Family names, member names, pets, schedules, and care history are stored on the studio's own server. Access is limited to members of your family. Share your invite code only with people you trust; the owner can replace the code and remove members.
Pet profile photos are optional. When you choose or take a photo, the app keeps a small cropped copy on your device and shares it with your family through the studio server. Other families cannot access it. Image metadata, including location tags, is removed. You can replace or remove a photo in the pet editor; deleting a pet also removes its profile photo from the current family data. Other devices receive that change when they reconnect. Restricted backups may retain earlier copies for recovery.
Feedback is optional. If you send feedback from Settings, the studio stores your message, app version, anonymous sign-in ID and submission time privately on its own server to respond to problems and improve the app. Feedback is not visible to family members or published publicly. Please leave out personal or sensitive information. Contact us to request deletion; restricted backups are retained for recovery.
Google Firebase provides anonymous sign-in and push delivery. The app does not use advertising or Google Analytics. Cloudflare handles the secure connection to the studio server. Notification text is generic; pet names and care notes are not displayed on your lock screen by server reminders.
Usage statistics are on by default. You can enable or disable them in Settings under “Help improve the app.” While this setting is enabled, the app sends screen names, foreground opens, reminder opens, app version, operating system, random session and event identifiers, and timestamps to the studio server. Your anonymous sign-in ID is transformed into a private pseudonymous identifier before storage. We do not include names, photos, care notes, messages, advertising IDs, location, or device fingerprints. Queued events are capped at 200 and expire after seven days. Turning this off clears queued events and stops further usage uploads; previously received events may remain for up to 90 days, subject to a fixed storage cap. Restricted backups may retain earlier data for recovery. Contact us to request deletion.
The server also counts requests, response codes and response times to keep the service reliable. These counters contain route templates, not identities, IP addresses, URLs or request bodies. Private founder reports summarise these counters, optional usage statistics and existing family care records. They are not accessible from the public app API.
Your installation keeps its sign-in on your device. Reinstalling or clearing the app can lose that identity. Keep another trusted family member connected. Contact us for help with access or a data deletion request.
Leaving a family on this device disables its reminders on this installation; it does not erase shared family history. Encrypted transport protects data in transit. Restricted server backups are kept for recovery, including off-device copies.
Contact: [email protected]
Updated 10 October 2026.