Privacy policy

1. Information we process and why

• Account: your email, authentication user ID and chosen handle, for sign-in, identification, permissions, important notices and support. Sign in with Apple provides an Apple user identifier and email address, which may be an Apple relay address if you choose Hide My Email.
• Animal information: names, species, sex, hatch dates, morphs and traits, source notes and photos, for animal cards, photo timelines and basic details.
• Relationships and history: parent–offspring links, confirmations and disputes, keeper periods, transfer and confirmation request senders and handlers, and timestamps, for relationship history, attribution and permission transfers.
• Care records: feeding outcomes, observations, record times, weights and measurement conditions, care schedules and reminder times, for timelines, charts and your chosen schedules.
• Authentication security: encrypted Apple refresh tokens and a credential identifier, used only to revoke the Apple connection when an account is deleted. Tokens and their account binding are erased after successful revocation; failed revocations remain encrypted for retry.
• Operational access logs: hosting, authentication and email providers process IP addresses, request times, URLs, device/browser information and response times for service delivery, abuse prevention and incident diagnosis. Supabase access logs may include country, region and city inferred from an IP address and the signed-in account identifier. This is not GPS location and is not used for advertising tracking or personalized ads. Provider retention is described below.
• On-device information: sign-in sessions, recent animal caches, display copies of photos, unsynced records, notification permissions and local notification identifiers, for secure sessions, offline recording and local reminders.

We receive your email when you request a sign-in link or use Sign in with Apple. You enter handles, animal details and care records yourself. We request only email, not your name, from Apple. Photos are accessed only when you choose to take or select a photo. We do not collect your address book or an invite recipient’s phone number or messaging ID.

We process account information and core records to provide the service you request and perform our agreement with you. Optional photos, reminders and visibility features operate only when you use or enable them. Where separate consent is required, we explain the information, purpose, retention period and consequences of refusing before requesting that consent.

2. Photos and reminders

• The server applies photo orientation, reduces image size and removes EXIF metadata, including GPS location, before saving an uploaded photo.
• Private photos use permission-checked URLs that expire within five minutes. The app keeps display copies on your device to avoid repeated downloads and clears them when you sign out, change accounts or transfer an animal.
• When you create a share card, the server renders the cover photo, name, species, morph and a summary of saved records and sends the image to your device. The generated image is not separately stored on the server. You choose its recipients using your device’s share sheet.
• Care reminders are local notifications scheduled on your device. Dogam does not create or collect remote push tokens or send server-side marketing notifications.

3. What other people can see

By default, animal records are visible only to the current keeper and authorized collaborators. Selected information becomes visible within Dogam only when the current keeper enables visibility or approves a viewer. Confirmation of a parent–offspring link does not automatically disclose the animal’s full care history.

Accepting a transfer can carry the same animal card’s records, timestamps and relationship history to the new keeper. Previous visibility and collaboration permissions and personal reminders end, and the new keeper starts with private defaults. You send invitations through your own share sheet; we do not send text messages or DMs to invite recipients.

We do not sell personal information or provide it to third parties for independent purposes beyond the visibility, viewing and transfers you request. Only selected information is shown to approved viewers, transfer recipients or signed-in Dogam users permitted by your settings. Access ends when the permission ends, including after revocation, transfer or account deletion.

4. Retention and deletion

• Recovery backups: we may create access-restricted, encrypted copies of accounts, database records and photos for recovery from failures. We delete these copies within seven days of creation and do not use them for routine service access. Before restoring a copy, we check deletion history to avoid making deleted information available again. We do not restore a copy when that check cannot be completed.
• Account and profile: until account deletion is completed.
• Animals, photos, lineage, keeper history and care records: until you delete them or account deletion is processed. Personal information associated with the account is removed after deletion is confirmed.
• On-device caches, unsynced records and notifications: until sign-out, account change, disabling the relevant feature or uninstalling the app, as applicable.
• Deletion processing identifiers: only while safely retrying partial failures across file storage, authentication and database records. In normal processing, the account UUID is anonymized after data deletion, a five-minute safety delay and a final storage recheck. Retry jobs run every five minutes; the operator investigates persistent errors without undue delay.
• Web session and theme information: for the relevant session or feature. Browser language and time-zone preference cookies last up to one year and can be cleared in browser settings. Temporary invitation information expires after 30 minutes.

We delete personal information when its retention purpose ends. If a legal retention obligation arises, we identify the information, legal basis and period and separate it from other information. The service currently specifies no additional statutory retention category.

5. Service providers and international processing

Dogam uses the providers below for authentication, storage, the website/API and sign-in emails. The primary server processing and storage country is the United States. Necessary information is transmitted over encrypted connections when you sign up, sign in, upload or use the service.

These providers process and store information needed to deliver the service you request. To stop using the service or request an end to processing, request account deletion or email our privacy contact. Refusing processing needed for authentication or storage may prevent account-based service. Content delivery networks and provider subprocessors may handle requests, support and security in other locations listed in their disclosures below. We give notice before changing providers, primary regions or purposes and obtain separate consent first where required.

6. Advertising and tracking

Dogam has no advertising SDK, third-party behavioral analytics SDK or advertising-identifier tracking. We do not sell accounts, photos or animal records or use them for advertising across apps and websites. We do not track users across third-party websites, whether or not the browser sends a Do Not Track signal, and do not change this practice in response to that signal. If our processing changes, we will update this policy and the store’s privacy disclosures before the change takes effect.

7. Your rights

You may request access, correction, deletion, restriction of processing, withdrawal of consent or account deletion. Use the privacy and account menus or the account deletion page linked below. We verify your identity using the minimum necessary information, such as your account email, and respond without undue delay. Do not send passwords, national identification numbers or full copies of identity documents.

If you cannot sign in, use the email deletion instructions below. A request may be limited where necessary to protect another person’s rights or comply with law; we will explain the reason.

8. Children under 14

Dogam is not intended for children under 14 and does not provide a guardian-consent verification process. Children under 14 may not create an account or use the service. Contact us if you learn that we have processed a child’s information without appropriate consent.

9. Security measures

We apply measures appropriate to the service’s scale and risks, including encrypted transmission, separated permissions, database row-level access controls, separation of sensitive server keys from clients, private storage, short-lived photo URLs and secure device storage.

10. Policy changes

We notify you in the service or at your registered email before important changes, such as changes to the information we process or its purposes. Corrections that do not adversely affect your rights may be announced by updating the effective date on this page.

11. Privacy contact

Privacy contact: Wayne Kim, independent developer of Dogam. Email: kjs140611@gmail.com. You may also contact the relevant privacy authority, including Korea’s Personal Information Infringement Report Center (118 within Korea) or Personal Information Dispute Mediation Committee.