Privacy Policy

Leash Life is a shared app for looking after the animals in a household — dogs, cats, rabbits, birds, fish, reptiles and small pets, plus horses, cattle, goats, sheep, pigs, ducks and chickens. It is run by TribeApps LLC of Hampton, New Hampshire, USA. This page explains, in plain English, what we hold, who else can see it, and how to get it back or delete it.

The short version: your household’s data is private to your household. A few surfaces are public and every one of them is something you switch on deliberately.

What we store

• Your account: an email address and a PIN you choose. The PIN is stored hashed by our authentication provider — nobody at Leash Life can read it.
• Your household and its animals: names, species, breeds, birthdays, weights, photos, microchip numbers, allergies, medications, vaccination and weight history, vet contacts, quirks and care notes — whatever you enter.
• What you log: walks, rides, meals, water, meds, potty events, symptoms, grooming, chores, check-ins and free-text notes, each stamped with who logged it and when.
• Location, only while an outing is running: if you allow it, a GPS track is recorded for that walk or ride. We never ask for location before an outing actually starts. Separately, you may give a postcode — we keep the postcode’s town-level centroid, not your address, and it powers weather and nearby-hazard features.
• Photos and documents you upload, including veterinary records.
• People in your household: the names, roles and optional phone numbers of the family members, kids, sitters, walkers and barn helpers you invite.
• Operational records: which token links were opened and when (never by whom), bug reports you file, feedback you send, and basic error logs.

What is private, and what is public

Everything above is private to your household by default. These are the exceptions, and each one is a choice you make:

• The Pet Board and pet handles — opt-in. A pet you publish shows a first name, species, breed, photo and totals. Never a surname, a street address or a GPS route.
• Lost-pet alerts (BOLO) and collar-tag pages — when you mark an animal missing, the alert and the tag page are public on purpose, because reach is the point. They show the pet’s photo, first name, the contact numbers you chose, allergies and how to approach. They do not show your surname, your street address or your activity history.
• Community hazard pins — the pin and its type are public; the person who reported it is not named.
• Token links — health cards, sitter sheets, care codes, human cards and check-in pages are reachable by anyone holding the link. Each shows a deliberately narrow slice, is scoped in the database rather than merely hidden in the app, expires, and can be revoked by you at any time.
• Partner organisation pages — if a shelter, rescue or clinic publishes an animal, that listing is public. Their own team data is not.

Who else touches your data

We use a small number of processors, and none of them are advertising networks.

• Supabase — our database, authentication and file storage. Effectively everything you enter lives here.
• Vercel — serves the app and the website.
• Anthropic — only when you use the vet-record importer. The document you upload is sent to Anthropic’s API so the medications, vaccines and weights can be extracted for your review. That means a pet’s medical record leaves our systems for that request. Anthropic does not train models on API data. If you would rather that never happen, do not use the importer — every field it fills can be typed by hand. Anthropic’s commercial terms state that they do not train their models on API inputs; that is their commitment to us, and their policy governs it.
• Resend — sends our email (welcomes, reminders you asked for, replies to things you sent us).
• Google Maps — serves map tiles. Loading a map means Google sees the request and the area being viewed.
• OpenStreetMap (Nominatim) — turns an address you type into coordinates, for example a ride destination.
• Open-Meteo — walk weather. We send coordinates, never who you are.
• Petfinder — adoptable animals near an area you choose.
• Amazon — the shop uses affiliate links. Tapping one hands you to Amazon under Amazon’s own privacy policy.
• Stripe — if and when paid options exist. Stripe handles card details directly; we never see or store a card number.

De-identified data (from November 20, 2026)

From November 20, 2026, TribeApps may build and license de-identified data products from Leash Life — things like how often dogs of a breed are walked in a region, or how common a vaccine is by species. De-identified means the data cannot reasonably be linked to you, your household or your device. To get there we strip identifiers, aggregate so no household stands out, contractually forbid anyone who receives it from trying to re-identify it, and we commit publicly, here, not to re-identify it ourselves. This is not a sale of personal information, and we still do not sell personal information.

These are never included, whatever you choose:

• Anything you type — notes, messages, documents or any other free text.
• Photos.
• Precise GPS, or the route of any walk or ride. Location goes no finer than a broad region, such as a city or the first three digits of a ZIP code.
• Anything from a kid role or the chore chart.
• Contact information — names, email addresses, phone numbers and addresses.

Data collected before November 20, 2026 is included only if you opt in. You can leave your data out entirely at leashlife.app/privacy-choices — one switch, free, and it changes no feature. A Global Privacy Control signal from your browser counts as that opt-out. Opting out applies from the next data product we build; it cannot recall a de-identified set already delivered, which by design no longer points back to you.

Voice stays on your device

The microphone uses your device’s own speech recognition. Your voice is not streamed to us or to any cloud transcription service, and no recording is kept. What reaches us is the resulting command — the same row you would have created by tapping.

Children

Leash Life is for adults, and an account requires you to be 13 or older. A parent can create a kid role inside their own household for the chore chart. That role belongs to the parent’s account: it holds a display name and the chores done, it cannot open medical records or settings, and the parent can remove it at any moment. We do not knowingly collect personal information directly from children under 13. If you believe a child has created their own account, write to us and we will delete it.

Cookies and analytics

Essential storage first — what keeps you signed in and remembers your settings on that device. Any usage counting we do ourselves is aggregate: how many packs opened a screen, never a profile of you.

One optional exception, and only if you accept it in the cookie notice: when we run ads on Meta (Facebook and Instagram), the Meta Pixel may set a cookie on leashlife.app so Meta can count that an ad led to a visit or a sign-up. It receives the page you landed on and standard event names such as “registration completed” — never your pets, your log, or anything you type here. Decline in the notice and it never loads; you can also clear your browser’s site data to be asked again. Meta’s own handling of that cookie is covered by Meta’s privacy policy.

How long we keep things, and how to leave

Your data lives as long as your household does. From Settings you can export everything as CSV or JSON at any time, and deleting your household deletes what is in it — animals, events, photos, documents and shares — as a database-level cascade, not a hidden flag. Deleted content can persist for a short period in encrypted backups held by our hosting provider before those roll off. Some records we keep briefly for security and anti-abuse (for example rate-limit counters and error logs); those hold identifiers, not your pets’ histories.

Your rights

Wherever you live, you can ask us to show you what we hold, correct it, delete it, or hand it over in a portable file — and the app already does the last two without asking anyone. If you are in the EEA or UK, our lawful bases are performing the contract you signed up for, our legitimate interest in keeping the service safe, and your consent for location and the microphone (each revocable in your device settings at any time). If you are in California, we have not sold or shared personal information in the preceding 12 months as those terms are defined, and we do not sell it now. From November 20, 2026 we may license de-identified data as described above; at leashlife.app/privacy-choices you can keep your data out of it and tell us never to sell or share your personal information, and we will not discriminate against you for exercising any right. Write to theBigDog@leashlife.app and a human will answer.

Automated decisions

Leash Life predicts things — the next potty window, a walk-weather verdict, a health trend worth a second look. These are suggestions computed from your own logs, and none of them decides anything about you: no eligibility, no pricing, no access. You can ignore every one of them, and nothing in the app makes a legally significant decision about a person without a human involved.

If something goes wrong

If personal data is ever exposed in a way that puts you at risk, we will tell the affected households directly and without spin — what happened, what was reached, what we did — and notify regulators where the law requires it. We would rather send an uncomfortable email than have you find out from somebody else.

Do Not Track and Global Privacy Control

We do not track you across other websites, so a Do Not Track signal has nothing to switch off, and we do not sell personal information. We treat a Global Privacy Control signal as an opt-out of any sale or sharing and, from November 20, 2026, as an instruction to leave your data out of de-identified data products — exactly as if you had used leashlife.app/privacy-choices.

Security

Access is enforced in the database itself with row-level security, so a household’s data is unreachable by another household even if the app is wrong. Every build runs a test suite that proves those boundaries hold per role. Data is encrypted in transit and at rest. No system is perfect; if you find a hole, tell us and we will fix it and credit you.

International transfers

We are a US company and our processors are largely US-based, so using Leash Life means your data is processed in the United States.

Changes

If this policy changes materially we will date it here and tell you in the app before the change takes effect. We will not quietly widen what we do with data you have already given us.

Contact

Privacy questions or requests: theBigDog@leashlife.app.