Privacy Policy

Geographic availability

The Service is offered only to individuals located in the United States, the European Economic Area (EEA), the United Kingdom, and Switzerland (together, the "Permitted Territories"). This Policy is written to meet the requirements of the EU/UK General Data Protection Regulation ("GDPR") and applicable US state privacy laws (including the California Consumer Privacy Act, as amended by the CPRA). We do not knowingly collect personal information from, or offer the Service to, individuals located outside the Permitted Territories, and this Policy should not be read as extending any right or protection under the law of any other jurisdiction.

1. Information we collect

Account information. Email address, and if you sign in with Apple or Google, the name and email they share with us. If you use passwordless email sign-in, we send a one-time code to verify your address.

Profile & household information. Your display name, bio, and profile photo; the members of your household and their roles.

Pet information. Everything you choose to add about your pets: name, species, breed, birthday, weight, photos and videos, medical records, vaccinations, bills, and notes.

Community content. Questions, answers, reactions, and reports you post in Community groups, visible to other members as described in the app.

Care listings. Vets, groomers, and other places you add to the Care directory, and which places you save as favourites.

Usage & device information. Basic diagnostic information if you have crash reporting enabled (off by default), and a push-notification token if you enable notifications, so we can deliver reminders to your device.

Payment information. We do not collect or store your card details. Subscriptions are purchased and billed through the Apple App Store or Google Play, and payment is processed entirely by Apple/Google. We only receive confirmation that a subscription is active, via RevenueCat.

Biometric data. If you enable Face ID / Touch ID / fingerprint lock, that authentication happens entirely on your device using your device's own operating system. Airbok never receives, stores, or has access to any biometric data.

2. How we use your information

• To provide the Service: store your pets' records, sync your household, power reminders, and display Community/Care content.
• To send you transactional email: sign-in codes, notices about your account or subscription, and — only if you use them — content you explicitly ask us to send on your behalf, like sharing a Care listing or a referral invite by email.
• To operate the referral program and apply rewards to your account.
• To respond to support requests you submit through Contact Us.
• To keep the Service secure and prevent abuse (e.g. detecting spam or policy violations in Community content).

We do not sell your personal information, and we do not use your pets' photos or medical records to train any AI model.

Legal basis for processing (EEA/UK/Switzerland users)

Where GDPR applies, we rely on the following legal bases: performance of a contract(providing the Service you signed up for — your pet records, household sync, reminders); legitimate interests (keeping the Service secure, preventing abuse, and improving features), balanced against your rights; consent (crash reporting, push notifications, and marketing email, all opt-in); and legal obligation (where we must retain records for tax, accounting, or fraud-prevention purposes). You can withdraw consent at any time via Settings without affecting the lawfulness of processing before withdrawal.

3. Who we share it with

We use a small number of service providers to run Purrlo, each bound by their own privacy and security commitments:

Community posts, reactions, and Care listings you submit are visible to other Purrlo users as part of using those features — that sharing is the purpose of those features, and is separate from third-party service providers above.

We do not share your data with advertisers, and we do not sell it to data brokers.

4. Where your data lives

Your account and pet data is stored on Supabase infrastructure; photos, videos, and documents are stored in a private Amazon S3 bucket that only Purrlo's backend can issue access to (via short-lived, per-file links). We take reasonable technical and organizational measures to protect your data, including encryption in transit and row-level security so that only your household can access your pets' records.

International transfers. Our service providers (Section 3) may process data in the United States. Where we transfer personal data of EEA/UK/Swiss users to the US, we rely on that provider's Standard Contractual Clauses and/or other safeguards recognized under GDPR to protect that transfer.

5. Your choices & rights (all users)

• Export your data. From Manage Account → Export My Data, you can browse each pet's Gallery, Medical Bills, Medical Records, and Vaccinations, and share any of them to yourself or anyone else by email.
• Delete your account. From Manage Account → Delete Account, you can permanently delete your account and the data associated with it. If you solely own a household, deleting your account deletes that household too.
• Leave a Community group. You can leave any group at any time; your past posts remain visible to former group members unless you delete them.
• Turn off notifications or crash reporting at any time in Settings.

If you're in the EEA, UK, or Switzerland (GDPR)

You have the right to: access the personal data we hold about you; rectify inaccurate data; erase your data ("right to be forgotten"); restrict or object to certain processing; data portability (get your data in a structured, machine-readable format — our in-app Export My Data feature does this directly); and to withdraw consent at any time for anything based on consent. To exercise any of these, contact us (Section 8); we'll respond within one month as required by GDPR. You also have the right to lodge a complaint with your local data protection supervisory authority.

If you're in the United States (CCPA/CPRA and other state laws)

Depending on your state, you have the right to: know what personal information we've collected about you and why; delete personal information we hold about you; correct inaccurate personal information; and opt out of the sale or sharing of personal information. We do not sell or share your personal information for cross-context behavioral advertising, so there is nothing to opt out of — this right is provided as a matter of transparency. We will not discriminate against you for exercising any of these rights. To exercise them, contact us (Section 8); we may need to verify your identity before fulfilling a request.

6. Data retention

We keep your account and pet data for as long as your account is active. If you delete your account, we delete your personal data and uploaded files within a reasonable period, except where we're required to retain limited records for legal, security, or fraud-prevention purposes.

7. Children's privacy

Purrlo is not directed to, and we do not knowingly collect personal information from, anyone under 16 (consistent with GDPR's default age of consent) or under 13 (the threshold under the US Children's Online Privacy Protection Act, "COPPA"). If we learn we've collected personal information from a child under these ages, we'll delete it. If you believe a child has provided us personal information, contact us (Section 8).

8. Contact us

Questions about this Privacy Policy or your data? Reach us from Contact Us inside the Purrlo app (Profile menu → Contact us), or see our Support page.

9. Changes to this policy

We may update this Privacy Policy from time to time. If we make material changes, we'll notify you in the app or by email before they take effect.