Privacy policy
This explains what Exuvia stores about you, why, who else touches it, and how to get it back or get rid of it. Phi Aurum Group (Pty) Ltd, registration 2026/576088/07, is the responsible party under the Protection of Personal Information Act 4 of 2013 (POPIA) and the data controller under the UK and EU General Data Protection Regulation (GDPR).
The short version. We store the account details you give us and the husbandry records you create. We keep anonymous daily totals of a few page views and campaign labels so we can tell whether Exuvia is being used. Those totals contain no IP address, browser, cookie identifier, account or individual browsing history. We do not run advertising or cross-site tracking, and we do not sell or share your data. You can download everything or delete everything yourself, without asking us.
1. What we collect
Because you gave it to us
- Account details — username and email address. Your password is stored only as a salted hash; we cannot read it and cannot recover it for you.
- Husbandry records — specimens, species, enclosures, feeding offers and outcomes, moults, health events, rehousings, dates, measurements, free-text notes and photographs. Notes are free text, so whatever you type there is what we hold.
- Preferences — your light or dark appearance setting.
- Private product feedback — the fixed reason you select and any optional comment you choose to write. Feedback is not published and is not attached to an account, even when you send it while signed in. Do not include contact details if you want a reply; this form cannot provide one.
Because you signed in with Google (only if you chose to)
- Your Google account identifier, email address and display name, received from Google at sign-in. If you sign in with a username and password instead, we receive nothing from Google.
Because the service runs on the internet
- Server logs — IP address, browser user agent, the page requested and a timestamp. These are used to keep the service running and to investigate abuse and faults.
- Cookies — a session cookie that keeps you signed in and a CSRF cookie that protects forms from being submitted by other sites. Both are strictly necessary. Usage totals use no cookie at all. We set no advertising, analytics or cross-site cookies, which is why you are not being asked to dismiss a cookie banner.
- Aggregate usage totals — daily counts for the landing, signup, pricing, species-care and signed-in dashboard pages. When a link we publish carries standard UTM campaign labels, those short labels are counted too. We do not store an individual visit, IP address, browser, referrer, session, account or raw URL in these totals, so they cannot be used to reconstruct what one person browsed or to count unique visitors.
2. Why we are allowed to hold it
| What | Why | Lawful basis |
|---|---|---|
| Account details and husbandry records | To provide the service you signed up for | Performance of a contract (GDPR Art. 6(1)(b)); necessary to carry out the contract under POPIA s11(1)(b) |
| Server logs and security measures | To keep the service available and safe | Legitimate interests (GDPR Art. 6(1)(f)); legitimate interests under POPIA s11(1)(f) |
| Aggregate usage totals | To understand whether public pages and community posts lead to real use, and to improve onboarding | Legitimate interests (GDPR Art. 6(1)(f)); legitimate interests under POPIA s11(1)(f). The report is deliberately anonymous and aggregate |
| Private product feedback | To understand what prevents visitors from trying Exuvia and what makes the product confusing or incomplete | Legitimate interests (GDPR Art. 6(1)(f)); legitimate interests under POPIA s11(1)(f). No account, IP address, browser, session or referrer is stored with the submission |
| Google sign-in details | Only if you choose that sign-in method | Consent (GDPR Art. 6(1)(a)); consent under POPIA s11(1)(a) |
| Account and service emails | Confirmations, password resets, notice of changes | Performance of a contract; these are not marketing and cannot be switched off while your account is open |
| Daily digest email | One message a day listing what your animals need — what is due a feed, which offers you have not answered, which water dishes need checking | Legitimate interests (GDPR Art. 6(1)(f)); s11(1)(f) under POPIA. On by default because the app cannot warn you about an animal if you never open it, and a husbandry reminder about your own records is not marketing. Turn it off at any time on your profile, or from a link in the email |
3. Who else processes it
These providers process data on our instructions so that Exuvia can run. We do not give your data to anyone else.
| Provider | What they do | Where |
|---|---|---|
| Microsoft Azure | Hosting, database and photograph storage, and delivery of our outgoing account and digest emails through Azure Communication Services | South Africa North region |
| Lemon Squeezy | Takes the payment as merchant of record, but only if you subscribe. We send them your email address and your Exuvia account number, so that a payment can be matched to the right account. Your card is entered on their pages, handled by their payment processor Stripe, and never reaches us. | Outside South Africa |
| Google (Sign-In) | Authenticates you, only if you use that option | Outside South Africa |
| Google (Gmail) | Receives mail you send us, because the contact address published in this policy is a Gmail address. Nothing else is sent to them. | Outside South Africa |
4. What we do not do
- No advertising, tracking pixels, cross-site tracking, visitor profiles or unique-visitor fingerprinting.
- No third-party analytics. The first-party usage report holds daily counters, not a row for each visit, and cannot identify a keeper or reconstruct their path through the site.
- Private feedback is visible only to the Exuvia operator; it is never posted as a comment or public feature request.
- We do not sell, rent or trade your data.
- We do not show your collection to other keepers. Every query is filtered to your account; the only shared data is the built-in species reference list, which belongs to nobody.
- No profiling and no automated decisions with legal or similarly significant effects.
- No marketing emails during beta.
- The daily digest is on by default and can be turned off at any time on your profile. It is only ever sent to an address you have confirmed, it contains your own husbandry records and nothing else, and turning it off never affects anything else about your account.
5. How long we keep it
- While your account is open — your records are kept until you delete them or close the account.
- After you request deletion — your account is locked immediately and there is a 30-day window in which you can cancel. When it closes, your account and every record attached to it are permanently erased.
- Backups — database backups are retained for seven days, so an erased record can persist in a backup for up to a week before it is overwritten.
- Server logs — retained by our hosting provider for a short operational period and then discarded.
- Private product feedback — kept only while it is useful for evaluating and acting on the product question it answers, then deleted.
6. Your rights
Two of these you can exercise yourself, right now, without contacting us:
- Access and portability — download your data as CSV files in a ZIP archive.
- Erasure — delete your account.
For the rest, email us:
- correction of anything inaccurate;
- restriction of processing, or objection to processing based on legitimate interests;
- withdrawal of consent, where consent is the basis — this does not affect processing already carried out;
- a copy of the safeguards covering transfers outside your country.
Write to phiaurum.za@gmail.com. We will respond within 30 days. We may need to confirm it is really you before acting on a request.
7. Complaints
If you are unhappy with how we have handled your data, tell us first. You can also complain to a regulator: in South Africa, the Information Regulator; in the EU or UK, your national data protection authority.
8. Security
- Traffic to the site is encrypted with HTTPS, and the connection to the database is encrypted and certificate-verified.
- Passwords are salted and hashed, never stored in readable form.
- Photographs are held in private storage and served only to the account that uploaded them, never from a public URL.
- Access to production systems is limited to the operator.
No system is perfectly secure, and we will not claim otherwise. If a breach affects your personal information we will notify you and the Information Regulator as POPIA s22 requires, and within 72 hours where GDPR Art. 33 applies.
9. Children
Exuvia is not intended for anyone under 18 and we do not knowingly collect data from children. If you believe a child has created an account, tell us and we will remove it.
10. Changes to this policy
If we change how we handle your data in a way that materially affects you, we will email you before the change takes effect and update the date at the top of this page.
11. Contact
Phi Aurum Group (Pty) Ltd, South Africa — phiaurum.za@gmail.com. Our postal address and the details of our Information Officer are available on request at that address.