Privacy Policy

Privacy Policy

Last updated: August 25, 2026

1. Data Controller

The Rohns UG (haftungsbeschränkt) – ManeMap, Bührener Straße 15B, 26670 Uplengen, Germany · Phone: +49 177 4957900 · Email: info@manemap.app · Represented by the Managing Directors: Marco Rohns and Laura Rohns

Contact for privacy inquiries and data subject rights: info@manemap.app

2. Scope of this Privacy Policy

This privacy policy provides information in accordance with Art. 13/14 GDPR regarding the processing of personal data within the ManeMap app as well as on our website.

3. What Data We Process and for What Purposes

3.1 Account & Core Services

Processed data: Name (or alias), email address, login/auth credentials, language settings, app preferences.

Purposes: Account creation, authentication, providing app features, security and system integrity.

Legal basis: Art. 6 (1) (b) GDPR (performance of a contract), Art. 6 (1) (f) GDPR (legitimate interests in security and fraud prevention).

3.2 Horse Profiles, Training, and Routine Data

Processed data: Horse profile information (e.g., name, age, breed, husbandry/housing setup), training and grooming logs, horse health details, appointments and reminders, financial logs related to your horse, contacts (e.g., vet, farrier), and any photos uploaded by you.

Purposes: Providing stable management and organization tools (profiles, logs, calendar, analytics).

Legal basis: Art. 6 (1) (b) GDPR (performance of a contract).

3.3 "Milo" / AI-Powered Insights

Processed data: Your text inputs, selected context data (horse profile, weather, previous logs), and your chat history with Milo, which we store in our database so you can access past conversations in the app.

Purposes: Generating tailored suggestions, tips, and daily advice; continuing existing chat threads.

Service provider: Google (Gemini API, Google Ireland Ltd.).

Data privacy note: We use specific configurations to ensure your inputs are not used to train Google's AI models.

Legal basis: Art. 6 (1) (b) GDPR (performance of a contract to deliver the AI feature).

3.4 Location and Stable Location (Optional)

Processed data:

(a) Device Location – only if you grant explicit permission.

(b) Stable Location – the coordinates and name of the stable that you manually add to your horse's profile. This is stored permanently in the horse's profile.

To fetch weather updates, we send only the coordinates via our own server to WeatherAPI.com. Your IP address and account details are never shared with the weather service.

Purposes: Providing localized weather, pasture, and seasonal tips.

Legal basis: For (a) Art. 6 (1) (a) GDPR (consent), which can be revoked at any time in your device and app settings. For (b) Art. 6 (1) (b) GDPR (performance of a contract), as you actively save the stable location as part of the horse's profile; you can delete this information at any time.

3.5 Reminders (Notifications)

Processed data: The timing and type of reminders configured by you.

Important: These reminders are scheduled and triggered locally on your device. We do not collect push tokens, and no notification content is transmitted to our servers or third parties. The notification never leaves your device.

Legal basis: Art. 6 (1) (b) GDPR (performance of a contract). You can disable the system permission for notifications at any time in your device settings.

3.6 In-App Analytics (PostHog)

Processed data: Pseudonymized usage and event data (e.g., screens visited, actions such as "created horse" or "viewed paywall," completed onboarding steps), a pseudonymous user ID, device type, operating system, and app version.

Data processor: PostHog. Processing takes place on servers located in the European Union (eu.i.posthog.com). We do not share real names, horse health data, or billing information with PostHog.

IP Anonymization: IP addresses are truncated before storage, making it impossible to link them to a specific user or internet connection.

No Ads: The data shared with PostHog is never used for advertising, nor is it shared with ad networks or data brokers. No advertising identifier (IDFA) is used.

Purposes: Improving user experience, identifying bugs, and developing new features.

Legal basis: Art. 6 (1) (a) GDPR (consent). Analytics are disabled by default and will only run if you opt-in via our consent prompt. You can opt-out at any time in the app settings.

Retention period: Event data is deleted after 12 months at the latest.

3.7 Camera and Photo Gallery Access

Processed data: Photos that you actively choose to select or take.

Purposes: Saving photos to a horse's profile or attachment logs.

Legal basis: Art. 6 (1) (a) GDPR (consent granted via the system prompt on first access). Access is local to the device; photos are only uploaded to our servers if you choose to save them.

3.8 Website: Server Logs and Traffic Measurement

Server Logs: When visiting our website, technical log data is generated (IP address, timestamp of the request, page visited, user agent, referrer) to deliver the website safely and prevent cyberattacks.

Legal basis: Art. 6 (1) (f) GDPR (legitimate interest in running a secure and reliable website).

Traffic Measurement (PostHog): To analyze website traffic, we use PostHog (servers in the European Union, eu.i.posthog.com). This tracks pages viewed, time spent on site, referrer, approximate geographic region, device type, and technical performance metrics like loading times.

No cookies are set, and no information is stored on or read from your device. No persistent user profiles or tracking IDs are created. IP addresses are truncated. This data is never merged with your ManeMap account, is not used for advertising, and is never shared with ad networks or data brokers.

Legal basis: Art. 6 (1) (f) GDPR (legitimate interest in privacy-focused, cookie-free web analytics). Section 25 TDDDG is not applicable as no information is stored on or retrieved from your end device. You can object to this processing at any time (Art. 21 GDPR) with an informal email to info@manemap.app.

Retention period: Event data is deleted after 12 months at the latest.

3.9 Email Reminders (Customer.io)

If you haven't opened the app in a while, we may send you email reminders to log your horse's care routines and make the most of your ManeMap subscription.

Data processor: Customer.io (Peaberry Software Inc.). Processing is handled on servers located in the European Union (EU Data Center, cdp-eu.customer.io).

Purpose: Reminding you to utilize the horse care management features included in your subscription; reducing inactive subscriptions.

Legal basis: Art. 6 (1) (f) GDPR (legitimate interest in retaining and engaging paying subscribers). These emails are transactional service reminders, not marketing promotions.

Right to object: You can object to this processing at any time (Art. 21 GDPR) by clicking the unsubscribe link in any email or sending an informal message to info@manemap.app. Upon objection, your Customer.io profile will immediately be blocked from further mailings.

No third-party marketing: This data is never shared with ad networks or data brokers.

Retention period: Your profile on Customer.io remains active for the duration of your ManeMap subscription, up until your account is deleted. Upon objection, the profile is immediately blacklisted from mailings; upon account deletion, it is permanently removed.

4. Recipients and Data Processors (Art. 28 GDPR)

We work with the following service providers as data processors:

Regarding RevenueCat: To manage your subscription status, we send a pseudonymous user ID and the receipt token provided by the App Store to RevenueCat. Neither we nor RevenueCat receive your payment details or billing address — these remain securely with Apple or Google.

Regarding WeatherAPI.com: Only coordinates are transmitted via our server (see §3.4); no account details or user IP addresses are ever shared.

Note: The app store providers, Apple and Google, process payment and billing transactions independently under their own privacy policies.

5. International Data Transfers

Supabase, PostHog, and Customer.io process the aforementioned data within the European Union. RevenueCat and WeatherAPI.com process data in the USA; in the case of Google, data may be processed outside the EEA despite having a contractual partner in Ireland. We base these transfers on appropriate safeguards pursuant to Chapter V GDPR — specifically EU Standard Contractual Clauses (SCCs) or, where providers are certified, the adequacy decision under the EU-US Data Privacy Framework.

6. Retention Period

We only store personal data as long as necessary for the specified purposes or as required by statutory retention periods. Account data and content created by you will be permanently deleted upon account deletion (see §8). For individual services, the specific periods mentioned in §3.6, §3.8, and §3.9 apply. Under commercial and tax laws, business records may be kept for up to 10 years (§ 257 HGB; § 147 AO).

7. Your Rights

Subject to statutory requirements, you have the right to access (Art. 15 GDPR), rectification (Art. 16 GDPR), erasure (Art. 17 GDPR), restriction of processing (Art. 18 GDPR), data portability (Art. 20 GDPR), and the right to object to specific processing activities (Art. 21 GDPR).

Where processing is based on your consent, you may withdraw it at any time with future effect — the consents under §3.4(a), §3.6, §3.7, and §3.9 can each be managed individually.

To exercise your rights, simply send an informal request to info@manemap.app. You also have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR).

8. Account Deletion

You can delete your account at any time directly in the app: Settings → "My Account" → Delete Account. The deletion is immediate and irreversible.

This will permanently delete: your user account and credentials, all horse profiles (including health, training, feeding, and financial data), appointments, contacts, your Milo conversations, and — if active — your Customer.io profile.

If you are unable to delete the account yourself or require confirmation in writing, please send an informal email to info@manemap.app.

Not covered by deletion: Subscription and billing records handled independently by Apple or Google — you must request deletion directly through them. Furthermore, we may retain certain data to comply with statutory commercial retention obligations (see §6).

9. Data Security

We implement robust technical and organizational measures (Art. 32 GDPR), including transport encryption, database-level access restrictions, and EU hosting for core application data.

10. Children

ManeMap is not intended for children under 16 years of age. Users aged 16 to 17 should only use the app with parental consent.

11. Veterinary and Medical Disclaimer

ManeMap provides organizational tools and general insights. App content — including AI-powered insights from Milo — does not constitute veterinary advice and is not a substitute for professional diagnosis, treatment, or care. In the event of acute illness, injury, or emergency, please contact a veterinarian or equine emergency service immediately.

12. Changes to this Policy

We may update this privacy policy from time to time, noting the new effective date at the top of the document.