Pawprint Privacy Policy
Last updated 6 September 2026
1. Who we are
Pawprint is a pet-profile and QR-encounter app. This policy explains what personal data Pawprint ("we", "us", "Pawprint") collects when you use the app, why, and what rights you have over it.
- Data controller: Pawprint App Ltd, a company registered in England and Wales (company number 17441911), registered office at 5 Brayford Square, London, E1 0SG
- Contact: support@thepawprint.app
- Governed by: UK GDPR and the Data Protection Act 2018 (as amended by the Data (Use and Access) Act 2025). If you use Pawprint from the EU, the EU GDPR also applies in parallel; nothing in this policy is intended to offer EU users less protection than the EU GDPR requires.
2. What we collect
| Data | Where it comes from | Why we have it |
|---|---|---|
| Email address | You provide it to sign in | Account identity — we use a one-time emailed code instead of a password |
| Display name | You choose it on first sign-in | Shown to a pet owner if you request or become a pal of their pet — never shown anywhere else, and there is no public directory of users |
| Pet profile info (name, species, breed, birthday, bio) | You enter it when you add a pet | Powers the pet's profile and its QR code |
| Pet photos | You upload them | Shown on the pet's profile; the primary photo is used as the source image for that pet's collectible card (see §4) |
| Encounter records (which pet, when, an optional note) | Created when you scan a pet's QR code | Your own private journal — see §5 for who can see this |
| Pal relationships | Created when you request/accept/remove a pal | Lets a pet's owner manage who is connected to their pet |
| Basic session/device data (auth tokens) | Generated automatically | Keeps you signed in between app launches |
We do not collect precise location, contacts, or advertising identifiers, and we do not run any analytics or advertising SDKs.
Pawprint has no paid features at the time of writing. If we introduce a subscription or in-app purchase (see the Terms of Service, section 9), payment is handled entirely by the app store (Apple or Google) — we never collect or store your card details. We would receive limited purchase data from the app store to activate the feature you've bought (for example, that your account has an active subscription, or has unlocked a specific item, and the associated transaction ID), which we'd use only to grant you that feature and for related support and fraud-prevention purposes. The app store itself acts as an independent controller for the payment transaction and its own checkout data, under its own privacy policy.
3. Why we process it, and our legal basis
- Providing the service you asked for (creating pet profiles, generating QR codes, logging encounters, managing pals) — necessary to perform our contract with you (UK GDPR Art. 6(1)(b)).
- Keeping the app secure and working as intended (rate-limiting, fraud/abuse prevention) — our legitimate interest in running a safe, functioning service (Art. 6(1)(f)), balanced against your rights — we don't use this to justify anything beyond what's needed to keep the app usable and safe.
- Generating a pet's collectible card image — necessary to perform our contract with you, since this is a core feature you opt into per pet.
- Activating a subscription or in-app purchase you've bought, if we introduce one — necessary to perform our contract with you for that specific paid feature.
4. AI-generated content
Each pet's collectible card artwork is generated by an AI image model. To create it, the pet's primary photo is sent to Google's Gemini API, which generates a new stylised image based on it. That image is stored by us and shown in the app as the pet's card.
- This processing only happens once per pet, when a card is first generated (or when you explicitly add a photo triggering it), not on an ongoing basis.
- Card artwork is AI-generated: it is a stylised interpretation of your pet's photo, not a guaranteed accurate likeness, and the app identifies it in-app as a generated "card" rather than a real photo.
- This disclosure is made in line with Article 50 of the EU AI Act's transparency requirements for AI-generated image content.
5. Who can see your data
- Your journal (encounters you've logged) is private to you. No pet owner, and no other user, can see who has scanned their pet's QR code or what you wrote. We do not offer any feature that reveals this to anyone else.
- Your display name is shown only to the owner of a pet you have requested to be, or become, a pal of — nowhere else, and there is no directory or search of users.
- A pet's profile and card are visible to anyone you choose to show the QR code to (that's the point of the feature) — but the app only reveals what's on that pet's profile, never your journal or account details.
- We do not sell your data, and we do not share it with third parties for their own marketing purposes.
6. Who processes data on our behalf
We use the following processors to run the app. They only process your data under our instructions and their own contracts with us — they don't get to use it for their own purposes.
| Processor | What they handle | Located |
|---|---|---|
| Supabase | Database, authentication, file storage, backend functions | EU (Ireland) |
| Google (Gemini API) | Generates card artwork from a pet's photo | United States |
| Resend | Delivers the sign-in email code to your inbox | United States |
7. International transfers
Our core database and storage are hosted in the EU (Ireland). Google and Resend are US-based; where your data (a pet photo, or your email address for a sign-in code) is sent to them, that involves a transfer outside the UK/EEA. We rely on the safeguards available for such transfers (such as the UK's International Data Transfer Addendum / the EU-US Data Privacy Framework, or standard contractual clauses, as applicable to each provider) to ensure your data continues to be protected.
8. How long we keep it
We keep your data for as long as your account exists. If you delete your account (Account → Delete account, in the app), we permanently delete your profile, pets, photos, journal, and pal relationships. This is irreversible.
9. Your rights
Under UK GDPR, you have the right to:
- Access the personal data we hold about you
- Correct inaccurate data (you can edit most of this yourself in the app)
- Erase your data (delete your account, in-app, or contact us)
- Restrict or object to certain processing
- Data portability for data you've provided us
- Complain to the ICO (ico.org.uk) if you think we've mishandled your data
To exercise any of these, contact us at support@thepawprint.app.
10. Children
Pawprint is not directed at children, and you must be at least 13 years old to use it. This aligns with the UK's digital age of consent for information society services under the Data Protection Act 2018 — below 13, we would need a parent or guardian's consent, and we don't currently have a way to collect or verify that. We do not knowingly collect data from children under 13; if we learn that a child under 13 has created an account, we will delete it.
We recognise that users aged 13–17 are still "children" for the purposes of the ICO's Age Appropriate Design Code, even though they're old enough to create a Pawprint account. In line with that Code, Pawprint is deliberately built to need as little of your data as possible: we don't build advertising or behavioural profiles of any user, we don't track your location, we run no analytics or advertising services, and every privacy-relevant choice in the app (like who can see your journal) is private by default rather than something you have to go find and turn off. You can also exercise your data rights yourself at any time — deleting your account (Account → Delete account) immediately and permanently removes your data, with no need to email us and wait.
11. Security
We rely on Supabase's infrastructure, which encrypts data in transit and enforces row-level security policies so that, for example, one user's private journal entries are never readable by another user or by a pet's owner. No system is perfectly secure, and we can't guarantee absolute security, but we take reasonable technical measures appropriate to the data we hold.
12. Changes to this policy
We may update this policy as the app changes. If we make a material change, we'll make that clear in the app before it takes effect.
13. Contact us
support@thepawprint.app