Effective: 6 October 2026 · Version 1.6
This is a translation of the Turkish original. If the two versions ever disagree, the Turkish version prevails.
This policy covers the SarPet app for iOS and Android, and the services at sarpet.app and api.sarpet.app.
SarPet decides why and how your personal data is processed and is responsible for it. Contact details are in section 15.
The table below is the complete list of what the app actually stores. If a field isn't listed here, we don't collect it.
| Data | Contents | How we get it |
|---|---|---|
| Device identifier | An identifier the app generates on your device. It is the key to your account. | Automatically, on first launch |
| Profile (optional) | First name, last name, email, phone, language preference | Only if you enter it |
| Pet details | Name, species, breed, date of birth, sex, neuter status, weight, colour, identifying numbers and photos | Only if you enter it |
| Health records | Vaccinations, clinic visits, diagnoses, medications and treatments, dose schedules, allergy and chronic-condition flags, weight/water/food logs, tasks, reminders and tags | Only if you enter it |
| Walk and activity records | Start and end time, duration and — if you allowed it — the walking distance read from Apple Health or measured on Apple Watch (details) | If you use walk or activity mode |
| Documents | Files you add: vaccination cards, lab results, X-rays, prescriptions, invoices and the like | Only if you take or upload them |
| Share links | The link code, its permission scope, its expiry date and how many times it has been opened | When you create a link |
| Pending entries | Records submitted by a vet through a write-enabled link, plus the name they typed | If a third party submits one |
| Notification preferences | Which notification types you've enabled, and a log of what was sent | Automatically |
| AI usage log | Which feature ran, which model was used, how long it took and whether it succeeded. The content sent or returned is not stored. | Automatically |
| Technical logs | Crash reports, error logs and aggregate statistics about which screens are used | Automatically |
We don't ask for an email address or a password to create an account. Your account is tied to a device identifier. That means you can use the app without handing over any personal details — but it also means that if you lose your device, there is no way for us to give your records back. We recommend adding an email address on the profile screen.
Health permissions are optional. Without them walk mode still works; the walk is saved with its duration only.
These are deliberate choices, not omissions:
We run advertising campaigns to promote SarPet. To measure which campaign works, we use your device's advertising identifier (IDFA on iOS, Advertising ID on Android).
In the App Store's terms this counts as tracking, which is why the app asks you for separate permission.
This processing relies solely on your consent. Refusing, or withdrawing later, has no consequences.
| Purpose | Legal basis |
|---|---|
| Storing your health records and showing them back to you | Performance of a contract |
| Sending vaccination and dose reminders | Performance of a contract; you can turn notifications off in settings |
| Reading a vaccination card photo (OCR) | Consent — you start the feature yourself |
| Reading document, food label and food/water bowl photos | Consent — you start the feature yourself |
| Creating collection cards from your pet's photo (section 6) | Performance of a contract — no card is created if you don't add a profile photo or remove it |
| Creating and serving a share link | Consent — you create the link yourself |
| Reading walking distance from Apple Health; saving walks started on Apple Watch to Health as workouts | Consent — you grant the Health permissions and can revoke them at any time |
| Fixing crashes and improving the service | Legitimate interests |
| Preventing abuse and excessive request traffic | Legitimate interests |
| Measuring advertising campaigns (section 4) | Consent — nothing happens if you decline |
Health information about your pet belongs to your pet, not to a person, so it is not your personal health data. We still treat these records as sensitive and protect them with the same care.
AI comes from two providers: OpenAI for reading and text, and Google (Gemini API) for collection card images.
These run only when you start them:
When your pet levels up, the photo you added to your pet's profile is sent to Google's Gemini API together with your pet's name and species, and Gemini creates the card image from that photo. The created image is kept in our storage (Cloudflare R2) and shown only to you; if you share it, it goes where you share it.
No card is created if the profile has no photo. You can change or remove the photo at any time. We recommend using a photo that shows only your pet.
OpenAI and Google commit not to use data submitted through their paid APIs to train their models. Your name, email address and phone number are never part of these requests.
On our side we keep only a usage log: which feature, which model, how long it took, whether it succeeded, and the amount of data processed for cost tracking. The photo sent and the text returned are not written to that log.
We use the providers below to run the service. Each acts as a processor, working only on our instructions:
| Provider | Used for | What reaches them |
|---|---|---|
| Hostinger | Server and database | All account and record data (Frankfurt, Germany) |
| Cloudflare R2 | Document and photo storage | The files you upload |
| OpenAI | Vaccination card and document reading, food/water photos, vaccination plan suggestions, breed matching, care profile text | Only the photo or text for that request |
| Google (Gemini API) | Creating collection card images | Your pet's profile photo, name and species |
| OneSignal | Push notification delivery | Device push token, notification text |
| Google Firebase | Crash reporting, usage analytics, messaging, remote config, campaign measurement | Device and version info, crash traces, screen events; your advertising identifier if you allowed it |
| Amplitude | Product analytics: which features are used and whether people come back to the app | Defined app events (e.g. walk finished, report created), session and app-open information, device and version info, your account number. No advertising identifier. |
| Adapty | Subscription management and ad campaign measurement | Subscription status, device and store information; your advertising identifier if you allowed it |
| Apple · Google | App distribution and in-app purchases | Purchase records (your card details never reach us) |
No health data reaches any of these providers. Distance read from Apple Health or measured on Apple Watch is stored only on our own server, as part of the walk record.
Some of these providers are located abroad, and your data may be stored and processed on servers in those countries. Such transfers rely on our agreements with the providers and their commitment to process data only to provide services to us. By using SarPet, you accept that your data may be processed abroad in this way.
We are not liable for outages, failures or security breaches that occur within these providers' own systems and areas of responsibility, unless we are at fault.
Apart from these, we share data only where we are legally required to (a court order or a request from a competent authority).
The database and application server are located in Frankfurt, Germany. The documents you upload are stored on Cloudflare R2.
Documents cannot be reached directly: the app generates a short-lived, signed URL for every download. Once it expires, the URL stops working.
You can delete your account yourself from Profile → Delete account in the app. You don't need to ask us or wait for us.
We take reasonable technical and organisational measures to protect your data, but no system is completely secure and we cannot guarantee the absolute security of any transmission over the internet. If we determine that your personal data has been accessed by unauthorised persons, we will notify you and, where necessary, the competent authorities without undue delay.
Regarding your personal data, you have the right to:
You can exercise most of these instantly inside the app: edit or delete records, turn notifications off, and delete your account entirely. For anything else, write to us; we respond to requests within 30 days.
If our response doesn't satisfy you, you can apply to the competent data protection authority in the country where you live.
SarPet is not directed at children under 13, and we do not knowingly collect data from them. Everyone who uses SarPet confirms that they meet the age requirement for using this kind of service where they live. If we learn that a child's data has been processed without the appropriate permission, we delete it without delay.
We may update this policy. When we do, we update the effective date at the top of this page. If a change materially affects what we collect or how we use it, we will tell you inside the app before it takes effect.
For any privacy question, request or complaint: support@sarpet.app
It helps if you tell us which device you use: because accounts are tied to a device identifier, we have no other way to match you to your records.