Privacy Policy

Last updated: August 2026

This text applies equally to VetAura, VetCoral, VetExot and VetBreed.

1. Controller

Sebastian Tredt
Blanke Straße 28, 31028 Gronau (Leine), Germany
Email: VetAura@Vetkosmos.app (VetAura), VetCoral@Vetkosmos.app (VetCoral), VetExot@Vetkosmos.app (VetExot), VetBreed@Vetkosmos.app (VetBreed). The contact address for whichever app you use is also shown in that app's own legal notice.

This privacy policy applies uniformly to all four apps in our app family for pet care and breeding — VetAura, VetCoral, VetExot and VetBreed — all of which are operated by Sebastian Tredt (see above) as controller. All four apps process personal data under the same principles described in this policy; features specific to individual apps (e.g. breeding/pedigree data in VetBreed, habitat/environmental data in VetCoral/VetExot) are separately identified in Section 2. For data exchange between the apps, see Section 5.

2. Overview of processed data

• Account data: email address, display name, a unique user identifier (upon registration or login, including via Google Sign-In).
• Pet and health data: information you enter about your pet (name, species, breed, date of birth, weight, vaccinations, medications, health values, observations, appointments, costs).
• Breeding and pedigree data (VetBreed only): pedigree, parent animals, litter/offspring data, breeding planning.
• Habitat and environmental data (VetCoral/VetExot only): water parameters, terrarium climate data and comparable environmental readings.
• Documents and photos: findings, invoices and images you upload.
• Family sharing data: if you invite people to your family sharing group or accept an invitation, we process the invited person's email address, an invitation code or link and — once accepted — the joining person's user identifier and their access role (editor or read-only) for the inviting account's pet data.
• Referral data (invite friends): if you use our referral programme, we process your referral code, your user identifier and your email address; if redeemed by someone else, also that person's user identifier, in order to attribute the referral bonus.
• Community reports: if you report a hazard area (Hazard Radar) or a foraging area, we process the information you provide (see Section 6 for details on location accuracy and visibility to other users).
• Usage and device data: technical information for stability and security (e.g. crash reports, device/app version, anonymous usage statistics).
• Biometric screen lock: if you enable the optional fingerprint or face-recognition screen lock, this is handled entirely locally by your operating system's security features; we never receive, store or transmit this biometric data.
• Subscription data: status of your Premium subscription (but not payment data — this is processed by the app store).
• Buyer and contract data (VetBreed only): if you keep a waiting list of interested parties or draw up a sales contract, we process the buyer's contact details you enter (name, email address, telephone number), the contract details (animal, price, terms) and — where used in the contract — the signatures of both parties captured on the device. This data comes from third parties: obtain that person's consent before entering it. It is stored solely in your account, is not passed on to other users and is deleted with your account.
• App integrity check (VetAura and VetExot only): On start-up we check whether the installed app is unmodified. If a deviation is detected (e.g. an altered app signature, an installation from outside the Play Store or an attached debugger), we log the type of deviation together with the device model, the Android and app version and your user ID. No such entry is created for an unmodified app. The legal basis is our legitimate interest in detecting manipulated copies of the app (Art. 6(1)(f) GDPR).

3. Purposes and legal bases

Provision of account and app functions (storing and displaying your pet data): contract performance, Art. 6(1)(b) GDPR
Reminders / push notifications for appointments and medications: contract performance or consent, Art. 6(1)(b) / (a) GDPR
AI-powered features (receipt/vaccination record scan, health insights): consent, Art. 6(1)(a) GDPR
Family sharing (invitation, shared access to pet data): contract performance or consent, Art. 6(1)(b) / (a) GDPR
Referral programme (attributing referral bonuses): contract performance, Art. 6(1)(b) GDPR
Community reports (Hazard Radar, Foraging Map): consent, Art. 6(1)(a) GDPR
Stability, security and abuse prevention (crash reports, App Check): legitimate interest, Art. 6(1)(f) GDPR
Reach/usage analysis: consent, Art. 6(1)(a) GDPR
Processing of the Premium subscription: contract performance, Art. 6(1)(b) GDPR

4. Services and recipients

4.1 Firebase / Google Cloud (Google Ireland Ltd.)
We use Firebase/Google services to provide the app: Authentication (login), Cloud Firestore and Cloud Storage (storage of your pet data and files), Cloud Functions (server-side functions), App Check / Play Integrity (abuse prevention), Crashlytics (crash reports), Analytics and Cloud Messaging (push notifications). Pet and account data is stored in data centres within the European Union (region europe-west3, Frankfurt). Where this may involve transfers to third countries, these are safeguarded by EU Standard Contractual Clauses. Privacy policy: policies.google.com/privacy.

4.2 AI features (Google Gemini / Firebase AI)
When you use AI features (e.g. scanning a receipt or vaccination record, or retrieving health insights), the content required for this (e.g. the photo or the relevant health values) is transmitted to Google's AI service for processing in order to recognise text or generate hints. In VetAura, VetCoral and VetExot this applies to the following, in so far as the app in question offers the feature at all: receipt/vaccination-record scan, lab-report scan, invoice scan, the vet questions generated from them, AI symptom check, plant scanner, health insights and vet-visit preparation. Please note that lab reports and vet invoices usually carry your name, your address and the practice in their header; when scanned, those details are part of the transmitted image. These features are optional and require your explicit consent. Without consent, nothing is transmitted to the AI service. You may withdraw your consent at any time with future effect: Settings → Privacy & Security → AI tools.

In VetBreed this applies solely to the AI breeding recommendation: on your request, the species, sex and age of the two parent animals and the suitability result already calculated in the app are transmitted to the AI service, which turns them into a written assessment. Health records, photos, buyer or contract data are not transmitted. The genetic calculations themselves run entirely on your device.

4.3 Subscription management (RevenueCat)
We use RevenueCat, Inc. to manage the Premium subscription. A pseudonymous user identifier and the subscription status are processed. We do not process payment data — purchase and billing are handled exclusively via the Google Play Store (see 4.4).

4.4 Purchase & billing (Google Play)
The Premium subscription is purchased via the Google Play Store. Google is responsible for payment processing. We do not receive any credit card or bank account data.

4.5 Hosting of this website
This website is provided via Firebase Hosting (Google). When accessed, technically necessary server log data (e.g. truncated IP address, timestamp, page accessed) is processed for delivery and security purposes (Art. 6(1)(f) GDPR).

4.6 Cross-app account registry (referral programme)
So that a referral code can be recognised and redeemed across apps — including when switching between VetAura, VetCoral, VetExot and VetBreed — we maintain a cross-app registry of which apps in our app family an account uses, along with the associated referral status. This registry is also run on Google Cloud/Firestore, but kept separate from the app-specific pet data databases, and contains only account and referral data (user identifier, email address, referral code), never pet or health data.

5. Public pet profile, vet share link, family sharing & cross-app data

If you activate the emergency QR code / public pet profile or a vet share link, the information you select for this purpose (e.g. pet name, emergency contact) is made accessible via a non-guessable link — publicly or to the recipient. This processing is based on your consent (Art. 6(1)(a) GDPR). You can deactivate the sharing at any time in the app.

Family sharing: if you use the family sharing feature to invite additional people to your account (by email address and invitation code or link), the joining people gain access — once they accept the invitation — to the pet data of every pet in your account, depending on the role you assign: editor (read and write access) or read-only. Conversely, the invited person is shown that they are part of your family sharing group (including your email address as the inviting person). This processing is based on the joining person's consent and the subscription holder's contract performance (Art. 6(1)(a) / (b) GDPR). You can remove family members at any time in the app, or leave a family sharing group yourself; this ends the respective data access.

Cross-app data: if you link a pet from VetAura, VetCoral or VetExot as a parent animal in our breeding management app VetBreed, VetBreed can retrieve and display that pet's basic data (name, species, breed, date of birth). This retrieval only happens on your explicit action and only for pets that belong to you in the respective base app; the data is not permanently stored in VetBreed, only retrieved for display (see VetBreed's privacy policy).

6. Location data and community reports (Hazard Radar, Foraging Map)

If you use the Hazard Radar or the Foraging Map, we optionally request your device location (GPS) to show you reports or foraging areas near you. Location is only captured while you're using the respective screen (no background tracking), and only with your explicit permission via the Android system dialog.

If you report a foraging area yourself, your location is fuzzed by 50–100 metres before storage, so your exact location cannot be reconstructed.

If, however, you report a hazard area via the Hazard Radar, unlike a foraging area report, the location you provide is stored without fuzzing, along with an optional photo and a description you write, and is made visible to other users of the map; it is also visible which account created or confirmed (verified) the report. We expressly point out that such a report can therefore reveal your approximate whereabouts at the time of the report. You can disable the reporting feature at any time via the app permissions, without making the app unusable overall.

These processing activities are based on your consent (Art. 6(1)(a) GDPR).

7. Referral programme (invite friends)

If you use the "invite friends" feature, we generate an individual referral code for your account, which is stored together with your user identifier and — to attribute redeemed referrals — your email address. If another user redeems your code, we link your user identifier with the referred person's user identifier in order to credit both of you with the intended bonus (e.g. free additional months). Your referral code and the email address linked to it may, for technical reasons, also be recognisable for referrals redeemed via another app in our app family (VetAura, VetCoral, VetExot, VetBreed) (see Section 4.6). This processing is based on contract performance within the referral programme (Art. 6(1)(b) GDPR). You can avoid participating in the referral programme by not using the invitation feature; you can have already-redeemed links reversed by sending a deletion request to our contact email address, unless overriding interests (e.g. fraud prevention) apply.

8. Storage duration

We store your data for as long as your account exists. If you delete your account, your personal data — including pet data, family sharing and referral links, and public shares — is permanently erased (see Delete account section). Community reports (Hazard Radar, Foraging Map) you have published are likewise removed or anonymised as part of account deletion. Statutory retention obligations remain unaffected. Entries from the app integrity check (VetAura and VetExot only) are deleted automatically no later than 90 days after they are created; if you delete your account they are removed immediately.

9. Your rights

Under the GDPR, you have the following rights: access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and objection (Art. 21). You may withdraw consent you have given at any time with effect for the future (Art. 7(3) GDPR). To do so, contact the address of the app you use (see section 1).

You also have the right to lodge a complaint with a supervisory authority, e.g. the data protection authority responsible for your place of residence.

10. No data sharing for advertising purposes

We do not sell your personal data and do not share it with third parties for advertising purposes. We do not use any advertising networks (ad SDKs) and do not integrate any third-party advertising tracking tools. Affiliate/advertising links in the app merely redirect to partner shops; your health data is not transmitted to these shops.

11. Children

Our apps are intended for adults. Persons under 16 years of age should only use the app with the consent of their parent or guardian. This applies in particular to the AI-assisted health features (e.g. Plant Scanner, AI Symptom Check) — parents/guardians should review the results themselves when used by a minor and seek veterinary advice if in doubt. For users in Brazil, this also implements the specific consent of at least one parent or legal guardian required under Art. 14 LGPD for children (up to 12 years of age).

12. Notice for users resident in Australia (Privacy Act)

If you use an app from our app family while resident in Australia, the following additionally applies under the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs) it contains:

Small business exemption: Sebastian Tredt operates these apps as a small business with annual turnover well below the AUD 3 million threshold. Small businesses are generally exempt from direct application of the Privacy Act (the "small business operator" exemption), unless one of the statutory exceptions applies (e.g. trading in personal information, provision of health services to individuals). Because our apps process health data about animals rather than people, we consider the "health service provider" exception unlikely to apply here, so the small business exemption should apply. Regardless, we voluntarily process your data in line with standards informed by the APPs (including transparency about processing purposes, data minimisation, and access/correction options as described in Section 9).

Contact and oversight: for questions about your data, contact the address of the app you use (see section 1). You may also contact the Office of the Australian Information Commissioner (OAIC, oaic.gov.au), which handles privacy complaints in Australia — we review every request, even if the small business exemption applies.

Data breaches: should a notifiable data incident nonetheless occur, we voluntarily follow the principles of the Notifiable Data Breaches (NDB) scheme, even though it formally applies only to entities covered by the Privacy Act.

Note: this information does not replace legal advice. Whether the small business exemption applies depends on actual turnover and may change with future law reform; if in doubt, we also recommend seeking legal advice in Australia.

13. Notice for users resident in Brazil (LGPD)

If you use an app from our app family while resident in Brazil, we process your personal data additionally in accordance with the Brazilian Lei Geral de Proteção de Dados (LGPD, Law No. 13,709/2018).

Legal bases (Art. 7 LGPD): the processing purposes listed in section 3 are based — mapped onto the LGPD — on the performance of a contract (Art. 7 V), your consent (Art. 7 I) and our legitimate interest (Art. 7 IX).

Your rights (Art. 18 LGPD): confirmation of the existence of processing, access to your data, correction of incomplete, inaccurate or outdated data, anonymisation, blocking or deletion of unnecessary or excessive data, data portability, deletion of data processed with your consent, information about public and private entities with which we have shared your data, information about the possibility of denying consent, and withdrawal of your consent. To do so, contact VetAura@Vetkosmos.app — this address also serves as the contact for the Encarregado (data protection officer) within the meaning of Art. 41 LGPD.

International data transfer (Art. 33 LGPD): your data is processed — as described in section 4 — in data centres within the European Union, which offer a level of protection comparable to the LGPD (including via EU Standard Contractual Clauses). Where required, we additionally base any cross-border transfer on your explicit consent (Art. 33 IX LGPD).

Supervisory authority: you also have the right to contact the Brazilian data protection authority ANPD (Autoridade Nacional de Proteção de Dados, gov.br/anpd).

Note: this information does not replace legal advice. If you have questions about your rights under the LGPD, we also recommend seeking legal counsel in Brazil.

14. Changes

We will amend this privacy policy if the legal situation or our processing changes. The current version is always available here.

Note: Our apps are organisational tools and do not replace veterinary advice, diagnosis or treatment.