MedusaPrivacy policy
In short
- Medusa stores what you enter (animals, enclosures, feeding schedules, notes) so you can use it on all your devices and share it with the people you invite.
- We do not sell your data, show ads, or track you across other apps or websites.
- Usage statistics and error reports stay off until you agree.
- You can delete your account at any time. Here is how.
Who is responsible
Medusa is made by Nirah, a company that is still to be founded. Until then Medusa is run by Gijs Pampiermole, a private individual, Am Wurstberg 14, 76332 Bad Herrenalb, Germany. When the company exists, it will take over and this page will say so. For anything about your data, write to privacy@nirah.nl.
What we collect, and why
| What | Why | Do you have to give it? |
|---|---|---|
| Your e-mail address | To sign you in and to send sign-in and account-recovery e-mails | Yes |
| Your first and last name | To show other members of your organizations who you are | No |
| What you keep in Medusa: animals, enclosures, feeding schedules, tasks, notes, weights, sensor readings, the organizations you belong to and your role | To run the app and to share it with the people you invite | To use the app, yes |
| Photos and documents you upload. When we add the option, this also covers your own pictures that you use instead of the ones we provide | To show them to the members of your organization | Only if you upload them |
| Your devices: a random device ID, the device name, the system, the app version and when it was last used | So you can see which devices are signed in and sign them out | Yes |
| A push-notification token | To send the notifications you allow | Only if you allow notifications |
| Your purchases: what you bought and when | To unlock what you paid for. Google Play or the App Store takes the payment; we never see your card details | Only if you buy something |
| Usage statistics and error reports (with e-mail addresses and sign-in tokens removed), and records of failed requests | To find bugs and improve the app | No: only if you agree in the app |
| Server logs: IP address, time and the address requested | For security and to fix faults. Kept for a few days | Technically unavoidable |
We do not collect your location, contacts, calendar, microphone, camera or health data. Face ID or fingerprint unlock happens on your phone and never reaches us.
Our legal grounds (GDPR)
- To provide the service you asked for (Art. 6(1)(b)): account, content, devices, notifications and purchases.
- Your consent (Art. 6(1)(a)): usage statistics and error reports. You can withdraw it at any time, with effect for the future.
- Our legitimate interest in a secure service (Art. 6(1)(f)): server logs and abuse prevention.
- Legal obligation (Art. 6(1)(c)): keeping accounting records for purchases.
Who receives your data
Only service providers that work for us and may use the data for nothing else. We do not sell personal data.
- netcup GmbH (Germany) rents us the servers on which Medusa, sign-in and file storage run.
- Google (Firebase Cloud Messaging) delivers push notifications, if you allow them.
- RevenueCat (USA) handles purchases and subscriptions. It receives your account ID, e-mail address and purchase receipts.
- PostHog (EU servers) receives usage statistics and error reports, only if you agree.
- Google Play or the Apple App Store process your payment under their own privacy policies.
Google and RevenueCat may process data in the United States. Such transfers rest on the EU–US Data Privacy Framework or on EU standard contractual clauses.
How long we keep it
- Your account and content: until you delete your account.
- Devices: a device you sign out is removed after 30 days, and one that has not been used for about five weeks is removed too.
- Purchase records: up to eight years, as German tax law requires. After you delete your account they carry only an internal number that identifies nobody.
- Server logs: a few days.
- Backups: up to 30 days. Deleted data disappears from them as they expire.
- Usage statistics and error reports: only as long as needed to fix and improve the app. Ask us to delete yours at any time.
Your rights
You may ask us for a copy of your data, to correct it, to delete it, to restrict or object to its use, and to receive it in a common format. Write to privacy@nirah.nl from the e-mail address of your account. We answer within one month.
You may also complain to a data protection authority, for example the one of your German state or of the EU country where you live or work.
Deleting your account
Delete it in the app under Settings → Security, on accounts.nirah.nl, or ask us by e-mail. Everything about it is on the page Delete your account, including what is kept and why.
Security
All connections to Medusa are encrypted. Names, roles, plans and device names are additionally encrypted in our database, access to the servers is restricted, and we keep backups. No system is perfectly safe; if a breach puts your data at risk we will tell you as the law requires.
Children
Medusa is not meant for children under 16, and we do not knowingly collect their data. If you think a child has an account, write to us and we will delete it.
Changes
If this policy changes, the new version appears on this page with a new date. For important changes we also tell you in the app.