Privacy Policy

1. About this policy

This policy explains how Houcine Bousfiha, an individual developer based in Morocco ("PETTO", "we", "us"), collects, uses and shares personal information when you use the PETTO app for iPhone and Android and our website at pettoai.app.

We are responsible for this information as its data controller. You can reach us at petto.ai.contact@gmail.com. Please read this policy together with our Terms of Service.

2. The short version

• We collect what you give us (your account details: the email and username you sign up with, or your details from Apple or Google; your pets' profiles, photos, care routines and health records, including any vet documents you upload; and your conversations with the PETTO assistant), your PETTO Plus subscription if you have one, and some device and diagnostic information.
• Some of it is also kept on your phone, so PETTO can show your pets' day, in the app and on its widgets, and ring your reminders without a connection. Signing out removes it.
• We use it to run PETTO: to schedule your pets' care, send reminders (including for the dates in your pets' health records), power the AI features, including the assistant and the reading of vet documents, and fix problems.
• Some of it is handled by service providers who run parts of PETTO for us, including an AI provider. Most of them are based in the United States.
• We don't sell your information and don't use it for advertising.
• PETTO has a free plan and a paid plan, PETTO Plus, which you buy through the App Store or Google Play. Apple or Google takes the payment; we never see your card details.
• In the app, you can edit or delete your pets' information, health records and vet documents, export a pet's health record as a PDF, clear your conversations and delete your account, and find a plain-language summary in the Privacy Center.

3. Information we collect

Your account

You can create a PETTO account with your email address, or sign in with your Apple or Google account.

• With email: you give us your email address, a username and a password. We email you a one-time code to confirm the address is yours, and again when you reset or change your password, or when you sign in on a new device. Your username is shown on your profile, and you can sign in with it instead of your email.
• With Apple or Google: we receive your name, email address and profile picture from that account. If you used Apple's "Hide My Email", we receive the relay address instead. We never receive your Apple or Google password.

Passwords are handled by our sign-in provider, Clerk, which stores them only in a securely hashed form and turns down passwords known to have appeared in data breaches. PETTO's own servers never receive or store your password. We also keep an account identifier and the dates your account was created and updated. If you change your name in the app, we store the new one.

Your pets

• Profiles: whatever you add about each pet, such as its name, species, breed, birth date, sex, weight, activity level, diet, allergies and notes, plus a short summary PETTO writes for you.
• Descriptions: if you add a pet by describing it, the text you write or dictate (up to 500 characters). If you use the form, your answers to the routine questions, such as meal times or a medication name.
• Photos: pet photos you take or choose from your library, including a photo you add so PETTO can describe your pet. Photos are made smaller on your phone before they're uploaded.

Your pets' care

The care activities you or PETTO set up (titles, times, how often they repeat, reminder settings) and what happens to them: done, skipped, snoozed, rescheduled or missed, with any notes.

Your pets' health records

What you keep in a pet's health record: vaccinations (with the dates given and due), vet visits (with the reason, clinic, the vet's notes and follow-ups), medicines (with how they're given and for how long), allergies, conditions, your vet's contact details, the microchip number and whether the pet is spayed or neutered. Each entry notes whether you added it or it was read from one of your documents.

Vet documents

When you add a pet, or later from its health record, you can upload up to 3 vet documents per pet on the free plan, or 5 with PETTO Plus, such as vaccine cards, vet notes or test results, as photos or PDF files (up to 10 MB each). We keep each file, its name, type and size, and what PETTO read from it. Photos are made smaller on your phone before they're uploaded. Vet documents often show more than your pet's health, such as your name, address or phone number, or a clinic's details; PETTO keeps only what concerns your pet's health and profile, but the file itself is kept as you uploaded it. We also keep a daily count of the documents read for you, to apply your plan's daily limit.

Health record PDFs

When you export a pet's health record as a PDF (part of PETTO Plus), we prepare the document (your pet's profile, health record, the names of its documents and, if you have one, your name as its owner) on our servers, and your phone turns it into the PDF file. The file stays on your phone until you save or share it; we don't send it anywhere.

Conversations with the assistant

When you chat with the PETTO assistant about a pet, we keep your messages, any photos you attach, the assistant's replies and the care activities and health record entries it offers you. We also keep a daily count of the messages you send, to apply your plan's daily limit.

PETTO Plus

PETTO has a free plan and a paid plan, PETTO Plus. If you subscribe, you buy PETTO Plus through the App Store or Google Play, which take the payment under their own terms: we never receive your card or bank details. Purchases are managed for us by RevenueCat, which links them to your PETTO account through its account identifier and passes on what the store reports. We keep your plan (free, monthly or yearly), its status (free trial, active, cancelled or ended), when the trial or the current period ends, whether you've used the free trial, and a record of each change to your subscription: what it was, when it happened, the store's identifier for it and, for a payment, the price and currency you paid. We use this to apply your plan's limits and to email you about your subscription.

When your subscription starts, renews, is cancelled or ends, we email you at your account's address, in the app's language, with a receipt for each payment: its number, the date, the plan, the billing period, the amount and how it was paid.

Voice input

When you tap the microphone, to describe a pet or to talk to the assistant, your phone's own speech-recognition service turns what you say into text. Depending on your phone and its settings, this happens on the device or through Apple's or Google's speech service, under their privacy terms. PETTO receives only the resulting text, never the recording.

Your device and settings

• Time zone and language: your phone's time zone and the app's language, saved with your account whether or not you allow notifications, so your pets' days, the daily limits and your reminders follow your own day and language.
• For reminders: a notification token for your device, your device type and model (for example "iPhone 15 Pro"), when the device was last used with PETTO, and the period for which your phone has scheduled reminders on itself (Section 7).
• Reminder records: a record of each reminder we send (its text, timing and whether it was delivered), and the notifications shown in the app's notification list.
• Actions sent later: when you mark an activity done, skipped or snoozed without a connection, snooze it from a reminder, or tick it on a PETTO widget, your phone sends it once you're back online, with the time you tapped it and a one-time code. We keep the code with our answer, so the same tap is never recorded twice.

On your phone

So that PETTO works without a connection, the app keeps some information in its own storage on your phone: a copy of your pets' profiles and of each pet's activities for the week (refreshed whenever you're online, and not used after 7 days), the activities you marked done, skipped or snoozed offline until they're sent, the pet you last selected, and the reminders for the next 48 hours that your phone schedules itself (Section 7). Your account details are kept in your phone's secure storage, so the app can open signed in without a connection. When you sign out, or someone else signs in on the phone, this information is removed and those reminders are cancelled.

If you add a PETTO widget to your home screen or lock screen, the app saves what it shows in a space on your phone that only PETTO and its widgets can open: the selected pet's name and picture, its activities for the next 48 hours (their titles, times and whether they're done), the care illustrations, the app's language and appearance, your account identifier, and each activity you tick on a widget until the app sends it. The widgets never connect to the internet themselves: the app downloads their pictures for them. Anyone who can see your screen can see what a widget shows; on iPhone, the activity's name on a lock screen widget can be hidden while the phone is locked, depending on its settings. When you sign out, the widgets' copy, their pictures and any unsent ticks are deleted, and the widgets ask you to sign in.

On iPhone, the app also keeps a copy of each pet's picture on the phone, to show it on the reminders the phone schedules itself.

Issue reports

When you use Report App Issue, we receive your message and the type of issue you picked, your name, email address and the app's language, the screenshot if you attach one, and a link to the most recent error and session recording (see below), if there is one.

Diagnostics

To find and fix problems, the app automatically sends technical information to our error-monitoring provider: error and crash reports, performance measurements, your device and operating system details, the app version, your IP address, a record of your recent steps in the app, and your account identifier, name and email address so we can tell which account a problem affected. If buying or restoring PETTO Plus fails unexpectedly, the app also reports the kind of problem, the store's error code and message, and whether you're on iPhone or Android, never the price or your payment details.

Our servers report to the same provider too: a background task or request that failed, with your account identifier and the technical identifiers of what failed, and timing measurements for some of the app's requests (which part of PETTO was used, how long it took and whether it worked). For each reply from the assistant, we send technical measurements only: your account identifier, your pet's identifier, the AI model used, the amount of text processed (tokens), how long it took, the app's language and the kind of suggestions offered. These reports never include what you wrote, what your documents say, what the AI read or the assistant's replies.

The app also records a session replay for about 1 in 10 sessions, and for the last minute before any error. A replay is a video-like reconstruction of the screens you used, in which all text, images and drawings are hidden, so your name, your pets' details and your photos are not visible in it.

What we don't collect

PETTO doesn't access your location (we only use the name of your time zone, such as "Europe/Paris"), or your contacts, and doesn't collect advertising identifiers, or your payment card or bank details (for PETTO Plus, Apple or Google take the payment). It uses the microphone only while you're dictating, and never records or keeps audio.

4. How we use your information

We use your information to:

• provide PETTO: run your account; store and show your pets' profiles, photos, routines, history, health records and vet documents; prepare a health record PDF when you ask for one; schedule activities in your time zone; keep a copy on your phone so PETTO and its widgets work without a connection; and word reminders and AI results in your language;
• run your PETTO Plus subscription: apply your plan's limits, and email you about your subscription (a welcome, the start of your free trial, renewal receipts, a cancellation and the end of Plus);
• send reminders for your pets' activities, including early reminders you've set, and for the dates in their health records (Section 7);
• power the AI features, including the assistant, described in Section 6;
• support you and fix problems, using issue reports and diagnostics;
• keep PETTO secure, for example by checking that each request comes from a signed-in user and only reaches that user's own information, and to prevent misuse; and
• meet legal obligations and enforce our Terms where needed.

We don't sell your personal information, and we don't use it for advertising or share it with advertisers. We don't currently send marketing emails: the emails we send you are about your account and your subscription.

5. Our legal bases

If data-protection laws such as the GDPR apply to you, we rely on: performance of our contract with you to provide PETTO (account, pets, care, reminders, AI features and your PETTO Plus subscription); our legitimate interests in keeping PETTO working and secure, through diagnostics, session replays and issue reports, which you can object to (Section 12); and legal obligation where the law requires us to process or keep information, such as records of purchases.

6. PETTO AI and your data

PETTO uses an AI service provider, Anthropic (the maker of Claude), for the following features:

• Turning a description into a profile. When you describe your pet, we send your description and the app's language to the AI provider, which returns profile details and a short summary. If you dictated your description, we send the text your phone produced, so the AI can tidy it into a description.
• Describing a pet from a photo. If you add a photo while describing your pet, we send the photo and what you've written so far, and the AI describes the pet it sees (or tells you if it can't see one). You can edit the result before using it.
• Suggesting a starting routine. When you add a pet, we send your pet's profile details, plus your description or your routine answers if you gave them, to suggest care activities. If you described your pet or answered the routine questions, the suggested activities are added to your pet's care plan straight away. You can edit or delete them at any time.
• Reading vet documents. When you add a pet with vet documents, or add documents to a pet later from Health Records, we send each document to the AI provider, which reads the health information in it (vaccines, visits, medicines, allergies and the like, with their dates) and any profile details, such as the pet's breed or birth date. Nothing it reads is saved until you've reviewed it: PETTO shows you what it found, marks anything it's unsure of, and saves only what you keep. If a document says something different from your pet's profile, PETTO shows you both and changes the profile only if you choose. PETTO reads up to 5 documents a day for you on the free plan, or 20 with PETTO Plus.
• Keeping your pet's summary right. If a document, or a change you make while reviewing it, alters something your pet's summary is based on (such as its birth date, breed or sex), we send the pet's confirmed profile, its age as PETTO works it out and the current summary to the AI provider, which writes the summary again in your language. If that fails, the old summary stays. A summary you've edited yourself is never rewritten.
• The PETTO assistant. When you send a message, we send it to the AI provider with your recent conversation about that pet (including your latest photos), the pet's profile, its health record, its care schedule and recent care history, your time zone, the app's language, and your plan and what you've used of it today, so the reply fits your pet and the assistant can answer questions about PETTO Plus. When the assistant offers care activities or health record entries, nothing is added to your pet's care or health record until you tap to add it. If you ask it for your pet's health record as a PDF, it offers a button that prepares the same PDF as the Health Records screen.

We keep your descriptions, your conversations with the assistant, your vet documents and the AI's results with your account, along with any profile details, health record entries and activities you keep. You can clear a conversation at any time. We don't use your information to train AI models. The AI provider processes it to deliver these features under its agreement with us. Under Anthropic's commercial terms, it may not train its models on the information we send it.

Please don't include sensitive information about yourself or other people in descriptions, messages or photos. PETTO only needs to know about your pet. If you'd rather a vet document's other details weren't read, you can cover them before taking the photo.

7. Reminders and notifications

• To send reminders, we send the notification text and your device's notification token to Expo's push notification service, which passes them to Apple's or Google's notification service for delivery.
• Your phone also schedules your reminders for the next 48 hours on itself, so they ring even without a connection; their text stays on your phone. Your phone tells our servers which period it has covered, and we don't send it those reminders a second time, though they're still added to your notification list. On Android, PETTO may ask for the Alarms & reminders permission so they ring on time; you can turn it off in your phone's settings.
• A reminder at an activity's time has Snooze buttons. When you tap one, your phone schedules the reminder again on itself, so it rings even without a connection, and sends the snooze to our servers (once you're back online), which move the activity to its new time.
• When a health record entry has a date ahead (a vaccination or its next dose, a vet visit or its follow-up, a surgery, or a course of medicine), PETTO adds a reminder for it to your pet's care by itself, and moves or removes it if you change or clear the date. You can edit or delete these reminders like any other.
• A reminder's text includes your pet's name, the activity and its time (for example "Time to feed Luna" and "Breakfast · 8:00 AM", or "Rabies due"), and it shows your pet's photo, or the picture for its type if it has none. A reminder we send carries a link to that picture, which your phone downloads from our image-hosting provider to show it. A reminder may appear on your lock screen, depending on your device settings.
• We keep the notifications we've sent you in the app's notification list until you clear them.
• You can turn reminders off for any activity in the app, or for PETTO in your device settings; Notifications, in PETTO's Settings, shows whether notifications are on and takes you there. Signing out of PETTO on a device removes that device from reminders and cancels the reminders it scheduled itself.

8. Photos and vet documents

Pet photos are stored with our image-hosting provider, ImageKit, and shown in the app through a web address. These addresses are long and hard to guess, but they are not secret: anyone who has a photo's address can open it. Your profile picture from Apple or Google, if you sign in with one, is copied to the same provider, and so are the photos you attach to assistant messages or add so PETTO can describe your pet.

When you replace or remove a pet's photo, the old file is deleted. When you delete a pet or your account, or clear a conversation, the photos concerned disappear from the app, but the photo files kept by our image-hosting provider aren't yet deleted automatically. To have them removed, write to us at petto.ai.contact@gmail.com. Screenshots you attach to issue reports go to our error-monitoring provider (Section 3).

Vet documents are kept differently: they're stored with ImageKit as private files, which can only be opened through a link our servers create for you when you view one, and which stops working after a few minutes. When you delete a document, a pet or your account, the document files concerned are deleted automatically. A document you uploaded but never added to a pet (for example, if you left Add a pet or Add documents without finishing) is deleted after a day.

9. Who we share information with

We share personal information only with service providers who help us run PETTO. They process it on our behalf and only for that purpose:

• Clerk (sign-in and accounts): account details, usernames, passwords (stored hashed), sign-in sessions, and the one-time codes it emails to you.
• Neon (database): account, pet, care, health record, conversation, device and notification data (including your time zone and language, and the period your phone's own reminders cover), your plan and the record of changes to your subscription, records of actions sent from your phone, what PETTO read from your vet documents, and health record PDFs while they're prepared.
• Inngest (background processing for account sync, AI tasks, reminders, reading vet documents and preparing health record PDFs): account details, pet descriptions (typed or dictated), photos sent for description, routine answers, assistant messages and the health record entries the assistant offers. Vet documents are read from our servers; what they say isn't passed through Inngest.
• Anthropic (AI features, through its Claude models): pet descriptions, details, photos and routine answers; vet documents you upload; your pet's confirmed profile and summary when the summary is rewritten; and assistant messages with the photos you attach and your pet's health record, care schedule and history.
• ImageKit (photo and document storage and delivery): pet photos, profile pictures, photos attached to assistant messages, and vet documents (as private files).
• Expo (push notification relay, and hosting our app's servers through EAS Hosting): notification tokens, reminder text and the link to your pet's picture, and all information the app sends to our servers.
• Apple and Google (sign-in with Apple or Google, notification delivery, payment for PETTO Plus and, depending on your phone, speech recognition): as described in Sections 3 and 7.
• RevenueCat (managing PETTO Plus purchases): your account identifier, the store's records of your purchases and subscription (products, dates, prices, store and country), and the technical information about the app and your device needed to check purchases.
• Resend (sending the emails about your subscription): your email address, your first name and the content of these emails.
• Sentry (error monitoring and diagnostics): diagnostics, session replays, issue reports, account identifier, name, email and IP address; error reports and timing measurements from our servers; technical measurements of the assistant's replies, never their text; and reports of problems buying PETTO Plus, never your payment details.
• Cloudflare (hosting our website): website requests (Section 14).

We may also disclose information if the law requires it, or to protect the rights, safety or property of our users, the public or us; and, if PETTO is sold or merged, to its successor, in which case this policy continues to apply to your information.

10. Where your information is stored

Our providers store and process information in the United States, including our database (AWS, US East) and our error-monitoring provider. Our other providers may process it in the United States and in other countries where they or their subcontractors operate. If you live elsewhere, your information is transferred to these countries, which may not have the same data-protection laws as yours. Where the law requires it, we rely on safeguards such as the standard contractual clauses in our providers' data-processing terms.

11. How long we keep information

• Account, pets, photos, care routines, history, health records, vet documents, descriptions and AI results: for as long as you have an account, unless you delete them sooner.
• Vet documents never added to a pet: deleted after a day. An Add a pet or Add documents you didn't finish or confirm, with what was read from its documents, is deleted after 7 days.
• Health record PDFs: the copy prepared on our servers is deleted after a day; the PDF file itself is on your phone, and you decide what happens to it.
• Conversations with the assistant: until you clear them, delete the pet or delete your account.
• Daily counts of assistant messages and of documents read: for as long as you have an account.
• Your plan and subscription records: for as long as you have an account. Apple or Google, and RevenueCat, keep their own records of your purchases under their own policies and the law (for example, for tax), and our email provider keeps a record of the emails it sent for a limited time.
• Records of actions sent from your phone: for as long as you have an account.
• Notifications: until you clear them or delete your account.
• Device notification tokens: until you sign out on that device, it stops accepting notifications, or you delete your account.
• On your phone: the copy kept for offline use and for the widgets is refreshed whenever you're online, isn't used after 7 days, and is removed when you sign out (Section 3).
• When you delete your account: your account, and the pet, care, health record, conversation, device and notification data, your plan and subscription records, and the records of actions sent from your phone, in our database, are deleted automatically, and so are your vet documents' files. Photo files kept by our image-hosting provider aren't yet deleted automatically; write to us to have them removed (Section 8). Copies may stay in backups for up to 30 days, in server logs for up to 30 days, and in our background-processing provider's records for up to 30 days. Deleting your account doesn't cancel a PETTO Plus subscription: cancel it in your App Store or Google Play settings.
• Diagnostics, session replays and issue reports: kept by our error-monitoring provider for up to 90 days.

12. Your choices and rights

In the app, you can:

• edit your pets' details and your name;
• replace or remove a pet's photo;
• add, edit and delete your pets' health record entries, and remove their reminders;
• add vet documents to a pet at any time, and view and delete them;
• export a pet's health record as a PDF, to save or share;
• delete a pet and its information;
• clear your conversation with the assistant about any pet;
• delete your account (Account, then Delete account), which deletes your information as described in Section 11;
• see your plan, manage or cancel your PETTO Plus subscription (Account, then Manage subscription, which opens your App Store or Google Play settings), and restore your purchases;
• clear notifications, and turn reminders off for any activity;
• add PETTO's widgets to your home screen or lock screen, and remove them at any time;
• change notification, Alarms & reminders (Android), camera, photo, microphone and speech-recognition permissions in your device settings;
• see a plain-language summary of what PETTO keeps, and reach these controls, in the Privacy Center (in the menu); and
• sign out.

By contacting us at petto.ai.contact@gmail.com, you can ask us to give you a copy of your information, correct it, delete it, or object to or restrict how we use it. You can also send this request from the app's Privacy Center. We'll reply within 30 days, and may need to confirm that the request comes from you. Apart from a pet's health record PDF, PETTO doesn't have an in-app download feature, so we'll send copies by email, in a common format such as PDF or JSON.

Depending on where you live, you may also have the right to data portability, and to complain to your local data-protection authority.

13. Children

PETTO is not directed at children under 13, and we don't knowingly collect their personal information. The app doesn't ask for your age. If you believe a child under 13 has given us personal information, contact us and we will delete the account and its information.

14. Our website

Our website shows information about PETTO and our legal pages. It uses no cookies, analytics or advertising. It is hosted by Cloudflare, which processes the standard technical information any website receives (such as your IP address and browser type) to deliver pages and protect against attacks, and it loads images from ImageKit, which receives the same kind of information. If you use the light or dark button, your choice is remembered in your own browser (local storage) and never sent to us.

15. How we protect your information

Every request from the app to our servers must carry a valid sign-in session, and each request can only reach the signed-in user's own information. Our secret keys stay on our servers and are never included in the app. Your sign-in session is kept in your device's secure storage, the copy of your pets' information kept for offline use and for the widgets stays on your phone, in storage only PETTO and its widgets can open, and is removed when you sign out, your password goes straight from the app to our sign-in provider over an encrypted connection and never to our servers, photo and document uploads use short-lived, single-purpose permissions, vet documents can only be opened through links that expire after a few minutes, information between the app and our servers is encrypted in transit (HTTPS), and session replays hide all text and images.

No system is completely secure. If we learn of a security incident affecting your information, we will notify you and the authorities as the law requires.

16. Changes to this policy

We'll update this policy when our practices change. If a change materially affects how we use your information, we'll tell you in the app or by email before it takes effect. The "Last updated" date shows the current version.

17. Contact us

Houcine Bousfiha, Casablanca 20000, Morocco. Email: petto.ai.contact@gmail.com.

You can also reach us in the app: Menu, then Report App Issue.