Privacy Policy

1. Introduction & Data Controller

DosePaw ("we," "us," or "our") is a pet health management application that helps you track medications, vaccinations, and daily care for your pets. This Privacy Policy explains how we collect, use, disclose, retain, and protect your personal information when you use the DosePaw application and related services (collectively, the "Service").

The data controller responsible for your personal data is:

• Entity: DosePaw
• Email: contact [at] dosepaw.com

By accessing or using the Service, you acknowledge that you have read and understood this Privacy Policy. If you do not agree with our practices, please do not use the Service.

This Privacy Policy applies to all users of the Service, including registered users, unregistered visitors, and individuals who interact with publicly accessible features such as share links, emergency cards, or caretaker mode.

2. Information We Collect

2.1 Information You Provide Directly

When you create an account and use the Service, you may provide:

• Account information: email address, display name, password (stored as a cryptographic hash; we never store plaintext passwords), profile photo
• Phone number: optionally stored in your user profile for use in emergency cards
• Pet profiles: pet name, species, breed, birth date, adoption date, weight, photo, allergies, microchip number and registry, notes
• Veterinarian information: veterinarian name, phone number, address, and emergency veterinarian phone number
• Health records: medication names, dosages, frequencies, schedules, administration logs, vaccination records, medical events (surgeries, conditions, injuries), weight history, grooming schedules and logs
• Nutrition data: food names, brands, portions, feeding logs, stock levels
• Financial data: expense amounts, descriptions, and categories related to pet care
• Documents: uploaded files such as lab results, prescriptions, X-rays, certificates, and insurance documents
• Notes: free-text observations about your pet's behavior, appetite, or health
• Household information: household name and member roles when using the multi-user sharing feature
• Caretaker names: names entered by pet sitters when using caretaker mode

2.2 Information from Third-Party Authentication

If you sign in using Google OAuth, we receive the following from Google:

• Email address
• Display name (full name and/or name)
• Profile photo URL

We do not receive or store your Google password. We only request the minimum scopes necessary for authentication. You can revoke DosePaw's access to your Google account at any time through your Google account settings.

2.3 Information Collected Automatically

When you use the Service, we may automatically collect:

• Push notification tokens: endpoint URL, cryptographic keys (p256dh, auth), and browser user agent string — collected only when you opt in to push notifications
• Usage analytics: page views, navigation paths, country, and device type — collected through Vercel Analytics (a privacy-focused analytics service that does not use cookies, does not collect IP addresses, and does not track users across sites)
• Performance metrics: Core Web Vitals (Largest Contentful Paint, First Input Delay, Cumulative Layout Shift, Time to First Byte, Interaction to Next Paint) — collected through Vercel Speed Insights
• Timezone and locale: detected from your browser settings and stored as user preferences

We do not use Google Analytics, Facebook Pixel, advertising trackers, fingerprinting scripts, or any other third-party tracking technologies beyond those listed above.

2.4 Information from Payment Processing

If you purchase a paid subscription, payments are processed by Paddle.com Market Limited("Paddle"), which acts as our Merchant of Record. This means Paddle is the seller of record for all transactions and handles payment data directly.

• We do not collect, process, or store your credit card numbers, bank account details, or other financial payment instruments
• Paddle may share limited transaction data with us, such as your email address, country, transaction ID, subscription status, and payment amounts
• Paddle processes your payment data under its own privacy policy, available at paddle.com/legal/privacy

2.5 Information We Do Not Collect

For clarity, we do not collect:

• IP addresses (for our own purposes — our hosting provider may process them for security)
• Precise geolocation data
• Biometric data
• Social Security numbers or government-issued identification numbers
• Data from contacts, cameras, or microphones (beyond files you voluntarily upload)
• Data from other apps on your device

3. How We Use Your Information

We use your information for the following purposes:

• Provide the Service: store and display your pet data, synchronize data across devices, deliver push notification reminders for medications, vaccinations, appointments, grooming, and stock refills
• Authenticate you: verify your identity, manage your session, and protect your account
• Generate Health Insights: compute your Care Score, medication adherence rates, weight trends, and vaccination status indicators — all calculated locally or from your own recorded data, never shared with third parties
• Enable sharing features: generate share links, emergency cards, caretaker access, and household collaboration as directed by you
• Process payments: manage your subscription through Paddle
• Improve the Service: analyze aggregate, anonymized usage patterns to improve performance, fix bugs, and develop new features
• Communicate with you: respond to your inquiries, send service-related notices (such as security alerts or changes to our terms)
• Ensure security: detect and prevent fraud, abuse, and unauthorized access

We do not use your personal data for advertising, profiling, automated decision-making, or selling to third parties. We will never sell, rent, or trade your personal information.

4. Legal Basis for Processing

Under the General Data Protection Regulation (GDPR) and similar laws, we process your personal data based on the following legal grounds:

Where we rely on consent, you may withdraw it at any time by disabling the relevant feature (e.g., revoking push notification permission in your browser settings or deactivating a share link). Withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal.

Where we rely on legitimate interest, we have conducted a balancing test to ensure that our interests do not override your fundamental rights and freedoms. You may object to processing based on legitimate interest at any time by contacting us.

5. Data Sharing & Third-Party Service Providers

We do not sell, rent, or trade your personal data. We share your data only with the following categories of service providers, solely to operate the Service:

Each provider processes data under their own privacy policy and applicable data protection agreements. We require all providers to implement appropriate technical and organizational measures to protect your data.

We may also disclose your information if required to do so by law, regulation, legal process, or governmental request, or when we believe disclosure is necessary to protect our rights, your safety, or the safety of others.

6. International Data Transfers

Your data may be transferred to and processed in countries outside your country of residence, including:

• United States: Supabase infrastructure (AWS us-east-1 region), Vercel hosting, Google services
• United Kingdom / European Union: Paddle payment processing
• Global edge locations: Vercel edge network for content delivery

For transfers from the European Economic Area (EEA), United Kingdom, or Switzerland to countries that do not provide an adequate level of data protection, we rely on:

• Standard Contractual Clauses (SCCs) approved by the European Commission
• The service providers' certifications and compliance frameworks (such as SOC 2)
• Supplementary technical measures including encryption in transit (TLS) and at rest

7. Data Retention

We retain your personal data as follows:

When you delete your account, we execute a comprehensive data wipe that removes all your data from our cloud database, including all pet profiles, health records, documents, photos, household memberships, push subscriptions, share links, and activity logs. This deletion is permanent and irreversible.

Local data stored on your device (IndexedDB) is not automatically deleted when you delete your cloud account. You can clear local data through the Settings page or by clearing your browser data.

8. Publicly Accessible Features

DosePaw offers features that make certain data accessible without authentication. You control which features are enabled, and you can disable them at any time.

8.1 Share Links

When you generate a share link for a pet profile, the following data becomes accessible to anyone with the link:

• Pet profile (name, species, breed, birth date, weight, photo, microchip number, allergies)
• Veterinarian contact information (name, phone, address, emergency phone)
• Complete medication records, vaccination records, medical events, weight history, appointments, grooming tasks, and notes
• Document names and categories (but not the document files themselves)

8.2 Emergency Cards

Emergency cards expose the following without authentication:

• Pet name, species, breed, age, weight, allergies, microchip number
• Active medications with dosages
• Your name and phone number (from your user profile)
• Veterinarian name and phone number, emergency vet phone number

8.3 Caretaker Mode

Caretaker links expose:

• Pet name, species, breed, and photo
• Today's medication schedule (medication names, dosages, scheduled times, and administration status)

Caretakers may enter their name (stored in their browser's local storage) and mark medication doses as given. The caretaker's name is recorded in the medication log.

8.4 Household Invitations

Invitation links expose the household name, the inviter's display name, and the assigned role. Accepting an invitation requires authentication.

You are solely responsible for controlling access to these features. We recommend sharing links only with trusted individuals and deactivating them when no longer needed. Once data has been viewed by a recipient, we cannot control how they may use, store, or further share that information.

9. Cookies, Local Storage & Similar Technologies

9.1 Cookies

We use only strictly necessary cookies for authentication session management, set by Supabase Auth. These cookies:

• Are HTTP-only and secure
• Contain your authentication session token (JWT)
• Are required for the Service to function when you are logged in
• Cannot be used by third parties for tracking

We do not use advertising cookies, analytics cookies, social media cookies, or any other non-essential cookies. Because we only use strictly necessary cookies, no cookie consent banner is required under GDPR (Recital 30, Article 5(3) of the ePrivacy Directive).

9.2 Local Storage (IndexedDB)

DosePaw uses a local-first architecture. Your primary data is stored on your device using IndexedDB (a browser-based database) through the Dexie.js library. This includes all pet profiles, health records, medication logs, and other data you enter into the Service.

Local data storage is a core feature of the Service, not a tracking mechanism. This data remains on your device and is only transmitted to our cloud servers when you are signed in and sync is active.

9.3 Other Local Storage

We use browser localStorage for the following non-tracking purposes:

• Last sync timestamp: to determine when data was last synchronized
• Last backup timestamp: to remind you about regular backups
• Caretaker name: so caretakers do not need to re-enter their name on each visit
• Install prompt dismissal: to avoid repeatedly showing the PWA install prompt
• Theme preference: your light/dark mode selection (via localStorage, not cookies)

9.4 Service Worker Cache

The Service uses a service worker for offline functionality and performance. The service worker may cache application assets (JavaScript, CSS, HTML) and media files (pet photos, avatars, document thumbnails) on your device. Cached data is stored locally and is not transmitted to any server. You can clear the service worker cache through your browser settings.

10. Data Security

We implement appropriate technical and organizational measures to protect your personal data, including:

• Encryption in transit: all data transmitted between your device and our servers is encrypted using TLS (HTTPS)
• Encryption at rest: cloud data is encrypted at rest through our infrastructure provider (Supabase / AWS)
• Row-Level Security (RLS): database policies ensure you can only access your own data; each query is scoped to your authenticated user ID
• Signed URLs: sensitive documents (lab results, prescriptions, etc.) are accessed via time-limited signed URLs that expire after one hour
• Push notification encryption: push payloads are encrypted end-to-end using the Web Push Protocol (RFC 8030, RFC 8291)
• Secure functions: server-side functions use security definer patterns and explicit search paths to prevent injection attacks
• Secrets scanning: we use automated tools (Gitleaks, Semgrep) to prevent accidental exposure of credentials in our codebase
• Dependency auditing: we regularly scan dependencies for known vulnerabilities

While we strive to protect your data, no method of electronic transmission or storage is 100% secure. We cannot guarantee absolute security. You are responsible for maintaining the confidentiality of your account credentials and for the security of your device.

11. Children's Privacy

The Service is not directed to children under the age of 13 (or the applicable age of digital consent in your jurisdiction, such as 16 in certain EU member states). We do not knowingly collect personal data from children under 13.

If you are a parent or guardian and believe your child has provided personal data to us without your consent, please contact us at contact [at] dosepaw.com and we will take steps to delete that information promptly.

12. Your Rights

Depending on your location, you may have the following rights regarding your personal data. To exercise any of these rights, please contact us at contact [at] dosepaw.com. We will respond within the timeframe required by applicable law (typically 30 days).

12.1 Rights Under the GDPR (EU/EEA/UK)

• Right of access (Art. 15): obtain a copy of your personal data
• Right to rectification (Art. 16): correct inaccurate or incomplete data
• Right to erasure (Art. 17): request deletion of your data ("right to be forgotten")
• Right to restriction of processing (Art. 18): limit how we process your data
• Right to data portability (Art. 20): receive your data in a structured, machine-readable format (see Section 13)
• Right to object (Art. 21): object to processing based on legitimate interest
• Right to withdraw consent (Art. 7(3)): withdraw consent at any time where processing is based on consent
• Right to lodge a complaint: you may file a complaint with your local data protection authority (e.g., the CNIL in France, the ICO in the UK, the BfDI in Germany)

12.2 Rights Under the CCPA/CPRA (California, USA)

If you are a California resident, you have the right to:

• Know what personal information we collect, use, and disclose
• Delete your personal information
• Correct inaccurate personal information
• Opt-out of the sale or sharing of your personal information — we do not sell or share (as defined by CCPA) your personal information
• Non-discrimination: we will not discriminate against you for exercising your CCPA rights
• Limit use of sensitive personal information: we only use sensitive personal information for providing the Service

Categories of personal information collected in the preceding 12 months (per CCPA §1798.110): identifiers (email, name), internet/electronic activity (page views, device type), and other information you provide (pet data, health records). We do not sell any category of personal information.

12.3 Rights Under the LGPD (Brazil)

If you are a Brazilian resident, you have the right to:

• Confirmation of the existence of data processing
• Access to your data
• Correction of incomplete, inaccurate, or outdated data
• Anonymization, blocking, or deletion of unnecessary or excessive data
• Portability of data to another service provider
• Deletion of data processed with your consent
• Information about public and private entities with which we have shared data
• Revocation of consent

12.4 How to Exercise Your Rights

You can exercise many of these rights directly within the Service:

• Access and portability: use the Export Backup feature in Settings to download all your data in a standard JSON format
• Rectification: edit your data directly in the app at any time
• Erasure: delete individual records in the app, or use the Clear Data feature in Settings to wipe all local and cloud data
• Consent withdrawal (push notifications): revoke notification permission in your browser or device settings
• Consent withdrawal (sharing): deactivate share links, emergency cards, or caretaker sessions in your pet's settings

For any rights that cannot be exercised through the Service directly, or if you need assistance, contact us at contact [at] dosepaw.com.

13. Data Portability & Export

We are committed to data portability (GDPR Article 20). You can export all your data at any time through Settings → Data → Export Backup. The export includes:

• A complete JSON file with all your pet profiles, medications, dose history, vaccinations, medical events, weight records, appointments, grooming, nutrition, expenses, notes, and milestones
• All uploaded photos (pet photos and avatars)
• All uploaded documents (lab results, prescriptions, X-rays, certificates, insurance)
• A manifest with metadata (export date, version, record counts)

The export is a standard ZIP file containing human-readable JSON. It is not locked to DosePaw — you can open it with any text editor, import it into spreadsheets, or use it with other applications. No internet connection is required for exporting local data.

14. Do Not Track

Some browsers transmit "Do Not Track" (DNT) signals. As we do not use advertising trackers or cross-site tracking technologies, the Service's behavior is the same regardless of DNT settings. We respect your privacy by default.

We also support the Global Privacy Control (GPC) signal. If your browser sends a GPC signal, we treat it as a valid opt-out of any data sharing (though, as stated, we do not sell or share your data with third parties for advertising purposes).

15. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technologies, legal requirements, or other factors. When we make changes:

• We will update the "Last updated" date at the top of this page
• For material changes, we will provide notice through the Service (such as an in-app notification or a prominent notice on our website)
• We will not retroactively reduce your rights under this Privacy Policy without your explicit consent

We encourage you to review this Privacy Policy periodically. Your continued use of the Service after the effective date of any changes constitutes your acceptance of the updated Privacy Policy.

16. Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us at:

contact [at] dosepaw.com

We will endeavor to respond to all legitimate inquiries within 30 days. If you are not satisfied with our response, you have the right to lodge a complaint with your local data protection authority.