Summary. Mis Plumas works local-first: your data lives on your device. If you enable the optional cloud sync, your data travels encrypted to our own server in the European Union to keep your devices up to date — and you can delete it from there at any time.
Introduction
At Mis Plumas we value your privacy above all. This policy explains how we handle data inside our app dedicated to bird-breeding management.
Information we collect
The app lets the user enter local information for managing their aviary:
- Bird data (rings, species, sex, dates, notes).
- Pair management and their broods.
- Pedigree trees generated from your entries.
- Bird photographs (stored locally or referenced from your gallery).
Use of information
All collected information is used exclusively for the internal operation of the app:
- Breeding statistics.
- Pedigree visualization and genetic calculations.
- Bird inventory management.
- Scheduling local notifications (hatching alerts, etc.).
Required permissions
To offer a complete experience, we request the following permissions:
- Storage / files: to let you store bird photos and make manual backups of your database.
- Notifications: to alert you of important events in your breeding calendar.
- Location (optional): to calculate daylight hours and find nearby listings. Search uses your position only at that moment and does not store it; if you publish a locality, the app uses the approximate centre of the selected municipality, never your home location.
Backups
The app includes a backup feature. When you choose to export a copy, a local file is generated on your device. You decide where to share or save that file (Google Drive, email, etc.). We do not have access to those backups.
Website and contact form
The public website uses neither advertising nor analytics trackers. If you send the contact form, we process the name, email, subject and message you provide so we can reply. To prevent abuse, your IP is transformed into a hashed identifier for temporary rate limits and, when enabled, the anti-spam challenge may be served by Cloudflare Turnstile or hCaptcha, which receive the technical data needed to verify it. Do not use the form to send your PIN or sensitive health information.
Security
As a local app, the security of your data depends on the security of your own device. We recommend keeping your operating system up to date.
Changes to this policy
We may update this policy occasionally. Any change will be notified through the app itself.
Cloud sync (optional)
If you enable Cloud sync (off by default), we process this data to provide the service (Art. 6(1)(b) GDPR). Abuse prevention and moderation also rely on our legitimate interest in keeping the service safe (Art. 6(1)(f)):
- Account: your identifier (federation code + breeder number, or email) and PIN, stored as an irreversible hash. The optional recovery email is used to verify the address, reset the PIN and send security notices.
- Aviary data: the information you enter (birds, pairs, clutches, health, finances, etc.) and, if you allow it, photos, videos and documents.
- Transfers between accounts: “Visible for transfers” allows someone who knows your exact identifier to send you an offer. The bird record, message and selected attachments are shared only with the specified account.
- Listings and breeder profile: if you enable publishing, other authenticated accounts can see your public name, country and the fields you choose to show —area or locality, breeder credential and logo— together with published offers or wants. A listing projects only the selected bird data, text, modality, price/ring/photo when authorised, and the approximate municipality position if enabled. These are not open or indexable web pages.
- Contact and interaction: email and phone are never part of the bulk catalogue; they are delivered on demand to an authenticated account that taps Contact, only when you made that channel visible and under anti-abuse limits. We also process blocks, reports, per-account deduplicated view/share totals and, when used, a star rating tied to an accepted transfer. There is no in-app chat and we do not process payments.
The misplumas.es/cesiones/… web link is only a bridge to open or download the app: it displays no listing or breeder data.
Where: on Mis Plumas' own server hosted in the European Union (Hetzner Online GmbH, Germany/Finland, as infrastructure processor). Transactional emails are sent through Mailtrap (Railsware). There is no advertising.
Security and transparency: data travels encrypted (TLS) and access is restricted. There is no end-to-end encryption: the server operator could technically access data for maintenance, security or incident support; it is not used for advertising.
Retention: for as long as your account exists. Aviary items you delete remain in multi-device trash for 30 days and are then removed permanently. Technical server backups rotate within 7 days. Withdrawn listings leave the active catalogue immediately; minimum moderation, security and anti-abuse records are kept while needed to protect the service.
Transfers: a pending offer expires after 30 days. The optional ZIP is retained for at most 90 days after acceptance, reduced to 30 days once the recipient confirms import. The structured history remains while at least one participant account exists and is deleted once both are gone.
Your controls and rights: you can withdraw listings, disable publishing, hide each optional field, block breeders and delete your account and all its content from the app (Settings → Data → Cloud sync) or through the public account deletion page. Exercise access, rectification, portability and other GDPR rights through Contact. If you do not enable cloud sync, your aviary data is not sent to Mis Plumas; only data you choose to submit through independent services such as the website contact form is processed.