Privacy policy

This policy explains which personal data HKSolutions processes for the Nomara mobile app and the nomara.sunizeka.org QR pages (together "Nomara"), why, and for how long. Questions: support@needsolutions.net.

1. In short

• We never ask for your phone number, real name or address. An account needs only your email address.
• Visitors who scan a QR code need no account; raw IP addresses are not stored.
• Chats are deleted 72 hours after they close, photos after 7 days.
• No advertising, analytics or crash-reporting tools; your data is never sold.
• All data is hosted in the European Union (Germany).

2. Data about account holders

• Email address (stored encrypted): sign-in codes, security notices and the email copy of critical alerts.
• Display name (optional, encrypted), language, time zone and notification preferences.
• Tag details: tag code, nickname, status and what you enter for the tag type (e.g. vehicle colour and model, pet name, health note — the health note is encrypted). Number plates are not collected.
• Device details: platform, app version, installation ID and push token (encrypted), to deliver alerts to your phone.
• Session details: hashes of refresh tokens and when they were last used.
• Alerts and chats: alerts you receive, messages with visitors (encrypted), photos and locations visitors share.
• Security log: important account actions, with an irreversible hash of the IP address.

3. Data about visitors who scan a QR code

• The note, quick replies and chat messages the visitor writes (encrypted).
• A photo if the visitor sends one (re-encoded; EXIF data including location is removed) and a location only if the visitor taps the share button.
• To prevent abuse, a one-way hash built from the IP address, browser details and a random visitor cookie with a salt that changes daily. The raw IP address is not stored.
• Cookies: nomara_v (random visitor ID, 30 days, abuse prevention and blocking) and nomara_lang (language, 1 year). There are no other cookies.

4. Purposes and legal bases

• Providing the service (tags, alerts, chat): performance of a contract.
• Account security, preventing abuse and spam, handling reports: legitimate interests and legal obligations.
• Special-category data such as a pet's health note: only if you enter it and choose to show it, with your explicit consent.

5. Retention

• Chat content: deleted 72 hours after the chat closes.
• Photos: deleted after 7 days.
• Visitor hashes on alerts: deleted after 30 days. Blocks are deleted when they expire.
• Alert records: 12 months. Security log and closed abuse reports: 24 months.
• Sessions: end after 90 days without use and after 365 days at most.
• Data export link: 24 hours, single use.
• Account deletion: your account is closed at once and can be restored by signing in within 30 days; after 30 days the account and all data linked to it are permanently deleted.
• Encrypted database backups are kept for at most 14 days.

6. Service providers (processors)

• Hetzner Online GmbH (Germany): servers, database, photo storage and encrypted backups.
• Veridyen (Türkiye): domain name system and email delivery.
• Google Firebase Cloud Messaging: delivering alerts to your phone as notifications. Notifications carry only a short alert text and technical identifiers.

7. Your rights

You may access, correct and delete your data, object to processing and receive a copy of your data. In the app, Settings → Download my data exports your data and Settings → Delete account deletes your account (details). For anything else write to support@needsolutions.net; we answer within 30 days. You may also complain to your data protection authority.

8. Security

Connections are encrypted with TLS; email addresses, messages, health notes and push tokens are additionally encrypted in the database; the app verifies the server certificate (certificate pinning).

9. Children

Nomara is not directed at children; you must be 18 or older to create an account.

10. Changes

When we update this policy we change the effective date and announce important changes in the app or by email.