Privacy Policy
Version of 19 September 2026
This is a translation. In case of any discrepancy, the Ukrainian version prevails.
This policy explains what data the Nose Boss app collects, why, who it is shared with, how long it is kept and how you can control it. The controller of personal data is FOP Khatsynskyi Rostyslav Olehovych (sole proprietor), Ukraine. Send questions about your data to noseboss.app@gmail.com.
What data we store
- Account: the email you sign in with and the dates you accepted the terms. If you sign in with Google, also your name and Google account identifier. We store no passwords: you sign in with a code from an email or with Google.
- Pet data: name, species, breed, date of birth, sex, neutering, allergies, chronic conditions, weight, photo, notes — whatever you enter yourself.
- Documents: photos and PDFs of prescriptions, lab results, discharge summaries and vaccination records you upload, and the text recognised from them. Documents may contain personal data — your name, phone or address as the owner, the vet's name, the clinic's name. They are stored as part of the document and used only to run the app.
- Treatment and care: courses, doses, your "given / skipped" marks, feeding schedules, follow-up visits, vaccinations and parasite treatments.
- Technical data: a push notification token, time zone, crash reports and de-identified usage events (for example, "pet added"). Reports and events contain no document content, recognised text, pet names or email.
Reminders are scheduled on the phone itself. The app does not collect location, contacts or advertising identifiers, shows no ads and does not record your screen.
Why and on what legal basis
- To run the app — to keep your pet's health history, recognise prescriptions from documents, build the medicine schedule and remind you of it. Legal basis: our contract with you (the terms of use).
- To find and fix bugs and understand which features are useful — crash reports and de-identified statistics. Legal basis: our legitimate interest in keeping the app reliable; this data does not reveal the content of your records.
- To comply with the law — for example, to respond to lawful requests from public authorities.
We do not sell data, share it with advertisers or use it for advertising.
Who receives the data
Only providers the app cannot work without, and only as much as they need:
- App server — a VPS in Kyiv, Ukraine (ukraine.com.ua): the database with accounts, pets and records.
- Cloudflare R2 (storage in the EU): original documents, pet photos and database backups.
- Anthropic (USA): when you upload a document, its image or text is sent for recognition. Anthropic does not use this data to train models and deletes it within the periods set by its API terms (usually up to 30 days).
- Resend (USA): sends the email with your sign-in code.
- Google: sign-in with a Google account, if you choose it.
- Expo and Google Firebase Cloud Messaging (USA): deliver push notifications to your phone — only the notification text, for example "Document recognised".
- Sentry (crash reports, EU) and PostHog (de-identified statistics, EU): with no document content, recognised text, pet names or email.
Where a provider is located outside Ukraine and the EU (USA), the transfer takes place on terms that ensure adequate data protection, in particular the EU Standard Contractual Clauses.
Only you see your documents and records. We do not look at them in normal operation and access specific data only to fix a problem you reported or where the law requires it.
How we protect data
The app talks to the server only over an encrypted connection (HTTPS). Original documents are kept in encrypted storage and are never overwritten. Server access is key-only, and server logs contain no document content or email.
How long data is kept
- For as long as your account exists.
- After you request deletion, your account, pets, records and all documents are deleted after 7 days — during that time you can cancel the deletion by signing in again.
- Data may remain in database backups for up to 14 more days, after which the backups are destroyed.
- Crash reports are kept for up to 90 days, de-identified usage statistics for up to 1 year.
Your rights
- Get a copy of your data: Profile → "Вивантажити мої дані" (export my data) — a ZIP archive with all records and original documents.
- Correct: pet data and records can be edited in the app.
- Delete: Profile → "Видалити акаунт" (delete account), or without the app.
- Restrict or object to processing, including the collection of statistics — by email to the address above.
- Lodge a complaint with the Ukrainian Parliament Commissioner for Human Rights or the data protection authority of the country where you live.
We reply to data requests within 30 days.
Children
The app is not intended for people under 16, and we do not knowingly collect their data.
Changes
The app will notify you of material changes to this policy and ask you to accept the new version. The date of the current version is at the top of this page.