Security.

What protects your account and your dog’s records, and how to tell us if you find a hole. Nothing here is aspirational — if something is not built yet, it is not on this page.

How your data is protected

• Encrypted in transit. Every connection uses TLS 1.2 or later. The site is HTTPS-only and sends a strict-transport policy, so a browser will not fall back to an unencrypted connection even if something tries to push it there.
• Encrypted at rest. Account data, your dog’s records and your uploaded photos are stored encrypted on disk.
• Least privilege. Access to production data is limited to the people who need it to run or support the service, through individual accounts with multi-factor authentication. There is no shared login and no ad-hoc export.
• Private by default. Your dog’s profile belongs to your account. Nothing about it is public or indexed unless you deliberately share it, and a share link can be revoked.
• A hardened website. puffy.pet refuses to be framed, blocks MIME-type sniffing, limits what it leaks in the referrer, and switches off the camera, microphone, geolocation and payment browser APIs outright. There is no login on the website and nothing you type there is stored.
• Vetted providers. Every company that touches your data is engaged under a data processing agreement that binds it to our instructions.

What we deliberately do not do

• No advertising trackers, and no ads.
• No selling of personal data, and no sharing for cross-context behavioural advertising.
• No analytics of any kind before you consent to it.
• No restoring a backup to recover data someone asked us to delete.
• No training AI models on your conversations or your dog’s records, and no provider that reserves the right to.

Reporting a vulnerability

Email help@puffy.pet with "Security" in the subject. Include what you found, where, and the smallest set of steps that reproduces it. A proof of concept helps enormously; a scanner output on its own usually does not.

What to expect: we acknowledge within three business days, come back with an assessment within ten, and tell you honestly when a fix will land. If we disagree that something is a vulnerability, we will say why rather than going quiet.

We are two people. Sometimes the honest answer is "you are right, and it is behind three other things". You will get that answer rather than silence.

Safe harbour

We will not pursue legal action against anyone doing good-faith security research, provided you:

• stay within the scope below;
• do not access, modify or keep data belonging to anyone else — if you stumble into someone’s data, stop and tell us;
• do not degrade the service for other people;
• give us reasonable time to fix the issue before disclosing it publicly. Ninety days is our default, and we will usually be much faster.

Report in good faith and you have nothing to fear from us. That commitment is easy to make and we intend to keep it.

Scope

In scope: puffy.pet and its subdomains, the Puffy iOS app, and the API it talks to.

Out of scope: the third-party services we use — report those to their own programmes, then tell us so we can track it. Also out of scope: social engineering of our team or our providers, physical attacks, volumetric denial of service, spam or rate-limit findings with no demonstrated impact, missing headers with no working exploit, and automated scanner output submitted without analysis.

We do not pay bounties

There is no money behind Puffy yet, so promising a reward would be a lie. What we can offer is a fast fix, a straight answer, and public credit on this page if you want it. If that is not worth your time, we understand completely.

Machine-readable

Our contact details are also published under RFC 9116 at /.well-known/security.txt.

What changed here

Substantive revisions only — what this page says differently, not how it is laid out. Oldest at the bottom.

• 17 August 2026 — First published.