This policy explains what data is processed when you use the Kroket app (iPhone, iPad and Android) and the kroketapp.com website, why, and what your rights are. Kroket is published in France, so this policy follows the EU General Data Protection Regulation (GDPR) and French law.
1. Who is responsible for your data?
The data controller is Kroket, an app published by Adrien Leyronas, an independent developer based in France.
- Contact: bonjour@kroketapp.com
Kroket has not appointed a data protection officer. For any question, email the address above.
2. What data we process
If you use the app without an account
- Your scans: barcodes you scan are used to look up the product in our catalog. Your history and pending scans are stored only on your device.
- Products not found: if a barcode isn't in our catalog, we add it to a missing-products counter, with no information about you. The barcode is also sent to Open Food Facts to check whether it's a human food product (see section 6).
- Usage and crash data: see below.
If you create an account
- Account: email address, username, technical user ID, sign-up date and sign-in method (Apple, Google or email). If you sign in with Apple and choose to hide your email, we receive a relay address provided by Apple. Your password is handled by Firebase Authentication, and we never have access to it.
- Premium status: we store whether a subscription is active. Payment is processed by Apple or Google, and we never receive your payment details.
- Your pets:
- identity: name, species, breed, sex, date of birth, and a photo if you add one;
- weight and lifestyle: weigh-ins, weight goal, activity level, neutered status;
- health: allergies and health log (vaccines, treatments with dosage and doses given, spay/neuter, surgeries, notes, reminder dates);
- food and stock: products fed, package size and opening date, consumption, stock alerts you turned on.
- Your activity: scan history, favorites and pending scans. Anything you scanned before creating an account is moved to your account when you sign in.
- Sharing: the people you share a pet with and a feed of the actions they take (see section 4).
Information about your pet isn't health data under the GDPR, which only covers people. But because it's tied to your account, we protect it with the same care as your personal data.
If you contribute to the catalog
When you add a product or suggest a change, we receive the barcode, name, brand, species, format, guaranteed analysis, ingredient and additive text, and the package photo if you send one (resized before upload). On iPhone and iPad, text is read from the photo directly on your device. Contributions are never published with your name or username.
Usage measurement and diagnostics
We use Firebase Analytics to understand how the app is used and make it better. It records:
- screens viewed (Home, Scanner, Favorites, Profile, My pets, Settings, sign-in, app intro);
- in-app actions: app intro completed, sign-up, sign-in and sign-out (with the method used), successful scan (with the product name), product not found or human food (with the barcode), product added (species and score), contribution sent, favorite removed, history or favorites cleared, pet added, edited or deleted (species), weigh-in, weight goal, treatment added or given, product added to or updated in stock, personalized score viewed, allergen or recall alert shown, recall link opened, shared pet joined, account deleted;
- technical information collected automatically: device model, OS and app version, language, approximate country and region, app installation ID, and session length.
We use Firebase Crashlytics to detect and fix crashes: a technical crash report, device model, and OS and app versions.
When you're signed in, this data is linked to your account's technical ID (never to your email). Kroket doesn't collect your device's advertising ID and doesn't do any ad targeting.
On Android, Firebase App Check (with Google Play Integrity) confirms that requests come from the genuine app, to protect the service from abuse.
If you contact us
Your email address, your messages and anything you choose to share with us.
What stays on your device only
Some data never leaves your phone: history and pending scans when you're not signed in, the downloaded offline catalog, scheduled notifications, the data shown in widgets, the list of recalls you've already been alerted about, and your language choice.
3. Why we use your data and our legal basis
| What we do | Legal basis (GDPR) |
|---|---|
| Run the app: scanning, product pages, account, sync, pet profiles, daily portions, weight, health log, food stock, widgets, notifications, allergen and recall alerts | Performance of our contract (our Terms of Use) |
| Provide Premium: personalized score, search and offline catalog | Performance of our contract |
| Share a pet with the people you invite | Performance of our contract, at your request |
| Grow and moderate the catalog: contributions, not-found counter | Legitimate interest: offering a reliable, complete catalog |
| Detect human food via Open Food Facts | Legitimate interest: avoiding off-topic products |
| Measure app usage (Firebase Analytics) | Our legitimate interest in improving the app. You can object at any time by emailing us. |
| Fix crashes and protect the service (Crashlytics, App Check) | Legitimate interest: keeping the app stable and secure |
| Answer your messages | Legitimate interest |
| Meet our legal obligations (accounting, requests from authorities) | Legal obligation |
We don't use your data for advertising, marketing profiles or automated decisions about you. The personalized score is simply a calculation shown to you, with no legal effect.
4. Sharing a pet with other users
You can share a pet's records with family or friends, who need their own Kroket account.
- The code: Kroket creates an 8-character code that's valid for 5 minutes and works only once. It shows the pet's name, species and photo to whoever enters it. Expired codes are deleted automatically.
- What members see: the pet's full profile (including photo, weight and allergies), weigh-ins, health log, products and food stock. They can add or edit this information, but they can't delete the pet or manage other members.
- What the owner sees: the list of members with their usernames, and a feed of what they do (a new member joined, a weigh-in was added) with their display name.
- What's never shared: your other pets, your scan history, your favorites and your email address.
- Ending a share: the owner can remove a member, and a member can leave at any time. Whatever was added stays with the pet, under the owner's account. If the owner deletes the pet or their account, members lose access.
5. Contributions are public
Products you add, approved edits and package photos are visible to all Kroket users, without your identity. Please don't photograph people or personal information.
6. Who receives your data?
Your data is only accessible to Kroket's publisher and to the service providers below, each for their own part. It's never sold, rented or shared with advertisers.
| Provider | Role |
|---|---|
| Google (Firebase): Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, and Google LLC (USA) | Authentication, Cloud Firestore database (Europe “eur3” region), photo storage (Cloud Storage), server functions (catalog, recalls, moderation), Analytics, Crashlytics, App Check |
| Apple (Apple Distribution International Ltd., Ireland) | Sign in with Apple, App Store subscription and payment |
| Google (Google Ireland Limited) | Sign in with Google, Google Play subscription and payment |
| Open Food Facts (French nonprofit) | Receives the barcode of a product we can't find, plus your device's IP address like any internet request, to check whether it's human food |
| Cloudflare, Inc. (USA) | Hosting for the kroketapp.com website |
Product recalls come from RappelConso, the French government's public recall database. The recall list is downloaded to your device and checked against your history and favorites right there, so nothing is sent to RappelConso.
We may also disclose data to authorities when required by law.
7. Transfers outside the European Union
Kroket's database is hosted in Europe. However, some processing by Google (including Analytics and Crashlytics), Apple and Cloudflare may involve access from the United States. These transfers are covered by the EU-U.S. Data Privacy Framework, which these companies have joined, and by the European Commission's Standard Contractual Clauses included in their data processing terms. You can ask us for more information about these safeguards.
8. How long we keep your data
| Data | Retention |
|---|---|
| Account, pets, history, favorites, food stock, sharing | As long as your account exists, then deleted when you delete it. |
| Data used without an account | On your device until you clear it (Settings > Clear history) or delete the app |
| Sharing codes | Valid for 5 minutes, then deleted automatically |
| Usage measurement (Analytics) | Up to 14 months |
| Crash reports (Crashlytics) | 90 days |
| Catalog contributions | As long as the product is in the catalog, not linked to your account |
| Premium status | As long as your account exists; payment records are kept by Apple or Google under their own policies |
| Support emails | 3 years after our last exchange |
9. Deleting your account
You can delete your account at any time in the app: Settings > Account > Delete my account. This can't be undone. It erases your sign-in account, your profile, your pets (profile, weigh-ins, health log, photos), your food stock, history, favorites and pending scans.
Good to know:
- pets you own and share with others will no longer be available to those members;
- your catalog contributions stay published, with no link to you;
- usage and crash data are erased at the end of their retention period;
- deleting your account doesn't cancel Premium, so cancel it with Apple or Google.
If you can't access the app anymore, email bonjour@kroketapp.com from the address linked to your account.
10. App permissions
- Camera: to scan barcodes and photograph a package or label. Scanner images aren't saved.
- Photos: to pick a photo of your pet or a product. Only the image you select is used.
- Notifications: to alert you about low or empty food stock, an upcoming treatment or weigh-in, or a product recall. These notifications are scheduled on your device, and we don't use any remote push service.
You can turn these permissions off at any time in your phone's settings; the related features will then stop working.
11. Security
Data exchanged between the app and our servers is encrypted in transit (HTTPS) and encrypted at rest on Google's servers. Access rules ensure that only you, and the people you invite to follow a pet, can read your data. No system is perfect, so if a data breach puts you at risk, we'll notify you and the French data protection authority (CNIL), as the law requires.
12. Your rights
You have the following rights over your data:
- access: find out what data we hold and get a copy;
- correction: fix inaccurate data (most of it can be edited directly in the app);
- deletion: have your data erased;
- restriction: temporarily pause the use of your data;
- objection: object to processing based on our legitimate interest, including usage measurement;
- portability: receive the data you gave us in a readable format;
- withdrawing consent at any time, for processing that relies on it;
- instructions after your death: decide what happens to your data (a right under French law).
To exercise these rights, email bonjour@kroketapp.com, ideally from the address linked to your account. We'll respond within one month and may ask you to confirm your identity.
If you believe your rights aren't being respected, you can file a complaint with the CNIL (www.cnil.fr, 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, France) or with the data protection authority in your country.
13. Children
Kroket isn't intended for children. You must be at least 15 to create an account; younger users need a parent or guardian's permission. If you believe a child has given us data without that permission, email us and we'll delete it.
14. The kroketapp.com website
The website is a static showcase: it doesn't require an account, has no forms, sets no cookies and uses no analytics or advertising trackers. That's why you won't see a cookie banner.
Like any web host, Cloudflare processes technical connection data (IP address, date, page requested, browser) to deliver pages and protect the site from attacks.
Links to the App Store, Google Play or Instagram lead to services with their own privacy policies.
15. Changes to this policy
We update this policy as the app evolves. The date at the top shows the latest version. If we make a significant change, we'll let you know in the app or on the website.
16. Contact
For any question about your data: bonjour@kroketapp.com.