This policy explains what data the Nose Boss app collects, why, who it is shared with, how long it is kept and how you can control it. The controller of personal data is FOP Khatsynskyi Rostyslav Olehovych (sole proprietor), Ukraine. Send questions about your data to noseboss.app@gmail.com.
What data we store
- Account: the email you sign in with and the dates you accepted the terms. If you sign in with Google, also your name and Google account identifier. If you sign in with Apple, the identifier Apple issues for Nose Boss and the email Apple passes on (it may be a hidden Apple relay address), as well as an Apple service token needed to revoke Sign in with Apple when you delete your account. We store no passwords: you sign in with a code from an email, with Google or with Apple.
- Owner profile: your name, phone, country, city, address and a photo of yourself — only if you add them in your profile yourself. All of them are optional, and you can change or clear them at any time. The photo is stored the same way as pet photos: the app shows the latest one, and earlier photos (yours and your pets') stay in storage until they are deleted with your account.
- Pet data: name, species, breed, date of birth, sex, neutering, allergies, chronic conditions, weight, photo, notes — whatever you enter yourself.
- Documents: photos and PDFs of prescriptions, lab results, discharge summaries and vaccination records you upload, and the text recognised from them. Documents may contain personal data — your name, phone or address as the owner, the vet's name, the clinic's name. They are stored as part of the document and used only to run the app.
- Treatment and care: courses, doses, your "given / skipped" marks, feeding schedules, follow-up visits, vaccinations and parasite treatments.
- Technical data: a push notification token, time zone, crash reports and de-identified usage events (for example, "pet added"). Reports and events contain no document content, recognised text, pet names or email.
Reminders are scheduled on the phone itself. The app does not collect location, contacts or advertising identifiers, shows no ads and does not record your screen.
Why and on what legal basis
- To run the app — to keep your pet's health history, recognise prescriptions from documents, build the medicine schedule and remind you of it. Legal basis: our contract with you (the terms of use and the Public Offer) and your consent to the processing of personal data.
- To find and fix bugs and understand which features are useful — crash reports and de-identified statistics. Legal basis: our legitimate interest in keeping the app reliable; this data does not reveal the content of your records.
- To comply with the law — for example, to respond to lawful requests from public authorities.
We do not sell data, share it with advertisers or use it for advertising.
Who receives the data
Only providers the app cannot work without, and only as much as they need:
- App server — a VPS in Kyiv, Ukraine (ukraine.com.ua): the database with accounts, pets and records.
- Cloudflare R2 (storage in the EU): original documents, pet photos and database backups.
- Anthropic (USA): when you upload a document, its image or text is sent for recognition. Anthropic does not use this data to train models and deletes it within the periods set by its API terms (usually up to 30 days).
- Resend (USA): sends the email with your sign-in code.
- Google: sign-in with a Google account, if you choose it.
- Apple: Sign in with Apple, if you choose it.
- Expo, Google Firebase Cloud Messaging and Apple Push Notification service (USA): deliver push notifications to your phone — only the notification text, for example "Document recognised".
- Sentry (crash reports, EU) and PostHog (de-identified statistics, EU): with no document content, recognised text, pet names or email.
Where a provider is located outside Ukraine and the EU (USA), the transfer takes place on terms that ensure adequate data protection, in particular the EU Standard Contractual Clauses.
Only you see your documents and records. We do not look at them in normal operation and access specific data only to fix a problem you reported or where the law requires it.
How we protect data
The app talks to the server only over an encrypted connection (HTTPS). Original documents are kept in encrypted storage and are never overwritten. Server access is key-only, and server logs contain no document content or email.
How long data is kept
- For as long as your account exists.
- After you request deletion, your account, pets, records and all documents are deleted after 7 days — during that time you can cancel the deletion by signing in again. If you signed in with Apple, we revoke Nose Boss’s access to your Apple ID when you request deletion; you can sign in with Apple again, and Apple will ask for your consent anew.
- You can delete a single document for good at any time: its original files, the recognised text and everything created from it (medication courses with their dose marks, follow-up controls, vaccinations and treatments, the history entry) are deleted. You can likewise delete a pet with all its data (documents, courses, weights, feedings, history), after a warning.
- Data (including that of documents and pets you deleted) may remain in database backups for up to 14 more days, after which the backups are destroyed.
- Crash reports are kept for up to 90 days, de-identified usage statistics for up to 1 year. When you delete your account, your PostHog statistics are deleted with it.
- After an account is deleted, only service records without your name, email or document contents remain: an action log (which action, when, internal identifiers — for security and handling requests) and recognition spend records (token counts and cost — for accounting and budget control). They are not linked to any other data of yours, because that data has been deleted.
Your rights
- Get a copy of your data: Profile → "Вивантажити мої дані" (export my data) — a ZIP archive with all records and original documents.
- Correct: pet data and records can be edited in the app; a confirmed document can be edited too.
- Delete: a single document or a pet with all its data — in the app; your whole account — Profile → "Видалити акаунт" (delete account), or without the app.
- Restrict or object to processing, including the collection of statistics — by email to the address above.
- Lodge a complaint with the Ukrainian Parliament Commissioner for Human Rights or the data protection authority of the country where you live.
We reply to data requests within 30 days.
Children
The app is not intended for people under 16, and we do not knowingly collect their data.
Changes
The app will notify you of material changes to this policy and ask you to accept the new version. The date of the current version is at the top of this page.