Privacy Policy

Pupsley exists to help dogs make friends. That only works if you trust us with where you walk and who your dog is — so this page says exactly what we hold, why, and what you can make us do about it. In plain words, because a policy you can't read isn't really consent.

Last updated: 3 October 2026

Who we are

Pupsley decides what happens to your personal data, which makes us the controller of it. Reach us any time at [email protected] or through the contact page.

Operator: Pupsley, an independent service run from Australia. Pupsley is not yet a registered company — when that changes we'll name the entity here. Written enquiries and privacy requests: [email protected].

What we collect, and why

Your account

Your email address and password. Passwords are stored hashed — we can't read them.
Your first and last name, and a profile photo if you add one.
Account and security information that comes with having a login: a tidied-up copy of your email address for looking you up, whether it's been confirmed, the counters that lock the account after repeated wrong passwords, whether two-factor is on, the one-off tokens behind password resets and confirmation links, and internal markers that sign you out everywhere when your password changes.
Whether your account is active or deactivated, and — rarely — a moderation flag, such as one that pauses lost-dog alerts from an account that has misused them.
Notifications we've shown you inside Pupsley — a friend request, a walk invite, someone reporting they've seen your dog — kept so the list is still there when you come back.

Why we're allowed to: we need it to give you an account at all (contract), and keeping accounts secure (legitimate interests).

Signing in with Google

You can choose Continue with Google instead of a Pupsley password. Pupsley uses Google only to confirm who you are, so you can sign in or create your account.

What Google sends us. When you sign in, Google gives us a signed sign-in token. It contains your Google account ID (a number Google uses for you), your email address, and whether Google has verified that email address. Google's standard token also includes your name and profile picture.
What we use. Only your Google account ID and your verified email address. We check the token's signature against Google's published keys, use the account ID to recognise you next time, and use the email address to find or create your Pupsley account. Your name and profile picture from Google aren't read or saved. If you create your account with Google, your Pupsley first name starts as the part of your email address before the @, and you can change it on your profile.
What we keep. Your Google account ID, linked to your Pupsley account. That link is what lets you sign in with Google. If you create a new account this way, your Google-verified email address becomes your Pupsley email address, and your account has no Pupsley password until you set one with Forgot password. If you connect Google to an account you already have, that account keeps its own email address. Google's sign-in token itself isn't saved or logged. While you choose between creating an account and connecting an existing one, a temporary record holds your Google account ID and verified email for up to ten minutes. Once it's used, those two details are wiped from it. Unused records stop working after ten minutes and are tidied away later.
An existing account needs its password. If your Google email address matches an account already on Pupsley, Google isn't connected to it until you enter that account's Pupsley password.
Your Google password never reaches us. You type it into Google's own window, not into Pupsley.
No access to the rest of your Google Account. Pupsley asks Google only to confirm who you are. It doesn't ask for, and can't get, your Gmail, Google Drive, Calendar, Contacts, or anything else in your Google Account. It can't do anything at Google on your behalf.
Google sees the sign-in. On the log-in and sign-up pages, your browser loads Google's sign-in button directly from Google. Signing in happens in a Google window. Google handles that under its own privacy policy.
Not sold or shared for unrelated purposes. We don't sell anything Google sends us. Your Google account ID and your account email address are handled by the providers that run Pupsley: Microsoft Azure, which hosts the database they're stored in, and Cloudflare, which every request to Pupsley passes through. Our email provider also handles your email address when it sends you account email. Those providers are listed under Who else touches your data. We don't disclose this information for advertising or any other unrelated purpose.
How long it stays. Your Google link is part of your Pupsley account and stays for as long as the account exists. To ask for your account to be deleted, see Account deletion under How long we keep it.

The Pupsley app for Android, once it's out, offers the same Continue with Google and keeps exactly the same things.

Why we're allowed to: you chose to sign in with Google, and we need it to give you that sign-in (contract).

Where you walk

Your country, region and suburb.
The centre point of that suburb, which is how we work out who is near you. It is not your address and not a GPS reading — it's one point shared by everyone in your suburb.

If you tap Use my current location here, your device sends us a position. We don't ask your browser for a high-accuracy fix — we don't need one — but what it hands over is up to your browser and your device, so treat it as a real position. Our server matches it to the nearest suburb in our own list of places and saves that suburb. The position is used for that lookup and discarded; what we store as your location is the suburb. You can type your suburb instead, and saying no costs you nothing.

People near you see your suburb, your first name, your dogs and roughly how far away you are. Your profile never shows a precise location, and the distance is measured from your suburb's centre rather than from you.

Why we're allowed to: finding local dog owners is the service you signed up for (contract).

Live Walk Mode (in the Pupsley app)

The Pupsley mobile app isn't out yet. When it is, walking with someone will let you share where you are so you can find each other — and because that is the most sensitive thing Pupsley will ever hold, here is exactly how it's built:

Only the people on that walk can see it. Not your friends, not people nearby, not us for any other purpose. Nobody else, ever.
Only while the walk is on. Sharing stops when the walk ends, and in any case two hours after the walk started — that ceiling is measured from the start, so re-posting a walk can't stretch it.
Only your current position. One point per person per walk, overwritten each time. There is no trail, no history and no record of where you've been, because there's nowhere for one to accumulate.
It's deleted, not archived. Tapping stop sharing removes your point there and then. If a walk simply ends — the app was closed, the phone went flat — nobody can see the point any more from that moment, and a cleanup job removes the row from our database shortly afterwards, within minutes rather than days. Access stops first; the row goes right behind it.
You can stop at any time, with one tap, and it stays on screen while you're sharing.

It will be off unless you turn it on, and declining will cost you nothing — the walk still shows you the meeting place.

Why we're allowed to: you turned it on (consent), and you can withdraw it at any moment.

If your dog goes missing

If you report a dog missing, we tell Pupsley owners near where it was last seen, and we create a page you can share with anyone.

Your dog's name, photo and description become public on that page. We say so on the screen before you send it.
The place shown is where you said the dog was last seen — the spot you pick on the screen, never where you live. You can pick it two ways, and they're different: choose a suburb and we store that suburb's centre point, or tap use my current location and we store the position your device gives us. That second one is a real position, so if you're standing somewhere you would rather not pin, pick the suburb instead.
The public page never shows that point exactly. Anyone who opens a shared link sees a rounded-off location — enough to point at a neighbourhood, not at a doorway. Signed-in Pupsley owners close enough to be alerted are being asked to go and look, so they see the place you gave as you gave it.
Our moderators see every alert as it goes out. An alert reaches people who never asked to hear from you, so somebody has to be able to stop one that shouldn't have been sent.
Alerts stop after seven days, or as soon as you mark your dog found.

Why we're allowed to: you asked us to send it (consent), and our legitimate interest in keeping the alert system from being misused.

Your dogs

Names, breeds, birthdays and photos.
Care you record — worming, vaccinations, grooming and the like.

Why we're allowed to: contract.

Your community activity

Friend requests, groups you join, events you attend and walks you post.

Why we're allowed to: contract.

Supporting Pupsley

Supporting Pupsley is optional — a one-off contribution, or the supporter membership. Pupsley is free either way. On the website, our payment provider Stripe takes the payment on its own pages, and we send Stripe your email address so it can send you a receipt. Card details never reach Pupsley and we never store them — not the number, not the security code. There is nowhere in Pupsley to type one.
What we keep afterwards is a Stripe customer reference, your supporter status and badge, and — for a membership — a one-way fingerprint of the Stripe subscription reference, its status and price, the invoices it was paid or refunded by, and the plan and the dates it runs between; while a checkout is open, the reference of that checkout. Your account also gets a random billing number, made from nothing about you, so a payment can be matched to the right account. We also note which payment messages from Stripe we've already handled, so a repeated one isn't counted twice.
What passes through while a payment is being processed is a little more than that. Stripe tells us the name and email address on the payment so we can match it to your account and address the receipt, and Pupsley emails its own team mailbox to say a payment arrived — that message includes your name, your email address and the Stripe customer reference, so a person can set your badge up. It's a small team and that's how the badge gets done today.
In the Pupsley app for Android, once it's out, the membership is bought through Google Play rather than Stripe. Google takes the payment in its own purchase screen and handles your payment details under Google's own terms and privacy policy. Google Play doesn't give Pupsley your card or the details of your Google payment account, and the app doesn't ask for them.
Matching it to your account. When you subscribe, the app tags the purchase with your account's random billing number, so Google's records can show which Pupsley account it belongs to. Google then gives the app a purchase reference, and the app passes it to our server, signed in as you, so our server can check the purchase with Google directly.
What Google tells us. When you subscribe, and again whenever the membership changes — it renews, a payment fails, you cancel, or it's refunded — Google lets our server know, and our server asks Google for the membership's current state. That state is its status, the plan, when it started, when the current paid period ends, whether it will renew, Google's order number for the latest payment, and whether it was a test purchase. It doesn't include your name or email address.
What we keep for a Google Play membership is a one-way fingerprint of the purchase reference, linked to your account, with the status, plan and dates above, whether it renews, Google's order numbers for the latest payment and for any payment that was refunded, whether it was a test purchase, and your supporter status. We also note which messages from Google we've already handled, so a repeated one isn't counted twice. The purchase reference itself isn't saved or written to our logs.
Changing or cancelling it. Google bills you for the membership, so you change or cancel it in Google Play's subscription settings — that's what stops the payments.
If a rescue gave you a code and you enter it on your profile, we store that code and show a supporter badge. It isn't yet connected to anything that sends money to a particular rescue — when it is, we'll say so here.

Why we're allowed to: contract, and tax law for the records (legal obligation).

Notifications

Your email and push preferences, and a device token if you turn push on.
Everything we send you has an off switch. Push notifications and lost-dog alerts are on your profile screen in the Pupsley app; care reminder emails are there too, and on your profile page here on the website. The app's switches save the moment you flip them, and take effect on the very next thing we would have sent. Emails about your account itself — confirming your address, resetting your password — aren't optional, because they're how you get back in.

Why we're allowed to: you asked for them (consent).

Messages you send us

The contact form sends us an email. It isn't stored in Pupsley's database.
If you report seeing someone's missing dog, your note and any contact detail you choose to give are passed to that dog's owner — by email, and as a notification they keep. You don't need an account to do it, and the contact detail is optional.

Why we're allowed to: you sent it to us (consent), and getting dogs home (legitimate interests).

Keeping Pupsley working

When something breaks we save the error message, the technical trace, which part of Pupsley it came from, and the time. There's no field in that record for your name, your account or your IP address — but the text itself comes from whatever failed, and it's stored as written. In practice it often carries a reference to what was being worked on: a dog, an owner, a group, a walk, sometimes an email address. We can't promise a particular detail will be absent, so we won't. What we can tell you is what these are for: nobody reads them to learn about you, they get read when something is broken.
Our network provider tells us which country a request came from. We use it to put your own country's suburbs at the top of the location search, and nothing else. It isn't stored against your account.

Why we're allowed to: keeping the service running and usable (legitimate interests).

What we don't do

We don't sell your data. Not to advertisers, not to anyone.
There are no ads on Pupsley, so there's no ad tracking either.
We don't use analytics or tracking cookies. We don't use third-party analytics or advertising tags: there is no analytics script and no advertising pixel on any Pupsley page. The one piece of outside code is Google's sign-in button, which appears only on the log-in and sign-up pages — see Signing in with Google above. The cookies we do set are working ones, and they fall into three jobs: signing you in and keeping you signed in — including the parts of that which handle two-step sign-in and remembering a device you've verified; protecting forms so they can't be submitted from someone else's site; and carrying a short message from one page to the next, like the confirmation after you change your password. They're there to run the site, not to build a picture of you.
Your theme stays in your browser. Light or dark mode is written to your own browser's storage and never sent to us.
A suburb you pick before signing up is remembered in your browser — that's why we don't ask twice. Be clear about what that does and doesn't mean: it lives in your browser rather than in an account, but the page has to send it to our server on each visit, because working out who and what is near that suburb happens on our side. So the suburb reaches us and is used while you're on the page; it isn't saved against any account, and there is no account to save it against. Clearing your browser's storage removes it.
We don't track your movements. Normally we hold a suburb, not a position. The exceptions are the two you choose, one at a time and never continuously: a lost-dog report you pin with your current location, and — once the app ships — a walk you've turned sharing on for, which holds one current point that gets overwritten. Never a trail, never in the background, and never a record of where you've been.

Who else touches your data

Not everyone on this list is the same kind of thing, so they're grouped by what they actually get.

Wherever personal information goes beyond Pupsley, it has to be protected to the standard this policy describes, or an equivalent one, together with whatever applicable privacy law asks of whoever receives it. That is a floor, not a claim that everyone here acts purely on our say-so: payment and app-store providers also use a limited amount of what they receive for their own legal, security and fraud-prevention duties.

Companies that run Pupsley for us

Pupsley is built on top of these, so your data passes through them to do the job named beside each one. Each of them has its own privacy policy, and we'd rather point you at those than make promises on their behalf.

Microsoft Azure — hosting, database and photo storage.
Cloudflare — sits in front of the site, keeps it fast and blocks attacks. Every request passes through it, and it tells us which country a request came from.
Stripe — takes payments on its own pages, and gets your email address so it can send you a receipt.
Google Play — in the Android app, once it's out, sells the supporter membership and takes the payment in Google's own purchase screen. The app tags the purchase with your random billing number, and our server sends Google the purchase reference to check the membership and hear when it changes.
Our email provider — carries reminders and account emails, and therefore your email address and what's in them.
Google, Apple and Microsoft — deliver push notifications, if you turn them on. They get a device token and the text of the notification. The apps we're launching are for Android and iPhone, so in practice that's Google and Apple; Microsoft's Windows notification service is built but isn't part of this release.

Things your browser or phone loads directly

Nothing here gets your data from us. Your own device makes the request, so what each one sees is what any site you visit sees.

OpenFreeMap — supplies the map style and the map squares a live walk is drawn from, once the app ships. Your phone asks for them when you open the live map of a walk you're on, and those requests show OpenFreeMap your IP address, the ordinary information any browser sends with a request, and which squares you're looking at. Squares are areas, not points: at the zoom a live walk uses, that's a street or a neighbourhood rather than where exactly you're standing. What never goes with them is anything that would say who you are — no name, no email address, no Pupsley account, no dog, no sign-in token, and not the exact position of anyone on the walk. OpenFreeMap handles those requests under its own privacy policy and terms; it publishes that it has no accounts, sets no cookies and does no tracking, normally keeps no IP addresses, keeps request information only in anonymised form, and may log an IP address for a short time while dealing with a security incident. The map software itself is bundled in the app rather than downloaded.
Google Maps — only if you ask for it. Pupsley doesn't embed a Google map or load any Google map software: places, lost-dog pins and meeting points are drawn by us. When you tap Open in Maps, Map or View location, we hand that one place — its name, or its coordinates — to Google Maps or your browser as part of the web address, and from there Google handles it under Google's own terms.

Places we look things up

Overpass — dog parks and beaches come from OpenStreetMap's public map data, which our server looks up through public Overpass services (currently overpass-api.de and overpass.kumi.systems). The query carries a stored suburb or city centre point from our own place list — never the position your device reported, and never your name, your email address, your account or any sign-in token.
GeoNames — where our place names came from, under CC BY 4.0. Nothing is sent to them at all: we imported a copy and search it ourselves, on our own servers.

Where your data lives

Pupsley runs on Microsoft Azure — the site, the database and the photo storage — and is operated from Australia. All three are hosted in Azure's Australia East region. The backups we've checked — the database's, and the spare copies Azure keeps of your photos — stay in that same region rather than being copied to another one.

If you're outside Australia, that means your data is transferred to and stored in Australia. Storing it there isn't the same as processing it only there: Cloudflare sits in front of the site and handles your request at whichever of its locations is nearest to you, and several of the other providers above operate in other countries too. Australia isn't covered by a UK or EU adequacy decision, so if you're in the UK or the EU, ask us before you sign up — we'll tell you what safeguards are in place rather than name one here we haven't documented.

How long we keep it

Your account and its content: for as long as your account exists.
Deactivating hides your profile but keeps it, so you can come back. It isn't deletion and nothing is removed.
Account deletion. You can request account deletion from your settings on the website or in the app — you don't have to email us to start. You can still email [email protected] if you'd rather, or if you can't sign in. Requests are reviewed manually. There's more about how to ask, and about the limits, on the delete your account page.
A lost dog alert stops after seven days. A shared position during a walk stops being visible to anyone the moment the walk ends, and in any case two hours after it started; the record itself is deleted straight away if you tap stop sharing, and otherwise by a cleanup job that runs continuously and catches it within minutes. Both limits are enforced by the code, not by us remembering.
Payment records: as long as tax and accounting law requires. We're not quoting a number until we have a written schedule to hold ourselves to.
Error logs — the message, the trace and which part of Pupsley it came from. We keep these for 90 days, then delete them. That's a target we've set ourselves and written down, not a legal requirement, and nothing in the code enforces it — it's a monthly clear-out someone has to remember to run. So it's what we're working to rather than a promise about any particular day. And as above, the text is stored as written, so we can't promise it holds nothing that identifies you.

Your rights

Wherever you live, you can ask us to do all of the following. In the UK and EU these are rights under the GDPR; everywhere else we'll honour them anyway, because drawing a line there would be mean-spirited.

See it — get a copy of what we hold about you.
Fix it — correct anything wrong. Most of it you can edit yourself.
Delete it — ask us to delete your account, from your settings or by email. See Account deletion above, or the delete your account page.
Take it — get your data in a portable format.
Object — tell us to stop processing that relies on legitimate interests.
Change your mind — stop any notification at any time, without losing anything else. Where the switch isn't working yet, ask us and we'll do it for you the same way.

Email [email protected] and we'll answer within 30 days. Asking is free — we won't charge you for it.

If you're in the EU or UK and you think we've got something wrong, you can complain to your national data protection authority. We'd much rather you told us first.

Children

Pupsley isn't for children under 16. If you believe a child has an account, email [email protected]. Reports are reviewed manually.

Changes

If we change what we collect or why, we'll update this page and the date at the top. Anything significant, we'll tell you in the app.

Contact

[email protected], or the contact page. A real person reads it.