Privacy Policy

Effective 15 July 2026 · policy 2026-07-15.1 · disclosure 2026-07-14.3 · photo consent 5

What stays on your device

Pet profiles, questionnaire history, wellness baselines, reminders, locally kept photos, charts, and generated vet handoffs stay in PawTriage's protected local storage unless you deliberately share or export them. PawTriage does not upload your local history as part of a photo check.

Optional photo processing

Only after explicit, versioned consent, PawTriage sends the one prepared JPEG and its structured request through KeenShift and Vercel to Amazon Web Services (AWS). AWS receives the selected body area; limited dog-or-cat profile context such as species, breed hint, age, weight, and resting-breathing baseline when provided; questionnaire answers and context; on-device measurements; the local rule result; a random request identifier; and pseudonymous device, purchase, or session identifiers as available. Photo allowance uses one-way pseudonymous subject and global monthly counters. It does not use a source-IP photo bucket because Vercel can present shared proxy egress to API Gateway. Pet name, saved history, email, other local photos, and exported reports are not included.

OpenAI receives only the prepared JPEG plus PawTriage's fixed, non-personalized observation instructions. It does not receive the structured pet profile, body-area selection, questionnaire answers, on-device measurements, local rule result, request identifier, pseudonymous identifiers, source IP, saved history, or email. The returned content is limited to visible observations, uncertainty, limitations, and watch-for signs. It does not produce conditions, likelihoods, percentages, diagnosis, treatment, or a new urgency result.

PawTriage does not put the JPEG or raw request into its database or object storage and does not intentionally write request bodies to application logs. AWS application logs contain route, status, request identifier, timing, and build metadata only and expire after 30 days. Vercel performs TLS routing and may process request/security metadata; PawTriage does not configure it to store request bodies. OpenAI may retain API inputs and outputs for abuse monitoring for up to 30 days under its API data policy, unless the production account is granted stricter retention.

Usage and abuse controls

A temporary photo-capacity reservation logically expires after 10 minutes and is released immediately when provider work does not complete. A completed provider inference increments the common photo-use counters, including a bounded low-quality or no-signal response because the provider work occurred; Free and Pro use the same ceiling. The response tells the app explicitly whether that allowance was consumed. One-way subject and global monthly counters expire 45 days after the end of their month. A sanitized observation response, never the photo or raw answers, is held for 24 hours so an interrupted retry with the same request identifier does not buy or run the same analysis twice. The same 24-hour idempotency record stores a one-way SHA-256 fingerprint of the full structured request, including the prepared JPEG and answers, solely to reject reuse of that request identifier with different input; it does not store or reconstruct the raw request. The record key is also a one-way hash of the pseudonymous subject and request identifier. DynamoDB may physically remove an expired item later; expired data is no longer used by the app while deletion completes.

Purchases and optional Sign in with Apple

Apple handles payment-card details; PawTriage never receives them. To verify, restore, refund, revoke, and prevent replay, PawTriage stores Apple's signed transaction identifier, original-transaction identifier, product, expiry/revocation state, environment, a random appAccountToken, and purchase-token aliases. Purchase and entitlement records expire after seven years. App Store Server Notification replay records expire after 400 days.

Sign in with Apple is optional. If used, PawTriage stores a one-way Apple subject hash, a random stable user identifier, the entitlement link, and an encrypted Apple refresh token. The record expires after two inactive years. User sessions expire after 30 days; anonymous entitlement sessions expire after 180 days. PawTriage does not store the Apple name or email returned during sign-in.

Support

The in-app support form stores the email address, message, request identifier, and creation time for 90 days. To limit support-form abuse without grouping unrelated people behind Vercel, it keeps one-way hashes derived from the stable signed-in user identifier or app-generated pseudonymous device UUID and the lowercased email address in hourly counters for no more than two hours. A separate global hourly circuit-breaker counter contains no user, device, or email identifier. None of these counters contains the message. Source IP is not used for support throttling because Vercel may present shared proxy egress to API Gateway. Signed-in support messages are deleted with the optional account. Guest support messages expire after 90 days and can be removed sooner by emailing support with the request identifier.

Delete or withdraw

Turning off AI processing stops every future photo transmission until a new explicit consent. Deleting the optional account first creates a write fence, then revokes the stored Sign in with Apple authorization and deletes the server profile, encrypted refresh token, and signed-in support messages. A minimal deletion receipt containing only the one-way account partition key, the random deletion request identifier, completion times, and expiry remains for 30 days so an interrupted retry can confirm deletion without recreating account data; it contains no Apple subject, refresh token, entitlement identity, email, message, or pet health data. The app deletes local session and health data separately on device. Apple purchase/entitlement records, notification replay protection, and already-expiring one-way usage counters are retained for restore, refund, fraud prevention, accounting, and legal obligations until the exact periods above; they are not used for advertising or tracking.

Processors and rights

KeenShift operates PawTriage; Vercel provides edge routing; AWS provides compute, logs, secrets, and database services; OpenAI processes the optional image request. They receive only the data needed for the requested service and security. PawTriage does not sell data, build advertising profiles, or permit cross-company tracking. Questions and deletion requests: support@keenshift.ai.