Privacy Policy

1 · Who is responsible for your data

Sniff-it is a brand, part of the wider HappyPetSpace family of products for pet owners. The controller of the personal data described here is Happy Pet Space EOOD, UIC 207799797, ul. Han Asparuh 54, fl. 1, office 1, Sredets, Sofia 1000, Bulgaria.

Write to us at support@sniff-it.app about anything on this page.

2 · The short version

If you read nothing else, read this.

• —Your pet is public. You are not. Their page, their photos, their name — not yours.
• —If you list your pet, the feed shows their town, and that is usually your town.
• —Your email address is your account. There are no passwords.
• —Everything lives in the EU, except the website’s visit counts.
• —You can take it all back, in a few taps, from the app.
• —We do not sell your data, to anyone, ever, and we do not run advertising.

3 · What we collect

When you create an account: your email address, and your first and last name if the way you signed in gave them to us. Later, in the app: your handle, the town you live in and its country, your language, a photo of you, and anything you write about yourself. When you add a pet: their name, species, breed, date of birth, sex and photographs; whether they are listed and searchable; whether you are open to breeding, playdates or rehoming, if you say so; and the town they live in, if you set one for them. When you turn on lost mode: the contact details you choose to publish, where they were last seen, and a reward if you offer one. When you use the app: who you connected with and the messages you sent them, what you reported, and how many times your pet’s public page has been scanned.

Automatically, we collect the basic technical information needed to run and protect the service — your device type and app version, and your IP address, which we use to apply rate limits and to detect abuse. We use no advertising trackers and no cross-site tracking, and our websites set no tracking cookies. They keep two small things on your device: a cookie that remembers your language for a year, and a note that you have already seen the welcome pop-up on sniff-it.app, so it does not open again. That note stays until you clear your browser’s data. Neither identifies you. We count visits to sniff-it.app with Vercel Web Analytics, which uses no cookies. It records the page, the site that sent you, your approximate location down to the city, and your type of device and browser. It tells visits apart with a code calculated from your connection, including your IP address, and the code is discarded after 24 hours. We see only totals.

4 · Why we use it, and on what legal basis

Different things, different reasons, and the reason is what decides what you can ask us to stop.

• —Your account and profile, your pet’s profile and photos, their public page — to provide the service you signed up for. Basis: contract, Art 6(1)(b). Discovery does not work without a profile to discover.
• —Listing your pet in the feed and allowing search engines to index their page — so people nearby can find them. You choose this, per pet, and can change it at any time.
• —Lost mode publishing your contact details — so a finder can reach you. It only happens when you switch it on.
• —Sending you a welcome email and lost-mode alerts — making the service work. There is no marketing email in this version.
• —Rate limiting, abuse detection, moderating reports, keeping the service secure — protecting users and the service. Basis: legitimate interests, Art 6(1)(f).
• —Product analytics, in aggregate — understanding what works so we can fix what does not. Basis: legitimate interests.
• —Keeping a record of what you accepted, and when — demonstrating we did this lawfully. Basis: legal obligation, Art 5(2).

We do not use consent as the basis for the core service, and that is deliberate. Consent has to be freely given and freely withdrawn. If you withdrew it, we would have to keep processing anyway — the service cannot run otherwise — and a basis that cannot be honoured when withdrawn was never really consent. Where consent genuinely is the basis, we say so and it is genuinely refusable.

5 · What becomes public

Your pet’s page — their name, photos and breed — is visible to anyone with the link. That is what the QR code resolves to, and it is the reason the product exists. If you have them listed, that page also appears in the feed and can be indexed by search engines, and anyone browsing the feed also sees their age range and their town. You cannot hide those two. Their town is the one on your profile, unless you set one for them. Anyone signed in to Sniff-it who opens your pet’s profile also sees their sex, date of birth and town. In lost mode, the contact details you chose are published on their page until you turn it off.

You are not public. Your name, email address and photo are never published on the web and never indexed, and your email address is never shown to anyone. Inside the app, anyone signed in can open your profile and see your first and last name, photo, handle, town, what you wrote about yourself and your pets.

6 · Who else sees it

Other people using Sniff-it, as described above. Companies that run parts of the service for us, listed in the next section — they act on our instructions under a data processing agreement, and none of them may use your data for their own purposes. The authorities, where the law requires it, or to protect someone from serious harm.

Nobody else. We do not sell personal data and we do not share it for advertising.

7 · Where your data is, and who processes it

Your data is stored in the European Union.

• —Supabase — sign-in and sessions. EU, Frankfurt.
• —Neon — the main database. EU.
• —Cloudflare R2 — photographs. EU.
• —Upstash — caching and queues. EU.
• —Render — runs the API. EU.
• —Vercel — runs the website and counts its visits. EU, though static delivery is global; visit counting is processed outside the EU.
• —Resend — sends the emails. EU.
• —PostHog — product analytics. EU.
• —Sentry — error reporting. Region to be confirmed.

Where a supplier’s support or infrastructure reaches outside the EU, that transfer is covered by the European Commission’s standard contractual clauses.

8 · How long we keep it

While your account is open, we keep it. When you delete your account, your pet’s page goes dark immediately and your sessions are ended. Thirty days later we destroy the personal data — photographs are deleted, and your name, contact details, town, country and what you wrote about yourself are erased, along with any town set for your pets. What remains is an anonymous skeleton with nothing in it that identifies you, which we keep so the system stays consistent. Signing in during those thirty days cancels the deletion, and we tell you it has been cancelled rather than quietly restoring it.

A profile created on the pre-launch site and never claimed is deleted 12 months after it was confirmed, and we write to you before that happens. The record of what you accepted survives the erasure, without your name attached — it is the evidence that we did this lawfully, and deleting it would defeat its purpose.

9 · Your rights

You can see your data, correct it, delete it, take it with you in a machine-readable file, restrict or object to how we use it, and withdraw consent where consent is the basis.

Most of it you can do yourself, in the app, without asking us — that is deliberate. For anything else, write to support@sniff-it.app, and we will answer within one month. If you think we have got it wrong, you can complain to a data protection authority — in Bulgaria, the Commission for Personal Data Protection; in Ukraine, the Verkhovna Rada Commissioner for Human Rights; or the authority where you live.

10 · Children

Sniff-it is not for children under 16. [Age to confirm.] If we learn that an account belongs to someone younger, we close it and delete the data.

11 · Decisions made about you

No automated decision-making, and no profiling that has legal or similarly significant effects. The feed shows pets in your country, narrowed by species, breed or what you are looking for if you choose. It orders them by facts about the pets: how recently their profile was updated, whether they share a breed with your pet, and how many photos they have. It does not score you.

12 · How we protect it

Everything travels encrypted. There are no passwords to steal — sign-in is a one-time code or Google or Apple, and the session token is held in your device’s secure storage. Access to production data is limited to those who need it.

13 · Changes to this policy

If we change it in a way that matters, we will show you what changed the next time you sign in, and record that we did. We do not swap it silently — that is the whole reason each version has a name.