Privacy policy

For privacy questions or requests, email privacy@canimio.com.

• Account information: name, email address, internal account identifiers, authentication sessions, and account settings. Passwords are handled by the authentication provider and are not visible to the operator.
• Dog and household information: dog profiles, photos, breed, sex, birth date, weight, family memberships, invitation email addresses, household relationships and access roles. These relationships are created when you choose to invite someone or join a shared dog. Canimio does not read your phone's address book.
• Care information: walks, hydration and nutrition logs, appointments, medical and grooming records, uploaded care files, expenses, and related notes. When you choose to record a walk, the saved record includes its start and end times, duration and distance, and its route when GPS tracking is used. Walk records can also describe the physical activity of the person walking the dog. You can use Canimio's other care features without recording walks.
• Location information: precise coordinates and route points when you start walk tracking, and your current coordinates when you request local weather or nearby-place results.
• Device and service information: appearance and notification preferences, a browser push-subscription endpoint and public encryption keys when you enable web reminders, device time zone, app version, browser or device details, IP address, and security and diagnostic events processed by the infrastructure providers.
• Optional usage analytics: selected feature-use events, platform, app version, coarse success or failure outcomes, and a separate analytics identifier, only after you opt in on this device.
• Purchase information: your internal Canimio account identifier, App Store or Google Play product and transaction information, subscription expiry and renewal status, purchase entitlements, refunds, and device/service details needed to validate and restore purchases. Canimio does not receive your payment-card or bank credentials. RevenueCat may receive the platform's device identifier and IP address when its purchase SDK communicates with the service.
• Messages: information you include when contacting the privacy or support address.

Canimio uses this information to:

• create and secure accounts, synchronize data, and provide the requested app;
• record walks and care activity and enable chosen household-sharing features;
• provide maps, local weather, and nearby veterinary or pet-service results;
• deliver authentication and family-invitation emails and the device or browser reminders you request;
• prevent abuse, investigate errors, protect the service, and answer requests;
• understand feature adoption, return usage, and save reliability when you choose optional usage analytics;
• meet legal obligations and enforce applicable service terms.

Canimio does not collect location continuously by default. Location access begins only after you use a location-dependent feature and grant device permission. After permission is granted, Home and Walks can refresh your current position automatically when opened. The native app keeps the most recent position for up to 24 hours in its private on-device preferences so the map can reopen in the right area without first showing a world view. This device-only cache is removed when you sign out or delete your account. The website keeps its latest position in memory only. A walk you explicitly start may continue recording while the native app is backgrounded or the screen is locked, so the route remains accurate. Tracking stops when you end the walk or revoke the relevant permission. Canimio does not request always-on location access and does not use location for advertising.

Updated Android and iOS apps can keep an encrypted, account-scoped copy of recently loaded care information and supported entries waiting to synchronize. These device-only files are excluded from cloud backups, with encryption keys held by the operating system. Offline totals include locally saved entries and show a waiting-to-sync notice until the server confirms them. Permissions and record conflicts are checked again on reconnection. Recent read copies expire after seven days; unsynchronized entries are retained until confirmed or removed. Signing out, account deletion, or deletion of the relevant dog clears the corresponding device data. Signing out warns before removing unsynchronized care entries. Device care data is included when you export your account. The website does not persist this care cache or queue in browser storage.

Wardrobe previews and provisional treat purchases use the existing account-scoped wardrobe snapshot. Treat purchases are checked against server permissions and the current balance on reconnection; spending on another device can cause a reservation to be declined. Equipping outfits and App Store or Google Play purchases require a connection. Offline maps, care files and first sign-in still require connectivity.

Where data-protection law requires a legal basis, account and care processing is necessary to provide the service you request; optional device permissions rely on your choice and can be withdrawn in system settings; optional usage analytics relies on your consent and can be turned off in Account; security and service improvement rely on legitimate interests that are balanced against user rights; and some processing may be required to meet legal obligations.

Usage analytics is off by default. When available, you can enable it in More → Account. Your choice applies to your signed-in account on this device; each browser or phone has its own choice. PostHog Cloud EU processes selected events, such as creating a dog, starting or saving a walk, managing appointments, or confirming a wardrobe purchase, to help improve Canimio.

Events contain only selected actions or screens, platform, app version and release channel, coarse feature categories and outcomes, and separate account, session and event identifiers for counting and duplicate prevention. The account analytics identifier groups consenting use of the same account without sending your account ID, email, name, dog names or IDs, precise location, walk routes, care notes, or attachment contents. Canimio does not record screens, form contents, console or network logs, or full page URLs for usage analytics. We do not use these events for advertising or cross-app tracking.

Turning analytics off stops new capture on this device and clears its local analytics state. It does not automatically erase events already sent. Your account export includes available analytics data; contact privacy@canimio.com for earlier analytics access or deletion requests. After your account's 30-day recovery period, Canimio requests deletion of its linked analytics profile and events from PostHog as part of permanent account cleanup. Provider deletion processing may take time.

Purchases in the iOS app are processed by Apple. Purchases through Google Play in the Android app are processed by Google. RevenueCat validates transactions, supports restoration and purchase reporting, and tells Canimio which paid features your account can use. We send your internal account identifier rather than your email, dog names, care files or location to RevenueCat. This purchase processing operates separately from optional PostHog usage analytics.

Canimio Plus subscriptions renew through your Apple account for App Store purchases, or the Google account used for Google Play purchases. The Halloween costume is a separate permanent one-time purchase and is not included in Plus. Account deletion does not cancel a store subscription; manage or cancel it in your Apple account settings for App Store purchases, or in Google Play subscription settings for Google Play purchases. After the 30-day recovery period, Canimio requests deletion of its RevenueCat customer record before permanently removing the account. Apple, Google and RevenueCat may retain transaction information as required for payment, fraud, accounting and legal obligations. Contact privacy@canimio.com before permanent deletion if you need assistance with restoring purchased access.

Canimio does not sell personal information, show third-party advertising, or use cross-app advertising trackers. We use the providers below to operate the service. Some process information on Canimio's behalf and under our instructions; others, including Google Maps Platform, process certain information as independent controllers under their own terms and privacy policies. We may also disclose information when legally required.

• Supabase for authentication, database storage, and private file storage;
• Cloudflare for website and server hosting, network security, request processing, and email forwarding;
• Google Maps Platform for map display, weather, and nearby-place results. Location-dependent requests send the coordinates needed for the feature. On Android, the Maps SDK initializes at app startup and can automatically collect device and network information, a pseudonymous SDK identifier, and crash and diagnostic information. It also collects map interaction information when map features are used. This automatic SDK collection is separate from optional PostHog analytics and from your choice to record a GPS walk. Google processes Maps information under the Google Privacy Policy and the applicable Google Maps terms, which include independent-controller data-protection terms.
• Resend for transactional authentication and family-invitation email;
• RevenueCat for purchase validation, restoration, subscription status and purchase reporting. Apple's App Store processes iOS payments; Google Play processes purchases made through Google Play in the Android app;
• PostHog Cloud EU for optional usage analytics when you opt in;
• Apple and Google platform services for native operating-system features such as location permission, local notifications, file export, and the share sheet.
• Browser push services operated by Apple, Google, Mozilla, or Microsoftwhen you opt into web reminders. The browser chooses its service and gives Canimio an opaque delivery endpoint and public encryption material. Notification payloads are encrypted for the browser, so those services receive ciphertext rather than readable care-record content.

These providers may process information in countries other than yours under their applicable contractual and legal safeguards. Canimio may also disclose information when required by law or necessary to protect users, the service, or legal rights.

Account and care information is retained while your account is active or until you delete it. You can download a portable JSON copy from the Account screen before deletion. You can then permanently delete the account in the app or through the public account-deletion page. Account deletion requires a recent password confirmation. Your account is then deactivated for 30 days, during which you can sign in and explicitly restore it. After the displayed recovery deadline, the account and its associated data are permanently removed from Canimio's live systems. Deleting an individual dog is immediate and permanent after confirmation, including its associated records and uploaded files; individual dogs cannot be restored.

You can delete individual records without deleting your account. For instructions or a request to delete selected data, visit the account and data deletion page or email privacy@canimio.com. We will verify your identity before acting on a request and explain any shared records or information that must be retained for legal reasons.

Disabling browser reminders removes that browser's subscription from Canimio. Deleting the account stops reminders during the recovery period and permanently removes its push subscriptions and delivery history after the recovery deadline.

If you own a dog shared with another person, Canimio requires you to transfer ownership or remove the other members before deletion to prevent accidental loss of their household data. If you are a member of a dog owned by someone else, your membership and records tied to your account are removed while the owner's dog and other members' records remain.

Limited copies may remain temporarily in encrypted provider backups or security logs until those systems rotate them under the providers' retention schedules. They are not restored to the live product or used for ordinary product purposes. Information may be retained longer only when legally required or necessary to establish, exercise, or defend legal claims.

You can update profile and dog information in the app, change or revoke operating- system permissions, export your information, or delete your account. Depending on where you live, you may also have rights to access, correct, restrict, object to, or obtain a copy of personal information, withdraw consent, and complain to a data- protection authority. Contact privacy@canimio.com to exercise a right that is not available directly in the app. Identity verification may be required before a request is fulfilled.

Canimio uses encrypted network connections, private storage controls, row-level database authorization, scoped credentials, authenticated server functions, and least-privilege infrastructure access. No internet service can guarantee absolute security, so suspected privacy or security issues should be reported promptly to the privacy contact above.

This policy may be updated when the product, providers, or legal requirements change. The revised policy will be published here with a new “Last updated” date. Material changes will be communicated in the app or by email when appropriate.