Animal welfare, on the record.
Anonymous by design.
Strong laws.
No reporting infrastructure.
Greece has some of the strongest animal welfare laws in Europe, yet official counts of millions of stray animals remain non-existent.
The legal framework exists, but the reporting mechanism for a safe path from witness to prosecutor does not. Filing a report today often means walking into a police station and identifying yourself.
For many witnesses, that identifying step is a bridge too far. Our goal is narrow: lower the friction, route the report to the right desk, and refuse to become a privacy liability for the people who help.
Report. Route.
Record in 90 seconds.
How a welfare report moves from witness to prosecutor.
Report.
A witness sees an animal in distress, snaps a photo, and confirms the location. No accounts, no logins, no personal details.
Route.
The report is relayed in-memory directly to the authorities. Photos are stripped of digital fingerprints twice, on the phone and on the server.
Record.
Once sent, the report is gone from our system. We only store coarsened data like a general region and the month to help the community.
The privacy contract is the schema.
Witness fear is the rate-limiter on cruelty reporting. So we made the privacy contract impossible to break by design.
Most apps protect data with policies. We protect it by not having a database table that could hold it. Below is the exact line between what we store and what we discard immediately.
In-memory relay.
Reports are processed inside an Edge Function, sent out, then vanished. Photos and IDs never touch persistent storage.
Anonymous aggregates.
We only keep four fields. Enough for a public heatmap, not enough to identify anyone or anything.
External audit.
A written privacy audit and an automated test suite verify that the schema and the relay keep their promises. The audit is the contract; the tests catch drift.
What the public sees
is the only thing we store.
A map of cruelty trends in Greece. No individual reports exist.
The public heatmap uses only our four-field aggregate. Each cell represents a 9km square and a single month. Cells brighten as report frequency increases. No individual report is recoverable from this data because the individual data simply doesn't exist below it.
Mainstream, reliable, verifiable.
Boring is better. We choose audit-friendly tools.
Every layer is mainstream and replaceable. The privacy properties live in the architecture itself, not in a single vendor. If we change a tool, the contract we have with our users still holds.
Privacy audited.
App in active development.
Welfare infrastructure should be unable to harm the witnesses who use it.