Privacy Policy

1. The short version

Everything below is the longer version of these nine points.

• Your days, dates and settings work without an account. Until you sign in, they are stored only on your device.
• Signing in is optional. It backs up your days and turns on the journal, whose notes, photos and voice memos are stored on our server, private to you and never shared with your groups.
• Sharing is optional too. Shared countdowns, companion spaces and countdowns you share directly with people you know are invitation-only. What you share in them, such as titles, dates, posts, photos, your mood and status, and your display name and profile photo, is stored on our server so that the people you share with can see it.
• While you are signed in, the app asks to send you notifications. If you allow it, it registers a push token for your phone so that we can tell you when someone shares a countdown with you.
• What we store is kept with Google Cloud in the United States. It is encrypted in transit and at rest but not end-to-end, and you can delete it, down to your whole account, from the app.
• There are no ads in the app. The app counts how many people use it with Google Analytics for Firebase and reports its crashes to Firebase Crashlytics. Neither receives anything you write, Analytics never receives your account, and a crash report names your account's ID only while you are signed in, so that we can follow up on it. While you are signed in, our own server also keeps the dates on which you used the app and the time of your last visit, to count how many people still use it. The website has no analytics.
• Payments go through Apple or Google. Purchases are verified with an anonymous identifier, or with your account identifier while you are signed in.
• If you join the waitlist on the website, we keep your email address and language with our email provider until you unsubscribe.
• The website sets a single cookie, and only if you choose a language.

2. What the app stores on your device

PupCal keeps the days you create (their names, dates, times and kind), the puppy and pose you choose for each, your reminder settings, your language, week start and countdown preferences, and your widget choices. All of this is kept in the app's private storage on your device. You can use it all without an account, and until you sign in none of it is sent to us. Once you sign in, it is backed up to your account as described under Cloud backup, and the app also keeps a copy of your journal on the device so it works offline; signing out removes that copy.

Your operating system may include PupCal's data in its own device backups, such as iCloud Backup or Google's Android backup, according to the settings you have chosen on your device. Those backups are governed by Apple's or Google's privacy policies.

3. Your account

An account is optional. You need one for the cloud backup, the journal and sharing; countdowns, widgets and reminders work without one.

Signing in uses Firebase Authentication with your Google account, your Apple account where offered, or a link sent to your email address. We receive the account identifier, your name and email address as provided by that account, and we keep a display name and an optional profile photo that you can change. Email sign-in links are sent through Resend, our email provider.

We use your account to keep your backup and journal apart from everyone else's, to know who is in a shared countdown or space and to show members who posted what. On our server your backup, journal and profile photo are filed under a hashed form of your account identifier rather than the identifier itself.

4. Cloud backup

While you are signed in, the app backs up your days on its own after you change them: their names, dates, times and kind, the puppy and pose chosen for each, your reminders, and your settings and widget choices. The backup is a single file that each new backup replaces, and it is what brings your days back when you sign in on another phone.

The backup does not include your journal, which is stored separately (see Your journal), or shared countdowns and spaces, which come back from their groups when you sign in.

5. Your journal

The journal needs an account. Each entry can hold up to 2,000 characters of text, up to five photos, one voice memo of up to a minute and the name of a place, together with the time you wrote it and which of your days it belongs to. We store your entries so that you can read them on any phone where you sign in and so that they are not lost with your phone.

Entries are private. They are never shared with a group, even when the day they belong to is a shared countdown, and Share never includes them.

Photos are re-encoded on your device before they are uploaded, which drops their location tags, and our server refuses any photo that still carries GPS coordinates.

Adding a place is optional. When you add or update one, the app reads your device's location and passes it to the geocoder built into your phone's operating system, a service run by Apple on iPhone and by Google on Android, to turn it into a name such as a neighbourhood and city. Only that name is saved with the entry. Your coordinates are never sent to us and never saved.

When you delete an entry, its text and place are removed from our server at once and its photos and voice memo within a few hours. A small marker with the entry's identifier, date and day stays for 90 days so that your other phones remove it too.

6. Camera, microphone, photos, location and notifications

PupCal asks for the camera, microphone, speech recognition and location permissions only when you first use the feature that needs them, and for notifications as described under Reminders and notifications. You can withdraw any of them at any time in your device settings, and the rest of the app keeps working.

The camera is used to take photos for your journal, your profile photo and posts in shared countdowns and spaces, and only while the camera view is on screen. The microphone is used only while you record a voice memo. Photos from your library are chosen through the system photo picker, so the app receives only the photos you pick.

If you ask the app to write out a voice memo as text, the transcription runs on your phone only: the app requires the speech recognition built into the device to work offline, so neither the recording nor the text is sent to us, to Apple or to Google to transcribe it. The text is saved only if you add it to your note.

Location is used only to name the place of a journal entry, only while you are using the app, and on Android only as approximate location. It is never used in the background or for anything else.

7. Shared countdowns and spaces

PupCal lets you share in three ways: a shared countdown follows one day together with the people you invite; a companion space is an ongoing place for family and friends, with no date, where your puppies keep each other company; and you can share a countdown directly with people you have shared with before. All of them are optional and invitation-only: nothing in this section applies until you sign in and create, join or accept one. There are no public profiles, no search and no way for strangers to find you.

People who share a countdown or a space with you see your display name, the puppy you chose and, if you set one, your profile photo. People you have shared with before see your display name and profile photo too, so that you can choose each other when you share.

For each shared countdown we store its title, date, time and venue time zone, and for each space its title. For both we store the owner and the members with their chosen puppies; the notes and photos members post, with the name of the member who posted them; invitation links, which expire within seven days; and the small amount of scheduling data needed for puppy visits between members. Photos are uploaded to private storage and are only served through short-lived links to members.

In a space, you can also share your mood, chosen from a fixed list (happy, calm, tired, sad or stressed), and an optional status of up to 120 characters. We store them with the time you last changed them and show them to the members of that space; you can clear them at any time. Members can send each other a hug, a visit from their puppy that lasts a few hours, and we keep a record of each hug so that it is delivered once and its limits apply.

When you share a countdown directly, we store an invitation for each person you choose, holding your display name and the countdown's title and date. It expires after seven days, or sooner if the countdown ends first. When someone accepts, the two of you are added to each other's contacts in PupCal: a list of people you have shared with, which only you see and which the app offers the next time you share. Your phone's own contacts are never read.

Posts are visible to every member of the shared countdown or space and appear on the members' Wall in the app. Only members can read a group's content. It is stored and protected like the rest of your data, as described under Where your data is kept.

You can edit or delete your own posts at any time; a group's owner can remove posts and members. When you leave a group you choose whether your posts stay or go. Deleting the group deletes its content. Signing out removes shared data from your device. To delete your account entirely, see Deleting your account below.

You can report shared posts, another person's profile or status, and shared countdown or space details from the app. We store the reporter, the reported person where identifiable, the reason and optional note, and a snapshot of the reported content, including available photo evidence, so moderators can review what was reported. Reports and preserved evidence remain as moderation records after the content, group or either account is deleted. Blocking someone keeps their posts hidden for you, stops visits between your puppies and prevents their direct shares from reaching you across your signed-in devices.

Before publishing shared text or accepting shared photos and profile photos, our server sends that content to Google Cloud Natural Language or Vision for automated safety checks. This includes display names, companion names, shared titles, posts and statuses. Checks can make mistakes; if your content is rejected, you can edit it or contact support@pupcal.app. If a check cannot finish, the content is not published and you can try again. Your private journal, its photos and voice memos, and your private countdown backup are not sent to these moderation services.

8. Where your data is kept

Your sign-in account is held by Firebase Authentication. Your cloud backup, journal, profile photo, shared content, contacts, invitations and notification registrations are stored with Google Cloud (Firestore and Cloud Storage) in the United States (us-west1), and our server runs there. Automated safety checks use Google's global Natural Language and Vision services; their processing is not restricted to us-west1. Your data may therefore be processed outside your country. Where required, international transfers rely on safeguards in our providers' data-processing terms, such as the European Commission's Standard Contractual Clauses. Photos and voice memos remain in private storage and are served through short-lived links.

Your data is encrypted on its way between the app and our server and while it is stored, but it is not end-to-end encrypted: our server has to read it to sync and serve it, so the people who operate PupCal can technically access it. We do not sell it, use it for advertising, or look at it except where running the service requires it: to fix a fault, to respond to a report about a post, or when the law requires us to.

To protect it, the app never reaches our database or storage directly: every request goes through our server, which checks the signed-in account and its memberships. Your data is filed under a hashed account identifier, photos and voice memos are served only through short-lived links, and administrative access is limited to a small number of authorised accounts.

We keep your backup, journal and profile photo for as long as you have an account, and shared countdowns and spaces for as long as their group exists. Invitations expire as described above, contacts and your block list are kept with your account, and a phone's notification registration is kept until you sign out on it or Apple or Google report its token as no longer valid. Deleting an entry, a post or a group removes it as described above, and deleting your account removes the rest, subject to the retained records described here. Reports are kept as moderation records, as described under Shared countdowns and spaces. To finish interrupted profile-photo deletion, we may keep a small cleanup record after your account is deleted. It contains only storage references based on a hashed account identifier, timing and completion status; it does not include your name, email address, account identifier in its original form, text or image content. We remove the record after confirming cleanup. If an upload's outcome is unknown, we keep the record until the outcome is resolved so that a delayed photo can still be deleted.

9. Usage statistics, crash reports, and what we do not collect

To know how many people use PupCal and whether the first-launch welcome works, the app uses Google Analytics for Firebase, a Google service. It sends Google a random identifier that Firebase creates for this installation of the app (not your account); the names of the screens you open, such as Home or Settings; when you go through the first-launch welcome and which kind of day you pick there, such as a birthday or a trip; when you add a day, with only its kind, never its name or date; and the app's own events, such as its first launch, sessions, updates and in-app purchases. Google adds basic device details, such as the model, operating system, app version and language, and an approximate location that it derives from your IP address without storing the address. Analytics never receives your account, your name or email address, the names or dates of your days, your journal or anything you share. We look at it only as counts and trends, such as daily users, retention and how many people finish making their first day. It is not linked to your account, and Google signals and ad personalisation are turned off. Google keeps this data for no more than 14 months. Deleting the app resets its identifier.

We advertise PupCal with Google Ads. On Android, outside the European Economic Area, the United Kingdom and Switzerland, the app also lets Google use these Analytics events, together with your phone's advertising ID, to tell us which installs and in-app purchases came from one of our ads, so that we can see whether an ad works. This is for measurement only: it is not used to choose the ads you see, and we see only totals per ad, never who you are. You can reset or delete your advertising ID in your phone's settings, under Privacy › Ads or Google › Ads. Where your phone's region or time zone is in Europe, or when the app cannot tell, none of this happens. On iPhone and iPad the app does not use the advertising identifier.

When the app crashes, stops responding on Android, or a sign-in fails unexpectedly, it sends a crash report to Firebase Crashlytics, a Google service, so that we can find and fix the problem. A report contains the error and where in the app's code it happened, the app version, basic device details such as the model, operating system and free memory and storage, and a random identifier Crashlytics creates for this installation of the app. While you are signed in, it also carries your account's ID, a random string our sign-in service assigns to the account (not your name or email address), so that we can see which account a crash affected and fix it for you; signed out, a report carries no account ID. It never includes your name or email address, or the content of your days, your journal or anything you share. Google keeps crash reports for 90 days.

While you are signed in, our own server also notes each calendar day, in Pacific Time, on which the app contacts it for your account, and the time of your last visit, so that we can count how many signed-in people use PupCal and how many of them still have a day coming up, and see how recently each account was used. It keeps only those dates, with the first and the most recent one, and the time of your last visit (replaced by the next one, at most once a minute), filed under a hashed form of your account identifier: not the time of any earlier visit, what you did in the app, your device or anything you wrote. The dates and the time are not sent to Google Analytics or anyone else. We keep the dates within 400 days of the most recent one and drop older ones, and deleting your account deletes them and the time.

Beyond what is described above for your account, the cloud backup, the journal, sharing, notifications, usage statistics, crash reports and the waitlist, PupCal does not collect your name, email address, your phone's contacts or photos, and it never collects your device's location coordinates. It does not read your system calendar. It contains no advertising and no analytics or crash reporting beyond what is described above. If you have opted in at the operating-system level, Apple or Google may share anonymised crash and usage statistics with us; these contain no countdown or journal content.

10. Purchases

Optional puppy companions are sold as one-time purchases through the App Store or Google Play. Apple or Google process the payment; we never see your payment details.

To verify and restore purchases, the app uses RevenueCat, a purchase-verification service. RevenueCat receives an anonymous identifier generated by the app, the store's transaction and receipt information, and basic device details such as the app version and platform. While you are signed in, it receives your account identifier in place of the anonymous one, so that your companions can be verified in shared countdowns and spaces. The names and dates of your days and your journal are never sent to RevenueCat. RevenueCat's own privacy policy is available at https://www.revenuecat.com/privacy.

11. Drawing your puppy

You can have PupCal draw your own puppy in the app's hand-drawn style from five photos you choose. This is optional, and it works only while you are signed in. When you start, the photos are uploaded to our server, which first checks each one (that it shows a puppy and no person, and that it is not explicit, using Google Cloud Vision and Google's Gemini model) and then sends them to Google's Gemini image model to draw six pictures. Google processes the photos and returns the drawings; under Google's paid API terms they are not used to train Google's models. The names of your days and your journal are never sent with them.

Our server keeps the five photos only while the set is open, at most seven days, and deletes them with any previews you did not buy. The drawings you buy, and the head picture cut from the first of them for widgets, are kept with your account like your other purchases, in the same private storage described under Where your data is kept, and go when you delete your account. The name you give your puppy is kept with them. To stop anyone getting more than one free set, the app also sends our server an identifier of your device (on iPhone the vendor identifier, on Android the Android ID), which we keep only in hashed form, and we keep that record even after you delete your account.

12. Reminders and notifications

Reminders are scheduled locally by your phone's notification system and need no server. PupCal asks for notification permission when you turn a reminder on.

While you are signed in, PupCal also asks for notification permission so that it can tell you when someone shares a countdown with you. If you allow it, the app registers your phone with our server: an Expo push token, a random installation identifier created by the app, the platform (iOS or Android), your language and the app version. We send these notifications through Expo's push service, which hands them to Apple Push Notification service or Firebase Cloud Messaging for delivery. A notification shows the display name of the person who shared with you.

When you sign out, the app removes your phone's registration, and deleting your account removes all of them. If you do not allow notifications, sharing still works and invitations wait for you in the app. You can withdraw notification permission at any time in your device settings.

13. Service providers

We use these service providers to run PupCal. They process data on our behalf for the purposes below; Apple and Google also provide the platforms the app runs on, under their own terms and privacy policies.

• Google Cloud and Firebase: sign-in; storage and processing of account data, backups, journals and shared content; and automated checks of shared text and shared/profile photos using Natural Language and Vision; and usage statistics (Google Analytics for Firebase). Private journal content is not sent for these safety checks.
• Expo: delivering notifications about shares to Apple and Google.
• Apple: Apple Push Notification service, Sign in with Apple, the place-name geocoder on iPhone, and App Store payments.
• Google: Firebase Cloud Messaging, Google Sign-In, the place-name geocoder on Android, and Google Play payments.
• RevenueCat: verifying and restoring purchases.
• Google (Gemini API and Cloud Vision): checking the photos you choose and drawing your puppy from them, when you use that feature.
• Resend: sign-in links, account-deletion confirmations and waitlist emails, and notices to our moderators about reported posts, which include the reason and the post's text.
• Vercel: hosting the website.
• Cloudflare: Turnstile, which protects the waitlist form.

14. The website and the waitlist

The website at https://pupcal.app is hosted on Vercel. Like any web host, Vercel receives your IP address, browser type and the pages you request in order to serve the site and protect it from abuse, and keeps standard server logs for a short period under its own privacy policy.

The site uses the country derived from your IP address to pick English or Japanese by default. We do not store your IP address or your country. If you choose a language with the globe menu, the site sets one functional cookie named pupcal_lang, kept for one year, so that your choice is remembered. There are no analytics or advertising cookies. Fonts are served from our own domain, so no request is made to Google Fonts when you visit.

If you join the waitlist, we store your email address and the language of the page you signed up on with Resend, our email provider, and use them to send you one welcome email now and one when PupCal launches. Every email carries an unsubscribe link, and you can also write to us to be removed. The form is protected by Cloudflare Turnstile, which may process your IP address and browser characteristics to tell people from automated traffic, under Cloudflare's privacy policy.

Links to the App Store and Google Play take you to Apple's and Google's sites, where their privacy policies apply.

15. Age and children

Anyone can use the countdowns, widgets and reminders without an account. Signing in, and with it the cloud backup, the journal and sharing, requires you to be at least 13 years old, and if you are under 18 you need the permission of a parent or guardian. PupCal is not directed at children under 13 and we do not knowingly collect personal information from them; if we learn that an account belongs to a child under 13, we will delete it. If you are a parent and have a concern, please write to us.

16. Your rights and choices

You are in control of your own days: edit or delete any day in the app, or remove them from your device by deleting the app. If you are signed in, the cloud backup follows your changes, and deleting your account deletes it. Purchase records are held by Apple or Google and can be reviewed in your store account.

For your account, the cloud backup, the journal, sharing, notifications and the waitlist we do hold data about you. You can delete journal entries and photos, delete your posts, clear your mood and status, leave groups, turn notifications off, unsubscribe and delete your account yourself; for anything else, including a copy of your data, write to us and we will do it.

Depending on where you live, for example under the GDPR, the UK GDPR or Japan's Act on the Protection of Personal Information, you may have the right to access, correct, delete or port your data, to restrict or object to how we use it, and to withdraw consent at any time without affecting what we did before. We honour these rights on request. You also have the right to lodge a complaint with your local data protection supervisory authority.

Where the GDPR or the UK GDPR applies, we rely on these legal bases: performing our contract with you to provide the features you use (your account, backup, journal and sharing); your consent for optional permissions and notifications, which you can withdraw in your device settings; our legitimate interests in keeping PupCal safe, handling reports and moderating shared content, and in counting how many people use it so that we can improve it; and compliance with legal obligations.

We do not sell your personal information or share it for cross-context behavioural advertising. If you live in California, you can ask us to tell you what personal information we hold about you, and to delete or correct it, by writing to us; we will not treat you differently for doing so.

17. Deleting your account

You can delete your account in the app: open Account and tap Delete account. Your posts in shared countdowns and spaces, your mood and your status are hidden from other members straight away, and the app signs you out. If you signed in with Apple on an iPhone or iPad, the app asks you to confirm with Apple and requests that PupCal's Sign in with Apple access to your Apple ID be revoked; you can also remove it yourself at any time in your Apple ID settings.

The account is deleted 30 days after you ask. If you sign in before then, the app asks whether to keep it, and keeping it cancels the deletion; until then the account can't save changes. After 30 days we delete your journal notes, photos and voice memos, your cloud backup, your profile photo, your memberships in shared countdowns and spaces and the posts and photos you shared, your hugs and puppy visits, your contacts, the invitations you sent or received that are still pending, your phones' notification registrations, your block list, the dates on which you used the app and the time of your last visit, and your sign-in account, and we email the address on the account to confirm. Moderation reports are retained as described under Shared countdowns and spaces. Interrupted profile-photo deletion may finish later; minimal cleanup records remain as described under Where your data is kept.

If you no longer have the app, follow the steps at https://pupcal.app/delete: write to support@pupcal.app from the address linked to your sign-in and we will delete the account within 30 days of verifying it is yours. Purchase records stay with Apple or Google; companions you bought come back with Restore purchases on the same store account.

18. Changes to this policy

We may update this policy when PupCal changes. The date at the top shows the latest revision. If a change is material, we will point it out in the app or on the website.

19. Contact

Questions about privacy are welcome at support@pupcal.app.

PupCal is operated by Maneko AI LLC. Our business address and the name of our representative are provided without delay on request to support@pupcal.app.