Privacy, in plain English.

We don’t sell your data and we never will. This page explains what we collect, why, on what legal basis, where it lives, how we protect it, how long we keep it, and how to get it back or delete it. It covers both the Puffy iOS app and the puffy.pet website.

Who is responsible (the “controller”)

The controller of your personal data — the party legally answerable for it — is Puffy Lab, LLC, a Delaware limited liability company, 1401 Lavaca St STE 81012, Austin, TX 78701, USA (Delaware file no. 10756102).

Privacy questions and requests: help@puffy.pet. A human reads it, and we answer within 30 days.

What we collect

You can read every page on puffy.pet without an account and without telling us anything. In the app, we collect what the app needs to work:

• Account data — the email address you sign in with, authentication tokens, your region and language.
• Pet profile data — everything you enter about your dog: name, breed, age, weight, photos, health events, vaccinations, notes, documents. This is data about your dog; where it also says something about you, we treat it as your personal data.
• Asky conversations — the messages you exchange with Asky, and the profile context used to answer them.
• Subscription status — whether your account has Puffy Plus, and the Apple record we use to verify it. Apple takes the payment. We never see your card number.
• Walks from Apple Health — only if you connect it. Puffy reads walk and activity data your iPhone or Apple Watch already recorded, so a walk you tracked once does not have to be entered twice. This is data about you, not your dog, and it is the one place the app touches human health data. Puffy can also save walks you start in the app to Apple Health. You grant reading and writing separately in iOS and can revoke either there at any time, and Apple’s own rules forbid using it for advertising or selling it — which we would not do regardless.
• Diagnostics — crash reports and error logs from the app and our servers, so we can fix what breaks.
• Optional analytics — page and interaction events, with pseudonymous browser and session identifiers where the provider uses them. In the app, screen and action events linked to your Puffy account ID. Only if you consent; see “Analytics and measurement” below.
• Technical request data — your IP address, device or browser type, and the pages you request. Our hosting and CDN provider logs these to deliver the service and block attacks. Every website you visit does this; it cannot be switched off without switching off the service.

An email address is the only thing genuinely required — without one there is nothing to sign in to. Everything about your dog is optional and you can leave any field blank, though Puffy has little to work with if you do.

We do not collect your precise location, your contacts, your photo library beyond the pictures you pick, or what you do on other sites and apps. We do not use advertising trackers and we do not run ads.

Why we collect it, and the legal bases

Under the GDPR and comparable laws, every use of personal data needs a legal basis. Ours are:

• Running the service — storing your account and your dog’s profile, syncing your devices, answering Asky questions, unlocking what you paid for: performance of a contract (Art 6(1)(b)).
• Keeping it working and safe — diagnostics, abuse prevention, security logging, backups: our legitimate interests (Art 6(1)(f)) in operating a secure, reliable service.
• Improving Asky’s answers and its safety guardrails — reviewing conversations in de-identified or aggregate form: legitimate interests, with the safeguards described below. Where the law requires consent instead, we ask for it.
• Optional analytics, heatmaps and session replay, on the site and in the app: your consent (Art 6(1)(a)), which you can withdraw at any time.
• Service emails — sign-in codes, receipts, security and account notices: performance of a contract. These are not marketing and there is nothing to unsubscribe from.
• Legal obligations — tax, accounting, responding to lawful requests: legal obligation (Art 6(1)(c)).

We do not use your data for third-party advertising, we do not sell it, we do not share it for cross-context behavioural advertising, and we do not make decisions about you with legal effect by purely automated means.

Asky and AI processing

Asky is an AI assistant. To answer, it reads the conversation together with your dog’s profile context — breed, age, weight, recent events.

Writing a reply means sending that conversation and context through OpenRouter, a routing service that passes each request to the AI model provider that answers it (currently Anthropic, OpenAI and DeepSeek). We set OpenRouter to use only providers that do not keep prompts and do not collect them for training. The request goes there to produce your answer and for nothing else.

The commitment, whoever the provider turns out to be: your conversations and your dog’s records are not used to train AI models, and we will not use a provider that reserves the right to train on them.

Your dog’s photo is also read by a model, to draw your dog’s portrait and to infer breed and coat. Photos and documents you add, and live voice conversations with Asky, are processed the same way. That happens at a provider, not on your device: they go through OpenRouter to the model provider.

We may review conversations in de-identified or aggregate form to improve Asky’s quality and its safety guardrails — for example, to catch cases where it should have told you to call a vet and didn’t.

Asky is not a veterinarian and does not diagnose. That is a product promise rather than a privacy one, but it belongs here too — the detail, including when to stop reading and call a vet, is on the safety page.

Analytics and measurement

We want to know which parts of Puffy help and which get in the way. We would rather measure that honestly than guess — and rather ask you than track you quietly.

Optional analytics are off until you agree. Before consent, we do not load those providers or send them events. On the website, Do Not Track and Global Privacy Control block these providers and the consent prompt.

To change your website choice, close your Puffy tabs, clear cookies and site data for puffy.pet in your browser, then reopen the site and choose Decline if asked. This removes local analytics identifiers and keeps optional analytics off. It does not erase events already held by a provider; contact help@puffy.pet about your data rights. App analytics ship together with a privacy setting to withdraw consent, not before it.

What analytics covers, once you allow it:

• Which pages and screens you open, in what order, and which controls you tap — as event names and counts, not as a copy of what you wrote.
• Approximate location at country or city level, derived from your IP address, plus your device or browser type.
• Funnels: how many people who start something finish it. Aggregate by design.
• On the website, heatmaps and session replay — a reconstruction of how a page was used: scrolling, clicks, pointer movement. Anything you type into a form field is masked in your browser before it is sent, so a replay never contains what you typed.

Analytics events never carry the contents of your dog’s records or your Asky conversations.

Optional providers include PostHog (product analytics), Microsoft Clarity (website heatmaps and session replay), Plausible (page counts), Google Analytics 4 and Mixpanel (website and in-app measurement). Plausible does not set a browser identifier. PostHog, Clarity and GA4 use identifiers to distinguish browsers or sessions.

GA4 applies to puffy.pet, not the iOS app. After consent, it uses first-party cookies with pseudonymous browser and session identifiers. This is not fully anonymous or cookieless measurement. Google also receives technical information such as browser and device details.

Our GA4 events measure public page views, article reading milestones, feature-page buttons, matcher progress and App Store button actions. They include page and content IDs, language, button placement, experiment labels and limited campaign source tags. We exclude quiz answers, breed choices, form values, emails, pet records, conversation text and full URL query strings.

Our GA4 setup disables advertising features, Google Signals, automatic user-provided-data collection and enhanced automatic measurements such as forms and site searches. GA4 does not receive account IDs or user profiles from Puffy.

Mixpanel measures both puffy.pet and the iOS app, with a separate choice for each. On the website, it starts only after you accept a consent prompt naming Mixpanel. An earlier choice to allow GA4 does not authorize Mixpanel.

We send Mixpanel selected page views, button clicks, reading milestones and matcher progress. Events contain public page and content IDs, language, button and experiment labels, limited campaign tags and a temporary session identifier. We do not send quiz answers, form values, emails, pet records, chat text, full URL query strings or raw referrer URLs.

On the website, Puffy supplies Mixpanel with a temporary identifier for the current browser tab. We do not link it to an account or create a person profile. We disable Mixpanel’s own cookies and persistent storage, autocapture, session replay, heatmaps and IP-based geolocation. This measures consented browser sessions, not identified people.

In the iOS app, Mixpanel runs only if you agree. After you sign in, the app asks once whether you want to help improve Puffy. Until you tap “Happy to help”, the app sends Mixpanel nothing: actions from before your answer wait in your phone’s memory and are discarded if you tap “Not now”. Accounts created before this change see the same question once.

App events name what you did and where — for example, that you marked a walk, opened Asky or saw the Puffy Plus screen — with codes and counts such as how you got to a screen, how many records a document produced or how long a reply took. Each event also carries your plan (free or Plus), app language, your dog’s breed as a catalogue code and an age range, how many dogs are on the account, days since you installed the app, and the app version, iOS version and device model. Some events include Puffy’s internal IDs for a dog, an Asky conversation or a message, never their content.

App events never contain your Asky messages, photos, documents, health records, notes, your dog’s name, your email or your contacts. We do not use your advertising identifier, and we turn off IP-based geolocation.

Unlike the website, app events are linked to your Puffy account ID, so your devices count as one person. Mixpanel keeps a profile for that ID with your plan, language, number of dogs, species, install date and account creation date. It holds no name, email or phone number.

To stop app analytics, turn off “Help make Puffy better” in Profile → Privacy. Sending stops at once and events still waiting on your phone are deleted. Signing out stops it too. Events already sent stay in Mixpanel until they age out (see “How long we keep it”) or until you ask help@puffy.pet to delete them.

Our Mixpanel project stores website and app event data in the United States.

Cloudflare Web Analytics measures website visits and page performance without cookies or persistent browser identifiers. It runs separately from these optional providers and is not controlled by the optional analytics consent choice.

This list will grow as Puffy grows — crash reporting, subscription analytics, support tooling. When we add or replace a tool we update the list under “Who we share it with”, and if the change is material we tell you before it takes effect. What does not change: optional analytics stay opt-in, they never go to advertisers, and they never become a profile of your dog’s health.

Cookies and local storage

We use very little browser storage, and none of it is for advertising.

• Functional, always on: your language choice and your answer to the consent question, kept in your browser’s localStorage so the site doesn’t ask twice. These values keep your preferences on this browser.
• Optional analytics identifiers: set after consent. GA4 uses first-party cookies to distinguish browsers and sessions; clearing site data removes those local cookies, not data already received by Google.
• Mixpanel: after consent, Puffy supplies a temporary session identifier kept in sessionStorage for the current tab, with an in-memory fallback when storage is unavailable. Mixpanel’s own persistent storage is disabled. We also save your acknowledgment of Mixpanel in localStorage so an earlier GA4 choice cannot enable it.
• No advertising cookies, no tracking pixels, no social-media trackers. The links to Instagram, TikTok, X and the rest are plain links — those companies learn nothing unless you click through.

How we protect your data

“Your data is protected” is easy to say, so here is what it actually means at Puffy.

• Encrypted in transit. Every connection uses TLS 1.2 or later. The site is HTTPS-only and sends a strict-transport policy, so a browser will not fall back to an unencrypted connection.
• Encrypted at rest. Your account data, your dog’s records and your uploaded photos are stored encrypted on disk.
• Least privilege. Access to production data is limited to the people who need it to operate or support the service, through individual accounts with multi-factor authentication. There is no casual browsing of your data and no ad-hoc export of it.
• Private by default. Your dog’s profile belongs to your account. Nothing about it is public, indexed or shared unless you deliberately share it.
• A hardened website. puffy.pet refuses to be framed, blocks MIME-type sniffing, limits what it sends to other sites in the referrer, and switches off the camera, microphone, geolocation and payment browser APIs outright. There is no login and no user input stored on the website at all.
• Vetted providers. Every company that touches your data is engaged under a data processing agreement that binds it to our instructions and forbids using your data for its own purposes.
• Breach response. If a breach ever puts your rights at real risk, we notify the competent supervisory authority within 72 hours of becoming aware of it, and we tell you directly without undue delay — in plain language, including what we do not yet know.
• Security research welcome. Found a hole? help@puffy.pet. We will not threaten anyone who reports one in good faith.

No system is perfectly secure, and anyone who claims otherwise is selling something. What we can promise is that we don’t collect data we don’t need, we delete it when you ask, and we treat a security report as a gift rather than an attack.

The operational detail — what is in scope, the safe harbour for researchers, what to expect after you report something — is on the security page.

Where your data lives, and international transfers

Your account data and your dog’s records are stored with our cloud provider, Contabo GmbH, on servers in Germany (EU). Uploaded files such as documents and photos are stored there too.

Several of our providers operate globally, so your data may be processed outside your own country, including in the United States. Where personal data leaves the EU, the UK or Switzerland, we rely on an adequacy decision where one exists and otherwise on the Standard Contractual Clauses in each provider’s data processing terms, backed by encryption in transit and at rest.

Ask us at any time which transfer mechanism applies to which provider and we will tell you.

Who we share it with

Your dog’s profile is private by default. Sharing a profile is not in the app yet. When it arrives, the person you share with will see that profile and nothing else, and you will be able to revoke access whenever you like.

Beyond that, your data is handled only by service providers (processors) acting on our instructions. Grouped by what they do:

• Payments — Apple. Processes App Store purchases and subscriptions. Apple is the merchant of record and an independent controller for the payment itself.
• Sign-in — Apple, if you choose Sign in with Apple. Email sign-in codes are issued by our own servers and delivered by Resend.
• Transactional email — Resend. Delivers sign-in codes and service notices.
• Website delivery, protection and cookieless measurement — Cloudflare. Serves puffy.pet, logs requests, absorbs attacks and measures visits and page performance.
• Optional analytics, heatmaps and session replay — PostHog, Microsoft Clarity, Plausible and Google Analytics 4. Only after you consent. GA4 covers website events and pseudonymous browser/session identifiers; it does not receive your quiz answers or app records.
• Optional website and app measurement — Mixpanel, with event data stored in the United States. On the website, receives selected public-page interactions and campaign labels with a temporary session identifier after consent naming Mixpanel. In the app, receives screen and action events linked to your Puffy account ID after you agree in the app. Neither sends Asky messages, photos, documents, health records or your email.
• Help centre, changelog and feature requests — Featurebase. Anything you post there is public and governed by their terms, not by this page.
• Cloud hosting and storage — Contabo GmbH, Germany. Stores your account and your dog’s records, encrypted.
• AI model processing — OpenRouter, a routing service that passes each request to the AI model provider that answers it (currently Anthropic, OpenAI and DeepSeek). Generates Asky’s answers and live voice, reads photos and documents, and draws your dog’s portrait.
• Crash reports and error logs — Sentry. Receives diagnostics from the app and our servers so we can fix what breaks.

That is the whole list, and it also lives on its own page — puffy.pet/subprocessors — so it can be corrected the day something changes rather than at the next policy rewrite. If the change is material, we tell you before it takes effect.

We also disclose data when the law genuinely requires it — a valid legal order, not a polite request — and we push back on overreach. In a merger or acquisition your data stays covered by this policy, and we would tell you before any new controller took over. We have never sold personal data and we do not intend to.

How long we keep it

• Account and profile data — while your account exists. After you delete it, gone within 30 days.
• Asky conversations — while your account exists; deleted with it.
• Diagnostics and crash reports — up to 18 months, then deleted or fully anonymized.
• Analytics events — deleted or aggregated beyond re-identification within 24 months. Where a tool lets us set a shorter window, we use it.
• Server and CDN request logs — 60 days.
• Backups — encrypted and rotated on a rolling schedule. Deleted data drops out of them as those backups age out, and we do not restore a backup in order to bring deleted data back.
• Purchase and accounting records — as long as tax law requires, then deleted.

Your rights

Wherever you live, two things are always true: you can get a copy of your data, and you can have it deleted.

• Export — in the app, Profile → Settings → Data and Storage, or email help@puffy.pet and we send you a machine-readable copy within 30 days.
• Deletion — in the app, Profile → Edit → Delete account, or email help@puffy.pet. We delete your account and everything in it within 30 days and confirm when it is done.

One thing worth knowing: deleting your Puffy account does not cancel an active App Store subscription, because Apple controls that. Cancel it in iOS Settings → your name (Apple Account) → Subscriptions, before or after, whichever suits you. The procedure in full is on the account deletion page.

If you are in the EU, the UK or Switzerland you also have the rights of access, rectification, erasure, restriction, portability and objection — including objection to processing based on legitimate interests — and the right to withdraw consent at any time, without affecting what was lawful before you withdrew it. Write to help@puffy.pet and we answer within a month. You can complain to your local supervisory authority; we would appreciate the chance to fix it first.

If you are in California you can ask what we hold, ask for a copy, ask us to correct or delete it, and ask us to limit the use of sensitive information. We have not sold or shared personal information as the CCPA defines those words, and we will not treat you differently for exercising any right. An authorized agent may act for you.

If you are in Brazil, Canada, Australia, Japan, South Korea, India or another region with a comparable law, the same email works and we honour the equivalent rights. We don’t make you prove where you live in order to be treated well.

We never charge for any of this, and we don’t require you to create an account in order to ask about data we already hold.

Children

Puffy is for adults. We do not knowingly accept accounts from children under 13, or under 16 where that is the applicable minimum — parts of the EU set it higher. We do not market to children and we do not knowingly collect their data.

If we learn we hold a child’s data, we delete it. If you believe a child has given us something, write to help@puffy.pet and we will deal with it quickly.

Changes to this policy

When we change this policy in a material way — a new category of data, a new purpose, a new kind of recipient — we tell you in the app or by email before the change takes effect, and we move the date at the top.

Smaller edits (a clearer sentence, a renamed provider doing the same job) go in without an announcement, but the date still moves. Earlier versions are available on request.

What changed here

Substantive revisions only — what this page says differently, not how it is laid out. Oldest at the bottom.

• 31 October 2026 — Added optional Mixpanel analytics in the iOS app: the prompt after sign-in, what app events contain, that they are linked to your Puffy account ID, and how to turn them off.
• 15 October 2026 — Added optional website Mixpanel measurement, its separate consent acknowledgment, temporary session identifiers and US data storage.
• 15 October 2026 — Removed an outdated incorporation placeholder from the international transfers section.
• 15 October 2026 — Named Contabo (Germany) as our hosting and storage provider and set request logs to 60 days.
• 14 October 2026 — Named OpenRouter and the model providers behind Asky, the dog portrait and photo reading, in place of Google. Said that Puffy can also save walks to Apple Health. Described sign-in as it works (Sign in with Apple or an emailed code) instead of Clerk. Added Sentry for crash reports. Added the in-app paths for export and deletion. Marked sharing as not available yet. Removed the EU/UK representative and Adapty placeholders.
• 4 October 2026 — Added optional website Google Analytics 4, its cookies and limited events. Clarified consent withdrawal and the separate cookieless Cloudflare measurement.
• 8 September 2026 — Named the providers that process Asky conversations and the photo behind the 3D avatar, and said plainly that the photo leaves your device. Added a telephone number.
• 6 September 2026 — Replaced the “no company yet” placeholders with Puffy Lab, LLC.
• 16 August 2026 — Rewritten in full. MailerLite removed after the integration was dropped.
• 19 July 2026 — First complete version.
• 25 April 2026 — First published.