Support
What leaves your phone, and what stays on it
Two switches, a lock your own phone runs rather than one we run, and an email list nobody can add you to but you. This is the plain version: what the five seconds of video does, where the records sit, and which of it you can switch off.
support@dogoos.com · a person reads every message
The five seconds
The clip isn’t kept as a video
A read is a few seconds of footage that travels with the request — through our own server to today’s most advanced multimodal AI — and it exists to produce one answer. Dogoos does not store the clip as a video. What survives is the read itself, and the single still keepsake frame if that read saved one. Take the keepsake out of the album and the picture goes with it.
What the AI provider does at its end isn’t our sentence to write, so we quote theirs rather than paraphrasing it into a Dogoos promise: Dogoos runs on a paid service, and that provider states prompts and the files sent with them are not used to train or fine-tune its models without our permission, while it may log them for abuse monitoring in the circumstances its own documentation sets out. The privacy policy carries that in full, with a link to the terms it comes from.
As for where the rest of it sits: core app records and uploaded private media are stored in European Firebase regions, encrypted in transit and at rest, and never sold. Sign-in, notifications, analytics and crash reporting are global services, and the privacy policy names which is which instead of rounding the whole product up to “hosted in Europe”. Your dog’s photos and keepsakes aren’t shareable links either. They’re stored as authenticated references, and every fetch is checked against the account — or the household — that owns the file. The long-lived download link Firebase attaches to an upload by default doesn’t survive the upload: a server trigger rotates it away, and won’t acknowledge the file until it has confirmed the old link is dead.
What is left of a clip afterwards
- Five secondsTravels with the request, through our server
- One answerThe whole reason the footage moved at all
- The video is not keptDogoos does not store the clip
- What survivesThe read, and one still keepsake frame if it saved one
Data & personalisation
Two switches, and what each one actually changes
Both live in Settings → Privacy & data → Data & personalisation, both are on when you arrive, and each is one tap.
Share usage data is product analytics and nothing else: which screens get opened, whether a read finished, the mood and confidence it came back with, how long the clip was. Pseudonymous, IP-trimmed, and not used for advertising — no ad network, no ad SDK, and nothing in it is sold or shared with advertisers. It never carries your photos, your reads, your dog’s name or anything you typed. And the switch is the real gate rather than a label on one: turning it off turns collection off at the source.
Personalised insights decides how much the model is told about the dog in front of it. On, the read is sent your dog’s profile — name, breed, age, personality, and whichever of sex, whether they’re neutered, weight, energy, what they love, the cues they know and your health notes you filled in — plus a small reference photo, downscaled before it goes, so the model reads the right dog when two of them share the frame, plus whichever context tags you tapped before recording. Off, it gets the clip. Not the profile, not the photo, not the tags. Your weekly report and Story Mode follow the same rule and write about “the dog” rather than using their name.
This site behaves the same way. Its analytics run without cookies until you accept them in the banner, and never track you for advertising.
Turning personalisation off costs you accuracy. Better you know that now than work it out from a run of vague reads. Without the reference photo, a frame with two dogs in it has nothing to pin the subject to; without the tags, the model can’t tell a dog braced at the bathroom door from one braced at the front door.
The lock on the app
Your phone does the checking, not us
Settings → Security → Face ID or fingerprint lock puts a local privacy lock on this one installation of Dogoos. Your phone runs the match inside its own biometric service and hands the app a yes or a no. Dogoos receives nothing biometric, keeps no credential, and the preference lives on that installation alone. The lock screen says so in as many words: this is a device privacy lock, not a sign-in, and your biometrics stay with your phone.
While it is locked, the app’s screens aren’t blurred behind a cover — they aren’t built at all, so there’s no private text sitting underneath waiting for a screen reader to find it. Separately from the lock, and whether you ever turn it on or not, Android keeps Dogoos out of the recent-apps snapshot while it’s in the background and iOS drops a solid cover before it hands the screen back. A glance at your notification shade mid-read is treated as the nothing it is, so checking a message doesn’t kill a read in progress.
What the lock does
- Asks before anything in your account is uncovered on this device
- Accepts a biometric and only a biometric — the device PIN, pattern or passcode fallback is deliberately not accepted
- Stays locked on every failure: cancelled, temporarily locked out, hard locked out, no biometric enrolled, hardware that can’t do the check
- Re-locks every time the app is properly backgrounded — no timer, no grace period, and a half-finished biometric prompt is thrown away with it
What it isn’t
- A sign-in. It authenticates nothing about your Dogoos account, and it has no bearing on signing in anywhere else
- A store of anything biometric. The comparison never leaves your phone’s own biometric service
- A passkey, and we won’t call it one
- A lock with a back door. There is exactly one route past it without a biometric, and it is destructive
That one route is destructive, on purpose. Enrolment wiped, hardware that can no longer do the check, a face the phone stops recognising — the lock screen offers Sign out & clear this device, which wipes this device’s copy of your account and returns you to the sign-in screen. There is no bypass, and nobody at Dogoos can open it for you. Your account survives it: sign back in and your dogs, reads and history come down again.
Nobody puts you on a list but you
One kind of message you can’t switch off and shouldn’t want to: account and security mail — verification, password resets, email-change alerts. It carries no offers, and it exists to complete or protect something you did.
Everything else is an affirmative yes. There are exactly three optional lists and a separate switch for Bone Shop receipts, every one of them off until you turn it on. A missing record counts as off. Nothing was inherited from your notification choices — switching on a push is never read as permission to email you, and the two consent systems are kept apart on purpose. You need a verified primary address before you can switch an optional email on — turning one off always works, verified or not — and delivery goes to the verified address our server resolves: the app cannot hand it a recipient.
Open tracking, click tracking and tracking pixels are all switched off, so nobody here knows whether you opened anything. Unsubscribing works from the message itself, both of the ways your mail client offers — and the visible link is scanner-safe. Opening it shows a confirmation page and changes nothing, because corporate filters follow every URL in a message and a scanner should never be able to unsubscribe a person who never clicked. Confirming does it immediately. None of it touches your account and security mail.
Optional mail never contains your dog’s photos, keepsakes or clips, your health or nutrition notes, anything you said to Rex, or a household’s name. And there is no “email a friend” anywhere in Dogoos — we won’t take somebody else’s address from you and write to them on your behalf, so your friend’s address never reaches us in the first place. The switches themselves, and what each list actually sends, are on the notifications and email page.
What Rex keeps
Notes you can read, and delete
Rex keeps short notes from your conversations so he doesn’t ask you the same thing twice. They aren’t hidden from you: Settings → Ask Rex → What Rex remembers lists every one, and deleting a note stops him using it from your next message onwards.
The switch under it decides how much he does without asking. On, every change waits for a Confirm card before anything saves. Off, a simple journal log — a walk, a meal — saves straight away with an Undo, while medications, reminders and profile edits still stop and ask. Two things skip the card in both modes and only two: setting your theme colour, and flipping dark mode. You’re looking at the result the second it happens, so a Confirm card would only ask you to approve something already on screen.
Getting it out, getting it gone
One button exports it, another empties it
Download my data, in that same Privacy & data screen, writes a real file and hands it to your phone’s share sheet: your account, every dog profile, every read, your cached Stories, redemptions, training, quiz stats, bookmarks, preferences and your email choices. It carries a flag saying whether the cloud read archive came back complete, so an export that couldn’t fetch everything admits it rather than looking whole.
Erasure runs on the server rather than on the handset, which is what lets it reach the append-only reads and the private files a phone can’t touch by itself. Account & data covers the export and the separate controls that clear your reads, your photos, or the account itself; deleting your account covers the largest of them, and the one thing deletion does not stop — a store carrying on billing for a subscription nobody cancelled.
The long versions live where you’d expect. The privacy policy names the services, the regions and the retention windows; the terms cover the rest of the arrangement, including the line that matters most on this page — a read is insight, not veterinary advice. If you’re worried about your dog, that’s a conversation for a qualified vet, not an app.
Asking us directly
One inbox, and a person reading it
No chat widget, no phone line, no ticket number. support@dogoos.com takes privacy and data requests, accounts, billing questions and bugs; hello@dogoos.com is for the Kennel plan and other professional enquiries, press and partnerships.
Two requests the buttons in the app can’t do for you: the server-side records that sit outside the self-serve export — the consent ledger and the delivery audit behind your email — and content you personally captured in a household you have since left. Both go by email, and we’ll check the request against the address on your account. Ask for the first one before you delete the account rather than after; afterwards there is nothing left to match you to. And nobody from Dogoos will ever ask you for your password.
Questions, answered
The ones that arrive before the export does
What actually happens to the video clip?
It rides with the request, produces your read, and is not stored as a video. The only image kept is the single still keepsake attached to that read, and removing it from the album takes the picture with it. The short-lived operation and recovery-cache records behind the AI call expire after 30 days on their own.
Does turning off “Share usage data” stop the AI learning from my dog?
No — and we’d rather correct that than quietly benefit from it. That switch is a product-analytics gate: it stops pseudonymous, IP-trimmed interaction telemetry, which never contained your photos or your reads to begin with. What happens at the AI provider is covered by that provider’s own paid-service statement, quoted and linked in the privacy policy, not by this toggle. An older line inside the app’s Help centre calls it “model-improvement sharing”; that wording predates the switch, and this page is the accurate one.
What does “Personalised insights” send, exactly?
On: your dog’s profile — name, breed, age, personality, and whichever of sex, whether they’re neutered, weight, energy, what they love, the cues they know and your health notes you filled in — a small downscaled reference photo so the right dog gets read in a multi-dog frame, and the context tags you tapped. Off: the clip alone, and your weekly report and Story Mode write about “the dog” instead of using their name. Reads get less accurate without it, which is the honest reason it ships on.
Is the Face ID lock the same as signing in?
No. It’s a local privacy lock for one installation of the app: your phone performs the check and returns a success or a failure, and nothing about it authenticates your Dogoos account. It isn’t a passkey either. If the biometric stops working, the only way past is Sign out & clear this device, which wipes this device’s copy and returns you to sign-in — your account and its history are still there when you sign back in.
Where is my data stored?
Core app records and uploaded private media are stored in European Firebase regions, encrypted in transit and at rest, and never sold. Some supporting services — sign-in, notifications, analytics, crash reporting — are global, or process limited technical data outside the UK and EEA under contractual safeguards. The privacy policy names which is which rather than rounding it up.
Will you email me if I haven’t asked you to?
Only account and security mail: address verification, password resets, email-change alerts. Every optional list starts off and stays off until you switch it on, Bone Shop receipts included, and turning on a push notification is never treated as permission to email you. There are no tracking pixels in any of it, and there is no way to hand us somebody else’s address.
Could someone find my dog’s photos with a link?
Photos and keepsakes are stored as private references your signed-in app resolves, and access is checked against the account that owns the file on every fetch — in a household, against membership of that household. The long-lived download link Firebase attaches to an upload by default doesn’t survive it: a server trigger rotates that link away, and won’t acknowledge the file until it has confirmed the old one is dead.
Two switches, one lock,
and an export button that really exports.
Open the web app 🦴
Free to use · Live camera reads are on the phone app