Privacy Policy
Data controller
Doris Kayser, BSc
Raffelding 22, 4070 Fraham, Austria
Email: hello@dentiluna.com
Phone: +43 660 47 55 166
General
This privacy policy explains which personal data is processed when you use the Dentiluna app and for what purpose. Processing takes place in accordance with the General Data Protection Regulation (GDPR) and the Austrian Data Protection Act (DSG).
Registration & sign-in
When you first open the app, it automatically creates an anonymous account (Firebase Authentication). It contains only a random account ID, no name and no email address. If you later sign in with email, Google or Apple, we use Firebase Authentication and process your name, email address and account ID. The legal basis is Art. 6(1)(b) GDPR (performance of a contract / pre-contractual measures). Recipients are Google Ireland Limited (Google sign-in, Firebase) and Apple Distribution International (Sign in with Apple) under their own privacy notices.
Your child's profile
When you create a child profile, you voluntarily provide your child's first name, optionally their last name, and their date of birth. Also stored are the chosen mascot with its color and settings such as the tooth view. This data is used solely to display age-appropriate dental development information in the app. Children do not create their own account and do not sign in to the app themselves. You, as the legal guardian, enter this data. The legal basis is Art. 6(1)(b) GDPR.
Your child's health data (tooth status and brushing history)
Dentiluna stores your child's tooth status. This covers the teeth with the date they came in, became loose or fell out, optional notes, and values estimated from the date of birth. We also store the brushing history. This covers when and for how long your child brushed, plus the stars and streaks that result. This is health data under Art. 9 GDPR.
We process this data only to provide the app's features. We do not use it for advertising. The legal basis is your explicit consent as legal guardian under Art. 9(2)(a) and Art. 6(1)(a) GDPR. You give it when you create the child profile by ticking a box. It is not pre-ticked. As proof, we store with the profile which version of the consent text you confirmed and when.
You can withdraw your consent at any time with effect for the future. To do so, delete your child's profile or your account in the app. Processing before then remains lawful. Without consent we cannot create a child profile, because the app does not work without this data.
Sharing with invited people
You can invite other people, for example the other parent or grandparents, to a child. Invited people can see that child's data in the app and, depending on their permission, add or manage entries. For the invitation we store the name you give for the person and their relationship to the child. Everyone with access can see each other with their name and relationship to the child. You can revoke invitations and withdraw an invited person's access at any time. Only invite people you trust. No one else gets access to your child's data.
Cloud storage
Your account and profile data is stored in Cloud Firestore. The data resides on Google Cloud servers in the europe-west3 region (Frankfurt, Germany) and therefore within the EU. Because the parent company, Google LLC, is based in the USA, access by US authorities under the US CLOUD Act cannot be fully ruled out; as an additional safeguard we rely on the European Commission's Standard Contractual Clauses (Art. 46 GDPR). More information: https://firebase.google.com/support/privacy
Settings
Settings such as language, date format, week start and sound effects are stored locally on your device (shared_preferences). Language, date format and week start are also stored in your profile in the cloud, so they are the same on all your devices. All other settings never leave your device.
In-app purchases
Dentiluna Pro is purchased through the App Store (Apple) or Google Play. We never see or store payment data such as credit card details. To manage your purchase and unlock the Pro features we use RevenueCat (RevenueCat, Inc., USA). This processes your account ID, information about your purchase (for example product, purchase time, status) and technical device information. RevenueCat receives no information about your child or any health data. RevenueCat processes the data on our behalf under a data processing agreement. The legal basis is Art. 6(1)(b) GDPR. Apple's and Google's respective privacy policies also apply. More information: https://www.revenuecat.com/privacy
App stores
When you download and install Dentiluna via the Apple App Store or Google Play, Apple and Google respectively process their own data (e.g. device identifiers, purchase history) over which we have no control. The respective privacy policies of Apple and Google apply.
Crash reporting
To detect and fix software bugs, we use Firebase Crashlytics by Google Ireland Limited. If the app crashes, technical diagnostic data such as device model, operating system version, app version, and the error message with stack trace is sent to Google; your account or profile data is not included. The legal basis is our legitimate interest in a stable, functioning app (Art. 6(1)(f) GDPR). More information: https://firebase.google.com/support/privacy
Abuse protection
To protect the app from abuse, we use Firebase App Check by Google Ireland Limited. Google checks whether requests come from the genuine, unmodified app on a real device. This processes technical device and app information. The legal basis is our legitimate interest in operating the app securely (Art. 6(1)(f) GDPR).
Analytics, tracking & advertising
Beyond this, we currently do not use any analytics, tracking, or advertising services (e.g. Google Analytics or advertising IDs) in the app. Should this change, we will update this privacy policy accordingly.
International data transfers
Signing in with your Google or Apple account (Firebase Authentication, Google sign-in, Sign in with Apple) uses these providers' global infrastructure, which can result in data being processed outside the EU, for example in the USA. Google Ireland Limited and Apple Distribution International have committed to the EU Standard Contractual Clauses, which are intended to ensure an adequate level of data protection. RevenueCat, Inc. is based in the USA. We rely on the EU Standard Contractual Clauses for this transfer. Your profile data stored in Cloud Firestore itself remains in the europe-west3 (Frankfurt) EU region.
Retention period
We store your data for as long as your account exists. After you delete your account or your child's profile, directly in the app or by request via email, the data is removed within one month unless we are legally required to retain it longer. To protect against data loss we create automatic backups of the database. They are also stored in the EU region europe-west3 (Frankfurt) and are deleted automatically after 30 days at the latest. Deleted data can therefore remain in these backups for up to 30 days longer.
Data security
Your data is transmitted in encrypted form (TLS). Access to your data is technically and organizationally restricted to what is necessary. Within the app, only you and the people you give access to can see your child's data.
Your rights
You have the right to access, rectify, erase, and restrict the processing of your data, as well as the right to data portability and objection (Art. 15–21 GDPR). You can delete your account and your children's profiles at any time directly in the app. You may withdraw any consent you have given, including the consent for your child's health data, at any time, with effect for the future. For any other requests, contact hello@dentiluna.com.
Right to lodge a complaint
You have the right to lodge a complaint with the Austrian data protection authority:
Österreichische Datenschutzbehörde, Barichgasse 40–42, 1030 Vienna, Austria
Email: dsb@dsb.gv.at, Web: www.dsb.gv.at
Changes to this privacy policy
We update this privacy policy whenever the app or the legal situation changes. Last updated: October 2026.