Privacy policy

Meddor — last updated: October 7, 2026. The French version is the reference text.

Meddor is a health record for pets. This page explains, plainly, what data the app stores, why, who it is entrusted to, how long it is kept, and what you can do about it.

What we store

• Your email address, which is your sign-in identifier, and your password if you choose one (never stored in plain text).
• Your first name, if you give it: entered in Household → Account, or passed on by Google or Apple the first time you sign in. Your household members see it.
• Your pets’ profiles: name, species, breed, date of birth, sex.
• Their health record: weigh-ins, vaccines, treatments and doses, parasite treatments, symptoms you noted, heat cycles, vet visits, food.
• Your organization: tasks, notes, appointments, and the places you save — a place can include the name, address, phone number and map coordinates of a clinic or a shop.
• Your household members: the people you invite to share the record, identified by their email and first name.
• The photos and documents you add: photos of your pet, prescriptions, vaccination records, vet reports, invoices, and the drawn portraits of your pet.
• The sign-up for dose reminders: your phone’s notification token, time zone, language and clock format, so the server can remind you of a dose that hasn’t been logged yet. Other reminders (tasks, appointments, parasite treatments…) are scheduled on the phone, and nothing is sent for them.
• A daily count of your automatic readings and place searches, to cap how many you can make.
• Your app language (French or English), so the emails we send you — sign-up and password codes — are written in it.
• To block random code guessing: when an invite code is checked, the internet (IP) address the request comes from is kept for fifteen minutes at most, along with the number of attempts that minute.
• An invitation opened from a link: when you tap an invitation link without having the app, we keep, for fifteen minutes at most, the invitation code and a fingerprint of your internet address (a value from which the address cannot be recovered), so the app can find it once installed. It is deleted as soon as it is used.

Signing in with Google or Apple

You can create your account with an email address and a password, or with Google (on iPhone and Android) or Apple (on iPhone). Either way, the service identifies you itself, then passes on your email address — with Apple, possibly a relay address that hides yours — and your name. Google also includes the address of its profile photo, which the app doesn’t show. We keep the email and the name with your account, and never receive your Google or Apple password. When you delete an account created with Apple, we also remove Meddor’s access from your Apple account.

Automatic reading with AI

Some features send an image or a text to OpenAI (United States), only when you trigger them yourself, and only to provide that feature:

• the photo of a prescription or a vaccination record, to extract the treatments or vaccines — you review and confirm every line before it is saved;
• the photo of a food package, to read its name;
• the name of a food you search for (a text), to find its analysis on the web. The searched name and the product found then join the shared food catalog, with no link to your account;
• the photos of your pet, to draw its portrait.

We send it neither your name, nor your email, nor the rest of the record. Under its API terms, OpenAI does not use this data to train its models, and keeps it for up to 30 days (to detect abuse, and, for the food search, the answer itself), unless the law requires it to keep it longer. A prescription often shows the owner’s and the vet’s names: if you don’t want it read by this service, enter the treatment by hand. The number of readings per person per day is capped.

Place search

When you search for a clinic or a shop to save, the text you type is sent to Google Places (Google), with the app language, to suggest addresses. Our server is what queries Google: Google receives neither your name, nor your email, nor your internet address. The place you pick (name, address, phone number, coordinates) is saved in your record. If you prefer, enter the place by hand: nothing is then sent to Google.

What we don’t store. No location of your phone (a place’s coordinates are those of the business you picked, not yours), no advertising identifier, no cross-app tracking and no usage analytics in the app. We never sell your data or share it with third parties for commercial purposes.

Who can see your data

Your data belongs to your household: you and the people you invite. The database rejects any read coming from another household: this isn’t an app setting, it’s a rule enforced on the server for every request. An invite code is valid for seven days, works once, and is never stored in plain text.

One exception: your pets’ drawn portraits are served from a public web address that is long and impossible to guess. Anyone who knows that address can see the image — the portrait alone, with no name or other information. The photos you take are never public.

How your data is protected

• Traffic with our servers uses HTTPS, and data is encrypted at rest.
• Your session is kept in your phone’s secure keychain, never in a plain file.
• Our technical logs always mask personal fields: neither your name, nor your email, nor your addresses appear in them.
• Sensitive operations (creating a pet, a treatment, a checkup, a sitter access) are logged — the operation, its date, the account’s technical ID, without the content — and that log cannot be edited or erased from the app.

Where your data is hosted

On Supabase infrastructure, in the Western Europe region (Ireland). Only what the sections above and below describe leaves the European Union, at the moment the service is provided: images and text read by OpenAI, place searches sent to Google, and dose reminders delivered by Expo and Apple.

Other services we use

• Sentry, in its European Union region (Germany), receives the app’s crash reports: the technical trace of the error, the device model and the system version. Personal fields are turned off: neither your name, nor your email address, nor your IP address is sent. It also receives errors from our server functions (automatic readings, portraits, place search, account deletion); when a place search fails at Google, that report carries your account’s technical ID, to match the error with a possible report from you — never your name or email.
• Expo (United States) and Apple’s notification service (on iPhone) or Google’s Firebase Cloud Messaging (on Android) deliver the dose reminders sent by the server. They receive the phone’s notification token and the reminder text: the pet’s and the medication’s names, the dosage and the time (“Max · Amoxicillin” — “1 tablet · 8:00 AM”), then, when a household member logs the dose, “Given by Lola at 8:02 AM”.
• Open Pet Food Facts and Open Food Facts, open collaborative databases, receive the barcode you scan and return the product sheet. A barcode is not personal data, and nothing else is sent to them.
• Cloudflare Web Analytics counts visits to the meddor.fr website: the page viewed, the site the visitor came from, and the type of browser. With no cookies or identifiers, it can’t recognize a visitor from one visit to the next. This applies to the website only, not the app.

How long we keep it

• Your account and your record: as long as your account exists.
• A pet you delete goes with its health record, photos, documents and portraits. A deleted document goes with its image.
• A phone’s sign-up for reminders: as long as the phone is signed in to your account; it is erased when you sign out or with the account. The record of reminders sent is erased after two days.
• The daily count of readings and searches: 90 days.
• The log of sensitive operations: one year.
• An IP address kept against code guessing, and the fingerprint of an invitation opened from a link: fifteen minutes at most.
• At our service providers: up to 30 days at OpenAI (see above); error reports for Sentry’s retention period (90 days at most); automatic database backups disappear as they are replaced.

Deleting your account

From the app: Household tab → Account → Delete my account. Or by email, to connect.meddor@gmail.com, from the account’s address. What deletion erases depends on your household:

• If you’re the only one in it, everything is erased: your account, the household, the pets and their whole record, notes, places, photos, documents and portraits.
• If you share it, your account and your personal data are erased, but the record stays with the other members: the pets, their record, the photos and the documents are kept for them; if you created the household, it passes to the person who joined it first. Notes, tasks and doses you logged there stay, without your name.

In both cases, what stays, detached from you: foods added to the shared catalog, and, until their retention period ends, the log of sensitive operations (technical ID only) and copies at our service providers. The full details are on the Delete your account page.

Your rights

Under the GDPR, you can ask to access your data, correct it, erase it, or take it with you, and object to its processing. Write to connect.meddor@gmail.com: we reply within 30 days. If our answer doesn’t satisfy you, you can file a complaint with the French data protection authority, the CNIL.

Permissions the app asks for

• Camera — to photograph your pet or a prescription, or to scan a food barcode. A photo is only taken when you open the camera yourself.
• Photos — to pick an existing photo.
• Notifications — for care reminders, each adjustable on its own. A reminder shows the pet’s name and the care, and for a dose the dosage and time; whether it previews on the lock screen follows your phone’s setting.
• Alarms & reminders (Android) — so a reminder goes off at the exact time, even when the phone is asleep.

Meddor · connect.meddor@gmail.com