Privacy Policy

Pets Lovers is committed to protecting your privacy. This policy, which complies with the General Data Protection Regulation (GDPR - EU Reg. 2016/679), describes how we collect, use and protect your personal data.

It covers both the iOS and Android app and the petslovers.app website.

1. Data Controller

The data controller is:

Denis Vittorio Truccone Via Prato 16, 20152 Milan, Italy Email: denis.truccone@gmail.com

For any request about your personal data, you can contact the controller at the email address above.

2. Data We Collect

We collect the following types of data:

Registration data: email and password (which we never store in readable form)
Profile data: name, profile picture
Profile preferences: language, currency, country of residence, device time zone and region. You choose the country; language, time zone and region are read from the device at each sign-in
Pet data: name, species, breed, date of birth, sex, colour, microchip, photos, weight
Pet health data: vet visits, vaccinations, medication, tests, procedures, documents and reports
Expense data: amount, category, description, receipts and invoices
Appointments: date, title, type, status, notes and reminders
Family data: members, roles, permissions and invitations
Feeding plans: your pet's parameters and the products saved for portion calculations
Location data: your device location when you search for nearby vets or groomers, the point you mark on a lost pet report, and the area you set for alerts
Lost pet and sighting reports: pet details, photos, address and coordinates, and a phone number if you choose to add one
Technical logs: error message, IP address, device and browser type, session identifier

3. Legal Basis and Purposes

Your data is processed on the following legal bases:

Performance of a contract (art. 6.1.b): to provide the app and its features — account, health record, expenses, calendar, family sharing
Consent (art. 6.1.a): for notifications, publishing a report on the public map, nearby lost pet alerts, and sharing clinical data with your vet. Every consent can be withdrawn at any time, without affecting what was done before
Legitimate interest (art. 6.1.f): to keep the service secure, diagnose faults and moderate published content
Legal obligation (art. 6.1.c): where we must keep or disclose data to comply with the law

Providing the data needed for your account is required to use the app; everything else is optional, and leaving it out only limits the feature it belongs to.

4. Recipients and Providers

We do not sell your personal data and we never pass it on for marketing. Your data may be seen by:

The family members you invited, according to the role you gave them
The vet you choose to show a clinical record to, for the 15 minutes of the session
Anyone opening the public map, limited to the report you chose to publish
The controller, when moderating a report before it is published
Authorities, where required by law

Neither the app nor the website contains analytics, advertising trackers or profiling: we do not measure visits and we collect no browsing statistics.

We also rely on providers that process data on our behalf, as processors under art. 28 GDPR:

Supabase Inc. (United States) — database, file storage and authentication: all app data lives there
Resend (United States) — service emails: invitations, password resets, alerts, exports
Mapbox (United States) — turning addresses into coordinates, and maps
Vercel Inc. (United States) — hosting of petslovers.app and its technical logs
Google Places API (Google Ireland Limited) — searching for vets and groomers: receives your approximate location and the search text

5. The Public Lost Pet Map

When you publish a lost pet or sighting report, it becomes visible to anyone, on the map in the app and on the website, with no account needed.

What becomes public: photos, species, breed, colour, size, sex, the instructions you wrote, the address and coordinates of the point, and the date
A phone number becomes public only if you choose to add one: the field is optional, and the website map never shows it
Your email, your name and the rest of your profile never become public

The coordinates are exactly the ones you marked: choose the point carefully if you would rather the report did not sit on your home.

A report stays public for 30 days, renewable, and you can withdraw it from the app at any time. Legal basis: your consent, given when you publish.

People who send a report from the website without an account also provide a name and an email address, which stay visible to the controller alone, for moderation and to send the receipt with the withdrawal link.

6. Sharing With Your Vet

From the app you can generate a four-digit code and read it out to your vet, who enters it on petslovers.app to view, read-only, the record of the pets you selected: profile, health record, weight, clinical history and attached documents.

The code is valid for 15 minutes from when it is created, after which access closes by itself. You can end it earlier at any time from the app. We record when the record was opened and, to protect the data against repeated attempts, a non-reversible code derived from the IP address of whoever enters the code.

Legal basis: your consent, given when you generate the code.

7. Nearby Lost Pet Alerts

If you turn alerts on, we keep the location you set and the radius you chose, so we can email you when a report appears in that area. We do not track your movements: it is a fixed point, and you choose it.

You can turn alerts off whenever you like in the app settings; the subscription data is deleted at that moment. Legal basis: your consent.

8. Data Security

We use technical and organisational measures appropriate to protecting your data:

Encryption in transit (HTTPS/TLS)
Passwords kept only as a cryptographic hash, never in readable form
Database access rules that keep each family separate from every other
Role-based permissions: owner, admin, member
PKCE authentication flow for signing in with Google and Apple
Limits on repeated attempts for sharing codes and for reports sent from the website
Automatic backups
Error logging, so problems get noticed

9. Your Rights (Art. 15-22 GDPR)

You have the right to:

Access (art. 15): see your data at any time in the app
Rectification (art. 16): correct inaccurate or incomplete data directly in the app
Erasure (art. 17): delete your data with "Delete account" in your profile
Portability (art. 20): export your data as JSON or CSV with "Export data"
Withdrawal of consent (art. 7): turn off notifications, alerts and sharing in their respective settings
Objection (art. 21): object to processing based on legitimate interest
Restriction (art. 18): ask that data be kept but not processed further
Complaint: contact your data protection authority

The in-app functions are the quickest route, but you can always write to the controller — including if you no longer have access to your account, and if you never had one. We reply within one month of your request, extendable by two months for complex cases, telling you if that happens. If your message does not make clear who you are, we may ask for a little more, so as not to hand your data to someone else.

To exercise these rights, write to: denis.truccone@gmail.com

10. Data Retention

We keep data for as long as the purpose it was collected for requires:

Account and pet data: for as long as the account stays active
Map reports: 30 days from publication, unless renewed or withdrawn earlier
Vet sharing sessions: 15 minutes; the record of attempts, 30 days
Family invitations: they expire after 60 days and are deleted after 90
Technical and error logs: 90 days
Data from reports sent via the website: 30 days for the anti-abuse counters, 30 days for the report
Image cache on your device: cleared when you sign out
Inactive accounts: after 24 months without a sign-in we notify you and then delete the account

You can delete your account whenever you like from "Profile > Manage data > Delete account". Deletion removes your profile, pets, health records, expenses, appointments, documents and photos. If you own a family with other members, ownership passes to another member and the shared data stays available to them. The reports you published on the map are removed too: they can carry your phone number, and leaving them online after an erasure request would be the opposite of what you asked for. The operation cannot be undone.

11. Children

Pets Lovers is intended for people aged 16 and over and does not knowingly collect data from anyone younger. If you are a parent and believe your child has created an account, write to denis.truccone@gmail.com: we will delete the account and the data attached to it.

12. International Transfers

App data is hosted on Supabase Inc. servers located in the United States (region us-east-2). The other providers listed in section 4 are also established in the United States or transfer data there.

The United States is a third country with respect to the European Union. Transfers take place on the basis of the Standard Contractual Clauses approved by the European Commission, contained in the agreements we have entered into with each provider, and — for providers that participate in it — of the adequacy decision on the EU-US Data Privacy Framework.

You can ask the controller for a copy of the safeguards in place.

13. Cookies and Statistics

The app uses no cookies and no measurement tools: it only keeps your preferences on your device.

Neither does the petslovers.app website: no cookies, no statistics tools, nothing to accept or decline — which is why you see no banner. The only thing left in your browser is the memory of having dismissed the app download prompt, and it goes away with the tab. The details are in the Cookie Policy.

14. Changes to This Policy

We may update this policy to reflect changes in the law or new features. Significant changes will be flagged in the app, which will ask you to read the updated text. The date it was last updated is shown at the top of this page.

15. Contact and Complaints

For privacy questions, to exercise your rights, or for any request about how your data is handled, contact the controller:

Denis Vittorio Truccone Via Prato 16, 20152 Milan, Italy Email: denis.truccone@gmail.com

If you believe the processing of your data breaches the GDPR, you have the right to lodge a complaint with the Italian data protection authority (www.garanteprivacy.it) or with the supervisory authority of the country where you live.