1. What we collect
Account information includes your name, email, sign-in method, account status, login timestamps, and policy acceptance records. Passwords are stored as bcrypt hashes. Google sign-in can create linked account records containing provider identifiers and tokens.
Pet profiles can contain photos, names, breed, color, notes, medical or behavior notes, emergency phone/email/WhatsApp, Lost Mode information, last-seen area, and reward text. Do not put private information about people in public pet notes or photos.
Tag scans record a timestamp, user-agent string, and a truncated hash of the supplied IP header. A finder who shares location submits coordinates, accuracy, an optional note, and a device fingerprint derived from browser/device attributes. These identifiers are not guaranteed anonymous.
We also store owner notifications, moderation reports and administrative audit records. Deletion requests record identity verification, request status, and processing evidence.
2. Why the service uses this information
Information supports account access and recovery, pet identification, owner management, Lost Mode contact, scan history, location sightings, notifications, abuse prevention, moderation, and data-rights handling.
Acceptance of the Terms is separate from consent to optional processing. Browser permission to obtain location is not a blanket permission for other uses. The applicable legal basis for each processing purpose requires owner/legal confirmation. No marketing subscription or external analytics SDK is implemented in the application.
3. Public profiles and location sharing
Anyone with a public pet link can view its eligible profile, photo, and published notes. Lost Mode makes the configured emergency contacts available to finders. Turning Lost Mode off removes those contacts from the public profile response; it cannot recall information someone already copied.
Location sharing is optional. The location and note are sent to the pet owner’s dashboard and may be emailed to the configured pet contact address. Authorized administrators can access platform records. A Google Maps link contains coordinates; opening it shares the request with Google.
5. Cookies and browser storage
Auth.js uses cookies for sign-in sessions, callback destinations, and authentication protections. Names can include authjs.session-token, authjs.callback-url and authjs.csrf-token, with secure prefixes on HTTPS. Provider flows can use short-lived state and PKCE cookies. Exact deployed names and expiry depend on the running configuration.
The functional localStorage preference fmp-lang remembers English or Bengali until you change it or clear browser storage. Supabase’s browser client has session persistence enabled by default; its actual storage use depends on the browser session. The application does not explicitly use sessionStorage or load analytics/advertising scripts.
A short-lived, HTTP-only cookie is used when you choose Google identity verification for a deletion request. It connects the verification to your account and is consumed or expires. No new non-essential tracker or general cookie banner is introduced by this upgrade. Any applicable consent requirement still needs confirmation for the actual deployment.
6. Retention and deletion limits
No general retention schedule or automatic expiry job is configured for account, scan, sighting, notification, moderation, or audit data. Some operations remove records: deleting a pet removes related database records; marking a pet found from the dashboard clears its sightings and sighting notifications. Saving Lost Mode off in the editor does not currently perform the same cleanup.
Database deletion does not automatically remove public storage photos, verification-token records, sent email, logs, backups, or copies held by recipients. Reports and audit relations also need review. Required retention, backup expiry, processor erasure, and the minimal evidence retained for a rights request must be confirmed before a request can be described as fully fulfilled.
7. Security and access
The application uses hashed passwords, server-side account/ownership checks, role-based administration, and hashed recovery tokens. Sensitive data-rights actions recheck the account and permissions against the database and require fresh identity verification.
These measures reduce risk but do not guarantee security. Infrastructure encryption, storage policies, backup controls, and universal session revocation have not been verified by this notice. Do not share passwords or sign-in/recovery tokens in a request.
8. Your choices and data rights
You can update your name, password, pet details and emergency contacts in your account. You can choose whether to activate Lost Mode or submit a finder location. You can change the language preference or remove local browser storage.
Signed-in users can submit and track a verified deletion request under Account settings → Your data rights. Only an authorized admin can carry out account deletion. Submission is a request, not confirmation of deletion. A receipt code allows minimal status tracking after an account is removed. Processing may need review of legal retention and external copies.
Access, correction, objection, restriction, portability, withdrawal, and complaint rights depend on applicable law and processing basis. A privacy contact and a verified procedure for people without an account, including finders, still require owner confirmation. Do not submit someone else’s personal records as proof of identity.
9. Contact and policy changes
Owner/legal confirmation needed: the operator’s legal identity, privacy contact address, non-account request channel, and applicable supervisory authority. No contact address or response deadline has been invented.
This policy and the Terms have separate version identifiers. The application records the Terms version accepted and the Privacy Policy version presented. Policy changes do not fabricate acceptance for existing accounts.