Privacy Policy

Who the controller is

The data controllers are two individuals acting jointly: Evgenii Bagrov and Aliaksandra Kuchynskaya.

The app is published from two developer accounts: on the App Store by Evgenii Bagrov, on Google Play by Aliaksandra Kuchynskaya. They determine the purposes and means of processing together and are responsible for it together. That is the essence of their arrangement as joint controllers within the meaning of Article 26 GDPR.

You may contact either of them, and that is enough to exercise any of your rights in respect of both. The single address for requests is [email protected].

Postal address of both: 30 Nekrasova St., Voronovo, Grodno Region, 231391, Belarus.

We reply in English and Russian.

Both controllers are established outside the European Union. A representative in the Union under Article 27 GDPR has not been appointed as of this publication; once appointed, their name and address will appear in this section.

What is collected

Account. Your email address — required, and it is also how you sign in. Your name, if you give one. You can sign in with a one-time code sent by email, or through Google or Apple; in the latter two cases we receive your email address from them, and your name if you allowed it. The product has no passwords at all.

Pet data and archive. Name, species, breed, sex, date of birth, chip number, weight, diagnoses, medications, vaccinations, reminders. Documents you upload: photos and files of clinic forms, and the values extracted from them automatically. Emails forwarded to your family address: the sender’s address, subject, time received and attachments — the attachments become archive documents; the body of the email is not saved to the archive. These describe an animal, but they are tied to your account.

Family. Who is in your family, their roles, and invitations. An invitation contains the invitee’s email address.

Trips. Route, dates, checklist state.

Subscription. Subscriber identifier, plan state, purchase and refund events. Payment details never reach us: payment happens entirely inside the App Store and Google Play; we neither see nor store card or account numbers.

Technical. Application error reports. App-usage statistics are collected only if you agreed at the “Help make the app better?” step (in the Android app, “Help the app grow?”). You can withdraw consent to future collection in settings; data already sent remains part of processing carried out lawfully. In iOS versions where Standard attribution of our own Apple advertising is enabled, it works without an ATT prompt: RevenueCat receives Apple Ads attribution metadata, including organisation, campaign, ad-group, ad, keyword, conversion-type and country information, and links it to the subscriber identifier and purchase events. App-usage statistics, archive content, diagnoses, measurements and documents are not sent for attribution. We receive a push notification token if you allowed notifications.

Measuring our Meta ads (Android only). Only if you agreed at the “Help the app grow?” step or turned on “Tell Meta about the install” in settings. The app then sends Meta the fact of installation once, together with the Google advertising ID, a random installation identifier, the Google Play install referrer if you came from a Meta ad (which lets Meta recognise its own ads), the Facebook app’s identifier if the Facebook app is installed on your phone, device and app information — model, OS version, language, time zone, mobile carrier, screen size and density, number of processor cores, total and free storage, the app’s name and version and the store it was installed from — and your IP address, from which Meta may infer your approximate location: country, region or city. App opens, time spent in the app, purchases, pets, archive content, diagnoses, measurements, documents and what you do in the app are not sent to Meta. Before you consent, the Meta module in the app does not start at all. The iPhone app has no Meta module.

Vet and sitter links. If you create a link, whoever holds it sees exactly what you put in it. We record that the link was created and when it expires.

Partner programme. If you arrived through a clinic, pet transporter or blogger link — the partner code and the fact of attribution. If you left your email on a partner page — that address, kept for 30 days.

Complimentary access. If we switched on a free plan for your family — the email address you gave us for that, and the date and reason it was granted. For such families we look at usage counts to understand what the product is good for: how many pets, documents, family members and vet links have been added. The content of the archive is not part of those counts.

Correspondence. The messages you send us and our replies.

Why, and on what legal basis

To make the product work — performance of our contract with you: sign-in, storing the archive, reading documents, reminders, travel checklists, vet and sitter links, subscription and its state.

Product analytics and push notifications — only with your consent. You can withdraw consent in the app’s settings; withdrawal does not affect the lawfulness of processing carried out before it.

Measuring our Meta ads — only with your consent, in the Android app. You withdraw it with the “Tell Meta about the install” switch in settings: after that the app no longer sends Meta the install, identifiers or device information. An install notice whose sending started before withdrawal (in the first seconds after consent) may reach Meta just after it. Until the app is closed, the module may still ask Meta for its own settings, and Meta will see the IP address of that request. Data already sent remains part of processing carried out lawfully.

Standard attribution of our own Apple advertising — our legitimate interest in measuring the effectiveness of our own campaigns. It uses Apple AdServices Standard without cross-app tracking or access to the advertising identifier; you may object to this processing by writing to [email protected]. After an objection, we delete that customer’s data in RevenueCat and do not enable new collection from the next app launch.

Security and answering your messages — legitimate interest: preventing abuse, investigating failures, corresponding with you.

The product makes no automated decisions producing legal effects for you. The model extracts values from your documents and assembles a summary for a vet, but this is not a medical opinion or a diagnosis — that is stated next to every such output. Decisions remain with the owner and the treating veterinarian.

Who processes the data

We do not sell data and do not share it for anyone else’s advertising. Processing is carried out by contractors, each for a specific task and under contract.

In the European Union: Supabase — database and files, Frankfurt; Railway — background document processing, Western Europe; PostHog — usage statistics with a pseudonymous device identifier, EU servers; Sentry — application errors, Germany; Resend — product email (sign-in codes, notifications) and receiving emails forwarded to your family address, Ireland; Cloudflare — serving the website and shared pages.

In Switzerland: Migadu — the [email protected] mailbox that receives requests about this policy.

Outside the EU: Anthropic (USA) — recognising and interpreting uploaded documents; this is the only transfer of the medical documents’ own content outside the EU. RevenueCat (USA) — subscription accounting and Standard attribution of our own Apple advertising: subscriber identifier, purchase events, and Apple Ads attribution metadata, including organisation, campaign, ad-group, ad, keyword, conversion-type and country information. Google Firebase Cloud Messaging — push delivery only; no archive content goes there. Apple and Google — payment processing under their own rules.

Transfers outside the EU rest on contracts with those processors that include the European Commission’s standard contractual clauses.

Meta Platforms Ireland Limited (Ireland) is not our processor but our joint controller: we and Meta Ireland are jointly responsible under Article 26 GDPR for collecting the data that measures our ads and transmitting it to Meta (Meta’s Controller Addendum to its Business Tools Terms, facebook.com/legal/controller_addendum). Meta carries out further processing as an independent controller under its own privacy policy (facebook.com/privacy/policy), including transfers to Meta Platforms, Inc. (USA). You can exercise your rights under Articles 15–20 GDPR regarding data held by Meta directly with Meta Ireland or through us; we forward such requests to Meta within seven days.

How long data is kept

For as long as your family exists in the product. Deleting a family erases everything belonging to it: pet cards, documents and the files themselves, the timeline, reminders, trips and links. Files are removed by a background service on its next pass.

The internal device-synchronisation log is kept for 90 days and then deleted automatically.

After erasure a record of the erasure itself remains — date and volume. It holds no content; it exists so that the deletion can be proven.

Subscription data and payment events are kept for as long as the stores’ accounting and tax rules require.

Your rights

You have the right to: access your data and obtain a copy; correct what is inaccurate; erase it; restrict processing; object to processing based on legitimate interest; receive your data in a portable form; and withdraw consent where it was given.

Some of these work directly in the app and need no request: the archive can be exported in full at any time, originals included, and it stays available even after a subscription ends. An owner’s data is never locked away — that is a product rule, not a courtesy.

For everything else, write to [email protected]. We answer within one month. If our answer does not satisfy you, you may complain to a data protection supervisory authority — in the EU, the one in your country of residence.

Children

The product is not intended for children. We deliberately do not collect data of people under 16 and do not create accounts for them. If such data reached us by mistake, write to [email protected] and we will delete it.

Changes to this policy

Material changes get a new effective date at the top of this page, and those affecting your rights are announced by email to your account address. Earlier versions are not rewritten after the fact.