Privacy Policy

Effective October 25, 2026 · Applies to the PawPawCare app and this website

PawPawCare exists to keep your pets' health organized — not to make a business out of your data. This page explains, in plain language, what we collect, why, and what we will never do with it.

Who we are

PawPawCare is built and run by Ahmed Chioua ("PawPawCare," "we," "us"), who decides how your personal data is used and is responsible for it — the "controller" under data-protection laws such as the GDPR. You can reach us about anything on this page at privacy@pawpawcare.app.

What we collect

• Your account — name, email address, and a password (stored only as a secure hash; we can't read it). If you sign in with Google or Apple, we receive your name, email, and an account identifier from them instead of a password.
• Your pets' records — the profiles, vaccinations, medications, weights, expenses, appointments, notes, photos, and documents you add. This is your data; we store it to show it back to you and the people you invite.
• Community content — posts, comments, and lost-pet reports you choose to publish are visible to other PawPawCare users.
• People you invite — when you invite someone to share a pet, we store the email address you enter so the invitation can find them when they sign in. Please only invite people who'd expect to hear from you.
• Server logs — like any online service, our server records technical details of each request (such as your IP address, the time, and what was requested) to keep the Service secure, limit abuse, and diagnose problems. Our crash reports and analytics are set not to keep your IP address. To protect your account, we also remember the networks (IP addresses) of the last 3 times you signed in with your password or reset it, so someone failing to sign in or reset your password elsewhere can't lock you out.
• Device information for reminders — a push-notification token and your time zone, so reminders reach your phone at the right local time.
• Usage analytics — which screens and features are used, and when the app is installed, updated, opened, or closed, collected through PostHog to help us improve the app. Events carry feature names and counts plus basic device details (phone model, operating system and app version), never your pets' medical details, your name, or your email. Once you sign in, they're tied to your account ID. Before that — for example, right after you install the app on a new phone — they're tied to a random ID created for that installation, which joins your account's analytics when you sign in. You can turn this off anytime in the app under Profile → Privacy → Share usage analytics. Your choice is saved on your account and takes effect on each of your devices once you sign in there, so a new installation may already have sent its first install and open events.
• Crash reports — when the app or our server hits an error, a report (what failed and where in the code) is sent to Sentry so we can fix it. Reports carry your account ID only — no name, email, IP address, screenshots, or pets' records — and are scrubbed of personal details before they leave the device.
• Purchases — if you subscribe to PawPawCare Plus, Apple or Google handle the payment; we never see your card details. RevenueCat tells us what you bought, its status, and when it renews or ends, linked to your account ID.
• Feedback and support messages — what you write to us from Profile → Help & feedback, the topic you pick, and your app version and phone platform (iOS or Android) so we can reproduce problems. Only our team reads them; they're never posted publicly.
• Waitlist email — if you join the waitlist on this site, your email is sent to us (via Cloudflare and Resend) solely to confirm your signup and send your invite.
• Website analytics (opt-in) — only if you accept the cookie banner on this site, Google Analytics sets a cookie to count visits and see which pages help. Decline it and nothing is loaded. It never receives your name, email, or pets' records.

How we use it

To run the product: syncing your records across devices, sending the reminders you set, powering the community feed, processing subscriptions, fixing crashes, and understanding — in aggregate — which features are worth improving. We also use it where needed to keep the Service secure, prevent abuse, and meet our legal obligations. That's the whole list. We don't use your data for advertising, we don't track you across other companies' apps or websites, and we don't make automated decisions about you that have legal or similarly significant effects.

Our legal bases

Data-protection laws such as the GDPR require a legal reason for each use of personal data. Ours are:

• Providing the Service you signed up for — your account, pets' records, reminders, sharing, community features, document scanning you ask for, account emails, and subscriptions.
• Our legitimate interests — crash reports, server logs, and security measures, so PawPawCare keeps working safely; and usage analytics in the app, so we can see which features help and improve them. We keep analytics to feature names and counts, never your pets' records, and you can object at any time with the Share usage analytics switch.
• Your consent — website analytics (the cookie banner) and the waitlist. You can withdraw it anytime through Cookie settings at the bottom of this site, or by asking us to remove your waitlist email.
• Legal obligations — when the law requires us to keep or disclose information.

AI record scanning

When you scan a vet document, the image is sent to our AI provider (Anthropic) to extract details like vaccine names and dosages. The results come straight back to you for review — nothing is saved to your pet's file until you approve it, and your documents are not used to train AI models.

Sharing — always your call

• Vet share links and caretaker pages exist only when you create them. They are read-only, expire automatically on the schedule you pick, and you can revoke them at any time.
• Family sharing shows a pet's records only to people you explicitly invite.
• We never sell your data. No data brokers, no advertising networks.

Beyond the services listed below, we disclose personal data only in two situations: when the law requires it (for example, a valid court order), or if PawPawCare is merged, acquired, or transferred — in which case your data stays protected by this policy and we'll tell you before it's governed by a different one.

Services we rely on

A small set of processors help us run PawPawCare. Each receives only what its job requires:

• Namecheap — hosts our server and database, where your account and pets' records are stored.
• Expo — app updates and push-notification delivery.
• Google and Apple — sign-in, if you choose it; and payments for PawPawCare Plus through the App Store or Google Play.
• RevenueCat — manages subscriptions: purchase status and history, linked to your account ID.
• Sentry — crash and error reports, as described above.
• PostHog — usage analytics, from the app and our server, unless you turn it off.
• Anthropic — AI document extraction, only when you scan.
• Our email provider — account emails such as verification and password-reset codes.
• Cloudflare — this website; storage of the photos and documents you upload (Cloudflare R2); and encrypted nightly backups of our database and uploads. All stored in the US.
• Resend — the waitlist form on this website.
• Google Analytics — website visits, only if you accept the cookie banner.

Where your data is processed

Our server and database are in the United States (Namecheap's data center in Arizona), and several providers — including PostHog, Sentry, and RevenueCat — also process data there. So if you use PawPawCare from outside the US, your data is transferred to the US. Where data-protection laws such as the GDPR apply, we rely on safeguards for those transfers: the EU–US Data Privacy Framework for providers certified under it, and otherwise the providers' data-protection terms, such as the European Commission's Standard Contractual Clauses. Email us for details of the safeguard that covers a given provider.

Security

Data moves over encrypted connections (HTTPS). Passwords are hashed, sessions use short-lived tokens, and share links are signed and time-limited.

How long we keep it

• Your account, pets' records, and support messages (including feedback) — as long as your account exists, then permanently deleted 30 days after you delete it (see below). A copy of each support message also reaches our support inbox and is kept only as long as needed to handle your request.
• Invitations — until they're accepted, declined, or cancelled, or the pet is deleted.
• Server logs — 14 days.
• Sign-in networks — 90 days after the sign-in. They stop counting as soon as your password changes or you link Google or Apple sign-in, and are deleted with your account.
• Backups — encrypted nightly copies of our database and uploads, kept so we can recover from an outage or mistake. Each copy is deleted within 90 days, so anything you delete is gone from backups by then too.
• Crash reports — deleted automatically by Sentry under its retention period, at most 90 days.
• Usage analytics — until your account is deleted, when your analytics profile and its events are deleted too, including those your phone sent before you signed in. Events from an installation that never signs in stay under its random ID, which isn't linked to any account. Turning analytics off stops new events.
• Subscription records — your plan status is deleted with your account; the subscription notices RevenueCat sends us are deleted after 90 days. Apple and Google keep their own purchase records under their policies.

Your rights

Depending on where you live, data-protection laws give you rights over your personal data. You can always:

• See and correct it — most of it is in the app, and you can edit your profile and records there. Ask us for a copy of anything else we hold about you.
• Take it with you — Profile → Export health records gives you your pets' records as PDF or CSV, free. For a machine-readable copy of the rest, email us.
• Delete it — see Deleting your data.
• Object or restrict — turn off usage analytics in the app, or ask us to stop or limit another use of your data.
• Withdraw consent — through Cookie settings on this site, without affecting what happened before.
• Complain — to the data-protection authority where you live (for example, your national authority in the EU or UK, or the CNDP in Morocco). We'd appreciate the chance to fix things first.

Email privacy@pawpawcare.app from your account's address to make a request; we may ask you to confirm it's you. We'll reply within one month, and we won't treat you differently for using these rights.

Deleting your data

• In the app: go to Profile → Edit → Delete account. Your account is deactivated right away, every session is signed out, and everything is permanently deleted after 30 days — pets, records, photos, documents, and posts. Signing back in within those 30 days cancels the deletion.
• Without the app: email privacy@pawpawcare.app from your account's address and we'll delete it the same way.
• With our providers: when your account is permanently deleted, we also delete your analytics profile at PostHog and your customer record at RevenueCat. Crash reports at Sentry carry only your account ID and expire automatically.
• Subscriptions: deleting your account doesn't cancel a PawPawCare Plus subscription — Apple or Google keep billing until you cancel it in your App Store or Google Play settings. The app reminds you before you delete.
• Waitlist emails are deleted on request or once invites have gone out.

Children

PawPawCare is for pet owners and is not directed at children under 13. We don't knowingly collect data from them.

Changes

If this policy changes in a way that matters, we'll say so in the app and update the date at the top of this page.

Contact

Questions or deletion requests: privacy@pawpawcare.app