (e.g. Cloudflare R2 or Backblaze B2);
• Google Firebase Cloud Messaging for sending push notifications (it receives the device token and the notification content);
• Apple Push Notification Service for push notifications to iOS devices;
• Brevo for sending transactional emails (address verification, sign-in codes, password resets, invitations): it receives your email address and the message content;
• Google Maps to render the dog-friendly places map, and Google Geocoding to turn an address you type in the search box into coordinates (it only receives the text you typed).

I use no third-party product analytics or crash reporting services.

I do not sell, rent, or otherwise transfer your personal data to third parties for commercial purposes. Ever, under any circumstances.

7. International transfers

Some of the providers I use (such as Google, Apple, Cloudflare) are headquartered or operate in non-EU countries, primarily the United States. In those cases, data transfers happen on the basis of appropriate safeguards under the GDPR, including:

• European Commission adequacy decisions where applicable (e.g. the EU–US Data Privacy Framework);
• Standard Contractual Clauses (SCCs);
• Supplementary technical and organisational measures where required.

You can request detailed information about transfers by writing to the contact address at the bottom of this page.

8. Your rights

As the data subject, you can exercise the following rights under Articles 15–22 GDPR at any time:

• Access: get confirmation that I'm processing your data and obtain a copy of it. All of your data is already visible inside the app;
• Rectification: update or correct your data. Everything is editable directly from the app;
• Erasure (right to be forgotten): request deletion of your data. You can do this yourself from "Delete account" — I will permanently delete it within 30 days;
• Restriction of processing in the cases listed in Article 18 GDPR;
• Data portability: receive your data in a structured, machine-readable format. Write to the address at the bottom of this page and I will send you a complete archive within 30 days;
• Object to processing based on legitimate interest, in particular for diagnostic logging;
• Withdraw consent at any time for processing based on consent (e.g. push notifications), without affecting the lawfulness of processing carried out beforehand.

You also have the right to lodge a complaint with a supervisory authority — for Italy, that's the Garante per la Protezione dei Dati Personali (garanteprivacy.it) — if you believe the processing of your data infringes applicable law.

To exercise your rights, write to trica.assistance.apps@gmail.com. I will reply within 30 days of receiving your request.

9. Push notifications

Norbo uses push notifications to deliver reminders for the events and due dates you set up (vaccinations, vet visits, maintenance tasks, pet birthdays, etc.). Notifications are sent only with your explicit consent, which you give:

• Initially, through the operating system's permission prompt on your device;
• Granularly, through the notification settings inside the app, where you can choose which categories of reminder to receive (health, admin, maintenance, milestones).

You can disable notifications at any time from your device settings or from the app preferences. Disabling them does not affect any other functionality.

10. Cookies and similar technologies

The Norbo mobile app does not use cookies in the traditional sense. For service functionality, it relies on equivalent technologies:

• Session tokens stored locally on your device to keep you signed in between sessions;
• Local cache to improve speed and offline experience;
• Technical identifiers for push notifications: the FCM token, the Firebase Installation ID generated by Google, and the installation identifier created by the app. None of these is a hardware or advertising identifier, and all of them are regenerated if you uninstall and reinstall the app.

These elements are strictly necessary to operate the app and are not used to profile you or for marketing purposes.

11. Minors

Norbo is not intended for users under 16 years of age. I do not knowingly collect personal data from minors without the consent of the holder of parental responsibility, as required by Article 8 GDPR and the Italian Privacy Code.

If you are a parent or guardian and believe a minor has provided personal data through the app without your authorisation, please contact me: I will promptly remove the data.

12. Changes to this policy

I may update this policy when the app changes substantially, when I add or change providers, or when applicable law evolves. The current version is always published at this address, with the date of the last update clearly shown.

For material changes, I will notify you in advance through an in-app notification or by email to the address linked to your account, giving reasonable notice before the changes take effect.

13. Contact

For any question about this policy or about how your data is handled, write to:

• Privacy: trica.assistance.apps@gmail.com
• General support: trica.assistance.apps@gmail.com

I'll do my best to reply quickly, and in any case within the timeframes set by applicable law.