Privacy Policy

1. Introduction

At Pawey, we take your privacy seriously. This Privacy Policy explains how we collect, use, store, share, and protect your personal information when you use the Pawey mobile application (“App”), website at pawey.co (“Website”), and all related services (collectively, the “Service”). Pawey is operated by Trendspark Ltd, a company registered in England and Wales, with its registered office at 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ, United Kingdom.

By using the Service, you consent to the data practices described in this Privacy Policy. If you do not agree with this Privacy Policy, please do not use the Service. We encourage you to read this policy in full and to contact us at hello@pawey.co if you have any questions.

2. Information We Collect

We collect different types of information to provide and improve the Service. Below is a detailed breakdown of the data we collect:

2.1 Account Information

When you create an account, we collect your email address, full name, phone number (optional), and mailing address (optional). You can sign up and sign in using an email address and password, or with Sign in with Apple or Sign in with Google. When you use Apple or Google sign-in, we receive an identity token and basic profile information (such as your name and email address) from that provider to create and authenticate your account. This information is used to identify your account, provide customer support, and communicate with you about the Service.

2.2 Pet Data

To provide the core functionality of the Service, we collect and store data about your pets, including: pet name, species, breed, date of birth, gender, weight measurements, health records (vaccinations, medications, vet visits, allergies, conditions, and any cost recorded with them, such as the cost of a vet visit), photographs, microchip ID and implant date, passport details (passport number, issuing country, and expiry date), and any notes you add. This data is provided by you and is essential to delivering the Service.

2.3 Location Data

We collect your device’s location data only when you actively use a feature that needs it and only with your explicit permission: the vet finder, using your current location when you add a clinic, and filling in your country or address in Personal info. Location data is used only to show nearby veterinary clinics and how far away clinics are, to list nearby places first when you search (see Section 5.3), to place a clinic you add on the map, and to turn your position into a place or address (see Section 5.4). When you add a clinic without picking a place from search or on the map (for example, by tapping “Use current location”, or by saving with only a name or a typed address), your device’s precise coordinates (approximate, if you allowed only approximate location) are saved with that clinic in your account. They are used only to show the clinic on the map, to show how far away it is, and to open directions in your maps app when you ask for them. They are deleted when you delete the clinic or your account (see Section 9 for backups). The location used to show nearby vets and to search for places is used live and is not stored as a location history on our servers. We do not track your location in the background.

2.4 Device Information

We collect basic device information including device type, operating system version, unique device identifiers, and push notification tokens. This information is used to deliver push notifications (such as care reminders, see Section 5.10), ensure compatibility, and diagnose technical issues.

2.5 Diagnostic & Crash Data

To keep the App stable and reliable, we collect crash reports and error diagnostics through Sentry (see Section 5.5). These reports include error and crash details, device and operating-system information, and a pseudonymous identifier created on your device. That identifier lets us group reports from the same installation of the App, but it is derived using a random value that never leaves your device, so we cannot use it to look up your account. Sentry is set not to store IP addresses. Before a report is sent, automated filtering is designed to remove account, pet and record identifiers, email addresses and file names, and to shorten web addresses to the name of the site. It applies to the operation context we attach to a report and to the details recorded automatically alongside it, such as recent network requests, log messages and error messages. We also collect a small sample of performance measurements, such as how long screens and network requests take, and filter them the same way. One kind of report is not filtered: when the App crashes in the phone’s own code rather than in the App’s, the crash reporter writes the report without the App’s filtering, and on iPhone it may list the full web addresses of recent network requests. Those can contain an internal account or pet identifier, a link to a pet photo, or an address you searched for. Reports from earlier versions of the App were filtered less completely. Reports are not intended to include pet names, free-text notes, uploaded files, or the contents of health records. We do not use this data for advertising; it is used solely to detect, diagnose, and fix technical issues.

2.6 Usage & Analytics Data

To understand how the App is used and to improve it, we collect product-usage and analytics data through PostHog (see Section 5.8). This includes a pseudonymous identifier (your internal Pawey account identifier) and product events — for example, which features and actions you use; pet category, type, and sex; health- record category and whether cost or an attachment is present; subscription and trial events; and app-lifecycle events such as the App being opened or sent to the background. PostHog’s software in the App also sends some device and app context with each event automatically, such as the app version, your device’s language and region setting (locale), its time zone, and its screen size. PostHog is set to discard your IP address, so it is not stored with these events. Before discarding it, PostHog uses the IP address to work out an approximate location, such as your country and city, and that approximate location is stored with your analytics events and profile, under your internal Pawey account identifier. We do not send names, email addresses, free-text notes, or health-record contents in these events, and we do not use them for advertising. PostHog does not capture your screen or record your session, and we do not use it to track you across other apps or websites.

2.7 Newsletter & Waitlist Data

When you voluntarily subscribe through a newsletter or launch-waitlist form on the Website, we collect your email address, the date and time of your consent, the form or page where you subscribed (the consent source), the version of the consent notice you accepted, and a coarse acquisition source such as a campaign or referring website when available. Newsletter and waitlist signup is separate from creating a Pawey account. You can withdraw at any time on our unsubscribe page, which deletes your address and consent record from the list.

To stop the same sender submitting the subscribe or unsubscribe form over and over, our server also counts recent submissions per sender. It does not store the network address the submission arrived from: it stores a one-way digest of that address, computed with a secret key, which is not designed to be read back as an address. The count covers a rolling one-minute window, is never linked to your email address, your subscriber record, or a Pawey account, and expires with that window — expired records are then deleted automatically, normally within 24 hours.

3. How We Use Your Information

We use the information we collect for the following purposes:

• Provide the Service: Store and display your pet profiles, health records, and related data
• Send reminders and notifications: Deliver push or on-device notifications for care reminders, vet appointments, and other alerts you configure
• Improve the Service: Use crash and error diagnostics to fix bugs, improve stability, and develop new functionality
• Analyze product usage: Measure how features are used — through pseudonymous product analytics — to understand engagement, prioritize improvements, and inform product decisions
• Customer support: Respond to your questions, troubleshoot issues, and provide assistance
• Manage subscriptions: Process Pawey Plus subscription status and ensure access to the appropriate features
• Present your records: Organize and display the pet health and care history stored in your account
• Communicate with you: Send important updates about the Service, policy changes, or security notices
• Send requested newsletters: Send pet care tips, product news, or launch updates when you have subscribed through a Website form

4. Data Storage & Security

Your data is stored securely using Firebase, a cloud platform operated by Google. Firebase provides enterprise-grade security including:

• Encryption in transit: All data transmitted between your device and our servers is encrypted using TLS (Transport Layer Security)
• Encryption at rest: Your data is encrypted when stored on Google Cloud servers
• Access controls: Strict authentication and authorization rules ensure only you can access your data
• Regular security audits: Firebase infrastructure undergoes regular security assessments and certifications (SOC 1, SOC 2, SOC 3, ISO 27001)

While we implement commercially reasonable security measures, no method of electronic storage or transmission over the Internet is 100% secure. We cannot guarantee absolute security, but we are committed to protecting your data and will notify affected users promptly in the unlikely event of a data breach.

5. Third-Party Services

We use the following third-party services to operate and improve the Service. Each service provider has its own privacy policy governing their use of data:

5.1 Firebase (Google)

We use Firebase for user authentication (Firebase Auth), database storage (Cloud Firestore), and file storage (Firebase Storage). Firebase processes your account information, pet data, uploaded photos, and newsletter or waitlist email addresses and consent records stored in Cloud Firestore. Google’s privacy policy applies: policies.google.com/privacy.

5.2 RevenueCat

We use RevenueCat to manage subscription entitlements for Pawey Plus (Pawey Plus Monthly at $4.99/month and Pawey Plus Annual at $29.99/year). RevenueCat processes a user identifier, the purchase tokens issued by the app stores, and your subscription status. Actual payment is handled by the Apple App Store or Google Play (see Section 5.7) — neither RevenueCat nor Pawey receives or stores your card details. RevenueCat does not have access to your pet data, health records, or other personal information beyond what is necessary for subscription management. RevenueCat’s privacy policy: revenuecat.com/privacy.

5.3 OpenStreetMap data (the Pawey clinic directory, Overpass, Photon and Nominatim)

To find nearby veterinary clinics for the vet finder, the app (from version 1.0.1) first downloads the list of clinics for the area around you from our own website, pawey.co, which keeps a weekly copy of OpenStreetMap’s veterinary clinic data. Those requests cover the map square of about one degree (roughly 100 km across) that contains your position and the squares around it, so they reveal only that square, not your exact location. If that list cannot be reached, and in earlier versions of the app, the app asks the OpenStreetMap Overpass API directly, using geographic coordinates only. The app also asks the Overpass API directly for the latest details of an emergency clinic you picked from OpenStreetMap, using only that clinic’s OpenStreetMap identifier. When you search for a place or address in the vet finder, or when you add a clinic, the text you type is sent to Photon, a place search over OpenStreetMap data operated by komoot GmbH (Germany), together with your approximate position when you have granted location permission, so that nearby places are listed first. When Photon finds no match, the text is sent to the OpenStreetMap Foundation’s Nominatim service instead. No account information or pet data is shared with either service. komoot’s privacy policy: komoot.com/privacy. The OpenStreetMap Foundation’s privacy policy: osmfoundation.org/wiki/Privacy_Policy.

5.4 Maps (Google Maps on Android, Apple Maps on iPhone)

The vet finder map is rendered using Google Maps on Android and Apple Maps on iPhone. When you open the map, your device communicates with that provider to load map tiles and other map data; this request may include your device’s approximate or precise location when you have granted location permission for the vet finder. We do not send your account information or pet data to either map provider. The same platform service (Apple on iPhone, Google on Android) also turns your position into an address when you add a clinic at your current location or fill in your country or address in Personal info, and looks up a place you typed when neither Photon nor Nominatim (Section 5.3) finds a match. Apple’s privacy policy applies on iPhone: apple.com/legal/privacy. Google’s privacy policy applies on Android: policies.google.com/privacy.

5.5 Sentry

We use Sentry for crash and error reporting from the App. Sentry collects error and crash details (such as stack traces), device and operating-system information, and a pseudonymous identifier created on your device that we cannot use to look up your account (see Section 2.5), as well as a small sample of performance measurements. Sentry is set not to store IP addresses. Automated filtering is designed to remove identifiers and email addresses before a report is sent and to shorten web addresses to the name of the site, except in a crash report written by the phone’s own code, which on iPhone may still list the full web addresses of recent network requests (see Section 2.5). Reports are not intended to contain pet names, free-text notes, uploaded files, or health-record contents. Sentry is not used for advertising. Sentry’s privacy policy applies: sentry.io/privacy/.

5.6 Email Communications

We may send you transactional and service-related emails (such as account verification, password resets, and important updates). Automated messages are sent through our app's authentication provider, Google Firebase. Direct correspondence from our @pawey.co addresses is handled by a third-party email provider. Newsletter and waitlist addresses and their consent records are currently processed and stored in Cloud Firestore as described in Section 5.1. As of the date of this policy, we have not selected an email service provider for newsletter campaigns and do not share this list with an email marketing platform. We will update this policy before sharing the list with a selected provider.

5.7 Apple & Google (App Stores)

Pawey is available now on Android. The iOS version is still in preparation. When a store version and Pawey Plus purchase are available, in-app subscription payments are processed by that store. Pawey does not have access to your full payment information (e.g., credit card numbers). Apple’s or Google’s privacy policy applies to transactions processed through its platform.

5.8 PostHog

We use PostHog (provided by PostHog, Inc.) for product analytics within the App — to understand how features are used across the activation, subscription, and retention journey. PostHog processes a pseudonymous identifier (your internal Pawey account identifier) together with feature/action metadata, pet category/type/sex, health-record category and cost/attachment-presence metadata, app-lifecycle events, and subscription or trial events, plus the device and app context its software sends automatically (such as app version, locale, time zone, and screen size). PostHog is set to discard client IP addresses, so they are not stored with events. Before an IP address is discarded, PostHog derives an approximate location from it (such as country and city), which is stored with the events and the analytics profile for that pseudonymous identifier. It does not receive names, email addresses, free-text notes, or health-record contents through Pawey product events. We do not enable PostHog’s session replay or on-screen autocapture, and PostHog is not used for advertising or cross-app tracking. Subscription and trial events are forwarded to PostHog through RevenueCat’s integration (see Section 5.2). PostHog’s privacy policy applies: posthog.com/privacy.

5.9 Umami

We use Umami for privacy-focused, cookieless analytics on our Website (see also Section 11.1). Umami collects aggregate, anonymous usage data — such as pages visited, referral source, and device type — together with a small number of interaction events (for example, clicking a call-to-action, an app-store link, or submitting the newsletter form). Umami does not use cookies, does not collect personal data, and does not track individual visitors across websites. Umami’s privacy policy applies: umami.is/privacy.

5.10 Push Notifications (Expo, Apple & Google)

Reminder notifications are delivered through Expo’s push notification service, provided by 650 Industries, Inc. (“Expo”). Expo hands each notification to Apple Push Notification service (APNs) on iPhone, or to Firebase Cloud Messaging (FCM), provided by Google, on Android, which delivers it to your device. To set this up, the App registers your device with Expo, sending the push token Apple or Google issued for it and an identifier for this installation of the App. The daily summary of overdue care items, if you keep care nudges turned on, is delivered the same way. A reminder push carries the reminder title (for a medication, the medication’s name), your pet’s name, an internal identifier for the pet so that tapping the notification opens the right profile, and your device’s Expo push token, which tells these services where to deliver it. A summary carries the same push token, the number of overdue items and, when they are all for one pet, that pet’s name and identifier. Neither includes your name, your email address, or any notes you have written. Notifications that the App schedules on your device itself, such as appointment reminders, or reminders on a device that cannot receive push notifications, do not pass through these services. Expo’s privacy policy applies: expo.dev/privacy. Apple’s privacy policy applies to APNs and Google’s to FCM (see Section 5.4).

6. Data Sharing

We do not sell, rent, or trade your personal information or pet data to third parties. We only share data in the following limited circumstances:

• Service providers: With the third-party services listed in Section 5, strictly as necessary to operate the Service
• Legal compliance: When required to comply with applicable law, regulation, legal process, or governmental request
• Safety and security: When we believe in good faith that disclosure is necessary to protect the rights, safety, or property of Pawey, our users, or the public
• Business transfers: In connection with a merger, acquisition, reorganization, or sale of assets, in which case your data would remain subject to this Privacy Policy or a policy at least as protective
• With your consent: When you explicitly request or authorize us to share data or show information from your account to another person

7. Your Rights

We respect your rights over your personal data. Depending on your location, you may have the following rights:

7.1 General Rights (All Users)

• Access your data: View all personal and pet data stored in your account at any time through the App
• Request a copy of your data: Contact hello@pawey.co to request a portable copy of personal data covered by applicable privacy law. Pawey Plus subscribers can also create a health summary PDF of a pet’s records in the App. It is made on your device and is not uploaded to Pawey, and it is a summary for sharing with a vet, not a complete copy of your data.
• Delete your data: Delete your account and the active-service data covered by account deletion directly in the App’s account settings. Step-by-step instructions, timelines, and exceptions are available on our account deletion page. For a broader privacy-erasure request involving processor records, email hello@pawey.co
• Opt out of notifications: Disable push notifications at any time through your device settings or within the App
• Update your data: Edit or correct your personal information and pet data at any time within the App
• Withdraw marketing consent: Use our unsubscribe page or email hello@pawey.co at any time. Unsubscribing on the page takes effect immediately; we will stop sending newsletter and waitlist marketing promptly after receiving an emailed request

7.2 Rights for EU/EEA Users (GDPR)

If you are located in the European Union or European Economic Area, you have additional rights under the General Data Protection Regulation (GDPR):

• Right to erasure: Request deletion of your personal data, subject to applicable exceptions. In-app account deletion covers the active Pawey/Firebase account surface. For a broader request involving records held by processors such as RevenueCat, PostHog, or Sentry, contact us at hello@pawey.co. Processor and app-store records may still be subject to lawful retention, and deleting a processor customer record does not cancel an app-store subscription
• Right to data portability: Receive your personal data in a structured, commonly used, and machine-readable format
• Right to restrict processing: Request that we limit how we process your personal data in certain circumstances
• Right to object: Object to processing of your personal data for certain purposes, including direct marketing
• Right to lodge a complaint: File a complaint with your local data protection authority if you believe your rights have been violated

Our legal basis for processing personal data under the GDPR includes: performance of a contract (providing the Service), legitimate interests (improving the Service, ensuring security), and consent (where applicable, such as for newsletter and waitlist subscriptions, push notifications, and location access).

7.3 Rights for California Users (CCPA)

If you are a California resident, you have the following rights under the California Consumer Privacy Act (CCPA):

• Right to know: Request information about the categories and specific pieces of personal information we have collected about you
• Right to delete: Request deletion of your personal information, subject to certain exceptions
• Right to opt-out of sale: We do not sell your personal information. As such, there is no need to opt out, but we affirm this commitment
• Right to non-discrimination: We will not discriminate against you for exercising any of your CCPA rights

8. Children’s Privacy

The Service is not directed to children under 13 years of age. We do not knowingly collect personal information from children under 13. If we become aware that a child under 13 has provided us with personal information, we will take steps to delete such information promptly.

If you are a parent or guardian and believe that your child under 13 has provided us with personal information, please contact us at hello@pawey.co so we can take appropriate action. This practice is in compliance with the Children’s Online Privacy Protection Act (COPPA).

9. Data Retention

We retain your personal information and pet data for as long as your account is active and as needed to provide the Service. Our data retention practices are as follows:

• Active accounts: Your data is retained for the duration of your account’s existence
• Account deletion: When you delete your account, all personal information, pet data, and uploaded photos in Pawey’s active Firebase service are permanently deleted within 30 days of a verified request. The Pawey sign-in identity is deleted only after that active-data cleanup completes
• Backup systems: If a copy exists in an encrypted backup, it is isolated from the active service and follows the applicable configured provider, backup, and legal retention period. Contact us for current retention details
• Subscriptions and purchases: Deleting a Pawey account does not cancel an Apple App Store or Google Play subscription. Apple, Google, and RevenueCat may retain purchase, transaction, entitlement, and subscription records under their own legal and operational retention. Cancel billing separately through the applicable app store. A verified broader erasure request can include an applicable RevenueCat customer record, but deleting that record still does not cancel the store subscription
• Newsletter and waitlist data: We retain your email address and consent record until you withdraw consent, ask us to delete it, or the list is no longer needed for the purpose described in Section 2.7. Newsletter signup is separate from a Pawey account, so deleting an App account does not automatically delete a newsletter entry. Unsubscribing on our unsubscribe page deletes your address and consent record from the active list immediately. You can also request deletion by emailing hello@pawey.co. We stop sending newsletter and waitlist marketing promptly after receiving an emailed withdrawal request, and delete the active record within 30 days of a valid emailed deletion request; backup or provider recovery copies follow their applicable configured and lawful retention periods.
• Newsletter abuse-prevention data: The rate-limit record described in Section 2.7 expires one minute after the submission it counted, and expired records are deleted automatically, normally within 24 hours. No network address is retained
• Diagnostic data: Historical Sentry events are not part of the in-app Firebase deletion sweep. Diagnostic events that can still identify an account are subject to applicable privacy-request and provider-retention handling. Aggregated or de-identified diagnostics that no longer identify you may be retained for stability, security, and reliability purposes
• Usage & analytics data: Pseudonymous product-analytics data (collected through PostHog, as described in Sections 2.6 and 5.8) may be retained to analyze usage trends and improve the Service. Pseudonymous data is not the same as anonymous data and may remain personal data where it can be linked back to an account; broader erasure requests are handled through the privacy contact above. Aggregate, anonymous Website analytics (collected through Umami, as described in Sections 5.9 and 11.1) are not tied to your account
• Legal obligations: We may retain certain data as required by applicable law, such as transaction records for tax or regulatory purposes

10. International Data Transfers

Your data may be processed and stored on servers located outside your country of residence, including in the United States and the European Union, through Google Cloud infrastructure (which powers Firebase).

Google Cloud maintains compliance with international data transfer frameworks, including Standard Contractual Clauses (SCCs) approved by the European Commission, to ensure adequate protection for data transferred internationally. By using the Service, you acknowledge and consent to the transfer of your data to these locations, subject to the safeguards described in this Privacy Policy.

11. Cookies & Tracking Technologies

11.1 Website

Our Website uses Umami (see Section 5.9), a privacy-focused, cookie-free analytics tool, to understand how visitors interact with the site (e.g., pages visited, referral sources, device type). Umami does not use cookies, does not collect personal data, and does not track individual visitors across websites. All data collected is aggregated and anonymous.

Our Website does not set any tracking cookies. The only cookies that may be used are those strictly necessary for the Website to function (e.g., session management). No consent banner is required as we do not use any non-essential cookies.

11.2 Mobile App

The Pawey mobile App does not use cookies. We use device identifiers to deliver push notifications and ensure service functionality (see Section 2.4), and a pseudonymous account identifier for product analytics (see Sections 2.6 and 5.8). The App does not use advertising identifiers, and we do not track you across other apps or websites.

12. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. When we make material changes, we will:

• Update the “Last updated” date at the top of this page
• Post a notice within the App or on the Website
• Send you an email or push notification for significant changes that affect how we use your data

We encourage you to review this Privacy Policy periodically. Your continued use of the Service after any changes become effective constitutes your acceptance of the revised Privacy Policy.

13. Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, including exercising any of your rights described in Section 7, please contact us at: