Privacy policy

## v0.4: app help, suggestions and approximate browsing The Filaraki assistant answers questions about this platform using approved published help. OpenAI processes the text supplied for the reply, including a limited recent conversation and relevant public help. Do not include sensitive personal details. Automated redaction is imperfect. Conversation history and retry responses are encrypted on our server and expire 24 hours after the conversation/request is created; expired content is not served and the running worker removes it on its next cleanup cycle. Clearing chat removes the current history and its saved reply records. Operational backups have their separate retention schedule. Conversations are isolated by account and browser. When you sign in, the current guest conversation may move to your account; it is not exposed again after logout. Chat verification normally lasts 24 hours. Daily counters enforce 10 completed messages for guests and 50 for signed-in users, resetting at midnight Europe/Athens. Guest usage on the browser transfers once into the account allowance. Counters expire after three days. A necessary anonymous browser cookie lasts up to 180 days to associate verification and prevent quota resets on refresh; clearing cookies or using another browser can affect guest identification. Normal security rate limits also apply. Helpful/not-helpful feedback stores message identifiers, a rating, knowledge version and, for signed-in users, account association for up to 90 days; feedback does not retain message text after conversation expiry. Chat text and location coordinates are excluded from analytics. The main map offers location permission to centre the view around an approximate area. The browser can initially return precise coordinates; the app reduces them to an approximately one-kilometre grid before using them for browsing. It shows no personal marker and does not save the raw browsing coordinates to your account or analytics. Geoapify receives the map area requested, and any address searches you choose to make. Report-location selection remains a separate deliberate action and can contain precise private coordinates. Feature suggestions are private submissions to administrators. We store the idea, category, timestamps, review status, optional contact email and account association if signed in. Contact email is encrypted at rest. It is used only to follow up on the idea. Internal notes and priority support review and are not public. Requests remain while being reviewed or retained for product planning; you can contact the team to request deletion. This is not an emergency reporting channel or a promise of implementation. Account navigation is now **My Filaraki → Area alerts**, and **Settings → Website preferences / Privacy & data**. These routes supersede earlier references to Privacy centre for alerts. --- ## Interactive maps When you enable external maps, MapLibre displays map data supplied by Geoapify. Your browser requests map styles, tiles, fonts and icons directly from Geoapify; the provider receives your IP address, browser request information, site origin and the map areas requested. Filaraki does not send your report contact details with these map requests. Viewing a map is optional: address search, GPS selection and manual area entry remain separate controls. Public report pins remain approximate. --- ## Google sign-in and location search Google sign-in is optional. When you choose it, Google supplies a verified identity identifier, email address and basic profile name. We associate that identifier with your Filaraki account; we do not request access to Gmail, Drive or contacts, and do not keep Google access or refresh tokens. Existing accounts require password confirmation before linking. Some email addresses need a separate Filaraki verification email. Roles and NGO approvals remain controlled by Filaraki. Account export/deletion can use your password or a recent sign-in with the linked Google account. See [Google's privacy policy](https://policies.google.com/privacy). When you type in address search, the query is sent through our server to Geoapify after a short pause. Choosing GPS or a map point can send coordinates for an address lookup. GPS is requested only when you press the location button; there is no continuous location tracking. Manual area entry remains available. Address search is separate from optional map tiles. See [Geoapify's privacy policy](https://www.geoapify.com/privacy-policy/). Selected report street addresses are stored encrypted with private report information, and are not included in the public report. Public report coordinates remain approximate. Saved alert areas are private account settings, and use the selected centre and radius where available. Temporary Google flow records expire after ten minutes and are removed after use or by hourly cleanup; backups follow their own retention schedule. --- ## v0.3: optional alerts, privacy tools and usage measurement This section replaces any earlier statement that Filaraki has no usage analytics. Analytics remain off until you choose them separately in Cookie settings. There are no advertising trackers or session recordings. With consent we record an ephemeral random browser-session identifier (hashed on the server), public page categories, selected action names, coarse device category, interface language and timestamps. We do not attach account IDs, names, email addresses, query strings, private pages, form text, IP addresses or precise locations to analytics records. Hosting/security logs are separate. Authorized administrators see aggregate funnels and recent consenting sessions; these are not counts of uniquely identified people. Events expire after 14 days, active session records after one day; the background worker removes expired records. Backups follow their separate retention schedule. Withdrawal stops new analytics and requests deletion of this tab's session events; a failed request is retried when connectivity returns. DNT and GPC browser signals suppress collection. Analytics run on our infrastructure, not PostHog. In [Privacy centre](/privacy-centre), signed-in users may choose geographic email subscriptions and matching-email preferences, export an account-data JSON file after password confirmation, or submit/cancel a pending deletion request. Export is not a full database dump: original files and third-party information requiring review are handled through Contact. Deletion requests receive human review; submitting one does not instantly erase records or backups. Necessary security and service messages remain enabled. Area alerts are opt-in, use saved city/region names or an optional radius, concern newly published reports and include an unsubscribe link. Saved areas are not live location tracking. AI inputs undergo best-effort removal of obvious personal details in structured fields and text. This cannot reliably remove every name, image detail or sensitive fact: avoid uploading them. Administrators can review similarity explanations, record feedback, curate known matching/non-matching pairs for evaluation and inspect model/prompt versions, token usage and estimated costs. Evaluation uses selected animal photos and descriptions with the configured AI provider. AI cannot publish/reject reports or approve organizations. Reunion attribution is reported by the reporter, not independently proven. --- ## At a glance Filaraki connects people who want to help animals. We use the details you provide for accounts, reports, communication and work with organizations. This release does not install advertising trackers or traffic analytics. ## Who handles your data {{operator}} For personal-data enquiries: {{privacy_contact}}. You can also use our [contact form](/contact), with “Personal data” as the subject. Do not send passwords or full identity documents in your first message. ## What we collect and why - **Accounts:** name, email, password hash, verification state, role and saved animals, to deliver and secure the service you request. - **Lost or found reports:** animal descriptions, photos, time, area, optional coordinates and contact details, to review and publish reports and help reunite animals. - **Private incidents:** descriptions, sender details and evidence for private review by authorized administrators. They are not published as listings. - **Messages and adoption enquiries:** contact details and messages so we can respond or forward them to the reporter or organization you choose. - **Organizations:** organization and representative details, supporting documents and public profiles. Authorized organizations also manage private contacts, notes and follow-ups in their workspace. - **Security and records:** technical logs, rate limits, administrative events, timestamps and versions of terms acceptance and privacy acknowledgement. The hosting provider may keep access logs. Do not submit human health information, children's details, third-party faces, number plates or precise home addresses without necessity and a lawful basis. Photos should focus on the animal. ## What becomes public Published lost/found reports display animal details and photos and an approximate map location. Coordinates are rounded; in a small area they may still be identifying. A visitor can reveal the phone number after an anti-abuse security check. This check does not verify the visitor's identity. Email addresses, private identifying features and microchip details are excluded from the report's public view. Approved organization profiles, listings, events, needs and donation details are public. Public material may be copied or indexed by search engines. ## Legal bases Account administration and requests rely on providing the service you request. Fraud prevention, security and content oversight rely on our legitimate interests, balanced against your rights. We comply with applicable legal obligations. For optional features requiring consent, you may refuse or withdraw it. Acknowledging this notice is not blanket consent to any use of your data or to marketing. ## Artificial intelligence Messages sent to the AI assistant are passed to the configured OpenAI provider. Descriptions and selected animal photos may also be processed for writing assistance, checks and suggested matches. Suggestions can be wrong and do not prove ownership or animal identity. Review them and request human reconsideration through Contact when needed. Organization approval requires an administrator. Do not give the AI passwords, identity documents, private details or sensitive human information. The application does not use your data to train its own model. Provider retention and use depend on the API account's configuration and contract. ## Providers and transfers The service uses Hostinger hosting, Cloudinary image/file storage when enabled, OpenAI for AI, Cloudflare Turnstile for form protection and the configured SMTP provider for email. The selected map provider receives technical information when you enable external maps. Enquiries and messages share your details with their intended recipient. Organizations are responsible for their own subsequent processing. Depending on provider services and settings, processing may occur outside the EEA. The controller must ensure appropriate processor contracts and a lawful transfer mechanism, such as an adequacy decision or Standard Contractual Clauses. Contact us for information about the safeguards actually used. We do not sell your data. ## Retention and deletion Accounts remain while used or needed for an outstanding request or legal obligation. Public reports normally expire after 30 days unless renewed. **Expiry or removal from public view does not mean deletion from the database.** Enquiries, incidents, organization contacts, documents and audit records need periodic review and deletion by the responsible operator when no longer needed. The application does not promise automatic deletion of all records after a fixed interval. Temporary tokens and AI cache results expire and are cleared by the background worker. Backups and provider logs follow their respective retention cycles. You may request deletion; we will explain any lawful reason for limited continued retention. ## Your rights Subject to GDPR conditions, you may request access, correction, deletion, restriction or portability, or object to processing based on legitimate interests. Withdrawing consent does not affect previous lawful processing. We may ask for proportionate identity verification. We normally respond within one month and notify you of any lawful extension for complex requests. You can complain to the [Hellenic Data Protection Authority](https://www.dpa.gr/). Account and submission services are intended for adults. An adult should act when a minor needs help. ## Cookies and updates Read our [cookie policy](/cookies) and use the footer settings. The current publication date and version appear above. Material changes are communicated appropriately; new submissions record the current policy versions.