Your pet’s file is yours.

Your account

• Email address and name.
• Your password, stored only as a bcrypt hash. We never see or store it in plain text.
• Preferences: timezone, weight unit (kg or lb) and whether you want email reminders.
• Your plan and billing history (plan, amounts, dates and receipt details).
• Sessions: when you sign in we create a session. We store a hash of the session token and your browser’s user-agent, for up to 30 days or until you sign out.

Your pets

• Profile: name, species, breed, sex, whether neutered, birth date, color, microchip number, a photo (stored as a small image in our database), allergies, conditions, notes and target weight.
• Vet details (name, phone, address), insurance provider and policy number, and an emergency contact.
• Vaccinations (dates, clinic, batch number).
• Medications, their schedules and dose logs, including who gave each dose and when.
• Feeding plans, weight entries and vet visits (reason, diagnosis, treatment, cost, follow-up).
• Reminders you create.

Some of these fields contain personal data about people other than you, for example your vet’s contact details or an emergency contact’s name and phone number. Please only add details you have a good reason to keep and that the person would expect you to share with a pet-sitter.

Uploaded documents

You can upload PDF, JPG, PNG, WebP, HEIC and TXT files of up to 15 MB each (for example vaccination certificates, lab results or invoices). Files are stored on our storage volume and are only served to you and your co-carers after sign-in. They are never part of the pet-sitter card.

Payments

Card payments are handled by our payment provider. We receive and store only the card brand, last 4 digits, expiry date, cardholder name, country and postal code. We never receive or store your full card number or CVC.

Messages to us

If you contact support or send a report, we keep your message, your email address and our replies so we can help you.

Technical data

We use IP addresses transiently for rate limiting (to protect sign-in and other sensitive actions) in windows of at most one hour. They are not stored with your profile. Our hosting provider keeps standard server logs for operating and securing the service.

We use personal data only for the purposes below. Where the GDPR or UK GDPR applies, each purpose relies on the legal basis shown.

The pet-sitter card

Each pet can have a read-only sitter card at a random private link. When it is on, anyone with the link can see it without signing in. The card shows the pet’s name, photo, species, breed and age, sex, microchip number, allergies, conditions, notes, feeding plan, active medications with times, vaccine status, latest weight, vet contact and emergency contact.

Co-carers (Family plan)

On the Family plan you can invite co-carers to a pet with an invite link that expires after 7 days. A co-carer gets full access to that pet’s records and documents, and their name appears on dose logs they record. Co-carers can’t delete the pet. As the owner, you can remove a co-carer at any time.

We use a small number of providers who process data on our behalf, under contracts that limit them to providing their service to us:

We may also disclose data if required by law, to protect the rights, safety or property of our users, animals or the public, or as part of a merger or acquisition (in which case this policy would continue to apply to your data).

• Password reset emails, when you ask for one.
• Receipts for payments.
• On Plus and Family: a daily digest of medications and reminders due that day, sent after 7:00 in your timezone. You can opt out in Settings.

Pawfile is operated from Hong Kong, and our hosting and email providers are in the United States. Your data is therefore transferred to and stored in countries that may not have the same data-protection laws as yours. Where required, we rely on appropriate safeguards such as the European Commission’s Standard Contractual Clauses (and the UK Addendum) for these transfers.

• Account and pet data: for as long as your account exists.
• Sessions: up to 30 days, or until you sign out.
• Rate-limit data: windows of at most one hour.
• Backups: deleted data is purged from backups within 30 days.
• Billing records: as long as tax and accounting law requires, even after you delete your account.

Depending on where you live, you may have the right to:

• access the personal data we hold about you and get a copy of it;
• correct inaccurate data;
• delete your data;
• receive your data in a portable format;
• object to or restrict certain processing;
• withdraw consent where we rely on it.

You can do most of this yourself: edit anything in the app, download a full JSON export in Settings, use the print view for a pet’s health record, or delete your account. For anything else, email [email protected]. We may need to verify your identity first.

EU and UK

You have the rights under the GDPR and UK GDPR listed above, and you can complain to your local data-protection authority.

California

Under the CCPA you can ask to know, delete and correct personal information, and you won’t be discriminated against for doing so. We do not sell or “share” personal information for cross-context behavioral advertising.

Hong Kong

Under the Personal Data (Privacy) Ordinance you can request access to and correction of your personal data. You may also contact the Office of the Privacy Commissioner for Personal Data.

We protect your data with encryption in transit (HTTPS), hashed passwords and session tokens, access checks on every record and document, and rate limiting on sensitive actions. No system is perfectly secure; if we become aware of a breach affecting your data, we’ll notify you and the relevant authorities as the law requires.

Pawfile is for people aged 16 and over. We don’t knowingly collect data from younger children. If you think a child has an account, contact us and we’ll delete it.

If we make material changes, we’ll update the date at the top and tell you by email or in the app before they take effect. The current version always lives on this page.