Privacy
Paw Carnet keeps as little as it can, and this page says exactly what that is.
Last updated .
The short version
- No ads, no data sale, no ad trackers.
- The vaccine schedules, travel tables, care guides and emergency page work without an account, and what you type into them stays on your device.
- If you save a pet, we keep what you enter until you delete it, in AWS Frankfurt.
- Nothing you enter is sent to an AI provider.
Who is responsible
Paw Carnet is published by Vitaly Bibikov, an individual, who is the controller of the information described on this site and decides how it is used. Write to support@pawcarnet.com for anything about your pets' records or your account.
Write to support@pawcarnet.com about anything on this page.
What never leaves your device
- What you type into the vaccination schedules and the travel tables, and the dates they work out.
- A plan you have not saved.
- Calendar (.ics) files and printed pages: they are made on your device.
If you sign in
With Google
You sign in with Google. We ask Google for openid, email, profile. Google tells us your verified e-mail address, an identifier for your Google account, the name on your Google account and a link to your profile picture.
We keep your verified e-mail address, a nickname if you choose one and a one-way hash of your Google account identifier. We do not keep the name on your Google account: our sign-in step stores it with a new account for a moment, and Paw Carnet erases it the first time you open your pets or your settings. Earlier copies leave our backups within 35 days. We do not keep your profile picture.
Google learns that you signed in to Paw Carnet. What Google does with that is covered by Google's own privacy policy. No Google script runs on our pages: sign-in is a redirect to Google and back.
Paw Carnet's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
With a link we e-mail you
You can also ask for a sign-in link by e-mail. We keep the address you typed and a one-way hash of it, which identifies your account. The link works once, for 15 minutes, in the browser that asked for it.
While the link waits, your address sits in a pending sign-in record. That record stops working after 15 minutes and our database removes it within about 2 days. To stop abuse we count link requests per address and per network for up to 2 days, using one-way hashes, never the address itself.
An account made with Google and an account made with an e-mailed link are separate accounts, even when the e-mail address is the same.
Your pets' records
Your pets' records — the details you type, vaccinations, weights and your reminder settings — are kept in our database in AWS Frankfurt until you delete them.
- Household settings: your country, time zone, units and date format.
- Each pet: species, breed, name, sex, whether neutered, and a birth date or an estimate.
- Vaccinations you type: the vaccine, product, batch number, date, valid-until date and clinic.
- Weights you log, and the reminders you set with the time each one is due to send.
You enter every one of these yourself. Paw Carnet does not read them from anywhere else, and nothing about your pets is shared with anyone. Every connection to Paw Carnet uses HTTPS.
You can download all of it as a file, or delete your whole account, from your account page. You delete a pet from its own page in the app.
E-mails we send
If you turn on e-mail reminders, we send them 30 days before and 7 days before a vaccination's valid-until date and on the day, and when a puppy or kitten vaccine window opens. We also send a welcome e-mail, and one confirmation when you set your first reminder. A sign-in link is sent only when you ask for one.
- Every e-mail is plain text. There are no tracking pixels and no tracked links, so we cannot tell whether you opened one.
- Links in our e-mails go to fixed pages of the site, the same for everyone. The personal links are the unsubscribe link, which can stop e-mail and nothing else, and a sign-in link you asked for, which works once and only for 15 minutes.
- Every reminder e-mail has a one-click unsubscribe.
- If an address bounces or a message is marked as spam, we stop sending and show a note in your account.
If you press a Pro option
If you press a Pro option, we record which option, where you pressed it and the price shown, with "nothing charged". If you tick "E-mail me if paid plans launch", we e-mail you once if that happens. You can withdraw this on your account page. Monthly totals of these presses carry no account and are not deleted.
If you are not signed in, a press is counted only as a named analytics event (below), and nothing else is kept.
What Pro would include is described on its own page. Pro isn't open yet. Pressing tells us you'd want it. Nothing is charged, and no card is asked for.
Cookies and browser storage
No cookie is set until you start to sign in. Then we set only these, and each is strictly necessary for signing in:
| Cookie | What it does | How long |
|---|---|---|
__Host-sf-petcare | Keeps you signed in. It holds a signed session token, nothing about your pets. | 30 days, or until you press Sign out or Sign out everywhere |
__Host-sf-petcare-hint | An empty flag (its value is 1) that tells our pages to check whether you are signed in. Without it a page never asks our server about you. | The same as your session |
__Host-sf-petcare-state | Ties a Google sign-in to the browser that started it, so nobody can sign you in to their account. | 10 minutes, cleared when sign-in finishes |
__Host-sf-petcare-mlstate | Ties an e-mailed sign-in link to the browser that asked for it, so a forwarded link cannot sign someone else in. | 15 minutes, cleared when the link is used |
There are no advertising cookies and no analytics cookies, and there is no cookie banner, because there is nothing optional to agree to. Your browser also keeps a few small values for sign-in, unfinished forms and the Pro offer:
- This tab only (sessionStorage): petcare.signin.state, petcare.signin.return and petcare.signin.intent: a random sign-in check, the page to come back to and what you were doing (for example saving a plan). Removed when you come back from sign-in, or when the tab closes.
- This tab only (sessionStorage): petcare.draft.<form>: the answers in a step-by-step form you have not finished, such as adding a pet, so the Back button keeps them. Until the tab closes.
- This tab only (sessionStorage): petcare.pendingPlan: the vaccination dates a calculator worked out, kept when you press Save so the add-a-pet page can show them. Beside it, petcare.draftPlan.new-pet: a short code (not the plan) telling the add-a-pet page which plan its unfinished answers belong to. Removed when the pet is added, or when the tab closes.
- This browser (localStorage): petcare.pendingSave: the pet you were adding when you started to sign in, so it is saved after you come back. Removed when the pet is saved; no longer used after 30 minutes.
- This browser (localStorage): petcare.pendingPress: the Pro option you pressed before signing in, so it can be kept with your account. Nothing is charged. Removed when you sign in; no longer used after 15 minutes.
- This browser (localStorage): petcare.lockSnooze: that you pressed Not now on a Pro offer, so we don't show it again here for 30 days. 30 days.
- This browser (localStorage): petcare.ageScreen: that you passed the age question before signing in. The year you typed is not kept. Until you clear this site's data.
- This browser (localStorage): petcare.signin.return and petcare.signin.intent: the page to come back to after an e-mailed sign-in link, because that link opens in a new tab. Removed when you open the link; if you never open it, until you clear this site's data.
The cookies page has the full detail.
Analytics
We count visits and a fixed list of named events with our own cookieless analytics, a self-hosted copy of Umami that runs at analytics.pagefabrica.com. It stores no cookie and no identifier in your browser, and it ignores everything after a # in the address.
With each page view it receives the page address, the site you came from, your browser, operating system, device type, screen size and language. Your IP address reaches that server with the request, as it does with any website; it is used to work out an approximate location and is not stored.
Two events are counted on every tool: work_started and work_completed. An event may carry only these properties: corridor, from, kind, mode, option, section, species, step, tool. Each takes one value from a short fixed list, except corridor, a short label of at most 32 characters (for a travel route, the two place codes, such as ua-eu; never a date or a name). Inside your pets' pages only section is ever sent: which screen was shown, never what you entered.
Every event name we count (56)
account_delete_confirmed, another_pet_created, api_error_shown, article_read_end, card_opened, card_section_opened, data_export_downloaded, email_reminders_on, emergency_maps_opened, emergency_opened, faq_opened, first_pet_created, guide_opened, guide_task_added, hero_cta_clicked, ics_downloaded, launch_mail_opt_in, logout_all_clicked, manual_entry_saved, manual_entry_started, nav_link_clicked, onboarding_step_answered, onboarding_step_skipped, passport_confirmed, passport_step_opened, pet_start_opened, plan_copied, plan_ics_downloaded, plan_preview_shown, poison_line_tapped, pricing_page_cta_clicked, privacy_centre_opened, pro_choose_clicked, pro_intent_withdrawn, pro_lock_seen, proof_link_opened, reminder_channel_chosen, reminder_done_marked, reminder_settings_changed, reminder_snoozed, report_opened, save_not_now, save_plan_clicked, schedule_species_switched, sign_in_clicked, sign_in_completed, source_link_clicked, species_selected, tool_input_invalid, travel_corridor_selected, travel_uncovered_requested, trust_link_clicked, vaccine_added, weight_logged, work_completed, work_started
The e-mail preferences page counts nothing at all.
AI
Nothing you enter into Paw Carnet is sent to an AI provider today, and no AI reads your pets' records. Our public pages are written with the help of AI; how we write and check them explains how.
We plan to add reading of passport and lab pages. Before that feature opens, this notice will gain a section that names the AI provider (Anthropic, in the United States), lists exactly what is sent for each feature and says how long it is kept. Under Anthropic's standard terms it deletes what it receives within 30 days, keeps it for up to 2 years only if its safety system flags it, and does not use it for training (Anthropic's retention terms). Nothing is sent to it unless you use such a feature.
Who else handles your data
| Who | What for | Where |
|---|---|---|
| Amazon Web Services | Hosting the site, our server code and the database; sending e-mail (Amazon Simple Email Service); delivering pages from locations near you (Amazon CloudFront) | Database and server code in Frankfurt, Germany; pages cached worldwide |
| Sign-in with Google only | Google's own infrastructure, under its own privacy policy | |
| Our analytics server (Umami) | Counting visits and named events, without cookies, accounts or stored IP addresses | A server we run ourselves for our sites, not a third-party service |
Your records are stored in Amazon Web Services in Frankfurt, Germany. We do not claim that every byte stays in the EU: Google handles sign-in on its own systems, and cached pages are served from wherever is nearest to you.
Deleting, and how long we keep things
When you delete your account, it is deleted from our live database immediately. Point-in-time backups keep the database's earlier state for up to 35 days. If we ever restore one, we delete again every account deleted since, from the deletion notes, before it goes live. A pet you deleted (but not your account) within those 35 days could reappear after a restore; you can delete it again.
Export everything, delete everything. Deleted from our live database now; backups roll off within 35 days.
| What | How long |
|---|---|
| Your account and pets' records | Until you delete them; deleted from the live database at once |
| Database backups | Up to 35 days, then they roll off |
| A deletion note (one-way hashes of your account and sign-in identifiers, nothing else) | 40 days, so a restored backup can never bring your account back |
| Reminders already sent | Removed 400 days after sending, or when you delete your account |
| Accounts nobody has used | Until you delete them; we do not yet remove accounts for inactivity |
| Hashed network addresses used to stop abuse | At most 2 days |
| Server logs | 30 days; they hold no personal data |
| Visit counts and named events (analytics) | Kept on our own analytics server while Paw Carnet runs, so visits can be compared over time; they carry no account, no cookie and no IP address |
| Monthly totals (for example how many pets were added) | Not deleted; they carry no account and identify nobody |
| Messages you send us | Until your question is dealt with, and at most 12 months after the last reply |
Calendar files and printouts you made are on your own devices, and they are yours. If we ever close Paw Carnet, the terms promise at least 90 days' notice and a final e-mail with every future due date.
Why we may use your data
- To provide the account you ask for — your records, reminders, export and deletion — because it is needed to give you the service (a contract with you).
- To keep the service secure, stop abuse of sign-in and e-mail, and count visits without cookies, because we have a legitimate interest in running it safely, and these use as little data as they can.
- To e-mail you if paid plans launch or a travel route is covered, because you asked us to (your consent, which you can withdraw at any time).
- To keep the deletion note and answer lawful requests, because the law requires it or because we must be able to show that we deleted what you asked us to.
Your rights
You can see, download, correct and delete what we hold about you. Most of it you can do yourself: download your records and delete your account on your account page, and delete a pet from its own page in the app. For anything else, write to support@pawcarnet.com from the address on your account. We answer within one month.
In the UK, the EU and the EEA
You also have the right to object to how we use your data, to ask us to restrict it and to take your data elsewhere. You can complain to a data protection authority: in the UK the Information Commissioner's Office (ico.org.uk), in the EU or EEA the authority where you live.
In the United States
Wherever you live, we honour requests to know, correct and delete what we hold, and to get a copy. We do not sell or share personal information, and we do not use it for targeted advertising.
Your own health information
Paw Carnet is for animal health records. It is not built to hold information about a person's health, and we never ask for any.
Please do not enter or send us documents about your own health. Emotional-support-animal letters, service or assistance dog papers that describe a disability, and your own prescriptions are not supported.
We do not collect, share or sell consumer health data as Washington's My Health My Data Act defines it. If such information reaches us by e-mail, we delete it.
Children
You must be 16 or older to create an account. Before your first account is created we ask the year you were born; if you are under 16, we stop and store nothing.
Anyone can read the schedules, care guides and the emergency page. A child reading them is treated like any other visitor: those pages set no cookie, show no ads and build no profile.
Changes to this notice
When something on this page changes, the date at the top changes too. If we change how we use your data in a way that matters, we e-mail account holders at least 30 days before it takes effect.