Biskio

Privacy Policy

Effective June 4, 2026 · last updated September 2, 2026

This policy describes how the Biskio app (a pet care mobile application) and this website process your personal data.

1. Data Controller

The data controller is Štěpán Kameník (an individual). Contact: stepan@mazlio.com.

2. Data We Process

Account data

• email address and name,
• password (we store only a cryptographic hash — never the password itself), or an identifier when you sign in with Apple / Google,
• app settings (language, units, notification preferences).

Pet data

• pet profiles and health records you enter into the app (weight, symptoms, medications, vaccinations, vet visits, expenses, diary entries),
• photos and documents you upload (e.g. vet reports).

Technical data

• a device token for delivering push notifications (if you enable them),
• operational and security records (audit log of access, IP address, request identifiers) to the extent necessary to secure and operate the service.

Apple Health (HealthKit)

Only if you explicitly allow it in the iOS permission dialog and turn the import on in the app's Settings, the app can read your walks (walking workouts) from Apple Health and offer them as "walk" activities for your pet. We read only these values: the start time, duration and distance of walking workouts from the last 14 days. We never write anything to Apple Health.

Each walk you import this way becomes an ordinary activity record for the pet (type "walk", time, duration, distance and the note "Imported from Apple Health"). That record is stored on our server as part of your account data — exactly as if you had logged the walk by hand — and you can delete it in the app at any time. Apple Health data is never used for advertising or analytics and never passed to third parties for their own purposes. Because an imported walk is stored as an ordinary activity record, it may — like the pet's other records for that period — be included in an AI insight you explicitly request in the app (see section 4); in that case the activity's type, time, duration, distance and note are passed on, nothing else from Apple Health. You can revoke the permission at any time in iOS: Settings → Health → Data Access & Devices → Biskio.

Subscription data

• subscription and entitlement status (active / inactive, plan, renewal or expiry date, trial period) and the App Store purchase identifier,
• the identifier of your Biskio account the purchase belongs to. We do not process and cannot access payment details (card numbers and the like) — Apple takes the payment.

Website waitlist

If you enter your e-mail into the waitlist on this website, we store the address, your language and a label for the page you signed up from (for example “quiz” or “feeding calculator”), including any campaign tags in the link (utm_source, utm_medium, utm_campaign). We use those only to learn which topic interests people; they are not linked to a profile and not passed on. The address itself is used solely to send a one-time notice that the app is available — the legal basis is your consent (Art. 6(1)(a) GDPR), which you can withdraw at any time by e-mail.

Signups are confirmed by a double opt-in e-mail: until you confirm the address with the link in it we send you nothing else, and an unconfirmed address is deleted within 30 days. Confirmed addresses are deleted no later than after the launch announcement is sent, or immediately upon request.

3. Purposes and Legal Bases

• Providing the service (account, data sync, reminders, household sharing) — performance of a contract (Art. 6(1)(b) GDPR).
• Push notifications — your consent given in the system dialog; you can revoke it anytime in device settings.
• Security and abuse prevention (audit logs, login rate limiting) — legitimate interest (Art. 6(1)(f) GDPR).
• AI features (document summaries, health insights) — performance of a contract; processing happens only to fulfil your specific request in the app.
• Subscriptions (verifying purchases, keeping track of entitlements to paid features, renewal and cancellation) — performance of a contract (Art. 6(1)(b) GDPR).

4. Who We Share Data With

We do not sell your data and do not use it for advertising. We use the following processors to run the service:

• Hosting: servers located in the European Union (Hetzner Online GmbH, Germany).
• Apple / Google: push notification delivery and optional Sign in with Apple / Google.
• OpenAI, L.L.C. (USA): the language-model provider behind the AI features (document summaries, health insights, medication checks). We send only the content required for the specific request you trigger in the app — for example the text of an uploaded document, or the pet's health records for the period being summarised — and only to fulfil that request; never your e-mail, name or other account data. Data is sent through the api.openai.com API. Under OpenAI's API terms, inputs submitted this way are not used to train models. The transfer to the United States relies on the European Commission's Standard Contractual Clauses contained in OpenAI's Data Processing Addendum.
• Sentry (Functional Software, Inc.): crash and error reporting — in the iOS app, on this website and on our server — so we can fix issues. A report contains a technical description of the fault (error type, place in the code, app or browser version); the contents of your records are not sent with it. Data is hosted in the European Union.
• PostHog EU (PostHog, Inc.): product analytics for the iOS app, this website and our server (anonymous usage events such as "page opened", "waitlist e-mail submitted" or "trial started" — subscription events are sent by the server so that the counts also cover purchases and cancellations that happen outside the app); data is processed in the EU cloud. The events are anonymous — we do not build a user profile, and an event contains neither your e-mail, your name nor any data about your animal. On the website the measurement uses no cookies. The one exception is the campaign tags of the link you arrived through (utm_source, utm_medium,utm_campaign): so that we know which post brought you, the page keeps them for as long as the tab is open (sessionStorage) and sends them only with a waitlist signup. They say nothing about you as a person and are gone when the tab closes. Measurement honours the "Do Not Track" and Global Privacy Control settings; page addresses are sent in shortened form only, without any link that carries an access token (a vet share, for instance).
• RevenueCat, Inc. (USA): subscription processing — it verifies purchases made in the App Store and keeps the record of entitlements to paid features. We send it the identifier of your Biskio account (a random UUID, not your name or e-mail); RevenueCat adds purchase and subscription data from the App Store and technical data about your device and country. Processing takes place in the United States.
• Vercel Inc.: hosting of this website (not of app data). We measure website traffic with Vercel Analytics — it works without cookies and stores no personal data.

For processors established outside the European Union (OpenAI, RevenueCat, Vercel), transfers rely on the European Commission's Standard Contractual Clauses included in their data processing agreements.

5. Retention

We keep your data for as long as your account exists. You can delete your account anytime directly in the app (Settings → Delete account) — your data, including uploaded files, will be removed. You may also request deletion by email. Database backups are kept short-term for disaster recovery and are rotated automatically.

6. Your Rights

Under the GDPR you have the right to:

• access your data and obtain a copy — a data export is available in the app,
• rectify inaccurate data,
• erasure (“right to be forgotten”),
• data portability,
• object to processing based on legitimate interest,
• lodge a complaint with a supervisory authority — in the Czech Republic the Office for Personal Data Protection (ÚOOÚ), uoou.gov.cz.

To exercise your rights, contact us at stepan@mazlio.com.

7. Children

The service is intended for persons aged 16 and over. We do not knowingly create accounts for younger children and do not knowingly collect personal data from them; if we learn that an account was created for such a child, we delete it.

8. Changes to This Policy

We may update this policy; we will announce material changes in the app or on this website. The current version is always available on this page.