Privacy Policy

This Privacy Policy explains what personal data we process when you use the Pawivo mobile application and the pawivo.app website, why we process it, who we share it with, and what rights you have. We follow Regulation (EU) 2016/679 (GDPR) and the Polish Personal Data Protection Act of 10 May 2018.

1. Controller and contact

The controller of your personal data is Breaking Byte, the developer of Pawivo, with its registered address in Poland. For any privacy-related question - including access, correction, deletion, or a complaint - write to contact@pawivo.app. We respond to verified requests within 30 days, as required by Article 12 GDPR.

2. Data we process

Depending on how you use Pawivo, we process the following categories of personal data:

• Account data - email address (which may be a private Apple relay address if you use Sign in with Apple on iPhone), phone number (if you sign in by phone), display name and profile photo (if provided by you or by your Google or Apple sign-in), Firebase user ID, time zone, and locale.
• Dog profile data - name, breed, sex, date of birth, weight, neutered status, activity level, and an optional photo for each dog you add.
• Health and care data - weight history, weight goals, calorie goals, planner reminders (medication, vaccinations, deworming, flea/tick treatment, vet visits, grooming, custom items), completion history, optional notes, and optional photo attachments.
• Walk data - GPS coordinates (latitude, longitude, altitude), speed, accuracy, timestamps, derived statistics (distance, duration, pace, elevation), and walk events you log (pee, poop, meal, free-text notes).
• Device data - Firebase Cloud Messaging (FCM) push token, app version, operating-system version (Android or iOS), device language, and time zone, used to deliver reminders and to provide a working session.
• Diagnostic data - crash reports collected by Firebase Crashlytics (stack traces, Crashlytics installation ID, device model, OS version, app version) so we can fix bugs. Collection is off by default; we only collect this data after you explicitly opt in via Profile → Privacy and data → Crash reports, and you can withdraw consent at any time.
• Website data - if you use the pawivo.app website, your IP address, browser user agent, and basic request logs are processed by our hosting provider for security and to keep the site available. The website does not use advertising or tracking cookies.
• Advertising measurement data - to measure our own app-install campaigns on Instagram and Facebook, the Meta SDK in the mobile app sends Meta a limited set of app events (such as app installs and launches) together with the technical identifiers it attaches to each event. On Android, only if you opt in, this also includes your device advertising ID; on iPhone no device advertising identifier is used (see Advertising and measurement).

We do not knowingly collect special categories of data (Article 9 GDPR) such as biometric or health data about humans.

3. Purposes and legal bases

• To create your account, sign you in, and keep your session secure - Article 6(1)(b) GDPR (performance of a contract).
• To store and display your dogs, walks, weight history, planner items, and reminders - Article 6(1)(b) GDPR.
• To capture GPS during an active walk and compute statistics - Article 6(1)(b) GDPR; capture only happens when you start a walk.
• To send you push notifications for the reminders you scheduled - Article 6(1)(b) GDPR; you can disable notifications in your system settings at any time.
• To diagnose crashes and stability issues using Firebase Crashlytics - Article 6(1)(a) GDPR (your consent, given via Profile → Privacy and data → Crash reports). You can withdraw consent at any time; we stop collecting new crash data immediately and delete unsent reports from your device.
• To measure how effective our own Instagram and Facebook advertising campaigns are at bringing new users to Pawivo - app-install and app-launch events are processed under Article 6(1)(f) GDPR (our legitimate interest in understanding how well our own marketing works). On Android, additionally sharing your device advertising ID with Meta for this purpose happens only under Article 6(1)(a) GDPR (your consent), which you can withdraw at any time in Profile → Privacy and data → Ad measurement.
• To prevent abuse and protect the security of accounts and the backend - Article 6(1)(f) GDPR (legitimate interest in the security of the service).
• To respond to your support messages or legal requests - Article 6(1)(c) GDPR (legal obligation) and Article 6(1)(f) GDPR (legitimate interest).

4. Location and walk tracking (mobile app)

Pawivo uses precise GPS only while you are actively recording a walk. When a walk starts, the app keeps recording with a clear on-screen indicator so you always know that location capture is in progress - on Android a foreground service with a persistent notification, and on iPhone the system location indicator.

• Location is captured roughly once per second (latitude, longitude, altitude, speed, horizontal accuracy, timestamp) and stored locally on your device, then synchronised with our backend so you can see the route and statistics on any of your devices.
• Capture stops the moment you finish, pause, or abort the walk; closing or backgrounding the app while a walk is active keeps recording - with the persistent notification on Android, or the system location indicator on iPhone - until you stop the walk.
• Background location - we request the background location permission ("Always" on iPhone) during the walk-start flow. It is used only after you tap "Start walk" and only for the duration of that walk, so that recording continues when your screen locks or the app is in the background. On Android this also prevents the operating system from throttling location updates on some devices (particularly Xiaomi, OPPO, and Huawei). We do not use background location for passive collection, geofencing, or any other purpose; we never capture location outside an active walk session.
• You can delete any individual walk from the walk history; this also removes its GPS trace from our backend.
• Granting the camera permission is optional - it is only needed if you want to take a new photo for a dog avatar or attach a photo to a planner item.

5. Recipients and processors

We do not sell your personal data, we do not display third-party ads inside Pawivo, and we never share your data with advertisers to target you. The only advertising-related sharing we do is sending a limited set of app-activity data to Meta to measure our own campaigns (see <a href="#advertising-measurement">Advertising and measurement</a>). We rely on the following recipients and service providers, each bound by a written data processing agreement where it acts as our processor:

• Google (Firebase) - Firebase Authentication (sign-in via your Google or Apple account, email one-time codes, and phone-number verification by SMS; we receive your email, display name, and any profile photo from the provider you choose), Cloud Messaging (push notifications; uses Firebase installation IDs), and Crashlytics (crash reports, only if you have opted in). Operated by Google Ireland Limited; some processing - in particular crash reports and SMS verification - may take place in the United States.
• Apple - if you use Sign in with Apple on iPhone, Apple provides us with your name and an email address (which may be a private Apple relay address). On iPhone, maps are rendered by Apple Maps (MapKit), which receives the area of the map you are viewing in order to serve map tiles, and push notifications are delivered through Apple's Push Notification service (APNs). Operated by Apple Inc. / Apple Distribution International.
• Mapbox (Android) - on Android, map rendering for the live walk map and walk history. Mapbox receives the map view-port coordinates needed to serve map tiles, but does not receive your account identity. Mapbox additionally collects anonymous usage telemetry (Mapbox Telemetry); you can opt out at any time by tapping the "(i)" attribution icon on any map screen and using the "Mapbox Telemetry" toggle.
• Meta Platforms Ireland - we use Meta's measurement SDK inside the mobile app to measure our own advertising campaigns on Instagram and Facebook. We do not use Meta to sign you in. Exactly what is shared, and how to limit it, is described in Advertising and measurement below. Meta's processing is also governed by Meta's own privacy policy.
• Backend hosting and email delivery - providers operating in the European Union, used to run the Pawivo backend (api.pawivo.app), store the photos and attachments you upload, and deliver transactional emails such as one-time login codes and responses to your data requests. (SMS one-time codes are sent through Firebase, above.)
• Sentry - error monitoring for our backend, used to detect and fix server-side faults. It is configured not to send personal data by default, though a technical error report may occasionally include limited personal data contained in the failing request.

We may also disclose data to public authorities when we are legally required to do so - for example following a court order valid in the European Union or Poland.

6. International transfers

Our backend is hosted inside the European Union. Some processors - in particular Firebase services - may transfer personal data to the United States or other countries outside the European Economic Area. Where this happens, the transfer is protected by the European Commission's Standard Contractual Clauses (Decision 2021/914) and, where applicable, by additional safeguards required by the Schrems II ruling.

7. How long we keep data

We keep personal data only as long as we need it for the purpose for which it was collected:

• Account, dog, walk, and health data - for as long as your account exists. After you delete your account, we erase or anonymise this data within 30 days.
• Crash reports - collected only if you have opted in. Kept by Firebase Crashlytics for up to 90 days, then automatically deleted.
• FCM push tokens - kept until you sign out, uninstall the app, or the token is invalidated by the operating system.
• Backups - encrypted backups of the backend database are kept for up to 30 days for disaster recovery.
• Support correspondence - kept for up to 24 months so we can recognise repeat issues, then deleted.

8. Your rights under GDPR

You have the following rights regarding your personal data; you can exercise any of them by contacting contact@pawivo.app:

• Access (Article 15) - request a copy of your data; you can start this with the in-app data export feature, which covers your account, dogs, walks, health and planner data.
• Rectification (Article 16) - correct inaccurate data; most fields can be edited directly in the app.
• Erasure / right to be forgotten (Article 17) - request deletion of your account and all associated data.
• Restriction of processing (Article 18).
• Data portability (Article 20) - receive the personal data you provided to us in a structured, commonly used format; you can request this through the in-app data export feature and we send it to the email address you provide.
• Objection (Article 21) - object to processing carried out under our legitimate interest (for example, abuse prevention).
• Withdraw consent at any time, where processing is based on consent (for example, Crashlytics via Profile → Privacy and data → Crash reports, or - on Android - advertising-ID sharing via Profile → Privacy and data → Ad measurement), without affecting prior lawful processing.
• Lodge a complaint with the Polish supervisory authority - President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych), ul. Stawki 2, 00-193 Warszawa, uodo.gov.pl.

9. Security

We protect your data with HTTPS/TLS in transit, Firebase-managed authentication tokens, and access controls on the backend. Local storage on your device is sandboxed by your device's operating system (Android or iOS). No system is perfectly secure; if you discover a vulnerability, please report it responsibly to contact@pawivo.app.

10. Children

Pawivo is intended for users aged 16 or older. We do not knowingly collect personal data from children under 16. If you are a parent or guardian and believe a child has provided us with personal data, please contact us and we will delete it.

11. Automated decision-making

We do not carry out any automated decision-making or profiling within the meaning of Article 22 GDPR that produces legal or similarly significant effects on you. The statistics, calorie estimates, and weight trends shown in the app are computed for informational purposes only.

12. Website cookies

The pawivo.app website uses only essential cookies and local storage required to remember your language preference and to keep the site working. We do not use advertising, analytics, or third-party tracking cookies. This section concerns the website only; advertising measurement in the mobile app is covered separately under Advertising and measurement.

13. Advertising and measurement

We run paid advertising campaigns for Pawivo on Instagram and Facebook. To understand which of our own ads lead people to install and open the app, the Pawivo mobile app includes Meta's measurement SDK. We use this only to measure our own campaigns - we do not show ads inside Pawivo, we do not sell your data, and we do not build advertising profiles of you.

• What is always sent - on both Android and iPhone, the SDK sends Meta a limited set of app events (such as app installs, launches, and sessions) together with the technical information Meta's SDK attaches to each event, for example your app/bundle identifier, app version, a coarse device and operating-system description, an event timestamp, and information derived from your IP address.
• On iPhone - measurement uses Apple's privacy-preserving SKAdNetwork, which reports installs to Meta in aggregate without any device identifier. Pawivo does not access the iOS advertising identifier (IDFA) and does not show an App Tracking Transparency prompt, because no cross-app tracking takes place.
• On Android - by default we do not share your advertising identifier. Only if you opt in (a one-time prompt, and a toggle under Profile → Privacy and data → Ad measurement) does Pawivo additionally share your Google Advertising ID (GAID) with Meta for the same campaign-measurement purpose. You can turn this off at any time.
• Recipient - Meta Platforms Ireland Limited receives this data and processes it under its own privacy policy. We never receive your Facebook or Instagram profile from Meta through this measurement.

Legal basis: app-install and app-launch events are processed under our legitimate interest in measuring our own marketing (Article 6(1)(f) GDPR); on Android, sharing your advertising identifier happens only with your consent (Article 6(1)(a) GDPR), which you can withdraw at any time. This advertising measurement applies to the mobile app only - the pawivo.app website uses no advertising or tracking technologies.

14. Data deletion

You have full control over your data in Pawivo. You can delete your account along with all associated data at any time: dog profiles, walk history, care entries, photos, and app settings.

How to delete your account in the app

1. Open the Pawivo app and sign in to your account.
2. Go to Help in the bottom navigation.
3. Under Account data, tap Delete account.
4. Read the consequence notice explaining what will be deleted.
5. Confirm the deletion when prompted (on Android you confirm twice).

After confirmation, your account is marked as scheduled for permanent deletion. Permanent deletion happens after 30 days.

What happens to your data

• For 30 days after confirmation, your account stays in a "scheduled for deletion" state. Your data is still stored, but you can no longer access it from the app.
• If you sign back in to the same account within those 30 days, the deletion is automatically cancelled and you regain full access to all your data.
• After 30 days, your data is permanently and irreversibly removed from our servers. It cannot be recovered.

What data is deleted

• Your user profile (email, nickname, account ID).
• Dog profiles (photos, details, preferences).
• Full walk history (GPS tracks, timing, statistics).
• Care entries (reminders, completion records, notes, attachments).
• Weight measurements.
• App settings.

If you can't sign in to the app

If you've lost access to your account (for example, after revoking Pawivo's permission in your Google or Apple account settings), email us:

• Email: contact@pawivo.app
• Subject: Pawivo account deletion

In your message, include either:

• the email address or phone number associated with your Pawivo account, or
• the Google or Apple account you used to sign in (if you used social sign-in).

We'll confirm deletion within 30 days of receiving your request.

15. Changes to this Policy

We may update this Privacy Policy as the service evolves or as the law requires. The "Last updated" date at the top reflects the most recent revision. Material changes will be announced inside the app and on this page before they take effect.