Skip to content
Get the app
DEFRITEN

Privacy Policy

Situation: 7 October 2026

This statement applies to the app ReptiCare for iPhone, iPad, Mac and Android as well as for this website. It follows the Swiss Data Protection Act (FADP) and, so far as applicable, the European General Data Protection Regulation (GDPR).

1. Controller

Marlon Schick
Grenzacherstrasse 487
4058 Basel
Switzerland
Email: [email protected]

No representative in the European Union under Article 27 GDPR has been appointed. Enquiries from the EU should go directly to the address given above.

2. Data in the app

ReptiCare works without an account with us, and nothing you enter is stored on our servers. Everything: animals, photos, documents, appointments, weights, food stock, purchases, breeding data and notes, is stored in a database on your Apple device.

iCloud sync

In addition, ReptiCare can synchronise this data with your other devices through Apple’s iCloud and CloudKit services. The data then sits in the private iCloud area of your Apple account. This gives the developer no access to your animal data and no way to view or restore it.

Whether synchronisation happens depends on your iCloud settings. Synchronisation is additionally subject to Apple’s privacy policy.

Deleting the app removes local data. Data already synchronised with iCloud may remain in your private iCloud storage and reappear after a reinstall. The app’s settings let you delete all animal profiles, photos, documents, appointments and notes; with synchronisation active, the deletion is passed on to your other devices as well.

ReptiCare for Android

On Android, the same data sits in a database on your Android device. There is no iCloud synchronisation there. If backup to your Google account is switched on in the Android settings, Android automatically backs up the app data, encrypted, to your Google account. We have no access to that either. This backup is governed by Google’s privacy policy.

Access permissions

  • Photos / camera: only if you add an animal photo. The image is stored locally in the app.
  • Notifications: for appointment reminders. They are scheduled locally on the device, without a push server.
  • File access during export: only if you save a CSV export and only to the location you choose.

Downloading the reference data

So that species entries, care profiles, legal information and the German minimum dimensions stay current, the app fetches these directories from repticare.ch at long intervals. This is a plain download: no information from the app is transmitted, neither animal data nor an identifier. For technical reasons the server learns, as with any page request, your device’s IP address, the time and the file requested. The legal basis is our legitimate interest in nobody working from outdated legal information (Article 6(1)(f) GDPR).

Without this download the app keeps working; it then falls back on the version that shipped with your purchase.

3. Purchases (ReptiCare Pro)

ReptiCare Pro is bought as an in-app purchase through the Apple App Store. Apple handles the payment; we receive neither your payment details nor your address. The app merely asks Apple whether a valid purchase exists for the signed-in Apple ID. This is additionally subject to Apple’s privacy policy.

In the Android version, the purchase runs through Google Play. Google handles the payment; we receive neither your payment details nor your address. The app merely asks Google Play whether a valid purchase exists for your Google account. This is additionally subject to Google’s privacy policy.

4. Store diagnostic data

Independently of us, Apple and, for the Android version, Google collect aggregated data on installations and crashes. These analyses are not personal and allow no conclusions about individual users. ReptiCare uses no analytics or advertising SDK of its own.

In the Android version, ReptiCare uses Google Play’s library for purchases (Google Play Billing Library). When the app checks the purchase status or a purchase is made, this library sends technical log data directly to Google, such as whether the connection to Google Play succeeded and which errors occurred. According to Google, this data is used to improve the library and fix errors. We do not receive this data and have no influence over it. Google’s privacy policy applies.

5. This website

The site is static and delivered via Cloudflare Pages. Without your consent to Google Analytics (see below), it sets no cookies and does not recognise you on a later visit. It embeds no external fonts.

To measure reach we use Cloudflare Web Analytics. The service counts page views without setting cookies and without building a profile of you: no identifier is stored in your browser and your IP address is not retained. We therefore only see how often a page was opened, never by whom. No consent is required; the legal basis is our legitimate interest in knowing which content is needed.

When the page is requested, Cloudflare as operator of the infrastructure processes technically necessary connection data (IP address, time, address requested, browser identifier) in order to deliver the page and fend off attacks. The legal basis is our legitimate interest in secure operation. Details are set out in the Cloudflare privacy policy.

Under “From the reptile world”, the home page shows posts from external sources, currently videos from YouTube channels, with preview images. Our server at Cloudflare fetches the list of posts and the preview images from YouTube at regular intervals, independently of page visits, stores them and delivers them under repticare.ch. Your browser therefore makes no connection to Google or YouTube, and YouTube receives no information about you, neither your IP address nor cookies. Only when you click on a post does the video open on YouTube. YouTube is governed by Google’s privacy policy.

We also use Google Analytics to understand how visitors find us and which pages they follow up on. This service sets cookies, recognises you on a later visit and transfers data to Google LLC in the United States, where the level of data protection is not equivalent to that in Switzerland.

We therefore load Google Analytics only if you have expressly consented beforehand; the legal basis is your consent alone. Without consent, your browser does not on its own make any connection to Google on our pages, and no cookie is set; doing nothing counts as refusal. You only reach Google if you click a link to it yourself, for example to a video on YouTube.

You can change your decision at any time, with effect for the future: Withdraw or give consent. Details of Google’s processing are set out in its Privacy Policy.

6. Contact, forms and newsletter

If you write to us, we process your message and your address solely in order to answer the enquiry. We keep such messages only as long as necessary for that and do not pass them on.

The same applies to the forms on the support and consulting pages. What is transmitted is what you enter: for the contact form, name, email address and message; for a consulting enquiry, additionally the optional details on phone, location, business, topics, species, current situation, preferred form of advice and timeframe. These details serve solely to assess and answer the enquiry. The website itself does not store them; they arrive as an email in our mailbox.

Delivery may run through the service provider Resend, which delivers the message on our behalf. If no delivery service is configured, the site merely prepares the message in your own mail program: The details then leave your device only when you press send yourself. No sign-up is needed in any case, and no cookies are set.

To protect against automated submissions, the contact form, the consultation request and the newsletter sign-up use Cloudflare Turnstile. The verification script is only loaded when you use one of these forms. Cloudflare evaluates technical characteristics of your browser and your IP address to tell people apart from automated programs; Cloudflare does not receive what you enter in the form. The legal basis is our legitimate interest in protecting the forms against abuse. Details are set out in the Turnstile privacy addendum from Cloudflare.

So that nobody can submit the forms en masse within a short time, we count requests per sender: at most five per hour for the contact form and the consultation request, three for the newsletter sign-up. For this we do not store your IP address, only a fingerprint of it that we compute with a secret key (HMAC-SHA-256). Without this key the address cannot be worked out from it, so the data is pseudonymised. The counter expires after two hours and is deleted by the following day at the latest. The legal basis is our legitimate interest in protecting the forms against abuse.

Newsletter

If you sign up for the newsletter, we store your email address, the language of the page, the time of sign-up, the place on the website where you signed up and a random identifier for the confirmation and unsubscribe links. The data is held in a database at Cloudflare. The confirmation email and the newsletter are sent on our behalf by the service provider Resend.

You are only signed up once you click the link in the confirmation email. As proof of your consent, we then record the time and a hash value (SHA-256) calculated from your IP address, not the address itself. This value is not anonymous: it can be matched to a known IP address. The legal basis for the newsletter is your consent.

We delete unconfirmed sign-ups after 14 days. We use a confirmed address until you unsubscribe. The unsubscribe link is in every email and takes effect immediately; it withdraws your consent. After that, your address remains stored with the note “unsubscribed” and the details listed above for as long as we need this to be able to prove your consent and its withdrawal. The legal basis for this is our legitimate interest.

If you open the newsletter with images, your email program loads them from our website and our marketplace. Since 7 October 2026, the preview images for videos also come from our website, not from YouTube: our server fetches them from YouTube at regular intervals, regardless of whether or when you open the email (see section 5). YouTube receives no information about you, neither your IP address nor cookies. Only clicking on a video takes you to YouTube. Editions sent before that date still embed the preview images directly from YouTube. If you open such an email with images, your email program loads them from there, and YouTube learns the IP address from which they are requested. The legal basis for this is our legitimate interest in showing the posts with an image. If you want to avoid this, open older editions without images.

7. Your rights

You have the right to information, rectification, erasure, restriction of processing and to receive your data. With us, this mainly concerns your newsletter sign-up including the proof of consent, as well as messages and form enquiries you have sent us. To exercise these rights, write to the address given above. We cannot attribute the counters used to throttle the forms to you, because we do not store your IP address for them; they are deleted by the following day at the latest. You manage your data in the app yourself: directly on the device and, if enabled, in your own iCloud storage or in your Google account backup.

Under the GDPR you also have the right to data portability and the right to object to processing that we base on a legitimate interest. You may withdraw any consent you have given at any time with effect for the future; processing carried out until then remains lawful.

You may lodge a complaint with a supervisory authority at any time. In Switzerland this is the Federal Data Protection and Information Commissioner (FDPIC). In Germany the data protection commissioner of your federal state is responsible; elsewhere in the European Economic Area, the authority of your country of residence.

8. Changes

If features are added that process data differently, we update this statement. The date above shows the current version.