Account and data deletion

What this page is

This is the public instruction for deleting a ZooPlanet account and the data attached to it. It is a page of its own rather than a paragraph in the privacy policy on purpose: the app stores require an address that opens in a browser, with no app installed and no sign-in, and this is that address.

It applies equally to an account created on the website and one created in the mobile app — they are the same account.

How to request deletion

From the app is easiest: open the account tab and choose account deletion. The request travels from your signed-in session, so we need no further proof of identity, and the acknowledgement reaches you by e-mail within minutes. Sending the same request twice does nothing twice — an account can have only one open request at a time.

E-mail works just as well, with the app or without it: write to kontakt@zooplanet.org from the address on the account, saying that you want it deleted. If you no longer have access to that address, write from any other and give us the account's address plus a few details that let us recognise it — the name it was opened under, the shelter you volunteered at, or the date of your last donation. In that case we will ask for additional confirmation, because deleting on an unverified request is simply another way for somebody to lose an account.

Say whether you want full deletion or only part of it — both are possible and both are described below. The app has a field for a reason, and it is optional.

• If you write by e-mail, the subject line: "Account deletion".
• The e-mail address of the account to be deleted.
• Whether you also want the donation records erased so far as the law permits, or whether that does not matter to you.

How long it takes

A request sent from the app is acknowledged automatically, by e-mail, within minutes; a request sent by e-mail is answered within a few working days. We carry out the deletion within thirty days at the latest, counted from the point we have established the request really comes from the account holder. That is the period the Law on Personal Data Protection sets and we keep to it.

Until the deletion happens the account works normally: you can sign in and use the app, and if you have changed your mind, replying to the acknowledgement is enough. When it is done we tell you what was deleted and what, under the rules in the section below, remained. Disk backups taken before the deletion expire by themselves within seven days and we do not restore them.

What is deleted

The following leaves the database and cannot be recovered:

• the first name, last name and e-mail address on the account;
• the password (bcrypt hash) and the session token, which ends any possibility of signing in;
• your list of favourite animals, everything you follow, and every reaction you left;
• e-mail confirmation and password reset tokens, if any exist;
• your daily digest subscription and everything attached to it;
• your membership of any shelter, which ends every right to write.

What remains, and why

An account that never published, noted or donated anything is deleted outright, as a row in the database. An account that did cannot be deleted outright, and that is not our decision but a property of the database itself: posts, care-journal notes, the animal-of-the-day pick and payments all point at the user, so the database refuses to delete the row they reference. Working around it would take an animal's whole care history and a record of other people's money down with the account.

What we do instead is this: we strip the first name, last name, e-mail address, password and token from the account, so that the row survives only as an unnamed reference carrying nothing by which you could be identified. Posts and notes stay with the animal, but they no longer name anyone.

Three things remain even after that, and each has a reason that is not our convenience:

• The record of donations and of their transfer to shelters: amount, date, currency, Stripe's transaction identifiers and which animal or shelter the gift was earmarked for. It is a record of other people's money and accounting rules require it. We remove the donor's e-mail address from it as soon as it stops being necessary for those rules.
• The shelter administration log: entries recording who changed settings, roles or membership and when, together with the e-mail address held at the time of the action. That log exists so a shelter can reconstruct what happened and is deliberately immutable. If it holds entries about you that the shelter no longer needs, ask and we will consider each one.
• Photographs of and writing about animals, which belong to the shelter's pages. The next section covers those.

Photographs and writing about animals

A photograph of a shelter dog and a description of its costs are data about that animal rather than about you, and they stay on its profile after your account is deleted — otherwise one volunteer leaving would erase the history of every animal they ever wrote about.

That does not leave you without a say. If you want a particular photograph or caption removed, tell us which and we will remove it. If you are in the photograph yourself, rather than only the animal, we will remove it without asking anything further.

Data on your phone

Uninstalling the app does not delete the account on the server — those are two separate things. The deletion request is sent from inside the app, on the account tab; removing the app sends no request at all.

What does live only on the phone — the queue of photographs not yet sent, the cache of downloaded images, and the sign-in details in the system vault — goes when you uninstall. Signing out of the app clears the sign-in details straight away; the queue stays until it is sent or until you uninstall.

If you do not want to delete everything

Deleting the account is not the only option and it is not all or nothing. You can ask only for the daily digest to be switched off, only for one photograph to be removed, only for your name to be taken off your posts, or for a copy of everything we hold about you.

All of it goes to the same address, kontakt@zooplanet.org, and within the same period.

If you are not satisfied with our answer

If you believe we refused a request without grounds or missed the deadline, you can complain to the Commissioner for Information of Public Importance and Personal Data Protection, Bulevar kralja Aleksandra 15, 11120 Belgrade.

We would be grateful for the chance to put a mistake right first, but that is in no way a precondition.