DoggyWalky Privacy Policy

This is a translation of the Ukrainian original. If the two versions differ, the Ukrainian version prevails.

Last updated: 9 November 2026

Operator (data controller): Dmytro Khait (an individual), Kyiv, Ukraine

Contact for data matters: privacy@doggyapps.com

1. In brief

• We record walks to show the route, the distance, and the “fog over the city” for your dog and your family.
• Your home address does not reach the server. The app creates a “privacy zone” (up to three — for example after moving house) with an offset centre and a random radius; only these zones go to the server, and the routes you share are clipped by them — by yours and by the zones of the other family members of the dog you walked.
• Only you and the family members you invited to the dog can see exact routes.
• Friends (who are not family) see your dog's name and mascot and — unless you turn it off — the day and length of your walks; your own name only if you allow it. They do not see routes, places or the time of walks (sections 2 and 5).
• Until a walk is saved, it lives only on your phone; another account on the same phone cannot see it (section 2a).
• We do not sell data and do not show ads.
• Crash reports are sent without coordinates, addresses, or photos; usage statistics — and with them the linking of reports to your account's pseudonym — can be turned off in the settings (section 3a).
• You can delete your account in the app, together with its data (see section 7).
• The doggyapps.com website sets no cookies and runs no analytics. If you sign up for the beta, we keep only your email (section 11).

2. What data we process and why

Geolocation. During a walk, the app records coordinates, including in the background (when the screen is locked) — only between “Start” and “Finish”. Outside a walk, your location is not recorded. Points with poor accuracy do not unlock fog; signs of GPS interference (jamming, spoofing) are stored only as a flag on the walk.

2a. What is stored only on your phone

So that a walk is not lost when the app is closed or the connection drops, some data lives on the phone. Walks and the queue are stored on iPhone in the app's private folder, which is not included in the iCloud backup; on Android, in the app's data folder, which is not included in the Google backup; in the web version, in the browser storage.

GPX export and the walk card are created on the phone. A GPX file contains exact coordinates and goes only where you yourself save or send it; the walk card is clipped by the privacy zones — yours and those of the other family members of the dog you walked; without a zone of your own it will not be created. To draw a map on the card, the app downloads map tiles around the route from OpenFreeMap; the areas of your home zones are covered with fog on the card — neither the map nor the route shows there. Without a connection the card has no map.

Android backups. The app does not hand its data to the Google backup: unsaved walks, the queue, the sign-in session and the settings on the phone do not go there. After reinstalling you sign in again, and everything saved on the server comes back. When you move data from an old Android phone to a new one directly (by cable or wirelessly, Android 12 and newer), the app's data moves along with the rest — from phone to phone, without the cloud.

Photos. Before uploading, the app re-encodes the photo on the device (up to 1080 pixels, up to 120 KB), which removes all EXIF metadata, including the GPS coordinates of the shot. Coordinates are not stored together with the photo.

3. Who the data is shared with (processors)

IP addresses in Supabase logs. Like any server, Supabase sees the IP address of every request from the app and records it in technical logs together with the time, the request address, the account identifier, and a technical description of the device and browser (user agent), as well as the approximate location that Cloudflare (which requests to Supabase pass through) derives from the IP address (country, city, postal code, approximate coordinates) and the name of your internet provider. The sign-in log is kept there too (when you signed in, signed out, or deleted the account), with the email and the name from Apple / Google, if there is one. The logs are needed for security (protection against abuse and break-ins) and to troubleshoot server failures; they are erased automatically — after 7 days at most (the log retention period on our Supabase plan). In addition, the sign-in system remembers the IP address and a technical description of the device for each sign-in session — until you sign out of the account or delete it. We do not use either the IP addresses or the location derived from them to track where you are or to build a profile of you, and we do not pass them on to anyone.

3a. Crash reports and usage statistics

What is not there. The statistics contain no free text — only the events from the list below with predefined values, so there can be no coordinates, map cells, addresses, names, dog names, photos, or invitation codes. From crash reports, the app removes, on the phone and before sending, coordinates, map cells, encoded routes, email, sign-in tokens, and request parameters, as well as the dog's name, your name, the names of family members, and the invitation code, if they ended up in the error text. Sentry and PostHog see your IP address while the request is made but do not store it (the projects are configured that way); city detection by IP is turned off in the statistics. For IP addresses in Supabase logs, see section 3.

A pseudonym, not anonymity. The switch is called Анонімна статистика (Anonymous statistics), but more precisely it is pseudonymised: while you are signed in, the services see not your account but a pseudonym — an irreversible hash (SHA-256) of the account identifier. Without the DoggyWalky database, a person cannot be found from the pseudonym; after you sign out, statistics on this phone are anonymous again. Crash reports receive the pseudonym only while statistics are on.

Installation identifier. Every crash report contains a random installation identifier of the app (on iPhone, a hash of the app identifier on this device), to tell one recurring crash from many. It is not linked to the account and disappears together with the app.

Which events the statistics count: opening the app; the steps of the first setup (sign-in, name, «Як почнемо?», dog, mascot, manual choice, family code) and the sign-in method (Apple, Google or an email code); the result of the location permission request (granted, denied, or approximate location only); completing the first setup (your own dog or a family code; mascot look from AI or chosen manually); starting a walk; finishing a walk — only ranges of duration and distance, numbers of new cells and “toilet” marks, whether there was a photo, and whether GPS was disrupted (jamming, spoofing); sharing a walk card; a family invitation sent and accepted (joining by code counts both as completed setup and as an accepted invitation); the notification permission (granted, denied or not asked yet; and what showed the request — a saved walk, the family or the reminder — or a check at start-up); opening the app by tapping a notification (the family's «… вже вигуляно» ("… already walked"), the walk reminder, «… вже вдома?» or the weekly summary); the reminder offer on the home screen (shown, accepted or dismissed) and turning the reminder on or off (from the offer or from settings; «Як зазвичай» ("As usual") or a time of your own — without the time itself); the «Explorer Pro — готуємо» ("Explorer Pro — in the works") card — where it was shown (a walk older than 30 days, a full family, all the dog's free AI portraits already drawn, or settings) and whether «Мені цікаво» ("I'm interested") was tapped (no price, no payment, none of your contacts); finds on a walk — which catalogue item was picked up, which of the dog's sets it is and how many of the set's 10 items are collected, and a completed set (only its number) — never where the find was, map cells, the district or the landmark; the weekly stamp earned for three walks in a week (the event alone, no values). Friends and paws — how a friend invitation was sent (the system sheet or copying), the result of a friend code entered (accepted, invalid, expired, used up, your own, from your family, list full or too many attempts), a friend added or removed, a paw given, the “Спільнота” (Community) tab opened (no friends, with friends or failed to load), the switches “Show my name to friends”, “Show my walks to friends” and “Paw notifications” turned on or off, and the app opened from a tap on a paw notification — only these values, without the codes and links themselves, names, friends' dog names, identifiers or places. There is no automatic collection of taps or screen views and no screen recording. To switch new features on gradually, the app (only while statistics are on) asks PostHog whether a feature flag is on: that request carries the same pseudonym and technical device data as the events, and nothing more; PostHog may work out an approximate location from the IP only to answer that request, without storing it.

How to turn it off. Профіль (Profile) → ⚙ Налаштування (Settings) → Анонімна статистика (Anonymous statistics) (the switch is present in builds where these services are connected). Turning it off takes effect immediately: statistics no longer send anything, its identifiers on the phone are erased, and crash reports no longer contain the account pseudonym; technical sessions in crash reports are turned off from the next launch of the app. The choice is remembered on this phone. The crash reports themselves are always sent: without them we would not know that the app crashes. You can object to them too — by writing to privacy@doggyapps.com.

4. Legal bases for processing

• Performance of a contract (the Terms of Use): account, walks, family, notifications.
• Your consent: access to geolocation (including in the background), photos, notifications, AI recognition. You can withdraw consent in the phone or app settings.
• Legitimate interest: protection against abuse (limits, AI budget accounting); server technical logs — security and troubleshooting; crash reports — stable operation of the app; usage statistics — development of the app (they can be turned off in the settings, section 3a).

5. Family

When you invite a person to a dog (a one-time code, valid for 48 hours), you give them access to the raw routes of that dog's walks, the calendar, photos, and the name of whoever walked. A family member can leave; the owner can remove a participant. If you join another family while you already have your own dog of which you are the only member, after you confirm, the app deletes that dog together with its walks, fog, stamps, and photos.

Friends are not family. A friend does not see the routes, the map, the cells or the time of your walks and cannot walk your dog in the app. Friendship is mutual and starts when someone opens your /f/<code> link or enters your code and taps “Дружити” (“Be friends”); you cannot become friends with your own family or with yourself. You can remove a friend at any time on the friend's profile — the friend is not notified, and afterwards no longer sees your dog's name, mascot or walks. A code lets anyone who has it become your friend, so share it only with people you want to add; an expired code stops working.

6. How long we keep data

• Sign-in data (email, the identifier and data from Apple / Google) — as long as the account exists.
• Walks, fog, and photos — as long as the account exists (in the free version, routes older than 30 days are hidden, not deleted, so that they open up after subscribing). The author of a walk or the dog's owner can delete a walk, with its photo, within 24 hours after it ends; the fog cells it opened remain. To prevent abuse, the server remembers for 2 days who deleted walks and when (only the account identifier and the time).
• Finds (item, who found it, walk, time) — together with the walk and the dog: a deleted walk takes its finds with it, a deleted dog all of them. After an account is deleted, its finds stay in the dog's collection for the rest of the family, like walks, but no longer linked to you; a dog with no other family members is deleted together with them.
• The notification queue — up to 7 days.
• Friends: a friend code is valid for 7 days and is kept with the account; a friendship lasts until either of you removes it or deletes the account; paws last while the walk and the account of whoever gave the paw exist; paw notifications are not sent from 22:00 to 07:00 Kyiv time. The log of code attempts (an hourly counter) and the log of friends-feed calls (only the account and the time of the call, for the rate limit; entries older than an hour are erased at the next call) are kept no longer than the account exists.
• City count: a cell's row disappears if it has not been confirmed for 8 weeks; it holds no data about people, so it does not depend on account deletion — afterwards the dog is simply not counted in the next weekly run.
• The AI recognition log after account deletion is kept de-identified (not linked to you) — only to control the monthly budget.
• The weather cache contains only ~10 km cells and the forecast — there is no personal data in it.
• Supabase technical logs with IP addresses and the sign-in log — up to 7 days; a sign-in session with its IP address — until you sign out or delete the account (section 3).
• Emails with the sign-in code and their delivery log in Resend — up to 30 days.
• Crash reports in Sentry — up to 90 days; statistics events in PostHog — up to 1 year.
• Data on the phone — according to the periods in section 2a.

7. Account deletion and your rights

• To delete the account: in the app — Профіль (Profile) → ⚙ Налаштування (Settings) → Видалити акаунт… (Delete account…) → confirm by holding the button Утримуй, щоб видалити (Hold to delete). Deleted: the account (together with the email and the data from Apple / Google), profile, privacy zones, family memberships, friendships, friend codes, your paws, visibility settings for friends and the “Paw notifications” switch, the logs of code attempts and feed calls, sign-in sessions, notification tokens, your photos; dogs for which you were the only member — together with their walks, fog, and photos. For shared dogs, your walks remain in the family history without your name. If you sign in with Apple, on iPhone Apple will ask you to confirm it is you before the deletion, and the app asks Apple to revoke its access to your Apple ID. If you delete the account from a device other than an iPhone or closed the Apple window (the account is deleted all the same), you can remove DoggyWalky from the list yourself: on iPhone — Settings → your name → Sign-In & Security → Sign in with Apple.
• On the phone from which you delete the account, the following are erased: the queue and rejected walks of your account, the current unsaved walk on this phone and its finds, your “parked” walks, the marker of your account, the remembered sunrise and sunset times, the “photo or Safari lookalike” choice for dogs, the list of walks “with transport”, the last registered notification token, the scheduled walk reminders and weekly summary; the session ends. If something could not be erased, the app will tell you — then delete the app. On other phones where you signed in, local data remains until the app is deleted there.
• Crash reports and statistics are linked at most to a pseudonym (section 3a) and are deleted within the periods in section 6; on request, we will delete them earlier — we can compute the pseudonym of your account.
• Supabase technical logs (section 3) and the emails with the sign-in code in Resend are not deleted separately — they are erased on their own, after 7 and 30 days at most respectively.
• Without the app — a request to privacy@doggyapps.com from the address linked to the account (see How to delete your account).
• You have the right of access, rectification, erasure, restriction of processing, data portability, and objection, as well as the right to complain to the Ukrainian Parliament Commissioner for Human Rights, and, if you are in the EU, to the data protection supervisory authority of your country.

8. Children

The app is not intended for children under 16. If you learn that a child under 16 has created an account, write to us — we will delete it.

9. Security

Access to data is restricted by database-level rules (row-level security): every request checks that you are a family member of the relevant dog. Photos are stored in private storage and are served only through temporary links (1 hour). Connections are encrypted (HTTPS).

10. Changes

We will notify you of material changes in the app before they take effect.

11. Website and beta waitlist

The doggyapps.com website uses no cookies, browser storage, analytics or trackers. To serve a page, our host Cloudflare processes your IP address and the technical data of the request. A family invite link carries the code in the address itself (doggyapps.com/join/CODE), so the code, as part of the page address, ends up in Cloudflare Pages' technical logs; the code works once and only for 48 hours.

Waitlist. On the home page you can leave your email to get into the closed beta.

• Legal basis — your consent: the box under the form, which you tick yourself. You can withdraw it at any time by writing to privacy@doggyapps.com — we will delete the address without undue delay and within a month at the latest.
• Who receives it: Supabase stores the list (EU, Frankfurt; on IP addresses in Supabase logs see section 3). When we invite you to the beta, we enter your email in App Store Connect and Apple sends the TestFlight invitation; from then on Apple processes that address under its own terms. Any other emails we write from privacy@doggyapps.com.
• No newsletters: we send no ads or news and share the list with no one.
• No confirmation email: we do not verify the address with a separate email. If someone entered your address without your knowledge, simply ignore the invitation or write to us and we will delete it.
• The form is for people aged 16 and over.