We hold the minimum about you needed to make CalDog work. Your dog's photos are stripped of identifying information before they leave your phone, processed once for a body-condition estimate, then deleted within 24 hours. We never sell your data. We never train AI models on your photos. We don't ship to under-13s. If you want everything we hold, ask, and we'll send it within 30 days.
2. Who we are
CalDog is a product of Grow Fast Ltd, a company registered in England and Wales (Company No. {{COMPANY_NUMBER}}). Our registered office is TBD, London. Grow Fast Ltd is registered with the UK Information Commissioner's Office (Reg No. {{ICO_REG_NUMBER}}). Grow Fast Ltd is the controller for any personal data covered by this notice.
3. Data we collect
Account email and password hash. Optional date of birth (for the age gate). Your dog's name, breed, weight, life-stage, and feeding log. Photos you upload for body-condition estimation (handled separately — see §5). Device and crash diagnostics. We do not collect precise location.
4. How we use it
To run CalDog: calorie targets, BCS estimates, trends, account log-in, and the home-screen widget. To respond when you email support. To send transactional notifications (only if you opt in). We do not send marketing pushes. We do not personalise advertising.
5. Photos & AI processing
When you take a body-condition photo, your phone strips EXIF metadata and blurs detected human faces and number plates before upload. We send the cropped dog ROI to Anthropic's commercial API for the WSAVA estimate. Inputs and outputs are not used to train Anthropic's models. Original photos are deleted from our servers within 24 hours. Your dog's BCS history (range, date, confidence) stays in your account until you delete it.
6. Subprocessors
Supabase (account & data storage, EU region). Anthropic (BCS inference). RevenueCat (subscription management). Google Cloud Run (backend hosting, EU region). Netlify (marketing-site hosting). Each is contractually bound by data-processing terms aligned with UK GDPR. Full list at /subprocessors.
7. Children & the UK Children's Code
CalDog blocks accounts where the date of birth indicates the holder is under 13. For accounts aged 13–17, we apply UK Children's Code high-privacy defaults: no photo upload, no social features, no ad personalisation, geolocation off. We do not knowingly collect data from anyone under 13. If you believe a child has created an account, email privacy@caldog.app and we will remove it within 7 days.
8. Your rights under UK GDPR
You have the right to access, correct, port, or delete the personal data we hold about you. You can withdraw consent for optional processing at any time. Account deletion is one tap from Settings → Account, and removes everything within 30 days (backups rotate out within 90). Data-subject requests are handled within one calendar month and at no charge.
9. Retention
Account and feeding-log data: held for the lifetime of your account. Original BCS photos: deleted within 24 hours of upload. BCS history (range, date, confidence): held for the lifetime of your account or until you delete a scan. Server logs and crash diagnostics: 30 days. Backups: 90 days rolling, encrypted at rest in EU region.
10. Contact & complaints
Questions, requests, or complaints: privacy@caldog.app. We aim to reply within 5 working days. If you're not satisfied with our response, you can complain to the UK Information Commissioner's Office at ico.org.uk/make-a-complaint or by phone on 0303 123 1113.