Privacy Policy

This policy explains what the Dogoos mobile app ("Dogoos", "we", "us") collects, why, and the choices you have. Dogoos helps you understand your dog's mood from a short camera clip. If you have any questions, email support@dogoos.com.

Information we collect

How AI features are processed

Reads and other AI features are processed by the pinned Gemini 3.5 Flash model through Dogoos Cloud Functions and Google Cloud's Vertex AI service in the EU multi-region. We use a paid Google Cloud service: Google states that prompts, associated files and responses from paid services are not used to train or fine-tune its AI/ML models without our permission. Google may log prompts for abuse monitoring in the circumstances described in its Vertex AI retention documentation. A read is an interpretation for insight and entertainment — it is not veterinary advice or a medical diagnosis.

How we use your information

• To provide the core features — reads, your dog profiles, history and cross-device sync.
• To send notifications you've turned on.
• To send essential account and security emails, such as address verification, confirmation after a verification you completed, password reset and email-change alerts. These are not marketing messages.
• If you make a separate affirmative choice, to send the selected daily or weekly factual account brief, successful-read inactivity reminders, or Dogoos product news, a one-time getting-started guide, useful tips, feature announcements and occasional Dogoos offers. Each category starts off and can be changed independently.
• If you separately enable Bone Shop receipts, to send one factual service confirmation for each eligible Bone Shop redemption. This choice starts off, contains no marketing and can be changed at any time.
• To keep the service secure and prevent abuse.
• To improve Dogoos — using pseudonymous app-interaction analytics (on by default; opt out anytime in Settings → Privacy).

Where it's stored

Firestore data is stored in Google's eur3 European multi-region, private media in europe-west1, and AI model processing uses the EU multi-region. Authentication, notifications, analytics, crash reporting and some supporting Cloud Functions are global services or may process limited technical data outside the UK/EEA under Google's contractual safeguards. Data is encrypted in transit and at rest. We do not sell it.

Who we share it with

• Google — as our infrastructure and AI provider (Firebase Authentication, Firestore, Storage, Cloud Functions, Vertex AI/Gemini, Crashlytics, notifications and Analytics).
• Google Play or Apple — to process purchases and subscriptions under the store account and payment terms you choose.
• Mailgun (Sinch) — to deliver Dogoos account/security email and, only after your explicit choice, the optional categories or Bone Shop receipts you enable. Mailgun processes the recipient address, message and limited delivery/security metadata for that purpose; Dogoos uses its EU sending service. Dogoos disables open and click tracking for Dogoos-controlled optional and receipt messages.
• We do not share your personal data with advertisers and we never sell it.

Households

Dogoos lets you form a household so family members can share the same dogs while each keeps their own account, name and settings. When you add or bring content into a household — dogs and their photos, reads, keepsake photos, health entries and Story cache — that content is visible to every member of the household, and any member may edit or remove shared dogs. Content you contribute may be retained by the household after you leave so the rest of the family keeps their pack; when the last member leaves, the household and its shared data are deleted. If you want the content you personally captured removed after you've left, contact support@dogoos.com. Your personal account data (name, themes, quiz progress, bones and history that isn't shared) always stays yours and is removed when you delete your account.

Keeping & deleting your data

We normally keep account content until you delete it. Short-lived AI operation and recovery-cache records expire after 30 days, quiz receipts after their short validation window, and inbox notifications according to their category. Idempotency receipts for a reads/photos clear remain with the account so a delayed retry cannot erase newer content, and are removed when the account is deleted. Firestore point-in-time recovery can retain deleted document versions for up to seven days, and Cloud Storage soft deletion can retain deleted private-media objects for up to seven days. Aggregated, non-content AI cost totals may be retained for financial reconciliation.

When account deletion is accepted, sign-in and app access are removed and current account content is erased on the server. A Cloud Storage resumable upload that began before deletion can technically finish during Google's maximum one-week session window. Dogoos keeps a server-only deletion safety record, removes any such late object when it appears, and re-scans the account's media for eight days before retiring that record. A previously obtained direct download link may remain usable only until that automatic late-object removal runs. This bounded asynchronous cleanup is separate from the seven-day backup/soft-delete retention above.

After account deletion, a Play purchase record may remain without your account identifier while needed to prevent token replay and to restore or resolve a still-live subscription, refund or dispute. Legal, security and provider logs may also remain for their applicable retention periods.

Dogoos keeps your separate email choices, consent history, limited delivery and idempotency state and one-way unsubscribe-token hashes only as needed to honour and evidence those choices. Changing the primary account email disables the old optional-email binding and the Bone Shop receipt binding until you actively choose again for the verified new address. Pending verification-completion intents expire after eight days; completed or ambiguous delivery ledgers remain with the account where needed to prevent duplicate security or service messages. The in-app data export includes your current optional-email choices, Bone Shop receipt choice, preference revision and consent version, suppression status, timezone, local hour and locale. It marks that section incomplete rather than inventing choices if the server is temporarily unavailable. You can ask Support for the broader server-only consent and delivery audit history. Recipient identity hashes, message or provider identifiers, and reusable unsubscribe tokens or hashes are not put in the in-app export. Account deletion removes the account's subscriptions, lifecycle intents, consent and delivery records, successful-read reminder facts and unsubscribe-token records. Clearing reads removes or re-fences the read-generation facts used for a brief or inactivity timer.

In the app you can:

• Download an app data export (Settings → Privacy → "Download my data"), including the complete paged read archive. Contact us for a broader access request.
• Clear the reads & photos you captured, which removes them on your device and in the cloud. Content you've shared into a household is handled under "Households" above.
• Delete your account (Settings → Account), which removes sign-in/access and starts permanent server erasure of your personal account, your own dogs, reads, photos and related data, including the bounded late-upload cleanup described above. Dogs and content shared into a household stay with the household for its remaining members (and are deleted with it when you were the last member).

Your rights

Depending on where you live (including under UK/EU GDPR), you have rights to access, correct, export, and delete your data, and to withdraw consent. You can exercise most of these directly in the app; for anything else, contact support@dogoos.com.

Dogoos sends engagement or marketing email only for the default-off categories an account owner has affirmatively enabled; it does not treat push or in-app notification settings as email permission. Onboarding may show these choices so they are discoverable, but leaves them off unless you explicitly enable them. Dogoos uses only your live, verified primary account address for each selected category. Dogoos treats that choice as consent for the selected optional communications; you can withdraw it at any time without affecting your core account. Every optional message has visible preference and unsubscribe links and an email-provider one-click unsubscribe header. Opening the visible link with GET does not change your choice; confirming it, or a standards-based one-click POST, suppresses that category. Optional messages use a sender identity and category-specific List-ID separate from security email and contain no open/click tracking. Bone Shop receipts are a separately enabled factual service choice, not marketing, and are controlled by their own in-app switch rather than an optional-list unsubscribe. Essential security emails cannot be disabled while the related account action is in progress because they protect access to your account.

Dogoos does not accept a friend's email address to send a referral or marketing message on your behalf. If you use the phone's ordinary share sheet, the app you choose handles the recipient and Dogoos does not receive their address.

Children

Dogoos is not directed to children under 13 (or the minimum age in your country), and we do not knowingly collect their data.

Changes

We'll update this policy as the app evolves and revise the date above. Material changes will be highlighted in the app.