Privacy

When you create an account and use it, the following is recorded:

• Your profile: name, phone number, email address, profile photo if you add one.
• Your addresses: label, street, area, city — and their geographic coordinates when you specify them, to center the map near you.
• Your dogs' profiles: name, breed, sex, date of birth, color, distinguishing marks, microchip number, pedigree number, temperament, behavior notes, spay/neuter status, weight, and their photos.
• Your activity on the service: veterinary appointments, requests sent to a provider, lost-dog alerts, reviews you post about a place or a provider, notifications received.

Your sign-in credentials (password, SMS codes) are managed by the underlying platform's authentication service, never by our own code: we don't see your password.

The scan is the heart of the service: it's also the only place where data is recorded about a person who has no account. Here is exactly what is kept:

• The date and time of the scan.
• The GPS location and its accuracy, only if the person agreed to share it, along with the area and city inferred from that location.
• A fingerprint of their IP address, described in the next point.
• Their browser's technical identifier ("user agent"): phone make and browser version, as sent to any website.

This information forms your dog's scan history. It is visible only to you, from your space, and to the registry's administrator. It is never passed on to anyone else.

Declining to share a location blocks nothing: the scan is recorded in your space regardless, only the location is missing.

The IP address of the visitor who scans is not stored. What is stored is its fingerprint: the address is combined with a secret salt known only to the server, then passed through a one-way hash function (SHA-256). The result is a string of characters that cannot be traced back to the original address.

What is it used for? One thing only: recognizing that two successive scans come from the same phone, so as not to send you ten notifications when someone reloads the page. It is used neither to identify anyone, nor to track them from one dog to another.

The same mechanism applies to reports left on a search notice.

It's the question everyone asks, and the answer comes down to one rule:

Concretely: the function that responds to a scan only looks up your number if an alert is active AND you chose to share it. In every other case, it never leaves the server. Changing the interface would change nothing: there is nothing to display.

When you report the loss, the situation deliberately reverses: your number becomes visible on the scan page and on the search notice. That notice is public via its link — anyone the link is passed to, on WhatsApp or elsewhere, can see your dog's name, photo, breed, distinguishing marks and last known location. Your number, though, only appears there if you chose to show it: by default, people report your dog through the platform and you call back. Closing the alert shuts this access again: the link then returns nothing. If you had shown your number, remember that a printed flyer or a screenshot will keep carrying it.

Your address and your email, on the other hand, never appear on these public pages — even while the dog is missing, and even if you chose to share your number.

• YouEverything about you: your profile, your addresses, your dogs, their photos, their scan history, your appointments, your alerts.
• The veterinarian you have an appointment withThe relevant dog's profile and photos, your name and your phone number — enough to prepare the consultation and call you back. This access is tied to the appointment existing: a veterinarian cannot view the profile of a dog that isn't their patient.
• A provider (dog walker, groomer, boarder)Your name and phone number, and only once they have accepted your request. A pending or declined request gives them no contact details.
• Someone who scans your dog's codeThe name, photo, breed, temperament and status of the dog. Your phone number only if the dog is reported missing. Nothing else — no full name, no address, no email.
• Someone who receives a search-notice linkThe notice's information and your number, for as long as the alert is active.
• The registry administratorExtended access, needed for moderating places and reviews, verifying veterinarians and support. It's the only role that sees beyond what directly concerns it.
• Anyone, without an accountThe dog guide with verified veterinarians, their slots and approved places, approved providers' profiles, and reviews published about those places and providers. This information is public by nature: it's meant to be found.

These boundaries aren't display rules: they are set at the database level, table by table, and apply regardless of the path taken to read the data.

Photos — profile, dogs, reports — are stored in private storage. There is no permanent address to these files: on every display, the server generates a signed link valid for one hour, after which that link stops working.

This is what prevents a report's photo — taken in the street by a stranger, where passersby may appear — from staying accessible indefinitely to anyone who once obtained the address.

• We do not sell, rent, or transfer any data.
• We display no advertising and install no advertising tracker or audience-measurement tool.
• No payment goes through the site: we hold no banking data.
• We do not send marketing messages: the only notifications are the ones produced by your own use of the service (a scan, an appointment, a report).

The only cookies set are your session's: they keep you signed in from page to page. They are essential to the site working and disappear when you sign out.

There is no audience-measurement cookie and no advertising cookie. That's why no banner asks you to accept anything — there is nothing to accept.

Better to write it as it is: no automatic deletion is in place today. There is no job that erases old scans, closed alerts, or accounts inactive for X months. Data stays for as long as the account exists.

What does exist, and what you control:

• Renewing a dog's tag immediately deactivates the old code: the QR already printed no longer leads anywhere.
• Archiving a dog's profile removes it from your lists. Nothing is deleted — photos, scans and appointments are kept, and the profile reactivates whenever you want. Removing a profile is requested, like closing the account: the interface doesn't offer it yet, and an animal carrying certified acts keeps its health record.
• Deleting a photo removes the row and the stored file.
• Closing an alert immediately shuts the public search notice and stops exposing your number.
• Deleting a place review you published removes it from the site.
• Deleting your account, from the app or from the "Delete my account" page, is immediate and permanent. Your contact details, addresses, notifications and reviews are erased; a dog with no act in its carnet is deleted; a shared dog is handed over to its co-holder; a dog whose carnet holds acts stays in the registry, without your contact details.

You delete your account yourself, after confirming your password. A professional account — veterinarian, provider, member of an organisation — makes the request in the same place, and our team handles it. If anything goes wrong: the Contact page.

One reservation, which we'd rather write down than have you discover. Health acts certified by a veterinarian — vaccinations, treatments, procedures — are not erased, including when an account is closed. A record whose content could vanish at its holder's request would no longer prove anything: it's the same reason an act can't be rewritten once entered. An animal carrying such acts therefore keeps its health record, detached from your contact details.

What this means concretely: your personal data leaves, the animal's health trace stays. How long that trace is kept, and the cases where it could be erased, remain to be settled — we don't invent them here. Write to us via the Contact page for any request about a specific record.

Without asking us anything, you can: view and edit your profile and addresses, edit your dogs' profiles, delete their photos, archive a profile, renew a tag, view the scan history of each of your dogs, close an alert and delete your place reviews.

For everything else — getting a copy of your data, requesting the removal of a dog's profile, asking a question about a process described here — write to us via the Contact page. These requests are handled by hand: no automatic process takes care of them, and we'd rather say so than let it be assumed.

The boundaries described above don't rely on the application's good will:

• Every table is protected by access rules evaluated by the database on every read and every write.
• Public pages — the scan page, the search-notice page — never read a dog's profile directly: they go through dedicated functions that return only a closed list of fields.
• Sensitive columns (an account's role, a veterinarian's verification status, a place's approval) are locked: they cannot be changed from the application.
• The database's administrative key never leaves the server and is never sent to the browser.

No system is infallible, and we won't claim otherwise. If you spot a flaw, write to us rather than publishing it: we will fix it.

In Paris. Two technical providers are involved, both on servers located in France:

• Supabase hosts the database, the authentication service and the four photo storage spaces (avatars, dogs, reports, places). Region eu-west-3, on Amazon Web Services infrastructure.
• Vercel hosts the site itself — the pages and the server functions that produce them. Region cdg1.

Your personal data does not leave the European Union. The site's static files — code, stylesheets, the site's own images — are, however, distributed by a global network, as on any website: they contain no data about you, and pages that display such data are expressly excluded from that caching.

No other subprocessor is involved today: no SMS sending, no application email sending, no audience-measurement tool. If one were ever connected, it would be added here before going into service.

This page describes how the product actually works, verified in its code and its database as of the date shown below. It lets you know what is recorded and who sees it.

It does not constitute a declaration of compliance with any regulation: the corresponding checks have not been carried out, and we would rather state nothing than state something wrongly.

Any change to this text will follow an actual change to the product, and the date below will be updated.