Français

Privacy Policy

Woona — a social app for dog owners.
Last updated: 10 November 2026 · Publisher: Olivier Leonardi (Olileo), sole trader — 113 rue Montgolfier, 78500 Sartrouville, France · SIRET 107 656 852 00012 · APE 62.01Z · Contact: contact@woona.app

This translation is provided for convenience; in case of discrepancy, the French version prevails. The French version is available at woona.app/confidentialite.

1. Who processes your data

Woona is a social app for dog owners. The data controller is the publisher named at the top of this page (Olivier Leonardi, Olileo, France). Data is hosted in the European Union (Hetzner, Germany). Some occasional processing relies on processors outside the EU (section 5).

Person in charge of the protection of personal information (Quebec, Law 25): Olivier Leonardi, founder of Woona — reachable at contact@woona.app.

2. Data collected

• Account: email address, authentication credentials, and the date on which you declared that you are 16 or older and accepted the Terms of Use and this policy.
• Profile: display name, city, bio, avatar, banner photo (optional). Who sees what is set in Settings › Privacy, section by section — the profile, the details (bio, city, social links, banner), the published photos and the dogs — each one “Everyone”, “My friends” or “Only me”. These choices are enforced by our servers, and a person you have blocked sees nothing. Your name and profile photo always accompany what you write. By default, since version 1.6, a new account restricts to its friends its details, its published photos, its dogs and the ability to tag it (data protection by default, GDPR Art. 25; Law 25 in Quebec); the profile itself — your name and photo — remains findable, otherwise nobody could add you as a friend. In Quebec, the settings start even more closed (section 9). Accounts created before 1.6 keep their settings.
• Your country (version 1.6): the code of the country you live in (“BE”), and for Canada the province (“CA-QC” for Quebec, “CA-ON” for Ontario…). It is asked during onboarding (version 1.6): onboarding cannot be completed without it. It then comes from the city you choose among the suggestions (below), otherwise from your location if you have already allowed location access (Woona does not ask for it for this purpose), otherwise you choose it from a list (one of the open countries, or “Other”), as in Settings › Country. Afterwards, unless you choose otherwise, it is inferred from your location — the point of your lost-dog alerts (“My alerts point”, called “Home” before version 1.6) if filled in, otherwise the last known position of your phone, and only if you have already allowed location access — through your phone’s geocoding service (Apple or Google); in Canada, the province comes from the postal code of that point, read on your phone, and if it cannot be determined, nothing is recorded. During onboarding, the city you choose among the suggestions provides it: from the country and region codes OpenStreetMap gives for that city, or, failing that, on your phone, from the municipalities and country boundaries embedded in the app (no position is sent). Finally, you can choose it yourself in Settings › Country (one of the open countries, or “Other”): your location then no longer overrides it, until you switch back to “Based on my location”. It is never inferred from your language. Only the country code and, in Canada, the province code are recorded in your account, no position. It is used to suggest your country’s group and, if you appear in it, to rank you among the walkers of your country. The code itself is shown to nobody; but being a member of your country’s group, or ranked in your country, lets other members guess it.
• Published photos: your public profile gathers the photos from your posts, for the people you have chosen, and only for those who can already read the post where you published it (a private group remains restricted to its members).
• Dogs: name, breed, date of birth, weight, energy level, photos, health record (vaccines, treatments, visits) and, for an unneutered female dog, the heat tracking if you keep it (start and end dates, notes). This tracking is visible only to you and to the dog’s co-owners — never to a walker, on your public profile, in a group, in the leaderboard or in a search. The forecast of the next heat and its reminders are computed and scheduled on your phone. A single notification is sent from our server: around the 9th day of an ongoing heat, “sensitive period” (the dog’s name and a sentence of caution), to the dog’s owner only, if health reminders are enabled in your notification settings.
• Approximate profile location (if you enter an address in your profile): other signed-in owners see, in “Nearby”, how far away your profile and your non-private dogs are. This distance is computed from a grid cell of about 1 km (never from your exact address), within a radius of at most 10 km, and the number of searches is limited. A private profile does not appear there.
• Location: nearby (points of interest, parks, events, other owners) and in the background during a walk (GPS track), with your system consent — a walk you started yourself or, from version 1.5, one Woona offered to start when it saw you leave your home area (“Ask me” setting, the default, or “Automatic”). You can also import a route from a GPX file (watch, another app): the file is read on your phone, we keep its track and its times to turn it into a walk, and nothing else — neither the file, nor its name, nor its author is sent. No permission to access your files is requested: you pick one file, and the app sees only that one.
• Your home area (version 1.5 and later, optional): a centre and a radius (80 to 200 m) that you confirm when Woona suggests it, or that you set in Us › Automatic walks › Home (Settings › Home before version 1.6). It is used to end your walk on its own when you come back, and to detect your departure. The home area stays on your phone: it is never sent to our servers, and no position is collected outside a walk. When you leave the area, your phone alone watches your speed for at most 20 minutes, to tell a walk from a car trip; nothing is sent until you have said “yes” to the walk suggestion — if you decline or do not answer, those positions are erased from the phone. Without an answer, it keeps only the time you went out and the distance covered, to ask you on your return “Was that a walk?”: if you dismiss or do not answer, nothing is sent, and these two pieces of information are erased at most 4 hours after you went out (never later than midnight); if you choose “Keep”, the walk is recorded with its times and its distance, without a track. (This area is distinct from the point of your lost/found alerts — “My alerts point”, called “Home” before version 1.6 —, which you can enter in your settings and which, unlike the area, is recorded in your account.)
• Custom walks: to compute loops, the starting point you choose is sent to our servers and to our routing subcontractor for the time of the computation; it is not recorded. To avoid beaches and parks where dogs are not allowed at the time you pass by, the app also sends the position of these public places (version 1.8). Since version 1.8, the loops computed from your home and a copy of your saved routes stay on your phone so they work without a network, and are erased when you log out. If you turn on “Recompute them every day on wifi”, that same starting point is sent again once a day, on wifi only; your home area itself is still never sent.
• Your usual routes (version 1.5): to ask you “Doing your usual loop around the park?” when you go out, your phone groups your walks of the last six weeks into usual routes. This computation stays on your phone: nothing new is sent, and it is erased when you sign out.
• Your usual walk time (version 1.5): to nudge you in the evening (“No walk tonight?”) only if nobody has taken your dog out — you, or a co-owner —, our server keeps, for each type of day (weekday, weekend), the start and end times of your usual slot and the identifier of the walk to repeat. These times are inferred from walks you have already recorded: no position, no track. They are erased when you turn the nudge off (Us › Automatic walks) and together with your account.
• Social content: posts, photos, comments, messages (and emoji reactions to messages and comments: the emoji, your account and the message or comment concerned, visible only to the members of the conversation, or to whoever can see the comment, which you can remove at any time; on comments since version 1.7), participation in events, “at the park” presence, danger reports, and the free-text description of a group that you create or administer (500 characters, optional, visible to whoever can see the group).
• The Woona groups (version 1.6): on registration, you join Woona World, the group of the whole community, then your country’s group (Woona France, Belgium, Luxembourg, Switzerland or Monaco) as soon as your country is known — once only. In Quebec, no Woona group is joined automatically: belonging to a group is visible, and would tell strangers your country (Woona Quebec) or your presence (Woona World); Woona offers you to join them, and you choose. They are public groups like any other: you can leave either of them, and you are not re-enrolled automatically. As in any group, the other members can see that you belong to it: being in “Woona Belgium” says that you probably live in Belgium.
• Woona News (version 1.7): the team’s announcement feed (app updates, tutorials, dog news). You join it automatically, like Woona World and with the same exception for Quebec; you can leave it. Only the team posts there; you can like and comment, as anywhere else. Announcements only notify you if you turn on the “Woona News” option in Settings › Notifications (off by default). Nothing new is collected: announcements are written by the team, and a news item links to its source without any data about you being sent to it.
• Who can message you (version 1.5): in Settings › Privacy, you choose who can message you directly — everyone, your friends and the members of your groups (the default; the Woona groups, where everyone is enrolled automatically, do not count), or your friends only. Others go through a request: their message waits for you in “Requests”, without a notification, and they cannot see whether you have read it. Accepting opens the conversation; declining closes it without telling the sender. Your dogs’ household, and anyone answering your ongoing lost/found alert, can always message you; a blocked person, never.
• Public events (versions 1.5 and 1.6): a public event that you create, filed in a group or not, can be shared through a link woona.app/rdv/<id>, readable without an account as long as it is upcoming or ended less than seven days ago: its title, its date and time, its neighbourhood (failing that, the city of a public group), the number of attendees and, if it is filed in a public group, the name of that group. Neither the exact place, nor your note, nor your name, nor the attendees’ names, nor the name of a members-only or private group. The neighbourhood is inferred from the place chosen at creation (reverse geocoding by OpenStreetMap). A private event, among friends or restricted to a group has no page: the link reveals nothing.
• Health reminders from the record (version 1.7): the due date of a health-record entry (vaccine, treatment) triggers a reminder sent by our server to the whole household of the dog — the owner and accepted co-owners, never a walker — and no longer only to the person who entered it: they all read the same record. Each person gets it in their own language and can turn it off in Settings › Notifications.
• Public preview of a private group (version 1.7): the admin of a “Private, by invitation” group can turn on a “Public preview” in the group settings — off by default. The link woona.app/groupe/<id> and the group page then show, even without an account, its name, photo and member count, with “Request to join”: no description, no city, no post, no member name. A secret group never has a preview; turning it off, or changing the group’s visibility, removes it.
• Offering your services (version 1.7): if you create a service profile (walks, home visits, dog-sitting, day care; boarding for registered businesses), Woona keeps your services and guide prices (nothing is paid through Woona), whether you offer them as an individual or a business — for a business, its SIRET number and company name —, your description, how many dogs you take, the sizes, your availability, and the date you declared having liability insurance and accepted the rules (18 or over). Your area is never your address: the point you place on the map stays on your phone; only the centre of a circle of about 1 km, offset from it, is sent. The documents you upload (insurance certificate, local authority registration, training certificate) go to a private space, read only by you and the Woona team to check them; members only see the badge (“verified” or “declared”). Once published, your profile is visible to signed-in members (except where someone is blocked). You can hide or delete it at any time; deleting it erases your documents. To help you enter your SIRET, the app sends it to the French government’s public company search API (DINUM); nothing else is sent and nothing is kept. Since version 1.8: 30 days before a document’s end date, the app reminds you once; a document that has expired for more than a year is deleted (section 4); a member can report your profile — the Woona team then reads the reason, the optional note and who reported it (never shown to you), and can take the profile down with a reason sent to you.
• Opening your daycare (version 1.8): if you are a business running a dog daycare, you can open your premises’ listing. Woona keeps its name, description, address (picked from the suggestions, which place it on the map) and whether it is public or given after confirmation (a daycare at your home), its capacity per day, your prices including VAT (paid on site: nothing is paid through Woona), your drop-off and pick-up hours, your house rules (age, neutering, heat, sizes, category, vaccines, trial day, one free-text rule), your closures and the number of spots on a given day (public holidays are set for you), the link to your terms, and the photos of the premises, re-encoded without metadata: avoid showing recognisable people, as they will be public once daycare search opens. Your team members, invited with a link valid for 7 days, read the listing and keep the spots. Proof of your ICPE declaration, required from 10 dogs, joins your private provider space. A directory listing you take over keeps its reviews, marked “community reviews”. The Woona team reviews the listing (documents, capacity, photos) before approving it, or declines it with a reason sent to you. In 1.8, only your team and the Woona team can read the listing. You can hide or close it at any time; closing it erases the listing, its team, spots and photos.
• Finding a daycare (version 1.8): once daycare search opens (it stays closed until our terms have been reviewed), you will see the online daycares around you. Your position is sent to the server rounded to about a hundred metres and is not stored: it is used to compute distances, for the time of the answer. Woona compares each daycare’s house rules with what your dog’s profile already says (age, weight, breed, sex, neutering) and, on a daycare’s page, with the vaccines in its health record: this is computed for you alone, the daycare receives nothing until you send it a request. A daycare that doesn’t take your dog is hidden and counted; the order of the list is explained (suits your dog, spots that day, distance: nobody pays to rank higher). You only ever see a number of spots, never who is coming. A daycare’s page is public (name, description, photos, prices, hours, rules, company name and SIRET, the address of premises open to the public); a daycare run from its manager’s home only shows a circle of about 1 km, never the address or the exact point. You can report a page: Woona keeps the page reported, the reason and your note, which only the Woona team reads.
• Booking a daycare (version 1.8): once daycare search opens, you will be able to request days from a daycare for your dog. Your request sends it your dog (name, breed, sex, neutering, age, weight), the days and the option (with the hours of an hourly slot, or the night of a boarding stay), the indicative price of each day, your note, and the result of each of its house rules: from your dog’s profile, the date of the vaccine you confirmed in its health record (its title and dates, never the rest of the record), or what you declared. This result is frozen when you send; Woona certifies nothing, the daycare checks on the first day. Your address is never passed on. On the day, the team records your dog’s arrival and departure time (the time only, no location) and you are notified; that day only, it reads your dog’s care sheet (important info, vet, vaccines up to date or not, your emergency numbers). That day too, it may keep your dog’s daily log (meals, medication, a note, photos), which you and your household read in your request; the photos are private, stripped of their metadata, and deleted 30 days after the last day of the request. “Share the whole health record” stays off by default; if you tick it, the team reads your dog’s health record while the request is ongoing, then it closes. For its clients, the daycare may keep a status and internal notes that only its team reads; it may also create an internal record for a client without Woona (dog, owner’s name and phone, days of attendance and arrival and departure times), for which it is responsible, and which that client can join: what it entered is then erased. These notes and records are erased 3 years after their last change. The daycare may record a card of days sold and paid on site (Woona collects nothing), erased 3 years after the sale, and export a monthly statement (dog, owner, option, times, indicative price) which then leaves Woona, under its responsibility. The request opens a conversation with the manager; the daycare confirms all or some of the days, or declines with a reason picked from a list; with no reply within 48 h (or by 6 pm the day before the first day), the request expires and you are both told. A request is only read by you, your dog’s household and the daycare’s team. Cancelling is free until the daycare’s deadline; after that it is never charged (you pay on site, Woona collects nothing), but it is counted and only the daycare sees it. A request is kept for 3 years after its last day, then erased; the frozen rule results are erased 30 days after the last day. Woona will never ask you for a deposit by bank transfer or gift card.
• “I’m here” at the park (version 1.7): when you signal yourself at a place, the app sends your phone’s position once, with the signal; the server checks that you are near the place (within 400 m) and does not keep it — only the presence (the place, your dogs, the duration) is recorded. Too far, the signal is refused.
• Lost dog: “look here first” (version 1.5): on the page of your own alert (lost dog, ongoing alert), Woona shows you your dog’s usual places — the parks it visits most often, and your usual routes computed on your phone. They are visible only to you and to the dog’s household, and never added to the alert or to its public page.
• Landmark photos on the map (optional): the photo you add to a point (fountain, bag dispenser, park) to help others find it. It is public and attached to the point’s position: anyone who opens the map at that spot sees it, with your display name and the date. So avoid showing your home or recognisable people in it. You can delete it at any time, and anyone can report it.
• What a photo carries: before upload, the iPhone and Android app (version 1.4 and later) re-encodes each photo on your phone. It reduces it to the useful size and keeps only the image: the camera metadata, including the location where the photo was taken, is not sent. (From the web version, the photo is sent as your browser provides it.)
• Activity: walks; from version 1.5, the park visits detected during the walk (the name of the place, the start and end times, and the play intensity you indicate for each dog — calm, playful, flat out; without an answer, an estimated value); the park sessions of earlier versions; the corrections you make to a walk (times, dogs, park visits, a forgotten start drawn on the map — the server recomputes the figures from the track, and keeps the original for “Revert to original”); statistics, trophies, the daily activity level you declare for each dog (calm / active / very active, one answer per day) to complete its energy gauge, and the enrichment activities you log for it (sniffing, learning, chewing, novelty — the family and the date, nothing else) to follow its stimulation from one day to the next.
• The household of a shared dog (version 1.5): when someone takes out a dog that you share, the other members of its household — the owner and the co-owners, not the walkers — receive a notification at departure and at return (the duration and the distance). Neither the track, nor the position, nor the place is sent. Everyone can turn these notifications off dog by dog, on the dog’s page or (version 1.6) in Settings › Notifications › Household, where a master switch turns them all off; a blocked person is never notified. Tapping the notification opens the walk: while it is in progress, only the departure time, who started it and the dogs are shown (never the place); once finished, its summary, as for all the walks of a dog you share, which the household members see with their track.
• Your dog’s tracker (version 1.7): on your dog’s page, you can say whether your dog wears a tracker — AirTag, Android tracker (Find Hub), Galaxy SmartTag, Tile or another brand’s GPS collar. Woona only stores this type: not the tracker’s location, not its identifier, not your Apple, Google, Samsung or Tile account. Woona never reads a tracker’s location. This choice is visible to whoever already sees the dog’s page (its household, and the person you leave it with or who walks it), never to the public. It is used to tell you, when you leave your dog with someone, how to share the tracker with them, and to offer to open the tracker’s app (Find My, Find Hub) first if your dog goes missing; opening that app sends nothing, neither to it nor to us. It is optional, can be changed at any time, and is erased with the dog or your account.
• Leaving your dog with someone you know (version 1.7): when you leave your dog with someone you invite (by e-mail address, which is only used to find their account and is not kept, or by a single-use link), Woona keeps the stay: the dog, the days, who left it with whom, your instructions and whether you share the full health record. During the stay — and up to 12 h after the last day, then nothing — the person sees the dog’s profile, its important information, its vet, whether its vaccinations are up to date (not the record itself, unless you ticked it) and your emergency numbers. The stay log (meals, medicines, a note, and photos) can be read by both of you during the stay, then by you alone. The walks the person takes with your dog are shown to you live, track included — the sitter’s position is shared only during those walks, never outside them; the person is told before accepting. By default you get a notification when they leave for a walk with your dog and when they are back (“Alert me about outings during a stay”): each member of your household can turn it off for their part, in the stay or in Settings › Notifications, without touching the household walks setting. If they raise the “lost dog” alert during the stay, you are notified right away.
• Photos in the stay log (version 1.7): you or the person looking after your dog can add photos to the log, during the stay (60 at most per stay). They are re-encoded on your phone before sending — the size is reduced and the camera metadata, including the position where the picture was taken, is not sent — then uploaded to our servers in a private storage space, with no public link. Who sees them: the person who left the dog and their household (owner and co-owners), as long as the photo exists; the person looking after the dog, during the stay only — once the stay is over, or if you end it, they can no longer open them. For how long: photos are deleted 30 days after the stay ends (the file and the log line; the log text stays with you), or right away if their author removes them, if the stay is deleted, or with their author’s account. Why: to give you news of your dog, not to feed a timeline or a profile — they appear nowhere else. When the person looking after your dog adds photos, you and your household get a notification, grouped (for example “3 new photos of Nala” for those added within 10 minutes); it does not contain the photo, and can be turned off with “Dog sharing” in Settings › Notifications. Once a stay is over, the app tells you until which date its photos are kept.
• Reporting dog access to a beach or park (version 1.7): from the “Dog access” block of a place, “Report a change” sends what the sign says (no dogs, allowed on a leash, allowed off leash), the period and hours you chose, an optional note (280 characters at most), the day you saw it and the public place concerned — never your location. The photo of the sign is optional; it is re-encoded on your phone (reduced size, without the camera metadata, so without the position where the picture was taken) then uploaded to a private storage space, with no public link. Who sees it: you and the Woona team, to check the sign; never other members. It is read by no AI. For how long: it is deleted 180 days after the decision on your report (published or declined), or with your account. Why: to correct the access rules shown in the app. When two Woonauts report the same thing without a photo, the rule is published automatically, as “seen by Woonauts, not verified” (your name is not shown); never to lift a ban. You can also answer “Still accurate?” on a rule, or, after “Let others know I’m here”, the question “Are dogs allowed here today?”: Woona keeps your answer (one per rule) and only shows the total.
• Health (optional): today’s step count and energy expenditure, read from Apple Health / Health Connect with your consent, to display your activity rings. This data stays on the device — it is neither sent to our servers nor shared. From version 1.5, the app also reads, when you start a walk and in “Correct”, your step history for the last hour, to offer to count the walk from the time you really started walking. The steps stay on the phone; if you accept, only the walk changes: its start time, and an estimated duration and distance for that first stretch, without a track. Likewise, if on your return you keep an outing left unanswered, the app reads the steps of that outing to estimate its distance: only the walk is recorded, never the steps.
• Reminders during the walk (version 1.5 and later): water reminders and the end-of-walk notification are local notifications, scheduled by your phone; your answer (“Done”) stays there. Nothing is sent for this.
• Veterinary emergency numbers (optional): label and number that you enter yourself (on-call clinic, animal poison control centre, night vet). These are professional lines, but the list remains private — it tells where you live and whom you consult. Visible to you alone: neither your friends nor a co-owner of your dog can access it.
• Woona Collar & Base (closed beta, optional): if your account is part of the hardware beta and you pair a Woona collar, we store the dog’s activity measured by the collar (per day: active and intense minutes, score, impacts, battery of the unit) and the collar’s technical identifiers. If you add a Woona Base (a fixed unit that listens to the collar by radio at home), its identifiers and the dog’s presence within its range are added: “entered / left” events, with the time and the strength of the radio signal. No position: neither the collar nor the Base has a GPS, nothing computes or stores coordinates — only “within range of the unit, or not”. This data is visible to you and to the dog’s co-owners, to nobody else.
• Walkers’ leaderboard (version 1.5 and later): from your walks recorded by the app (never from a walk entered by hand or imported), our servers compute a regularity score (duration, number of days out, variety of places — a grid cell of about 1 km around the centre of the walk, never shown to anyone), your league of the month and your challenges (version 1.6: drawn each month from a catalogue, or added by the team, all computed by our servers from your recorded walks, never from a declaration). This computation is visible only to you: it lets you see your own rank. Appearing in the leaderboard is a choice, off by default (Settings › Privacy): other members then see your display name and your profile photo, the name and photo of the dog you choose, your city and your points and, since version 1.6, your league (Bronze, Silver, Gold, Platinum) — never more precise than the city, never your tracks or your times; your challenges and your trophies remain visible to you alone. To place you in your city and region, the app sends the official code (INSEE) of your profile’s municipality, computed on your phone; outside France, the name of your profile’s city is used, with the code of its region (Belgian region, Swiss canton, administrative region of Quebec), also inferred from that name on your phone. Since version 1.6, you also compete in your country and worldwide, among your friends and in each of your groups — always among enrolled members only —, and your walks are counted in your time zone (that of your phone, already recorded for your reminders). A blocked person cannot see you, and withdrawing takes effect immediately. If you wish, at most one notification per week tells you when you climb the ranks, and (version 1.6) another when you complete a challenge; each can be turned off in your settings.
• Your requests to the team (“Contact us”, called “Report a bug” until version 1.5.0): the message you write to us (a question, an idea, a problem), its category, the screenshots you attach (up to four) and, since version 1.7, a video if you attach one (a screen recording picked from your photos, one minute and 50 MB at most; its metadata is not removed: a screen recording holds no location, a filmed video may hold one, which we do not read) — screenshots and video are stored in a private space, readable by you and the team only —, and, to help us understand, the screen you send it from, the app version, the operating system and the model of your phone. Since version 1.5.1, My requests (Us › Help & about) shows you the status of each one and the team’s answer; nobody else sees them. When you send a request, the team is notified by a notification and by an internal email (your message and the information above, without your name or your email address). You can delete a request at any time, with its screenshots, its video and our answer.
• The weekly recap by email (version 1.8): only if you turn it on (Settings › Notifications, or the recaps screen; off by default). On Monday at 8 AM, your phone’s time, we email the address of your account your dogs’ week: the figures of their recap in the app (distance, walks, time outdoors, highlights), an image of the week’s tracks (the lines of your walks, with no map underneath), their weight, your own week on foot, your league if you play in the leaderboard, your health reminders and group outings for the week. Nothing is sent if the week had no walk. We keep a sending log (your account, the week, sent or not) so we never email you twice for the same week. Every email carries an “Unsubscribe” link that turns the option off with a single button, without signing in. It holds no tracking pixel and no tracked link: we do not know whether you opened it.
• Technical: push notification token, minimal technical logs.
• Crashes and performance: when the app crashes or hits an error, a technical report is sent to Sentry: the error and where in the code it happened, the app version, your phone’s model and system, and the app’s last technical actions before the error (screens opened, addresses of the requests sent to our servers, which may contain your account’s internal identifier). One session in ten also sends speed measurements. We attach neither your name nor your email address, and we do not link these reports to your account. They are used only to fix failures.

3. Legal bases

• Performance of the service: account, profile, dogs, content you create.
• Consent: location (including background), push notifications, announcements from the Woona team (off by default, “News and announcements from Woona” setting), device health data, AI advice, appearing in the walkers’ leaderboard, the weekly recap by email (off by default).
• Legitimate interest: security, abuse prevention, moderation, fixing failures (crash and performance reports).

You can withdraw a consent at any time (system / app settings).

4. Retention period

As long as your account is active. On account deletion (possible directly from the app), your personal data is erased within 30 days, unless a legal retention obligation applies. Your phone’s notification token is removed from our servers when you sign out.

A deleted post is no longer served, photo included, as soon as it is deleted; its text is permanently erased 30 days later. Photos in the stay log are deleted 30 days after the stay ends (section 2). Photos of a sign attached to a dog access report are deleted 180 days after the decision on the report (section 2). A service provider’s document (insurance certificate, registration, training certificate) that has expired for more than a year is deleted, file included; a document with no end date goes with the profile or the account. A daycare listing, its team and photos live as long as the listing exists: closing it, or deleting your account, erases them. Screenshots and the video attached to a “Contact us” request are kept as long as the request exists; they go with it when you delete it, and with your account. The sending log of the weekly recap by email keeps thirteen weeks, then is erased. A withdrawn lost/found alert disappears with its photo; a resolved alert no longer keeps the exact place (rounded to about 500 m) and is no longer readable by other members 30 days later.

5. Recipients / processors

The content you publish is visible according to the audience you choose (public, friends, group). Your data is not sold. Technical processors:

About elevation gain. To display the elevation gain of a suggested route or of a walk you have done, the server asks IGN for the ground altitude at about a hundred points of the track. The request carries neither your identity, nor your account, nor the date of your outing: only coordinates, sent by our server (never by your phone). The result is recorded on the walk and is not requested again.

About the weather. The weather comes from Open-Meteo, which never receives your identity or your exact position: only a coordinate rounded to ~11 km (a 0.1° cell). Three uses: the heatwave alert and the walk reminder, prepared by our server from the point of your lost-dog alerts (“My alerts point”, “Home” before version 1.6) if you have filled it in, otherwise from the centre of your last walk; the weather on the home screen, from your current position; and, from version 1.5, the pace of water reminders during a walk, from the walk’s position, re-read at most every 30 minutes. For the home screen, our server receives your position and rounds it before querying Open-Meteo; for water reminders, the rounding is done on your phone before anything is sent. If our server does not respond, the app queries Open-Meteo directly, with the coordinate rounded on the phone. To display official weather warnings, the server asks the Base Adresse Nationale for the département of that same rounded cell, and reads Météo-France’s national warning map, which receives nothing from you. No new data is collected for any of this.

Name of the municipality. The name shown next to the weather (“Near…”) is computed on your phone, from a directory of French municipalities embedded in the app (source: INSEE / IGN via geo.api.gouv.fr, Licence Ouverte 2.0) and, since version 1.6, of the municipalities of Belgium, Luxembourg, Switzerland and Quebec (source: OpenStreetMap, ODbL). In these countries, no request is sent to name your position. Elsewhere, the app queries the geocoding service, and again only with the coordinate rounded to ~11 km.

Transfers outside the EU rely on appropriate safeguards (standard contractual clauses).

Countries where your data may go. Germany and France (hosting, emails, map and weather services); the United States for the sole services marked “United States” in the table above. If you live in Switzerland, Germany and France are recognised by the Federal Council as offering an adequate level of protection; for transfers to the United States, the transfer relies on the same contractual safeguards. If you live in Quebec, your personal information is therefore communicated outside Quebec: we carry out a privacy impact assessment before any communication of this kind, and a written contract governs each provider. If you live in Monaco, these transfers outside the Principality are governed by Law No. 1.565 of 3 December 2024 and rely on the same contractual safeguards.

6. Your rights (GDPR)

Access, rectification, erasure, portability, restriction, objection. To exercise them: contact@woona.app. You can also delete your account directly from the app (Us → Account & security → Danger zone): deletion is immediate, with no grace period. If your account is linked to “Sign in with Apple”, it also revokes the authorisation granted to Woona at Apple.

A complaint? Write to us first; we answer within one month (thirty days in Switzerland and Quebec). You can also contact the authority of your country:

• France: CNIL (cnil.fr);
• Belgium: Data Protection Authority (autoriteprotectiondonnees.be);
• Luxembourg: National Commission for Data Protection (cnpd.public.lu);
• Switzerland: Federal Data Protection and Information Commissioner, FDPIC (edoeb.admin.ch);
• Quebec: Commission d’accès à l’information (cai.gouv.qc.ca);
• Monaco: Personal Data Protection Authority, APDP (apdp.mc).

Portability. There is no “export everything” button in the app yet: the request is made by email, at the address above. A walk, however, can be retrieved right away, in GPX format, from its page (see just below).

Exporting a walk (GPX). From a walk’s page, you can obtain its track in GPX format and send it wherever you like. Worth knowing before you do: a GPX contains exact coordinates, not a picture — and a dog walk often starts from home. The app therefore offers by default to trim 500 m at the start and at the end, and lets you choose to export the whole route. This cut removes the most obvious clue; it does not make the route anonymous.

6 bis. Cookies and audience measurement on the website

This website sets no cookies and embeds no third-party tracker — no Google Analytics, no social network button, no advertising network. That is why you see no consent banner: there is nothing to consent to.

To know whether the website is visited, our server counts the pages served: “the home page was served 42 times on 16 September”. This count keeps neither IP address, nor identifier, nor browser fingerprint, and therefore can neither recognise you nor tell two visits apart. No personal data is processed for this purpose.

For the security of the web app, your browser may also report to our server a resource it would have refused to load (a “CSP” report). We keep only the kind of resource and the name of the site involved — no IP address, no page, no identifier.

The only exception, and only if restricted access is enabled: a strictly necessary cookie remembers that you have entered the access password. It is exempt from consent under Article 82 of the French Data Protection Act (loi Informatique et Libertés). The application itself is covered by the sections above.

One more point, for completeness. The website’s fonts are served by woona.app itself: no request goes to a third party to display them. And to prevent event pages from being scraped in bulk, our server counts, in memory and for one minute, the event pages requested by a given IP address; this count is written nowhere.

7. Minors

Minimum age required: 16, whatever your country. Woona is not intended for younger people. In Quebec, the law requires a parent’s consent to collect the personal information of a child under 14: as Woona is restricted to people aged 16 and over, we do not knowingly collect any information from a child of that age. If it has happened, write to us at contact@woona.app: the account and its data will be deleted.

8. Security

Access protected by authentication and row-level access rules (RLS) on the database side. Exchanges encrypted in transit (HTTPS).

If an incident affects your data (unauthorised access, loss, leak), we record it in a register, we report it to the competent authority within the prescribed time (72 hours for the CNIL, “as soon as possible” for the FDPIC and for the Commission d’accès à l’information) and we notify you directly when it presents a risk to you.

9. If you live outside France

Belgium and Luxembourg. The GDPR applies as in France: same rights, same legal bases; only the supervisory authority (section 6) changes.

Monaco. Law No. 1.565 of 3 December 2024 on the protection of personal data gives you rights close to those of the GDPR: access, rectification, erasure, objection and portability. You can contact the Personal Data Protection Authority (section 6).

Switzerland. The Federal Act on Data Protection (nFADP) gives you the same essential rights: access, rectification, erasure, objection, and delivery of your data in a common format. The destination countries of your data are listed in section 5.

Quebec. The Act respecting the protection of personal information in the private sector (Law 25) gives you the right to access your personal information, to have it rectified, to withdraw your consent, to obtain a copy of it in a structured, commonly used technological format, and to ask that its dissemination cease. We ask for your consent for each specific purpose, separately: location, for example, is active only after your authorisation in your phone’s operating system, and appearing in the leaderboard is off until you have chosen it. If you create your account in Quebec, it starts, without you having to do anything, as soon as Woona knows that you live there (the city chosen during onboarding, your location, or the country chosen from the list during onboarding or in Settings › Country; the country is asked during onboarding), at the most closed level of each setting: profile absent from search and from discovery and shown to nobody, details, published photos and dogs “Only me”, nobody can tag you, only your friends can message you directly (others have to ask), and no Woona group is joined automatically. Woona then asks you — during onboarding, or on the Home screen if your country is only known later — whether you want to be findable by other members and your friends to see your details, your photos and your dogs, and whether you want to join Woona Quebec and Woona World (and, since 1.7, Woona News). Without an answer, everything stays closed: you are the one who chooses to open them, there or in Settings › Privacy. A parent’s consent before age 14 is dealt with in section 7, and the person in charge of the protection of personal information is named in section 1.

10. Changes

This policy may change; the date at the top indicates the latest version.