Boopet01 Who we are and what this policy covers
Boopet is an app for organizing the care of dogs and cats, developed and operated by Oakboo, in Brazil.
This Privacy Policy describes how we handle the information of people who use the Boopet app and the boopet.app website, in compliance with Brazil's General Data Protection Law (LGPD — Law no. 13,709/2018), the Marco Civil da Internet (Law no. 12,965/2014) and the developer policies of Google Play and the Apple App Store.
For the purposes of the LGPD, Oakboo acts as the controller of the personal data processed in Boopet. By creating an account and using the app, you declare that you have read and understood this document. If you do not agree with it, do not use the service.
02 Summary in one table
The whole document is below. This table is just the essentials, for those in a hurry.
| Question | Short answer |
|---|---|
| Do you sell my data? | No. We never sell, rent or hand over personal data for third parties' commercial purposes. |
| Are there ads in the app? | No. Boopet shows no advertising and integrates no ad networks. |
| Is the document photo kept? | No. It is processed for reading and discarded. We keep the extracted text and a record of the scan. |
| Can another user see my pets? | No. Isolation is enforced in the database, per account. |
| Do you track my location? | No, not in the background on our own. Only during a walk you start yourself, and only while it is being recorded. |
| Can I delete everything? | Yes. Deletion of the account and all data within 30 days. |
| Where is my data kept? | On Supabase servers, encrypted in transit and at rest. |
03 Data we collect
We collect only what the app needs to work. Nothing is collected "just in case".
3.1 Account data
- E-mail and password (stored only as a hash, never in readable text), used to create and authenticate your account.
- Display name, when you provide one.
- Verification code sent by e-mail on sign-up confirmation and password reset.
- If you choose to sign in with Google or Apple (when available), we receive from the provider only the account identifier, the e-mail and, if you authorize it, the name. We never receive your password.
3.2 Data about your animals
- Pet profile: name, species, breed, sex, date of birth, weight, height, color, personality traits and the chosen photo or icon.
- Health: vaccines given and dates, veterinary prescriptions, medications, doses and schedules, treatments, diary entries (mood, food, hydration) and documents such as tests and reports.
- Routine: reminders, calendar events, grooming appointments.
- Expenses: amounts, categories, store and date of pet-related purchases.
- Clinics and professionals you record on a prescription.
- Walks (Pro bonus feature): distance, duration and route travelled, when you start a recording.
3.3 Files and images
- Pet photo: stored in a private bucket, accessible only through a temporary signed link generated for your session.
- Document photos (prescription, vaccination card, receipt): sent only for automatic reading and not stored. See section 6.
3.4 Technical and usage data
- Photo-scan records: date, document type, outcome (success, failure or rejection) and the AI model that responded. Used to apply the monthly quota and account for cost. Does not include the image nor a description of what was in it.
- Error logs and stability metrics, used to fix defects.
- Access logs kept by the infrastructure (IP address, date and time), as required by the Marco Civil da Internet.
- Local preferences stored on the device itself (language, active pet, session), with no sensitive content.
04 Legal bases for processing
Each piece of data is processed on a basis provided for in article 7 of the LGPD:
| Purpose | Data involved | Legal basis |
|---|---|---|
| Creating and maintaining your account | E-mail, password, name | Performance of a contract (art. 7, V) |
| Storing and syncing pet data | Profile, health, routine, expenses | Performance of a contract (art. 7, V) |
| Reading documents from photos | Submitted image, extracted text | Consent (art. 7, I) — you choose to photograph |
| Sending reminders | Dates and items you registered | Consent (art. 7, I) — notification permission |
| Recording a walk with GPS | Location during the recording | Consent (art. 7, I) — location permission |
| Security, fraud prevention and quotas | Access and scan records | Legitimate interest (art. 7, IX) |
| Keeping access logs | IP, date and time | Legal obligation (art. 7, II — Marco Civil) |
| Managing the Pro subscription | User identifier, subscription status | Performance of a contract (art. 7, V) |
| User support | E-mail and message content | Performance of a contract / legitimate interest |
05 App permissions
Every permission is requested at the moment of use, with its purpose explained on screen, and can be denied or revoked at any time in the device settings. Denying a permission disables only the corresponding feature — the rest of the app keeps working.
| Permission | When it is requested | What for |
|---|---|---|
| Camera | When photographing a document or the pet | Capture the image that will be read or used as a profile photo |
| Gallery / photos | When choosing an existing image | Select the pet photo or the document to be read. We access only the file you choose |
| Notifications | When creating the first reminder | Alert about vaccines, medication doses and appointments. Notifications are scheduled locally on the device |
| Location | When starting a walk recording | Calculate distance and route. With no walk being recorded, no coordinates are read |
| Internet / network state | Always | Authenticate the account and sync your data |
| Vibration | Always | Haptic feedback when tapping buttons |
06 Reading documents from photos (artificial intelligence)
The Pro photo-scanning feature uses artificial-intelligence models to extract the content of veterinary prescriptions, vaccination cards and receipts. Because it involves sending an image of yours for processing, it deserves a full explanation.
6.1 The image's path, step by step
- You photograph or choose the image. It is downsized on the device itself before leaving it.
- The image is sent over an encrypted connection (TLS) to our server, which checks that your account has an active plan and quota available.
- The server sends the image to the AI model provider, which returns structured fields (medication, dose, date, amount).
- The result comes back to the app for your review. Nothing becomes an active treatment or medication alarm without your confirmation.
- The image is discarded. We persist only the extracted text you confirm and an accounting record of the scan.
6.2 AI keys are never inside the app
The call to the model happens exclusively on the server. No AI provider credential is embedded in the app — if it were, anyone who downloaded the installable package could extract it.
6.3 Model providers
Today we use Anthropic as the model provider. Our architecture allows switching between providers (for example Anthropic, OpenAI or Google) for reasons of quality, cost or availability. We contract these companies under commercial API terms, which provide that submitted content is not used to train models.
6.4 Content moderation
Before any extraction, the image goes through an automatic check for inappropriate content. If it is rejected, we record only the category of the rejection and the number of occurrences on the account — never the image, nor any description of what was in it. Repeated rejections may lead to suspension of the feature, as per the Terms of Use.
07 How we use data
We use the information collected exclusively to:
- provide the service — store and sync your animals' history across devices;
- authenticate your identity and protect your account against unauthorized access;
- calculate the vaccination schedule from the animal's species and age;
- trigger the reminders you registered;
- perform photo scanning and apply the Pro plan's monthly quota;
- identify and fix technical defects;
- respond to support requests and to requests concerning LGPD rights;
- comply with legal obligations and respond to competent authorities, when required.
08 Who we share with
Your data is processed by a deliberately small number of suppliers, each strictly within what is necessary to operate Boopet:
| Supplier | Role | What it receives |
|---|---|---|
| Supabase | Database, authentication and file storage | Account, pet data, photos and documents, encrypted in transit and at rest |
| AI providers (currently Anthropic) | Text extraction from document photos | The image submitted for scanning, transiently. Without identification of your account and without use for training |
| RevenueCat | Subscription management | Your account identifier and the transaction confirmation coming from the store |
| Google Play and Apple App Store | App distribution and subscription billing | Payment data, handled exclusively by the stores — it never reaches Boopet |
| Google / Apple (social login, when available) | Authentication | Confirmation of your identity and e-mail, if you choose that method |
We may also disclose information when there is a legal requirement, court order or request from a competent authority, and when necessary to investigate fraud or protect rights, always within the strict limit of what is required.
In the event of corporate reorganization, merger or acquisition, data may be transferred to the successor, with the obligations of this policy maintained; you will be informed before that happens.
09 International data transfer
Part of our infrastructure and the AI model providers are located outside Brazil, mainly in the United States. This means your data may be processed abroad, a possibility allowed by article 33 of the LGPD.
We select suppliers that offer a level of protection compatible with Brazilian law and sign data protection contractual clauses with them, including obligations of confidentiality, security and restriction of use to the contracted purpose.
10 Security
We adopt technical and administrative measures to protect your data: communication exclusively over HTTPS/TLS, encryption at rest, per-account isolation enforced in the database itself, private file storage with temporary links, and plan verification done on the server — not only on the app screen.
The full description is in Security and Data.
No system is impregnable. Should a security incident occur that may cause relevant risk or harm, we will notify the affected data subjects and Brazil's National Data Protection Authority (ANPD) within a reasonable time, as per article 48 of the LGPD.
11 How long we keep data
| Data | Retention period |
|---|---|
| Account and pet data | While the account is active |
| After an account deletion request | Complete removal within 30 days |
| Document photos sent for scanning | Not stored — discarded after processing |
| Scan records (date, type, outcome) | Up to 12 months, for quota, cost accounting and abuse prevention |
| Error and diagnostic logs | Up to 90 days |
| Access logs (IP, date and time) | 6 months, as per the Marco Civil da Internet |
| Subscription transaction records | For the period required by tax and civil law |
Once the period ends, data is deleted or irreversibly anonymized, except in the cases of mandatory retention set out in article 16 of the LGPD.
12 Your rights as a data subject
The LGPD guarantees you, free of charge and at any time, the right to:
- confirm that your data is being processed;
- access the data we hold about you and about your animals;
- correct incomplete, inaccurate or outdated data;
- request anonymization, blocking or deletion of unnecessary data or data processed in breach of the law;
- request portability of the data to another provider, in a readable format (JSON or CSV);
- obtain information about who we share your data with;
- withdraw consent given for optional features, such as notifications, photo scanning and location;
- object to processing based on legitimate interest;
- petition the ANPD.
To exercise any of these rights, write to contact@boopet.app from the registered e-mail address. We reply within 15 days. We may request additional information to confirm your identity — it is a safeguard against requests made by third parties in your name.
13 Subscription, payments and billing
The Boopet Pro subscription is processed exclusively by Google Play or the Apple App Store. We receive only confirmation that the purchase was made and the subscription status, associated with your account identifier.
We have no access to card numbers, bank details or billing address — that information stays entirely with the store and with the payment method you chose.
Cancellation is done in the store's own subscription settings. Cancelling stops automatic renewal: Pro access remains until the end of the period already paid. Refund requests follow the policy of the store where the purchase was made and section 9 of the Terms of Use.
14 Cookies and this website
The boopet.app website is static and uses no tracking cookies, conversion pixels or analytics tools that identify visitors.
Two honest caveats: (i) the pages load the Nunito typeface from Google Fonts, which makes your browser contact Google servers and exposes your IP address to that contact; and (ii) the hosting service keeps technical access logs, as is standard for any website.
15 Children and teenagers
Boopet is intended for people 13 years old or older. We do not knowingly collect data from children under 13 and do not direct the product to that audience. If we identify an account created by a child, it will be removed.
If you are a legal guardian and believe that a child in your care has created an account, write to contact@boopet.app and we will delete it immediately.
16 Changes to this policy
This policy may be updated to reflect changes in the product, in suppliers or in legislation. When a change is relevant, we will update the date at the top of this page and give notice inside the app or by e-mail before the change takes effect.
We will keep information about the current version available. Continued use of the app after the notice means agreement with the updated text.
17 Contact
Questions about privacy and requests for access, correction, portability or deletion of data should be sent to our data-subject channel:
Data Protection Officer (DPO)
Talk to us about any matter of privacy, LGPD or data deletion.
Controller: Oakboo · Brazil · Reply within 15 days.Company name and tax ID: to be filled in before publishing — see Legal Information.