Privacy | PawSafe

1. Controller

The controller for processing is:

Blocksize One UG (haftungsbeschränkt)
Oberstr. 3
47829 Krefeld
Germany

Represented by managing director Holger Köther. Register court: Amtsgericht Krefeld, HRB 21178. VAT ID: DE456304266.

Privacy and support contact: webmaster@blocksize.one

2. Data processed by PawSafe

Device identity	PawSafe has no login and no user account. The app creates a cryptographic signing key and stores it in your iCloud Keychain. PawSafe recognizes you through this key, including on a new iPhone with the same iCloud Keychain. Device-specific key protection remains local. PawSafe processes the display name, device identifier, short-lived access and refresh tokens, and security information. The owner profile, device identifier and active countdown are stored server-side in Cloudflare. The app does not ask for an email address.
Owner phone number	The owner may add their own phone number. PawSafe stores it encrypted. Accepted helpers see the number only while an emergency is open, so they can call the owner directly. Once the emergency ends, it is no longer shown to helpers. The owner can remove the number in the app at any time; it is deleted when the owner deletes their data.
Safety configuration	Pet names, time limits, home address, coordinates and radius, and an optional access note. For address search, the app sends the address or place name you enter to Apple Maps (MapKit) to find matching places and coordinates. If you select a point on the map or use your current location, the app may send those coordinates to Apple's geocoding service to resolve an address.
Helpers	Name and, if added, phone number of helpers selected by the owner, plus priority, preferred language, invitation, response, and revocation status, and whether the helper can be reached by app, SMS, or WhatsApp. By accepting the invitation, the helper agrees that PawSafe notifies them in an emergency by app notification, SMS, and WhatsApp. PawSafe records the time and source of this consent and any later withdrawal details.
Return reports and location data	Start and end times, timer status, return signals, location coordinates, accuracy, distance, and derived status values. The latest return signal remains stored with the running timer during the set period and in the closed history for up to 30 days after it ends. PawSafe also keeps encrypted response copies for individual requests for seven days so the same request can be safely retried. Several return measurements may therefore exist during that period. PawSafe does not continuously monitor location.
Pet photos	Optional uploaded pet photos. Image files are stored privately in Cloudflare R2 and are not served from public image URLs.
Helper page	Emergency information, short-lived protected access, response status, and delivery status. While an emergency is open, accepted helpers see the owner’s display name, the names of the affected pets, the owner’s phone number if one was added, and their own response status. They do not see other helpers: no names, answers or phone numbers. When WhatsApp notifications are configured and sent, PawSafe records the recipient phone number through the helper, an encrypted message copy, the provider message ID, and delivery status.
Invitation preview	Anyone holding the invitation link sees, before accepting, the inviting owner’s display name and the names of their pets. The preview contains no address, phone number, or access note. The link can be accepted once and expires after seven days. After acceptance, expiry, or revocation it no longer shows a preview.
Live Activities for helpers	A helper’s iPhone can register Apple push tokens for Live Activities with PawSafe: one token to start a Live Activity and, for each emergency, one token for updates. PawSafe stores these tokens encrypted. Through the Apple Push Notification service, PawSafe uses them to send the emergency status to the helper’s device: the owner’s display name, pet name, the helper’s own response status, and the name of the helper who took over. The tokens are deleted when the helper ends the helper relationship, the device is replaced, or the owner removes the helper.
Apple Watch	The app sends the current status from the iPhone to the paired Apple Watch, including open emergencies where you are a helper. The transfer runs locally between iPhone and Watch through Apple’s WatchConnectivity. Responses you choose on the Watch are sent to PawSafe by the iPhone.
Emergency card	The app creates the printable emergency card as a PDF on your device. Names and phone numbers you enter for it or pick from your iOS contacts are not sent to PawSafe servers. The app uses the iOS contact picker for this and does not need access to your whole address book. The emergency card on the website is also created in your browser. Only if you create it inside the browser of an app such as TikTok or Instagram does the page upload the finished PDF file once to our server so you can open and share it there. It is stored encrypted in Cloudflare D1 under a random address and deleted after 15 minutes. We do not evaluate it.
Helpers on the lock screen	The Live Activity on the owner’s lock screen shows the names and phone numbers of up to four helpers during an emergency or after the timer has expired. This is on by default. The owner can switch it off in the app settings with the “Show emergency card on Lock Screen” switch. While it is on, anyone who sees the locked iPhone can read these names and numbers. Only then does PawSafe send these details to the owner’s iPhone through the Apple Push Notification service to update the Live Activity.
Subscriptions and purchases	Product, App Store transaction and subscription identifiers, term and status of the “Extended alerts” subscription, and the link to the owner profile. These records are used to verify purchases and current entitlement.
Optional product analytics	Only after separate consent, the app sends individual events for onboarding start and completion, starting a check-in period, opening and accepting a helper invitation, and starting or completing a purchase. Purchase completion is recorded only after the server confirms a Production transaction. Events contain their name and time, a randomly generated role-specific identifier, app, platform, reduced language, and, for subscription events, the plan. Names, contact details, pet and location data, safety status, and emergency data are not sent. The app does not make screen recordings or automatically capture interactions.
Error and crash reports	When the app crashes or an action fails, an error report is created with error code, action, response status, correlation ID, app version, device model, iOS version, and time. The app sends these reports only while the “Help improve PawSafe” switch is on. For its own errors, the server creates a report with error code, function, response status, correlation ID, and software version. The reports contain no names, phone numbers, addresses, pet or location data, or message content. Details are in section 5.
Launch waitlist	Only if you sign up on the website to be notified when PawSafe launches: your email address, the platform (Android, or iPhone for older sign-ups), the chosen language, time and IP address of sign-up and confirmation, the version of the consent text and the sign-up status. Details are in section 11.
Partner programme	Only if you sign up as a partner on https://pawsafe.pet/en/partner/: your account name on the chosen platform (TikTok, Instagram, YouTube or other), your email address, the website language, time and IP address of sign-up and your personal partner code. Details are in section 12.
Technical use	Website and API requests may involve IP address, time, requested page or function, response status, browser and device information, and security events.
Operational and security reporting	For service operation, misuse prevention, and traceability, PawSafe evaluates server-side business aggregates for active devices, app opens, started timers, alerts, helper responses, subscriptions, invitation status, and delivery status. Sender and recipient values in invitation and delivery history are stored encrypted or as protected lookup values. This required server-side reporting is separate from optional, consent-based product analytics in the app.
Device and app	Apple device tokens may be stored for push notifications, and on helper devices also the Live Activity tokens described above. The app protects credentials, a cryptographic signing key, and pending owner actions in the iOS Keychain or local storage until they are sent or expire.

The helper page receives full address and pet details only after the explicit “Open emergency” action. Related pet photos can then be viewed within the protected helper access. Access information is shown only after a further explicit action.

Push notifications to helpers contain names in their title or body. An emergency notification names the owner’s display name and the affected pets. The only status notification says that someone else is helping. It names the helper who took over and the pets. The final notification names the owner and the pets. Depending on the preview setting on the helper’s device, this content can be read on the helper’s lock screen.

3. Sources of the data

Profile details and safety configuration come from the owner. The owner enters contact details and sets each helper’s priority. A selected helper first receives an invitation as a link the owner shares, for example by SMS or WhatsApp. The invitation page contains the privacy information and the option to decline. By accepting the invitation, the helper agrees that PawSafe notifies them in an emergency by app notification, SMS, and WhatsApp. The helper does not choose a channel, only a preferred language. If the helper has the app, the app notification comes first in an emergency. If they do not respond within 2 minutes, SMS and WhatsApp follow. Without the app, SMS and WhatsApp go out right away. PawSafe sends SMS and WhatsApp only if the owner has the “Extended alerts” subscription.

Location data comes from the owner’s device when the owner grants location access for a started flow. The required measurements are sent to PawSafe for the configured home area and return confirmation. The latest return signal stays stored with the running timer during the set period and in the closed history for up to 30 days after it ends; encrypted response copies for individual requests are removed after seven days. PawSafe does not continuously monitor location.

4. Purposes and legal bases

Providing the owner profile or helper access, timers, return confirmation, and the purchased “Extended alerts” subscription on the basis of Article 6(1)(b) GDPR.
Processing the home address, search terms sent to Apple Maps (MapKit) for address lookup, and return signals where required for the flow started by the owner, on the basis of Article 6(1)(b) GDPR. The app respects operating-system permission for location access.
Inviting helpers selected by the owner, providing helper access, and sharing emergency status on the basis of Article 6(1)(f) GDPR. The legitimate interest is to organize the help requested by the owner. Helpers receive information in the first communication and may object to further notifications.
Notifying a helper in an emergency by app notification, SMS, and WhatsApp is based on their consent under Article 6(1)(a) GDPR. The helper gives it by accepting the invitation. There is no separate switch for it. The helper withdraws consent on the page behind their link with “Stop future messages” or in the app with “Stop helping here”. If they write STOP in WhatsApp, PawSafe sends them no more WhatsApp messages. Withdrawal does not affect the lawfulness of notifications sent before it.
Optional in-app product analytics is processed only with separate consent under Article 6(1)(a) GDPR. Refusal does not affect the timer and emergency features. After withdrawal, the app blocks future events and attempts to cancel requests that have not completed. Withdrawal does not reverse transmissions already made. You may contact us using the address above to request deletion.
The email notification about the PawSafe launch is sent only with your consent under Article 6(1)(a) GDPR and Section 7(2) No. 2 of the German Act Against Unfair Competition (UWG), given through a confirmation link (double opt-in). We keep evidence of the consent under Article 7(1) GDPR. Details are in section 11.
Protecting the service against misuse, operating the required server-side reporting, and keeping security-relevant actions traceable on the basis of Article 6(1)(f) GDPR. PawSafe does not create advertising profiles.
Server error reports to Sentry and Slack on the basis of Article 6(1)(f) GDPR. The legitimate interest is finding and fixing errors quickly so timers and notifications work.
App error and crash reports only with your consent through the “Help improve PawSafe” switch, on the basis of Article 6(1)(a) GDPR. If you turn it off, the app sends no further reports.
Telegram notifications to the operator about new users and new subscriptions on the basis of Article 6(1)(f) GDPR. The legitimate interest is following the growth of the service promptly.
Measuring which Apple Ads campaign leads to installs on the basis of Article 6(1)(f) GDPR. Details and your right to object are in section 5.

5. Recipients and service providers

We use the following service providers to provide PawSafe. Each of them is bound by contract to protect your data to the same standard we do, under Art. 28 GDPR:

Cloudflare Workers, Durable Objects, D1, Queues, and R2 for the API, timers, encrypted state, tasks, invitations, and private pet photos.
seven communications GmbH & Co. KG (Kiel, Germany) for SMS delivery.
Meta Platforms Ireland distributes the WhatsApp Business Platform Cloud API; WhatsApp Ireland processes customer data under the WhatsApp Business Data Processing Terms.
Apple for iCloud Keychain, Apple Push Notification Services including Live Activity updates, Apple Maps (MapKit) address search and geocoding, and App Store purchases. PawSafe receives signed transaction and subscription information to verify entitlement.
PostHog for optional in-app product analytics, only after separate consent.
Meta Platforms Ireland to measure our advertising on Instagram and Facebook (Meta SDK in the app), only if you agree in the iOS tracking prompt.
Apple to attribute installs to App Store ad campaigns (Apple Ads).
Plus Five Five, Inc. (Resend) for sending the emails of the waitlist and for the list of confirmed Android sign-ups. Details are in section 11.
Functional Software, Inc. (Sentry) for error and crash reports from the app and the server.
Slack for error alerts to the operator.
Telegram for notifications to the operator about new users and new subscriptions.

Cloudflare may process data outside the European Union. The relevant Cloudflare DPA, Cloudflare privacy policy, seven.io data processing agreement, seven.io privacy policy, and, for Apple services, Apple privacy policy describe the applicable terms and safeguards. Whether a particular service and transfer mechanism is used depends on the operator configuration. We do not promise EU-only processing.

The WhatsApp terms provide for processing under the Business Data Processing Terms and onward transfers to WhatsApp LLC and Meta Platforms Inc. in the United States. See the WhatsApp Business Data Processing Terms, the WhatsApp Business Data Transfer Addendum, and the Meta Terms for WhatsApp Business. Whether this service and particular transfers take place depends on the operator configuration. We do not promise EU-only processing.

For optional product analytics, the app sends events through PostHog’s EU Cloud endpoint. PawSafe sets the documented per-event property that prevents GeoIP enrichment. The provider still receives the IP address as network connection metadata. See PostHog’s privacy policy. The public website does not use PostHog.

Ad measurement with Meta: After setup, iOS asks whether PawSafe may track you across apps and websites owned by other companies. Only if you agree does the app start the Meta SDK. It then sends your iPhone’s advertising ID, events such as opening the app and finishing setup, and confirmed purchases with price and currency to Meta. Meta uses this to measure which ads led to installs and purchases. The legal basis is your consent (Art. 6(1)(a) GDPR, § 25(1) TDDDG). You can withdraw it at any time in the iOS settings under Privacy & Security > Tracking. Without consent, the app sends no data to Meta. Names, addresses, locations, pet data and your helpers’ data never go to Meta. See Meta’s privacy policy.

Apple Ads: After setup, the app requests a one-time attribution token from Apple and sends it to our server. The server asks Apple whether the install came from an Apple Ads campaign. With your owner profile it stores the source (Apple Ads or no ad), the IDs of campaign, ad group, keyword, and ad, the country or region, the conversion type (download or redownload), the click date, and the time of the lookup. Apple provides no advertising ID and no data from other apps. We use this to measure which campaign leads to installs. The legal basis is our legitimate interest in this measurement (Art. 6(1)(f) GDPR). You can object at any time under Article 21 GDPR by email to the contact address above. After an objection we delete these details from your profile. Without an objection they stay stored until your owner data is deleted.

Error and crash reports through Sentry: The provider is Functional Software, Inc., 45 Fremont Street, 8th Floor, San Francisco, CA 94105, USA, acting as processor. The app and the server send their reports to Sentry’s EU data region. Access from the United States cannot be ruled out. The transfer is based on the EU standard contractual clauses and the EU-U.S. Data Privacy Framework. The app sends reports only while the “Help improve PawSafe” switch is on. The IP address is transmitted as network connection metadata. See the Sentry Data Processing Addendum and the Sentry privacy policy.

Error alerts through Slack: We also post server errors and app error reports to a Slack channel that only the operator reads. The alert contains error code, function, response status, correlation ID, and software version. The server removes names, phone numbers, addresses, and message content first. When someone confirms a waitlist sign-up, the server posts only the platform (iPhone or Android), language, campaign code, and the number of confirmed sign-ups to the same channel, never the email or IP address. The provider is Slack Technologies Limited, Dublin, Ireland. Slack also processes data in the United States, based on the EU standard contractual clauses and the EU-U.S. Data Privacy Framework. See the Slack privacy policy.

Notifications through Telegram: When someone creates a new owner profile, the operator receives a Telegram message with the country code of the connection, for example DE. For a new subscription, the message names the plan (weekly or annual), the App Store country, whether a code was redeemed, and whether it was a test purchase. The messages contain no names, phone numbers, IDs, or IP addresses. The provider is Telegram FZ-LLC, Dubai, United Arab Emirates. There is no EU Commission adequacy decision for this country. We therefore send only details that cannot be linked to a person. See the Telegram privacy policy.

The website uses no analytics, advertising, or marketing services and sets no marketing cookies.

6. Cookies and local storage

The public website needs no analytics or advertising cookies. The helper page uses a strictly necessary HttpOnly, Secure, and SameSite protected cookie for access. The helper cookie expires after 24 hours; invitation and emergency links expire after seven days. A separate helper settings and unsubscribe link is not subject to that seven-day limit and remains valid while the helper relationship is accepted and has not been revoked. The unlinked operator area uses a separate HttpOnly, Secure, and SameSite protected cookie for authorised operational purposes, with an eight-hour lifetime. The helper page does not store its language choice in local browser storage; after an invitation is accepted, the language is saved as a helper preference. On the public website, you may save a language choice locally in your browser for your next visit to /.

After consent, the app stores a random pseudonymous identifier in local app preferences to associate analytics events with the same app role. On withdrawal the identifier is deleted and the app sends no further events. No analytics cookies are set on the website.

Storage strictly necessary for a service expressly requested by the user falls under the exception in Section 25(2)(2) TDDDG.

7. Retention and deletion

Invitation and emergency links expire after seven days; the separate helper settings and unsubscribe link does not expire after seven days and remains usable while the helper relationship is accepted and has not been revoked. Encrypted response copies for individual return requests are kept for seven days. Access to the helper page expires after 24 hours. Ended emergencies, including the latest return signal, and delivery status are retained for up to 30 days after closure. Priority, preferred language, helper status, and the time and source of the helper’s consent and its withdrawal remain until the owner data is deleted, including after a helper relationship is revoked. Completed WhatsApp delivery records, including an encrypted message copy, provider ID, and status, are deleted after 30 days. The historical invitation and message overview with recipient numbers and names is removed by scheduled cleanup after 90 days. When a helper relationship ends, because the helper ends it or the owner removes the helper, PawSafe deletes the helper's name and phone number right away, including in this overview. This applies to that owner only; if the same person is a helper for another owner, that entry stays. If the helper ended the relationship themselves, only a one-way check value of the number remains, so the same owner cannot invite it again. When a helper deletes their own data in the app, the app first ends each of their helper relationships. Pet photos remain stored until replaced, deleted, or removed when the owner data is deleted. An owner phone number remains stored until the owner removes it or deletes their data. A helper’s Live Activity tokens are deleted when the helper ends the helper relationship, the device is replaced, or the owner removes the helper. App Store transaction records remain until the owner data is deleted; transaction records may remain after a subscription ends or is cancelled to verify earlier purchases. Analytics events follow the retention setting for the PostHog project; PawSafe does not promise a fixed period. The same applies to error reports at Sentry and error alerts in Slack. The retention period for the launch waitlist is in section 11.

Owners can start deletion in the app under Settings > Reset and delete my data. PawSafe blocks further use of the owner profile and removes profile data, invitations, timers, helper records, identifiable reporting rows, and App Store transaction records. Private pet photos are deleted from Cloudflare R2. Deletion stays open until the end of helper relationships with other owners and the photo deletion are confirmed. It is not reported as complete before then. If storage is temporarily unavailable, deletion is retried and may take longer. A pseudonymous anti-replay marker may remain for up to 24 hours after deletion to reject delayed device proofs. The app clears local credentials and pending commands. The address above is an additional route for deletion or privacy requests. Statutory retention duties and provider log and backup retention remain unaffected.

8. Data subject rights

Subject to the GDPR, people may request access, correction, erasure, restriction, portability, and object to processing. Owners can start deletion in the app under Settings > Reset and delete my data; the address above is an additional route. Reasonable identity verification may be required where there are doubts about the requester’s identity.

Helpers can change their language in helper settings. They withdraw their consent there with “Stop future messages” or in the app with “Stop helping here”. After that, PawSafe no longer notifies them. Anyone who writes STOP in WhatsApp receives no more WhatsApp messages from PawSafe. Accepted helpers can use this settings link beyond the seven-day expiry of invitation and emergency links, while the relationship has not been revoked. Requests are handled within the statutory time limits.

9. Complaints

You may lodge a complaint with a data protection authority, including the State Commissioner for Data Protection and Freedom of Information of North Rhine-Westphalia: LDI NRW complaint information.

10. Changes

This notice will be updated when data flows, providers, purposes, or legal requirements change. The version and date will be shown when it is published.

11. Launch waitlist: notification by email

On https://pawsafe.pet you can sign up to receive an email as soon as PawSafe is available for Android. Until the iPhone app launched on 28 October 2026 you could also sign up for iPhone. This is voluntary. The app itself does not ask for an email address.

How it works (double opt-in). After you submit the form we send you an email with a confirmation link. Your consent only takes effect once you click that link within 48 hours and confirm the sign-up on the following page. If you do not confirm, we delete your address no later than seven days after sign-up and you will not receive any other email.

Which data. Your email address, the platform (Android, or iPhone for older sign-ups), the website language (German or English), time and IP address of sign-up and of confirmation, the version of the consent text and the status (unconfirmed, confirmed, unsubscribed). We store the email address and the IP addresses encrypted in Cloudflare D1. To check whether an address is already on the list we use a protected lookup value, not a plaintext list. We also count per address how many emails we sent within 24 hours to limit abuse of the form. If you signed up through a link with a campaign code, we store this code with your sign-up. This shows us which channel works. The code contains no information about you.

Purpose. We use your address only to send you the confirmation email and one email when PawSafe launches on your platform. If you enter the same address again, you receive a short notice with an unsubscribe link. We do not send a newsletter, do not share your address and do not build profiles. We evaluate the number of confirmed sign-ups per platform without personal reference to estimate demand.

Legal basis. Your consent under Article 6(1)(a) GDPR and Section 7(2) No. 2 UWG. We store the time and IP address of sign-up and confirmation and the version of the consent text to demonstrate consent under Article 7(1) GDPR. Limiting the number of emails per address and IP address protects the service under Article 6(1)(f) GDPR.

Sending and list through Resend. We send the emails through Resend. We also keep confirmed Android sign-ups in a contact list at Resend so we can tell you about the launch. The provider is Plus Five Five, Inc. (Resend), 2261 Market Street #5039, San Francisco, CA 94114, USA, acting as processor under the Resend Data Processing Addendum. Resend processes the data in the United States, based on the EU standard contractual clauses and the EU-U.S. Data Privacy Framework. Further information is in the Resend privacy policy. When you unsubscribe or the retention period ends, we also remove your address from the list at Resend.

Retention and withdrawal. We keep a confirmed address until you unsubscribe or until we have informed you about the launch on your platform, at most 24 months after confirmation. Then we delete it. Unconfirmed addresses are deleted no later than seven days after sign-up. After you unsubscribe we delete your address within 30 days. You can withdraw your consent at any time through the unsubscribe link in every email or by writing to the contact address above. Withdrawal does not affect the lawfulness of processing carried out before it.

12. Partner programme for creators

On https://pawsafe.pet/en/partner/ you can sign up as a partner and recommend PawSafe with a personal link. This is voluntary and meant for people who publish their own content about pets.

Which data. Your account name on the chosen platform, the platform, your email address, the website language, time and IP address of sign-up and the partner code we generate. We store the email address and the IP address encrypted in Cloudflare D1. To check whether an address is already registered we use a protected lookup value.

Counting through the link. When someone opens your partner link, we count the visit under your partner code as a daily number, without IP address, without cookie and without any identifier in the visitor’s browser. The same applies to every link with a campaign code on this website: we only count how often a page was opened through a code.

Purpose. We use your details to email you the partner link, to count visits and subscriptions credited to you, to settle the commission and to contact you about it. We do not send a newsletter and do not share your details.

Legal basis. Performance of the partnership with you under Article 6(1)(b) GDPR. We store the IP address of sign-up to protect the form against abuse under Article 6(1)(f) GDPR.

Sending through Resend. We send the email with your link through Plus Five Five, Inc. (Resend), as described in section 11.

Retention. We keep your details for as long as the partnership lasts and afterwards for as long as commercial and tax law requires us to keep statements. You can end the partnership at any time by writing to the contact address above. We then delete your details unless a retention duty applies.