Who processes your data.

Our privacy policy promises that the list of companies touching your data is the whole list, and that we update it when it changes. This is that list. It lives on its own page so it can be corrected the day something changes, rather than waiting for the next policy rewrite.

How to read this

Each entry says who the company is, what it does for us, and what it touches. Every one of them acts on our instructions under a data processing agreement, and none may use your data for its own purposes.

Apple is the exception, and it is worth stating: for App Store payments Apple is an independent controller, not our processor. It decides how it handles payment data, and its own privacy policy governs that part.

Running the service

• Apple — App Store purchases and subscriptions. Sees your payment details; we never do. Independent controller for the payment.
• Apple — Sign in with Apple, if you choose it. Email sign-in codes are issued by our own servers.
• Resend — transactional email. Delivers sign-in codes, receipts and service notices.
• Contabo — cloud hosting and storage, on servers in Germany (EU). Stores your account and your dog’s records, encrypted.
• AI model processing — OpenRouter, a routing service that passes each request to the AI model provider that answers it (currently Anthropic, OpenAI and DeepSeek). Receives your Asky conversation and the profile context needed to answer it, photos and documents you add, live voice with Asky, and your dog’s photo to draw the portrait. Set to providers that do not keep prompts or train on them.
• Sentry — crash reports and error logs from the app and our servers.

Running the website

• Cloudflare — serves puffy.pet, logs requests to deliver and protect it, and absorbs attacks. Its separate Web Analytics measures visits and page performance without cookies or persistent browser identifiers; the optional analytics consent choice does not control it. No account data lives here; the site has no login.
• Featurebase — help centre, changelog, roadmap and feature requests. Anything you post there is public, and Featurebase’s own terms govern it rather than ours.

Optional measurement — only if you consent

None of these load, set an identifier or send an event until you say yes. Decline, and the code is never downloaded. The full rules are in the privacy policy.

• PostHog — product analytics: which screens and features get used, and where people give up.
• Microsoft Clarity — heatmaps and session replay on the website. Text you type into a field is masked in your browser before anything is sent.
• Plausible — page counts. Sets no identifier at all.
• Google Analytics 4 — website page views, article and feature interactions, matcher progress and App Store button actions. Uses first-party cookies and pseudonymous browser/session identifiers after consent, plus technical browser/device information. Receives limited page, interaction and campaign labels; no quiz answers, form values, emails, pet records or full URL query strings.
• Mixpanel — optional measurement on puffy.pet and in the iOS app, with event data stored in the United States. On the website it receives selected page views, clicks, reading milestones and matcher progress, public page/content IDs, language, button and experiment labels, limited campaign tags and a temporary session identifier; it does not receive account identities, quiz answers, form values, emails, pet records, chat text, full URL query strings or raw referrer URLs. In the app it receives screen and action events with your Puffy account ID, plan, language, your dog’s breed code and age range, and app and device details; it does not receive Asky messages, photos, documents, health records, names, emails or contacts.

Our GA4 setup disables advertising features, Google Signals, automatic user-provided-data collection and enhanced automatic measurements. This website integration does not collect events from the iOS app.

In the app, Mixpanel starts only after you agree to the question shown after sign-in, and stops as soon as you turn off “Help make Puffy better” in Profile → Privacy.

On the website, Mixpanel starts only after you accept a consent prompt naming it, even if you previously agreed to GA4. Puffy supplies a temporary session identifier for the current tab; we do not link it to your account or create a person profile. We disable Mixpanel’s own cookies and persistent storage, autocapture, session replay, heatmaps and IP-based geolocation.

To withdraw website consent, close Puffy tabs, clear cookies and site data for puffy.pet, then reopen and choose Decline if asked. This removes local identifiers and stops optional collection; it does not delete events already held by Google or Mixpanel. The privacy policy explains your data rights.

What is not on this list

No advertising networks. No data brokers. No social-media tracking pixels. No optional analytics that runs before you agree to it. Nobody who buys data, and nobody we sell to, because we do not sell it.

If you ever see your browser make a request to a domain that is not represented here, that is a bug or worse, and we want to know: help@puffy.pet.

When this list changes

We update this page and move the date at the top. If the change is material — a new category of data, a new country, a new kind of recipient — we tell you in the app or by email before it takes effect, so that you have the chance to leave first.

What changed here

Substantive revisions only — what this page says differently, not how it is laid out. Oldest at the bottom.

• 31 October 2026 — Added optional Mixpanel analytics in the iOS app, which starts only after you agree in the app and links events to your Puffy account ID.
• 15 October 2026 — Added optional website Mixpanel measurement, fresh consent acknowledgment, temporary session identifiers and US data storage.
• 15 October 2026 — Named Contabo (Germany) for hosting and storage.
• 14 October 2026 — Replaced Anthropic and Google with OpenRouter and the model providers it routes to. Replaced Clerk with Sign in with Apple. Added Sentry. Removed the Adapty placeholder.
• 4 October 2026 — Added Google Analytics 4 for optional website measurement and distinguished it from cookieless Cloudflare Web Analytics.
• 8 September 2026 — Named Anthropic, which receives Asky conversations, and Google, which receives the photo used to build the 3D avatar.
• 17 August 2026 — First published.