Privacy policy

1. The short version

• No accounts, no email, no password.
• Readings, notes, medications, symptoms and videos are stored on your device.
• Anything synced or shared is encrypted on your device first. We can’t open it.
• No ads, no advertising or tracking SDKs, and we never sell data.
• You can export or delete everything at any time.

2. What stays on your device

Your pets’ profiles, every reading, notes, medications, symptom, weight and appetite logs, breathing videos, reminders and settings. This data is stored in the app’s private storage.

3. Backups

Heartside never backs up to our own servers. Backups only go to places you control:

• iPhone: your iPhone’s own backup, to iCloud (iCloud Backup) or to your computer. Heartside’s data is included with your other apps’ data and protected the way Apple protects that backup; with Advanced Data Protection turned on, an iCloud backup is end-to-end encrypted. You turn iCloud Backup on or off in the Settings app.
• Android: Android Auto Backup to your Google account. On Android 9 and later, the backup is encrypted with your screen lock PIN, pattern or password, so Google can’t read it. Android decides when to back up, usually once a day while charging on Wi-Fi. You can turn it off in Android settings.
• Breathing videos are part of an iPhone backup. Android leaves them out of its device backup because of their size. A backup file can include them.
• Backup file: you can save an encrypted .heartside file anywhere you choose (Files, Drive, Dropbox and so on). It’s encrypted with a random key made on your device. That key is kept in iCloud Keychain on iPhone, or in Google’s Block Store with your Google account on Android, both end-to-end encrypted, so a new phone signed in to the same account can open the file. Where the phone can’t sync it, the key stays on that device. You also get a recovery code that opens the file on any phone. The key, the code and the file never reach our servers, so we can’t recover a lost code. Backup files from older versions of the app are locked with the PIN they were saved with.

iCloud and Google backups are also subject to Apple’s and Google’s own privacy policies.

4. What our servers can see

We only run servers for live family sync, share links and video sync (Plus). For those, our servers store:

• Encrypted data we can’t read (ciphertext).
• Random identifiers for devices, shared pets and links.
• Your device’s public key and push-notification token, so other family devices can be told to sync.
• Timestamps, sizes and counts needed to run and limit the service.
• A one-way hash of your purchase receipt, to confirm Plus.

Video sync (Plus): when a breathing video is attached to a reading of a pet you share live, your phone encrypts the clip with a new key of its own before uploading it. That key travels only inside your encrypted family sync, so we store the video but can’t watch it.

Push notifications carry no health information. Server logs contain hashed identifiers only, never your data.

5. Share links and PINs

When you create a link, your device encrypts the data with a key built from a secret in the link and the PIN you choose. The secret part of the link is never sent to us, and we never see your PIN. We store only a value that lets us count wrong attempts. After 5 wrong PINs the link is deleted. One-time links expire within 30 days. Anyone you give the link and PIN to receives a copy of that pet’s data, so share with people you trust.

6. Purchases and tips

Payments are handled entirely by the App Store or Google Play. We receive a signed confirmation of the purchase, never your name, card or billing address.

7. Crash reports and support

Crash reports are off by default. If you turn them on, they include device model, OS version and the technical error, never your readings. If you contact us, we use your email and message only to reply, and delete them 12 months after the conversation ends.

8. How long we keep server data

• One-time links: deleted on expiry (≤ 30 days), after 5 wrong PINs, or when revoked.
• Live family sync: kept while in use, deleted after 12 months with no activity.
• Synced videos (Plus): deleted automatically about 90 days after upload. Older videos stay on the phones that have them.

9. Your choices and rights

You can export everything (CSV or PDF) or delete a pet or the whole app at any time. Deleting a shared pet removes your device from it and our copy is deleted on expiry. Because we don’t know who you are, we can’t look you up. Contact us with a link or device ID from Settings and we’ll help. Depending on where you live (for example under PIPEDA, GDPR or CCPA), you may have rights to access, correct or delete data. We honour them for everyone.

10. Where data is processed

Our servers run on Amazon Web Services, currently in North America. Because server data is end-to-end encrypted, its location doesn’t expose its contents.

11. Children

Heartside is not directed at children under 13, and we don’t knowingly collect their information.

12. Changes and contact

If we change this policy, we’ll update the date above and tell you in the app before material changes take effect. Questions: privacy@heartside.app.