Privacy policy
This explains what Exuvia stores about you, why, who else touches it, and how to get it back or get rid of it. Phi Aurum Group (Pty) Ltd, registration 2026/576088/07, is the responsible party under the Protection of Personal Information Act 4 of 2013 (POPIA) and the data controller under the UK and EU General Data Protection Regulation (GDPR).
The short version. We store the account details you give us and the husbandry records you create. We do not run advertising, analytics or tracking of any kind, and we do not sell or share your data. You can download everything or delete everything yourself, without asking us.
1. What we collect
Because you gave it to us
- Account details — username and email address. Your password is stored only as a salted hash; we cannot read it and cannot recover it for you.
- Husbandry records — specimens, species, enclosures, feeding offers and outcomes, moults, health events, rehousings, dates, measurements, free-text notes and photographs. Notes are free text, so whatever you type there is what we hold.
- Preferences — your light or dark appearance setting.
Because you signed in with Google (only if you chose to)
- Your Google account identifier, email address and display name, received from Google at sign-in. If you sign in with a username and password instead, we receive nothing from Google.
Because the service runs on the internet
- Server logs — IP address, browser user agent, the page requested and a timestamp. These are used to keep the service running and to investigate abuse and faults.
- Cookies — a session cookie that keeps you signed in and a CSRF cookie that protects forms from being submitted by other sites. Both are strictly necessary. We set no advertising, analytics or cross-site cookies, which is why you are not being asked to dismiss a cookie banner.
2. Why we are allowed to hold it
| What | Why | Lawful basis |
|---|---|---|
| Account details and husbandry records | To provide the service you signed up for | Performance of a contract (GDPR Art. 6(1)(b)); necessary to carry out the contract under POPIA s11(1)(b) |
| Server logs and security measures | To keep the service available and safe | Legitimate interests (GDPR Art. 6(1)(f)); legitimate interests under POPIA s11(1)(f) |
| Google sign-in details | Only if you choose that sign-in method | Consent (GDPR Art. 6(1)(a)); consent under POPIA s11(1)(a) |
| Account and service emails | Confirmations, password resets, notice of changes | Performance of a contract; these are not marketing and cannot be switched off while your account is open |
| Daily digest email | Only if you switch it on: one message a day listing what your animals need | Consent (GDPR Art. 6(1)(a)); consent under POPIA s11(1)(a). Off by default, and you can turn it off again at any time on your profile |
3. Who else processes it
These providers process data on our instructions so that Exuvia can run. We do not give your data to anyone else.
| Provider | What they do | Where |
|---|---|---|
| Microsoft Azure | Hosting, database and photograph storage | South Africa North region |
| Google (Gmail) | Delivers our outgoing account emails | Outside South Africa |
| Google (Sign-In) | Authenticates you, only if you use that option | Outside South Africa |
| Sentry | Error reports when something breaks. Configured not to send personal data with reports. | Outside South Africa |
4. What we do not do
- No advertising, no analytics, no tracking pixels, no cross-site tracking.
- We do not sell, rent or trade your data.
- We do not show your collection to other keepers. Every query is filtered to your account; the only shared data is the built-in species reference list, which belongs to nobody.
- No profiling and no automated decisions with legal or similarly significant effects.
- No marketing emails during beta.
- The daily digest is off unless you switch it on, and it is only ever sent to an address you have confirmed. It contains your own husbandry records and nothing else.
5. How long we keep it
- While your account is open — your records are kept until you delete them or close the account.
- After you request deletion — your account is locked immediately and there is a 30-day window in which you can cancel. When it closes, your account and every record attached to it are permanently erased.
- Backups — database backups are retained for seven days, so an erased record can persist in a backup for up to a week before it is overwritten.
- Server logs — retained by our hosting provider for a short operational period and then discarded.
6. Your rights
Two of these you can exercise yourself, right now, without contacting us:
- Access and portability — download your data as CSV files in a ZIP archive.
- Erasure — delete your account.
For the rest, email us:
- correction of anything inaccurate;
- restriction of processing, or objection to processing based on legitimate interests;
- withdrawal of consent, where consent is the basis — this does not affect processing already carried out;
- a copy of the safeguards covering transfers outside your country.
Write to phiaurum.za@gmail.com. We will respond within 30 days. We may need to confirm it is really you before acting on a request.
7. Complaints
If you are unhappy with how we have handled your data, tell us first. You can also complain to a regulator: in South Africa, the Information Regulator; in the EU or UK, your national data protection authority.
8. Security
- Traffic to the site is encrypted with HTTPS, and the connection to the database is encrypted and certificate-verified.
- Passwords are salted and hashed, never stored in readable form.
- Photographs are held in private storage and served only to the account that uploaded them, never from a public URL.
- Access to production systems is limited to the operator.
No system is perfectly secure, and we will not claim otherwise. If a breach affects your personal information we will notify you and the Information Regulator as POPIA s22 requires, and within 72 hours where GDPR Art. 33 applies.
9. Children
Exuvia is not intended for anyone under 18 and we do not knowingly collect data from children. If you believe a child has created an account, tell us and we will remove it.
10. Changes to this policy
If we change how we handle your data in a way that materially affects you, we will email you before the change takes effect and update the date at the top of this page.
11. Contact
Phi Aurum Group (Pty) Ltd, South Africa — phiaurum.za@gmail.com. Our postal address and the details of our Information Officer are available on request at that address.