Privacy Policy

1. Who is responsible for your information

Pawly is operated by Viktoryia Tamasheuskaya, an individual based in Lithuania, who is the data controller responsible for the processing described here. In this policy, “Pawly”, “we” and “us” refer to this operator.

Privacy contact: privacy@pawlyapp.gripe.

2. Information we handle

• Account information: your email address, account identifier, language preference, email verification status, account dates and sign-in information. Supabase Auth manages password verification and session credentials. Where guest access is available, an anonymous account identifier still links your saved records to that session.
• Pet profiles and weight tracking: information you enter, such as name, breed, sex, birth date or estimated age, adoption details, neutering status and date, microchip number, an optional emergency contact phone number, weight measurements over time, an optional weight goal and notes. The emergency number is stored with the pet profile and is not shown on the public lost-pet page unless you separately enter it in that page’s sharing settings.
• Care routines: routine names and instructions, schedules, completion history, related reminders and any notes or photos you add.
• Food and feeding: foods you save for your pet, such as name, brand, food type, barcode, ingredients, calories and other nutrients, serving size, a product image link and whether it is a favourite; meal logs with the food, meal type, time, quantity, calories and notes; feeding plans and meal times; feeding guidelines from a food package; and an optional daily calorie goal and its notes. For a shared dog profile, the owner and accepted members can see and update that dog’s foods, meal logs and feeding plans. Feeding reminders are scheduled on your device. If you are offline, food changes waiting to sync are kept on your device.
• Barcode and label scanning: if you scan a food barcode, the camera image is processed on your device to read the code. If you scan a nutrition label or feeding guide, the photo you take or choose is read on your iPhone using Apple’s on-device text recognition. Pawly does not upload these camera images or label photos; only the values you review and save are stored.
• Food product lookup: when you search for a food or scan a barcode, Pawly checks its own product catalog, which is built from Open Pet Food Facts data and hosted with Supabase. The app may also send the barcode or your search words directly to Open Pet Food Facts to find a product or refresh its details, and product images may be loaded from Open Pet Food Facts servers. These requests do not include your account details or pet information, but the service receives your device’s IP address and request details.
• Walk tracking on iPhone: if you start a walk, Pawly uses precise device location to calculate distance and record the route while tracking is active, including when the app is in the background or the screen is locked. The route is saved on your iPhone and synced to your private account so you can view it later. Completed walk dates, duration, distance, and any weekly distance goal you set are also saved to your private account. Walk maps use OpenStreetMap tiles when you view a route; the map provider receives tile requests from your device. An interrupted walk or one waiting to sync may be kept temporarily on your iPhone. Finishing or discarding stops location updates.
• Lost-pet QR profile settings: whether sharing is enabled, a random public-link token, and the fields you choose for the finder page: your pet’s name, one selected pet photo, essential care instructions, a primary contact phone number or contact link (including a social media link, Telegram contact or Facebook page), and an optional alternative phone number. A QR code points to this public page. Sharing starts disabled and requires you to enable it.
• Shared dog profiles and chat: when a profile owner invites you and you accept, your account identifier and membership are linked to that dog. The owner and accepted members can access the shared profile and related care records, routines and files. Chat data includes message text, sender name and account, timestamps, replies, reactions, edits, delivery/read receipts and online-presence events. Chat photos and captions, care tasks created from chat, device identifiers, public device keys, encrypted key envelopes and push-notification tokens may also be processed. Chat message text and reactions are encrypted on participating devices for the shared chat; photo files and other dog-profile data are handled separately and are not covered by that chat-message encryption. Push alerts include the dog name and sender, not the message text. Shared walks: if you choose to share a walk in the chat, Pawly sends your live position during that walk to the chat card, and the latest position is stored so the other members of that dog’s chat can follow the walk. Your position is shared only while that walk is active and only with members of that dog’s shared profile; it is not shown to anyone else. Chat key backup: if you turn on chat key backup, your chat keys are encrypted on your device with a key derived from a passphrase you choose, and only the encrypted backup is stored with Supabase so you can restore chat history on a new device. We cannot read the backup or recover your passphrase; if you forget it, you may not be able to restore earlier encrypted messages.
• Care records: vaccinations, treatments, conditions, medications, surgeries, other medical records, appointment dates, clinic or veterinarian names, clinic addresses, and related descriptions and notes.
• Appointment address search: if you search for a clinic address when adding an appointment, the text you type is sent to Photon, an address search service run by Komoot that uses OpenStreetMap data, and the results are shown on an OpenStreetMap map. Pawly does not send your location for this search. The address you choose is saved with the appointment and may be included in that appointment’s reminder notifications and reminder emails.
• Pet Health Brief: the Brief brings together selected information from your pet profile, care records, appointments, routines, weight history and check-ins. Brief edits are stored on your device; check-ins you choose to sync are stored with the relevant pet record. The shareable summary is prepared in the app. Pawly does not send it to another person or service until you choose to share it using your device.
• Photos and documents: the files you select or capture for upload, captions or notes, file names, types, sizes, upload dates and information linking them to a pet. Files may also contain embedded metadata; remove any unwanted metadata before uploading.
• Reminders and birthday messages: titles, descriptions, dates, times, timezone, notification choices, recipient email addresses and delivery status. Device reminders are scheduled locally. For a dog with an exact, known birthday, Pawly may send an annual birthday message to the verified email address on your account. That message may include your dog’s name and age, if available. Birthday and other email reminders are processed by the server.
• Technical information: sign-in IP addresses, device or browser information supplied with requests, session records, timestamps, and operational or security logs. Our hosting and authentication providers process this information to deliver the service and investigate errors or abuse.
• In-app feedback: the feedback category and message you submit, plus any optional rating or feature usefulness selection. The app version and platform are also sent. The feedback record is linked to your account; a copy and your account email are emailed to Pawly support.
• Support messages: your email address, message and any attachments you send when asking for help or exercising your privacy rights.

Pet records, photos and documents can contain information about people, such as an owner’s contact details or a veterinarian’s name. Only upload information you are entitled to share, and avoid including unrelated personal information.

An email address and authentication information are needed for an email account. Most pet details, uploads and reminder options are optional, although a feature may need particular information to work, such as a date for a reminder.

3. Why we use your information

We use account and pet information to provide the features you request: signing in, saving and retrieving records, displaying uploads, tracking weight measurements, walks and care routines, logging meals and feeding plans, looking up food products and clinic addresses, preparing your Pet Health Brief, storing an optional emergency contact number, scheduling reminders and sending birthday messages for exact, known birthdays. Tapping the emergency number opens your device’s calling app; Pawly does not place a call. If you enable a lost-pet QR profile, we use the separate sharing settings you select to make those fields available to people who open its link, so they can identify your pet and contact you. You can disable sharing or replace the link in the app. For shared dog profiles, we use invitations to grant access to the owner’s chosen accounts and provide shared care records and chat among current members. Members can remove themselves; the owner can remove members and cancel invitations. We use chat and presence data to deliver messages, show activity and manage notifications.

Pawly Guide contains general educational information and links to further reading. It is bundled in the app and does not use your pet profile to generate personalised health advice. Opening an external reference takes you to that publisher’s website, which handles your request under its own privacy policy.

We use technical information and support correspondence, including in-app feedback, for our legitimate interests in keeping Pawly secure, understanding and improving the service, resolving problems and responding to enquiries. We consider your privacy rights when relying on these interests. We may also process information to meet legal obligations or establish, exercise or defend legal claims.

Where an activity requires consent, we ask separately and you may withdraw it. Device permission prompts let you control access to features such as the camera and notifications; granting a permission does not authorise unrelated uses of your information.

We do not sell your personal information or use it for targeted advertising. Pawly does not make decisions with legal or similarly significant effects about you through automated profiling.

4. Service providers and sharing

Pawly uses the following services to deliver its features:

• Supabase: account authentication, database hosting, private photo and document storage, feedback records, and server functions. For shared dog profiles, Supabase stores the profile, care data, chat metadata, encrypted chat text and private chat photo files and applies account membership access rules. Chat device public keys and encrypted key envelopes support device encryption. For an enabled lost-pet QR profile, a Supabase server function provides only the selected public fields and selected photos to the Pawly website. See Supabase’s privacy policy.
• Google Firebase Cloud Messaging and Apple Push Notification service: delivery of chat push alerts to your device. They receive a device push token and the alert content (the dog name and sender, not the message text) so the alert can reach your phone. See Google’s and Apple’s privacy policies.
• Resend: delivery of reminder emails, birthday messages and in-app feedback notifications to Pawly support. Feedback notifications include your account email and submitted feedback details, which may include your message, category, rating or feature usefulness selection, app version and platform. For a birthday message, Resend receives the verified account email address and message content, which may include your dog’s name and age. For an enabled email reminder, the recipient address and reminder details are sent to Resend; an appointment reminder email may include the appointment title, date, time, clinic name and clinic address. Account verification and password reset messages are handled by the authentication service and its configured email delivery provider. See Resend’s privacy policy.
• Cloudflare: hosting and delivery of the website, account confirmation and password reset pages, and public lost-pet QR pages and the selected pet photo. A finder’s request can include their IP address, browser information and requested URL; Cloudflare delivers the public details you chose to share. QR profile and photo responses use no-store and noindex headers. See Cloudflare’s privacy policy.
• Open Pet Food Facts: an open, community-maintained database of pet food products run by the Open Food Facts association. Pawly’s product catalog uses its data, and the app may request product details, search results and product images from it directly. Those requests include the barcode or search words and your device’s IP address. See Open Food Facts’ privacy policy.
• Photon (Komoot) and OpenStreetMap: address search when you look up a clinic address, and map tiles for the address preview and walk maps. Photon receives the search text and your device’s IP address; OpenStreetMap tile servers receive map tile requests from your device. See Komoot’s privacy policy and the OpenStreetMap Foundation’s privacy policy.

Our email service providers also handle messages sent to our privacy and support addresses. Providers receive information needed for their respective services. Pet records and uploaded files are not published as a public gallery. The lost-pet page is a limited exception: it shows only the fields selected in your sharing settings to anyone who has the link, without requiring a Pawly account. The public page does not return your home address, email address, full pet profile, medical records or internal database identifiers. Do not put sensitive or unrelated personal information in public contact links or care instructions.

We may disclose information where required by law or where necessary and lawful to address fraud, security incidents or legal claims. If you export a record, share a file or choose an email recipient, that recipient receives the information you choose to share. When you share a document from your device, you choose the receiving app or person; their service handles that copy under its own terms, and we cannot control further copies. Use a reminder address you control or have permission to use.

5. Storage, security and international transfers

Pawly’s primary Supabase project is hosted in Ireland. Database access rules restrict private records to the owner and, for a shared dog, the accounts currently accepted as members. Members can access the dog data designated for sharing, including existing dog records and chat; access is removed when membership ends. Uploaded photos and documents use private storage with authenticated access or temporary access links.

Providers may process some information outside the European Economic Area, including in the United States. Hosting the primary database in Ireland does not mean all email, support, website or operational processing remains in the EU. Provider data processing terms describe safeguards for restricted transfers, including European Commission standard contractual clauses: Supabase, Resend and Cloudflare. Contact us for information about the safeguards applicable to your data or a copy of relevant terms.

We use access controls and encrypted network connections to protect information. No online service can guarantee complete security. Keep your password and access to your email account secure, and contact us if you suspect unauthorised access.

6. Device storage, permissions and analytics

The app stores session information, language and onboarding preferences, scheduled notification information and food changes waiting to sync on your device. You can manage camera, photo and notification permissions through your device settings.

The current app does not integrate third-party behavioural analytics, advertising trackers or a crash-reporting SDK. This does not stop authentication, hosting or email providers from keeping operational logs, or your operating system and app store from handling diagnostics under their own settings and policies.

The website does not include Pawly advertising or behavioural analytics scripts. It loads fonts, screenshots and images from Pawly’s Cloudflare-hosted website; Cloudflare still processes technical request information to deliver and protect the site. This policy will be updated if our use of analytics or tracking changes.

7. Retention and account deletion

Account and saved pet information, including an emergency phone number, are generally retained while your account exists so that your records remain available. Foods, meal logs, feeding plans, feeding guidelines and calorie goals are kept while the related dog profile exists and are removed when you delete the dog or your account. A meal log keeps a copy of the food name and brand even if that saved food is later deleted. Clinic addresses are kept with their appointments and removed when the appointment, dog or account is deleted. Shared profile membership, invitations, chat messages, photos, reactions, receipts and related records are retained while the dog profile and relevant records remain active; deleting the dog or account removes associated active records. Removing a member ends future access but does not erase the shared chat or records for other members. Encrypted chat content may remain in another member’s device or in copies they made. Uninstalling the app does not delete these server records. Deleting the pet profile or account removes that number from active account storage, subject to the limited retention described below. Brief check-ins saved as pet records follow the retention of those records. Local Brief edits are stored on your device until you clear them or remove the app data. Lost-pet sharing settings and their selected contact details are stored while the pet profile and sharing record remain in your account. Turning sharing off stops the public page from returning the profile but does not itself delete the saved settings; edit the fields or delete the pet or account to remove the stored details. Replacing the public link invalidates its previous token. In-app feedback is stored with your account and deleted when your account is deleted; the copy sent to our support inbox may be retained as support correspondence for as long as needed to handle the feedback and related follow-up or legal obligations. We retain other support correspondence for as long as needed to resolve the enquiry and handle related follow-up or legal obligations. Security logs and any backup copies have separate provider retention periods; these depend on the service configuration and any need to investigate an incident or meet a legal obligation.

You can request account deletion from the app’s account Profile screen using Delete profile and completing the confirmation steps. This is separate from deleting one pet’s profile. You can also email privacy@pawlyapp.gripe to request deletion, including if you cannot access the app.

The account deletion process removes your stored photos and documents, reminders, pet profiles and linked care records, followed by your authentication account. If deletion fails or you are unsure it completed, contact us so we can investigate and complete your request. We may need to verify that the account belongs to you; never send your password.

Deleting or replacing an individual pet record or photo can leave an earlier uploaded file in storage. You can request removal of remaining files by email; account deletion is intended to remove all uploads belonging to that account. Uninstalling the app or signing out does not delete your cloud account or records.

Deletion from active account storage does not necessarily remove information immediately from security logs, existing backup copies, messages already delivered to recipients, or copies you exported. Logs and backups remain subject to their retention schedules and applicable legal requirements. Contact us for details about retention relevant to your request.

8. Your privacy rights

Subject to applicable law, you may request access to your personal information, correction, erasure, restriction of processing or a portable copy. You may object to processing based on legitimate interests and withdraw consent where we rely on it, without affecting processing that was lawful before withdrawal.

Send requests to privacy@pawlyapp.gripe. We may ask for information needed to verify your identity. For GDPR requests, we normally respond within one month; if a permitted extension is needed, we explain why.

You may complain to a supervisory authority, including Lithuania’s State Data Protection Inspectorate, or the authority in the EU country where you live or work. You do not have to contact us first.

9. Children

Pawly is intended for pet owners and carers and is not directed at children. If you believe a child has provided personal information without the authorisation required by applicable law, contact us so we can review and address it.

10. Changes to this policy

We update this page when our practices change and revise the date above. For material changes, we will provide an appropriate notice, such as in the app or by email, and obtain consent where required.