Privacy

Who we are

PetPilot is operated from Copenhagen, Denmark. For anything on this page, write to hello@petpilot.io.

What we hold

Only what the app needs to be the thing it is:

• Account. Your email address, your name if you give one, and a password hash.
• Pets. Name, species, breed, gender, date of birth, microchip number, EU passport number and the profile photo you upload.
• The record. Walks and their routes, weights, medications and doses, health and grooming entries, calendar events, documents you scan or upload, expenses, and travel declarations you file.
• Mail sent to your PetPilot address. If you use the inbox address, the messages sent to it and their attachments.
• Sharing. Who you invited to a pet, in which role, and whether they accepted.

We do not build a profile of you, and we do not sell or share anything with data brokers.

What never leaves your phone

• Photo identity matching. Finding photos of your pet in your camera roll runs entirely on the device, using the machine-learning models your phone already has. Spotting the animal, deciding whether it is yours, and grouping the look-alikes all happen locally.
• The photo index. The record of what has been scanned, and every thumbs-up or thumbs-down you give a match, stays on the device.
• AI photo matches. A match is stored as a pointer into your own camera roll. The image itself is not uploaded and not copied to a server.
• Walk detection. Detection and recording happen natively on the phone. Only the finished walk — its route, distance and duration — is uploaded.
• Biometric sign-in. Handled by your phone's own secure hardware, never stored by the app.

What reaches a server, and when

Only if you say yes

• The photo cloud double-check. The first scan asks once, and the answer is on-device only or allow cloud check. With it on, a small number of borderline candidate crops are sent for a second opinion, composited with your pet's profile photo. With it off, no crop ever leaves the device. You can change the answer from the album at any time.
• Reference photos for a shared pet. Only while the cloud check is on, up to five high-confidence reference photos of a shared pet are hosted so a co-owner's scan can recognise the same animal. This is the one deliberate cross-account image surface in the product; every other photo row is scoped to a single account.

Because that is what the feature is

• Bills you forward to your PetPilot address are read to extract the vendor, total, currency and date.
• The weekly care tip is generated per pet from its species, breed and age.
• Looking up a microchip number inside a document you uploaded reads that document.

Where that processing happens, it runs inside our own service rather than being passed out to a separate AI company, and none of it is used to train anyone's models.

Where it is stored

Your account, your pets and their records are held on managed cloud infrastructure operated on our behalf under a data-processing agreement. No photo or document is ever reachable from a public link: every file is served through a request that re-checks your access, and nothing is cached where someone else could reach it.

Security

• Passwords are only ever stored hashed and salted — never in a readable form.
• Sign-in sessions expire, and you can end them all by changing your password.
• Changing your password signs you out everywhere else instantly — including any device where biometric sign-in was enabled — while keeping you signed in on the device you changed it from.
• One account can never read another account's data; that boundary is enforced on the server.

Phone permissions

Nothing is requested speculatively — each prompt appears at the moment the feature needs it. Signing out actively tears down geofence monitoring and beacon ranging, so the phone stops sensing for an account that is no longer there.

Who else can see your pet

Only the people you invite. A caretaker sees the profile, weights, walks, medications and dose history, the health and care log, and documents — and can log walks, doses and health events. They cannot change documents, the tag, or any owner setting, and they do not get the pet's photo album or your calendar. A co-owner has full parity with you, except that only the pet's creator can delete it. You can revoke either at any time from the pet's sharing card.

Your rights

If you are in the EU or UK, the GDPR applies: you can ask for access, correction, erasure, restriction, portability, or object to processing. In practice most of it is already in your hands — you can edit or delete any pet, walk, dose, document or expense from the app, and export the medication log as CSV. For a full export or a full account deletion, mail hello@petpilot.io and it will be handled within 30 days. Deleting your account removes your pets and everything attached to them, including the stored files.

Children

PetPilot is not directed at children under 13, and we do not knowingly collect their data.

Changes

If this page changes in a way that matters, the date at the top changes with it and you will be told in the app before it takes effect.