Privacy policy

Effective: 8 November 2026

This policy explains what data the Kahu app and the kahu.hu website handle, what we use it for, who can see it and what your rights are.

Who handles your data?

Data controller: Gábor Gurics
Privacy contact: adatvedelem@kahu.hu

What data do we handle, and why?

Account and profile

Email address, password (handled by Firebase Authentication, we can’t see it), the account identifier if you sign in with Google or Apple, nickname, profile picture, language and notification settings. These let you sign in and use the app.

If you give it, your phone number is stored in your profile too, where other users can’t see it. When you make a poster of your lost dog, we ask whether it should go on the poster. The poster is made on your phone and reaches only the people you share it with and those who see a printed copy.

Legal basis: performance of a contract (GDPR Art. 6(1)(b)).

Dog profiles

Your dog’s details and photos, such as its name, breed and chip number. The chip number and the other fields marked private are visible only to the dog’s owners. The nicknames and profile pictures of owners and followers are stored with the dog’s data.

Legal basis: performance of a contract.

Reports

When you report a lost, spotted or secured dog: the place, the time, the description, the photos and who made the report. For your own lost dog the place is rounded to about 1 km, because it is often the owner’s home. For spotted and secured dogs the exact place is stored and shown.

When you report a secured dog you also give your contact details, so the owner can reach you. These are stored with the report’s data.

Legal basis: performance of a contract; when you find someone else’s dog, our legitimate interest and that of the owner (Art. 6(1)(f)).

Location

If you allow it, the app uses your phone’s location to make it easier to enter the place when you report. We ask for it at your first report. We don’t send your continuous location to our servers: location reaches us only when you give it in a report. The guarded areas you choose (settlement names) are stored in your profile. You can withdraw the permission at any time in your phone’s settings.

Legal basis: consent (Art. 6(1)(a)) for device location, performance of a contract for guarded areas.

Notifications

For push notifications we store your device’s notification identifier (FCM token) and, following your settings, subscribe it to the topics of your guarded areas. We remove it when you sign out.

Legal basis: performance of a contract.

Contacting other users

If you send a message to an owner or a reporter from the app, we forward it by email. The recipient gets your email address so they can reply, which you agree to before sending. You only see the recipient’s address if they reply to you. To prevent abuse we count how many messages you send per day. You can turn these emails off in your settings.

Legal basis: consent; legitimate interest for the daily limit.

Finding similar dogs and merging reports

On our server we turn report photos into numeric image features and, together with descriptions, place and time, use them to suggest possible matches. This is about the dog and makes no automated decision about you: owners, reporters and moderators decide on a match. We also store votes on possible matches and merge requests.

Legal basis: legitimate interest (finding lost dogs).

Usage statistics

With Google Analytics for Firebase we see which features are used. For this we handle your account’s internal identifier, the features you use and usual device data. We don’t pass on your email address or name.

Legal basis: legitimate interest (improving the app).

Who can see your data?

• Registered users: reports are visible to users with a verified account, along with nicknames. The contact details given for a secured dog are part of the report’s data, so only give details you are comfortable with.
• Photos: uploaded images can be reached without signing in by anyone who has their link.
• Email address: not shown to other users, unless you write to them from the app.
• Moderators and ambassadors: to run the community they can access merge requests; ambassadors only those of their own settlement.

Who helps us handle data?

• Google (Firebase): sign-in, database, image storage, push notifications, background processes and statistics. The database is located in the European Union.
• Brevo: sending emails.
• Apple and Google: Apple or Google sign-in, delivering push notifications, and turning coordinates into addresses using the phone’s own service.
• OpenFreeMap: displaying maps. Your IP address reaches them when map tiles are downloaded.
• Our own server: match suggestions, image processing, message sending and this website run on a server we operate ourselves.

Some providers may handle data outside the European Union. In that case they rely on GDPR safeguards such as standard contractual clauses.

How long do we keep data?

Your account’s data is kept for as long as your account exists. You can delete your account in the app on the Profile page. This deletes your profile, your event feed, your profile picture and the dog profiles, with their photos and memorial pages, of which you are the only owner. Open reports of those dogs are closed, and invitations you haven’t accepted yet are removed. For dogs you share with others, you are only removed from the owners, and your follows are removed too.

What remains after you delete your account: your reports (closed ones too), their photos and image features (except the photos of deleted dog profiles), your votes, merge requests and the daily message counters. You can ask separately for your reports to be deleted at the address above. Deleted reports are permanently removed after 30 days. Statistics are kept for the retention period set in Google Analytics.

What are your rights?

You can ask for information about and access to your data, and for its correction, erasure, restriction or portability. You can object to processing based on legitimate interest and withdraw your consent at any time. To do so, write to the address above.

You can complain to the Hungarian National Authority for Data Protection and Freedom of Information (naih.hu) or go to court.

The kahu.hu website

The website uses no cookies and no statistics tools. Our own server’s technical logs may include your IP address and browser details.

Changes

If this policy changes, we publish the updated version on this page with its effective date.