Privacy policy

1. Controller

The controller responsible for data processing at HerpLabs (herplabs.org) is:
Marc Dunkel
Leiblstraße 22, 14467 Potsdam, Germany
E-mail: kontakt@herplabs.org

2. The key points

• HerpLabs is a digital record for reptiles. You can start right away as a guest, without an e-mail address; with an e-mail address and a password you save your collection later.
• We only process what the service needs: your sign-in details and the data you enter yourself.
• The website and the app contain no tracking, no ads and no analytics services, and no embedded fonts or scripts from third parties.
• Your app data is stored in the EU. You can export it at any time and delete your account yourself.
• If you share an animal pass, everyone with the link sees exactly the details you selected, until you revoke it.
• If you turn on sitter access for a QR label, your sitter sees the care card of this animal without an account and can log entries, until the date you chose.

3. Visiting the website and hosting

The website and the app are provided by Vercel Inc. (USA). When you visit, Vercel processes technically necessary connection data such as your IP address, the date and time, the address requested and browser information, in order to deliver the pages and protect them against abuse. Delivery takes place via data centers in the EU (Frankfurt am Main). The legal basis is our legitimate interest in secure and stable operation (Art. 6(1)(f) GDPR).

We have a data processing agreement with Vercel (Art. 28 GDPR). Vercel is certified under the EU-US Data Privacy Framework; the EU Standard Contractual Clauses apply in addition.

4. Account and app data

When you create an account and use HerpLabs, we process:

• Account data: e-mail address and password. The password is only stored in encrypted (hashed) form. If you sign in with Apple, an identifier from Apple is added instead of the password (see below).
• Content data: the animals and entries you create (for example feedings, weights, sheds, poop, notes), care profiles, breeding projects, clutches and offspring, as well as your settings.
• Animal photos: photos you choose to upload. They are reduced in size on your device before uploading and stored in non-public storage that only your account can access.

The legal basis is the performance of the contract of use (Art. 6(1)(b) GDPR).

Guest access: When you tap “Get started”, we create a guest account without an e-mail address and without a password. It consists only of a random identifier; your content data and animal photos are stored as with any account. Only the sign-in session on your device has access to the guest account (section 9). If you sign out as a guest, we delete the guest account with all its data. If you delete the app or your browser data, access is lost; we automatically delete guest accounts that were never saved after 60 days without activity (signing in, using the app or changes to the collection), with all their data. With “Save your collection” you add an e-mail address and a password to your guest account; your data stays as it is. To prevent abuse, our sign-in service limits the number of new guest accounts per IP address. The legal bases are the same as above; for the limit, our legitimate interest in secure operation (Art. 6(1)(f) GDPR).

Sign in with Apple: Instead of an e-mail address and password, you can sign in with your Apple ID or use it to save your guest collection. Apple (in the EU, Apple Distribution International Ltd., Ireland) then confirms your sign-in to us and transmits a random identifier that is valid only for HerpLabs, along with your e-mail address. If you choose “Hide My Email” at Apple, we only receive a forwarding address from Apple (…@privaterelay.appleid.com); Apple forwards e-mails about your account (section 7) to you. We do not ask for your name. If you delete your account in the iPhone app, we also revoke the sign-in with Apple: for this, the app gets a one-time code from Apple, which our server (Vercel, section 3) passes on to Apple. You can also disconnect at any time in your Apple ID settings under “Sign in with Apple”. The legal basis is Art. 6(1)(b) GDPR; Apple’s own processing is governed by Apple’s privacy policy.

Sign-in, database and photo storage are operated by Supabase Inc. (USA). The data is stored in the EU (data center in Ireland). We have a data processing agreement with Supabase (Art. 28 GDPR); for any access from the USA, for example for support or maintenance, the EU Standard Contractual Clauses apply.

5. Animal pass (shared links)

With the animal pass you can share the profile of an animal as a link or an image, for example when you sell offspring. An animal pass only exists if you create one yourself.

• What becomes public: only the details you select when sharing (for example name, photo, species and morph, sex, hatch date, weight history, feeding rhythm, parents from your breeding data, breeder), plus an optional note. What is stored is the state at the time of sharing; later entries only appear when you share again. Notes, documents, the animal ID, your e-mail address and your account are never part of the pass.
• Who sees it: anyone who knows the link, without an account too. The address contains a random key that cannot be guessed, and the page is blocked for search engines. Whoever has the link can pass it on. For this, the photo and preview image are kept as reduced copies in public storage at Supabase (section 4), accessible only via this key.
• Revoking: In the profile you can see whether a link is active and revoke it at any time. The stored state and the image copies are then deleted, and the link stops working; cached images may remain accessible for a few minutes. Link previews that messengers such as WhatsApp or iMessage created when the link was sent are held by those services, and we cannot retrieve them. If you delete the animal or your account, its animal passes are deleted as well.
• Sharing as an image: The image is created on your device and only goes where you send it via the share sheet. Nothing is stored with us for this.

Only share what you may share, for example a breeder’s name only with their consent.

The legal basis for providing your animal pass is the performance of the contract of use (Art. 6(1)(b) GDPR). When someone opens an animal pass, Vercel (section 3) and Supabase (for the images) process technically necessary connection data such as the IP address. The legal basis is our legitimate interest in delivering the page (Art. 6(1)(f) GDPR).

6. QR labels and sitters

For every animal you can print a QR label and stick it on the enclosure. The code only contains an address with a random key that cannot be guessed (herplabs.org/T/…), no details about the animal. QR labels are only available for saved accounts.

• Without sitter access: If you scan it yourself, your animal opens in the iPhone app or on herplabs.org if you are signed in there. Everyone else only sees that the label belongs to HerpLabs.
• With sitter access (turned on by you for one or more animals until a date): whoever scans the code or gets the link from you sees a care card without an account, with name, animal ID, species, morph, sex, photo or cover, the last feeding, the last shed and poop, whether a feeding is due, your note for the sitter and your feeder list. Notes from the details, documents, older entries, other animals, your e-mail address and your account are never part of the card.
• Entries by the sitter: We store feedings, refusals, poop, sheds and notes as entries in your animal record, marked as “Sitter”. We store nothing about the person logging them, only the time and the content. Per animal, the card accepts at most 20 entries and 3 feedings in 24 hours.
• Photo: If you show a photo, we keep a reduced copy in public storage at Supabase (section 4), accessible only via its own random address, which is not on the label. If you turn sitter access off or delete the label, we delete the copy immediately; after sitter access has expired, the next time the app is opened.
• Revoking: You can turn sitter access off in the profile at any time, and it also ends on the day you chose. “Generate new code” or “Delete label” make printed labels invalid. If you delete the animal or your account, its labels are deleted as well.

Only pass the link on to people who are to look after your animals. The legal basis is the performance of the contract of use (Art. 6(1)(b) GDPR). When the care card is opened, Vercel (section 3) and Supabase process technically necessary connection data such as the IP address; the legal basis is our legitimate interest in delivering the page (Art. 6(1)(f) GDPR).

7. E-mails about your account

To confirm your registration or your e-mail address when saving a guest collection, and to reset your password, you receive e-mails at the address you provided. The legal basis is Art. 6(1)(b) GDPR. We do not send advertising e-mails or newsletters.

Our authentication service (see section 4) hands these e-mails over for sending to the e-mail service Brevo of Sendinblue SAS, 17 rue Salneuve, 75017 Paris, France. In the process, your e-mail address, the content of the e-mail and technical delivery data (for example time and delivery status) are processed. Processing takes place in the EU. We have a data processing agreement with Brevo (Art. 28 GDPR).

To ensure delivery and to prevent abuse, Brevo technically records whether an e-mail was opened and whether a link in it was clicked. This information is stored anonymized, that is without reference to your e-mail or IP address. We do not analyze it. The legal basis is our legitimate interest in reliable delivery (Art. 6(1)(f) GDPR).

8. Error reports

If a technical error occurs in the app, it sends a short error report to our server: the error message, the page concerned and technical context. The content you entered and your e-mail address are not included. The reports end up in the logs of our host Vercel (processing in Frankfurt am Main) and are only stored there for a short time. The legal basis is our legitimate interest in finding and fixing errors (Art. 6(1)(f) GDPR).

9. Storage in the browser

HerpLabs only stores in your browser’s local storage what is needed for it to work or what you set yourself: your sign-in session (as a guest also when you dismissed a reminder to save, and to which address a confirmation link is on its way), whether “Sign in with Apple” is available, the chosen appearance (light/dark), the sort order of the animal list, the last style chosen for QR labels and your suggestions for feeders and feeder weights. So that the app starts right away and shows your collection without a connection too, it also keeps a copy of the data it last loaded and reduced previews of your animal photos in browser storage (IndexedDB); this copy is deleted when you sign out. This data does not leave your device for analytics or advertising. The storage is strictly necessary for the service you requested (§ 25(2) no. 2 TDDDG, the German Telecommunications Digital Services Data Protection Act); no consent is required for it. We do not set tracking or advertising cookies.

10. iPhone app

The iPhone app offers the same features as the website and uses the same account; sections 4 to 9 apply accordingly. In addition:

• Download from the App Store: When you download the app, Apple (in the EU, Apple Distribution International Ltd., Ireland) processes data such as your Apple ID under its own responsibility. We have no influence on this; Apple’s privacy policy applies.
• Feeding reminders: If you turn them on, the app works out on your iPhone when animals are due and schedules local notifications there. No data is transferred to us or third parties for this. You can turn the reminders off at any time in the app or in the iOS Settings.
• “Feed today” widget: So that the widget on the Home Screen and Lock Screen can show who needs food, the app keeps a small copy (animal names and feeding data) in storage on your iPhone that only HerpLabs and its widget can read. No data is transferred to us or third parties for this. The copy is deleted when you sign out.
• Photos and camera: The app only accesses a photo when you take or choose one yourself. Only this image is reduced in size and stored as described in section 4.
• Storage on the device: The app stores the sign-in session and settings (for example appearance and reminder time) in its own storage on your iPhone, as well as the copy of your data and the previews of your photos from section 9. This is strictly necessary for the service (§ 25(2) no. 2 TDDDG).
• Data export: You pass the export file on yourself via the iOS share sheet, for example to the “Files” app.

The iPhone app does not contain any tracking or analytics or advertising services either.

11. Contact by e-mail

If you write to us at kontakt@herplabs.org, we process your message and your contact details in order to deal with your request (Art. 6(1)(b) or (f) GDPR). Our mailbox is provided by Apple (iCloud Mail). We delete messages as soon as they are no longer needed and no retention obligations apply.

12. Storage period

We store your account and content data for as long as your account exists. If you delete your account in the settings, your account, all content data, your animal photos, your animal passes and QR labels are permanently deleted. We delete guest accounts that were never saved when you sign out as a guest, but at the latest after 60 days without activity (section 4). An animal pass remains accessible until you revoke it or delete the animal. A QR label exists until you delete it or the animal; the photo on the care card only as long as sitter access runs (section 6). Statutory retention periods remain unaffected.

13. Your rights

Under the GDPR you have in particular the right to:

• access to your data (Art. 15),
• rectification of inaccurate data (Art. 16),
• erasure (Art. 17),
• restriction of processing (Art. 18),
• data portability (Art. 20),
• object to processing based on legitimate interests (Art. 21).

You can exercise many of these rights directly in the app: in the settings you export all your data as a file (as a guest after saving your collection) and can delete your account or your guest access yourself. For anything else, an e-mail to kontakt@herplabs.org is enough. You can also lodge a complaint with a data protection supervisory authority, in particular in the EU member state where you live.