Privacy Policy

This policy explains what the Dogoos apps and website ("Dogoos", "we", "us") collects, why, and the choices you have. Dogoos helps you understand your dog's mood from a short camera clip. If you have any questions, email support@dogoos.com.

Who we are

Dogoos is made and run by Snowy Lakes. Snowy Lakes decides how and why your personal data is used in Dogoos, which makes it the controller of that data under UK data protection law. To ask about anything in this policy, or to use any of your rights, email support@dogoos.com.

Information we collect

How AI features are processed

Reads and text-based AI features use the pinned Gemini 3.5 Flash model through Dogoos Cloud Functions and Google Cloud's Vertex AI service in the EU multi-region. Rex Live uses Gemini Live native audio through a separate Dogoos streaming service in Google's europe-west1 region. Both use a paid Google Cloud service: Google states that prompts, associated files and responses from paid services are not used to train or fine-tune its AI/ML models without our permission. Google may log prompts for abuse monitoring in the circumstances described in its Vertex AI retention documentation. A read is an interpretation for insight and entertainment. It is not veterinary advice or a medical diagnosis.

Connected assistants

If you choose to connect ChatGPT, Dogoos shows the permissions before you approve access. The private owner pilot can share your dog profiles, recent read summaries, daily care totals and reminders, and Dogoos directory and booking-option snapshots with OpenAI's ChatGPT under your account there. If you separately approve the photo permission, it can also show small copies of your dog profile photos and saved keepsakes in ChatGPT. Photos stay excluded from connections without that permission; existing connections do not gain it automatically. Image metadata is removed and no public photo links are created. Photos delivered into ChatGPT are covered by your account settings and OpenAI's privacy notice, even after you disconnect Dogoos. Clips, audio, chat history, payment details and precise location remain excluded. Care entries remain drafts until you separately approve the exact entry in Dogoos; the connection cannot reserve a place or make a payment.

The optional panel-preferences permission saves your chosen default dog, time zone and compact-card setting in Dogoos for use with the connected panel. Dog and read mentions attach only the item you choose to the conversation; they do not attach photos. If you explicitly ask ChatGPT to monitor completed reads and approve the separate updates permission, Dogoos can send a small text summary when a selected dog's read is ready. Monitoring lasts no more than 24 hours at a time and can be stopped in ChatGPT or by disconnecting Dogoos. Photos, clips and audio are not included in these updates. Permissions added to the connection are always shown for your approval; refreshing an existing connection does not grant them.

You can disconnect in Settings → Privacy & data → Connected assistants. A connection lasts at most 90 days and is checked again on each request. Disconnecting stops future access and draft approval. It does not remove information already delivered into your ChatGPT conversations. OpenAI's own privacy notice and your ChatGPT data settings apply to that information. The EU storage described below is Dogoos's storage, not a claim about the assistant provider's copy. Deleting your Dogoos account removes its connection records and pending drafts from Dogoos as part of account erasure.

Monitoring records and delivery attempts are temporary. Dogoos encrypts the callback verification secrets, checks your current access and hidden-read choices before delivery, and removes expired records automatically. Saved panel preferences are removed when you delete your Dogoos account. As with other shared information, disconnecting does not remove updates already delivered to ChatGPT.

How we use your information

• To provide the core features: reads, your dog profiles, history and cross-device sync.
• To arrange Fetch bookings and orders with the business you choose, provide delivery or collection details, and handle payment status, cancellations, refunds and support for those transactions.
• To send notifications you've turned on.
• To send essential account and security emails, such as address verification, confirmation after a verification you completed, password reset and email-change alerts. These are not marketing messages.
• If you make a separate affirmative choice, to send the selected daily or weekly factual account brief, successful-read inactivity reminders, or Dogoos product news, a one-time getting-started guide, useful tips, feature announcements and occasional Dogoos offers. Each category starts off and can be changed independently.
• If you separately enable Bone Shop receipts, to send one factual service confirmation for each eligible Bone Shop redemption. This choice starts off, contains no marketing and can be changed at any time.
• To keep the service secure and prevent abuse.
• To improve Dogoos, using pseudonymous app-interaction analytics under the privacy choices described above.

Where it's stored

Firestore data is stored in Google's eur3 European multi-region, private media in europe-west1, and AI model processing uses the EU multi-region, or europe-west1 for Rex Live voice. Home-screen widgets keep a small, dated summary and an optional reduced keepsake image in private app storage on your device. Widget information is hidden when Dogoos biometric privacy lock is enabled: widgets show generic shortcuts instead. Cached widget data is cleared on sign-out. Authentication, notifications, analytics, crash reporting and some supporting Cloud Functions are global services or may process limited technical data outside the UK/EEA under Google's contractual safeguards. Data is encrypted in transit and at rest. We do not sell it.

Who we share it with

• Google: as our infrastructure and AI provider (Firebase Authentication, Firestore, Storage, Cloud Functions, Vertex AI/Gemini, Crashlytics, notifications and Analytics).
• Google Play or Apple: to process purchases and subscriptions under the store account and payment terms you choose.
• The Fetch business you choose: the booking or order details needed to provide that service, including the collection name or delivery address and any optional phone number or instructions you submit. The checkout identifies the seller and explains this use. The business handles the information it receives under its own privacy responsibilities; it is not a public profile or directory listing.
• OpenAI: only when you explicitly connect ChatGPT, the scoped Dogoos information described above goes to your ChatGPT account for the requests you make. OpenAI's own privacy notice and your ChatGPT data settings apply.
• Mailgun (Sinch): to deliver Dogoos account/security email; only after your explicit choice, the optional categories or Bone Shop receipts you enable; and the launch-waitlist confirmation and launch message described below; and to route website enquiries to our team. Mailgun processes the recipient address, message and limited delivery/security metadata for that purpose; Dogoos uses its EU sending service. Dogoos disables open and click tracking for Dogoos-controlled optional, receipt and waitlist messages.
• Open Pet Food Facts: when you scan a pet-food barcode that is not already saved in your My foods library, your phone asks the Open Pet Food Facts open database about that barcode directly, rather than going through our servers. Only the barcode is sent; no account, dog or device identifier goes with it. Because the request comes from your phone, Open Pet Food Facts receives your IP address, exactly as any website you open would. The product it returns is used for the meal you log and is not saved to My foods or a shared Dogoos catalogue. Open Pet Food Facts is an open database run by the non-profit Open Food Facts association and has its own privacy notice.
• We never sell your personal data. If you opt in to advertising measurement, we share limited identifiers and measurement events with Google to measure Dogoos adverts, as described above.

Households

Dogoos lets you form a household so family members can share the same dogs while each keeps their own account, name and settings. When you add or bring content into a household (dogs and their photos, reads, keepsake photos, health entries, meal routines and Story cache), that content is visible to every member of the household, and any member may edit or remove shared dogs. Content you contribute may be retained by the household after you leave so the rest of the family keeps their pack; when the last member leaves, the household and its shared data are deleted. If you want the content you personally captured removed after you've left, contact support@dogoos.com. Your personal account data (name, themes, quiz progress, bones and history that isn't shared) always stays yours and is removed when you delete your account.

Keeping & deleting your data

Fetch order contact details: when a current order is marked collected, delivered or cancelled, Dogoos schedules its collection and delivery contact details for removal after 90 days. A later refund does not restart that period. Older orders without this scheduled cleanup remain until account deletion or a deletion request. Account deletion also removes those details from Dogoos. The order and financial audit record can remain without those contact details where needed for reconciliation, refunds or disputes. This does not delete copies already received by the seller; contact that business about its records.

Temporary read clips and requests: unfinished captures expire 24 hours after capture. We remove the active temporary clip and request when processing finishes, you cancel the pending read, or it expires. Cleanup is asynchronous: server cleanup runs periodically, and a device copy is removed when the app or its operating-system worker can next run. Force-stopping the app can delay local cleanup. Expiry stops the capture being processed; it is not a promise that every physical copy disappears at that exact moment. Server backups and soft-deleted copies can remain for up to seven further days as described below. Completed read results and usable keepsake photos follow the normal account-content retention rules.

We normally keep account content until you delete it. Short-lived AI operation, recovery-cache and numeric Rex Live session records expire after 30 days, with asynchronous cleanup. Live session records contain usage and status, not audio or transcripts. The phone keeps up to 30 Live action receipts and clears them with account-local data on sign-out or account deletion. Routine completion receipts remain with the journal to prevent duplicate meals after a retry. Quiz receipts expire after their short validation window, and inbox notifications according to their category. Idempotency receipts for a reads/photos clear remain with the account so a delayed retry cannot erase newer content, and are removed when the account is deleted. Firestore point-in-time recovery can retain deleted document versions for up to seven days, and Cloud Storage soft deletion can retain deleted private-media objects for up to seven days. Aggregated, non-content AI cost totals may be retained for financial reconciliation.

When account deletion is accepted, sign-in and app access are removed and current account content is erased on the server. A Cloud Storage resumable upload that began before deletion can technically finish during Google's maximum one-week session window. Dogoos keeps a server-only deletion safety record, removes any such late object when it appears, and re-scans the account's media for eight days before retiring that record. A previously obtained direct download link may remain usable only until that automatic late-object removal runs. This bounded asynchronous cleanup is separate from the seven-day backup/soft-delete retention above.

After account deletion, a Play purchase record may remain without your account identifier while needed to prevent token replay and to restore or resolve a still-live subscription, refund or dispute. Legal, security and provider logs may also remain for their applicable retention periods.

A seven-day referral trial is available once per verified email address in twelve months, including if an account is deleted and created again or a different sign-in provider is used. For that sole abuse-prevention purpose, we keep a private key derived from the verified address with a separate server secret, together with the trial window's expiry. This fact contains no email address, account identifier, device information or household details and is not shown to other users. It remains after account deletion until twelve calendar months after the trial was granted, then expires and is removed by automatic background cleanup. Our normal backup window can retain a deleted copy for up to seven further days. We can recompute the private key when the same verified address requests another trial; it is a pseudonym, not anonymous data. We use it only to limit repeat referral trials, not to join accounts, send messages, analyse activity or advertise.

Dogoos keeps your separate email choices, consent history, limited delivery and idempotency state and one-way unsubscribe-token hashes only as needed to honour and evidence those choices. Changing the primary account email disables the old optional-email binding and the Bone Shop receipt binding until you actively choose again for the verified new address. Pending verification-completion intents expire after eight days; completed or ambiguous delivery ledgers remain with the account where needed to prevent duplicate security or service messages. The in-app data export includes your current optional-email choices, Bone Shop receipt choice, preference revision and consent version, suppression status, timezone, local hour and locale. It marks that section incomplete rather than inventing choices if the server is temporarily unavailable. You can ask Support for the broader server-only consent and delivery audit history. Recipient identity hashes, message or provider identifiers, and reusable unsubscribe tokens or hashes are not put in the in-app export. Account deletion removes the account's subscriptions, lifecycle intents, consent and delivery records, successful-read reminder facts and unsubscribe-token records. Clearing reads removes or re-fences the read-generation facts used for a brief or inactivity timer.

In the app you can:

• Download an app data export (Settings → Privacy → "Download my data"), including the complete paged read archive. Contact us for a broader access request.
• Clear the reads & photos you captured, which removes them on your device and in the cloud. Content you've shared into a household is handled under "Households" above.
• Delete your account (Settings → Account), which removes sign-in/access and starts permanent server erasure of your personal account, your own dogs, reads, photos and related data, including the bounded late-upload cleanup described above. Dogs and content shared into a household stay with the household for its remaining members (and are deleted with it when you were the last member).

Your rights

Depending on where you live (including under UK/EU GDPR), you have rights to access, correct, export, and delete your data, and to withdraw consent. You can exercise most of these directly in the app; for anything else, contact support@dogoos.com.

Dogoos sends engagement or marketing email only for the default-off categories an account owner has affirmatively enabled; it does not treat push or in-app notification settings as email permission. Onboarding may show these choices so they are discoverable, but leaves them off unless you explicitly enable them. Dogoos uses only your live, verified primary account address for each selected category. Dogoos treats that choice as consent for the selected optional communications; you can withdraw it at any time without affecting your core account. Every optional message has visible preference and unsubscribe links and an email-provider one-click unsubscribe header. Opening the visible link with GET does not change your choice; confirming it, or a standards-based one-click POST, suppresses that category. Optional messages use a sender identity and category-specific List-ID separate from security email and contain no open/click tracking. Bone Shop receipts are a separately enabled factual service choice, not marketing, and are controlled by their own in-app switch rather than an optional-list unsubscribe. Essential security emails cannot be disabled while the related account action is in progress because they protect access to your account.

Dogoos does not accept a friend's email address to send a referral or marketing message on your behalf. If you use the phone's ordinary share sheet, the app you choose handles the recipient and Dogoos does not receive their address.

Website contact enquiries

When you use the website contact form, we use your name, reply email, chosen topic and message to handle and follow up your enquiry. The message is sent to the appropriate Dogoos inbox through Mailgun's EU sending service, with open and click tracking disabled. Sending an enquiry does not create an account or opt you into any email list.

The app database does not store your contact message, name or raw reply address. It keeps short-lived, one-way abuse-prevention keys, counters and delivery status; these expire after two days, with automatic deletion following expiry. Raw IP addresses are not stored in those records. Correspondence in our inbox and mail-provider records is used to respond, follow up and meet any applicable obligations. You can ask us about access or deletion through the same form or by emailing support@dogoos.com.

Website form protection

When you interact with a contact or launch-waitlist form, we load Google's reCAPTCHA Enterprise to help prevent automated abuse. Google processes browser, device and interaction information, including the network address used to connect to its service. Our server sends Google the resulting short-lived token and the form action to check it; it does not send your enquiry, name, email address or forwarding headers in that assessment. The service is subject to Google's Privacy Policy and Terms of Service.

We keep an address-independent daily assessment counter to limit provider costs. That counter expires after two days, with automatic deletion following expiry. A bot assessment does not identify a unique person.

Launch waitlist (dogoos.com)

If you ask the Dogoos website to tell you when the app reaches the app stores, that is a separate list from everything above and is not connected to any Dogoos account. Because you do not need an account to join it, we cannot look your address up when it is time to write to you, so we have to store the address you typed. We keep it in its own place, apart from app data, and it is never joined to an account, a dog, a read or anything else about you.

What we store: your email address; a one-way key derived from it so the same address cannot be added twice and so we can rate-limit sign-ups; which page you signed up from; whether you are unconfirmed, confirmed or unsubscribed, and when; the exact consent wording shown to you and a fingerprint of it; the version of this policy in force at the time; and how many messages we have sent you. We do not store your IP address or use caller-supplied forwarding headers as an identity. Form protection is described above.

Lawful basis: your consent (UK/EU GDPR Art 6(1)(a)). Joining is double opt-in: after you sign up we email you, and you are only added once you open that email and press the confirm button on the page it opens. A link merely being visited (by you, your browser, or your employer's email security scanner) is deliberately not enough, because that would not be a choice you made.

How long we keep it: if you never confirm, the request and your address are deleted 30 days after you asked, counted from the original request, so asking again does not extend it. A confirmed entry is kept for at most 400 days. If you unsubscribe, your email address is deleted immediately and we keep only the one-way key; that key is itself deleted at most 400 days later. While we hold that key we will not re-add the address for at least 30 days, so nobody else can put you back on the list by typing it in. After that you are free to join again yourself if you want to.

How to withdraw: every email we send you carries an unsubscribe link, and pressing the button on the page it opens removes you and deletes your address straight away. You can also email support@dogoos.com. Withdrawing is free and has no effect on anything else. If you have a Dogoos account and you delete it, we also delete any launch-waitlist entry for that account's email address, so account deletion does not leave you on this list.

We use the list for one thing: telling you the app is live. It is never sold or used for advertising, and it is never shared with anyone except Mailgun, which delivers the message for us. It never receives Dogoos product marketing. That is a separate, account-only choice described above.

Children

Dogoos is not directed to children under 13 (or the minimum age in your country), and we do not knowingly collect their data.

Changes

We'll update this policy as the app evolves and revise the date above. Material changes will be highlighted in the app.