Dog Walk Tracker — Privacy Policy

Last updated: TODO: fill in the publish date.

Draft. This policy describes the current iCloud (CloudKit) version of the app. Parts marked in yellow are not final yet.

TODO: Legal entity name — for example, "Jane Doe, an individual" or "Example Software LLC." TODO: Jurisdiction/governing law and registered address.

This policy explains what Dog Walk Tracker collects, where it lives, and how you control it. It applies to the iPhone app, the Apple Watch app, and any web pages the developer publishes about the app.

The short version

Your walks, routes, dog photos, and notes stay in your iCloud private space, or in a private CloudKit family share you explicitly join. The developer cannot read them.
Making a dog's profile public shares only a name, handle, avatar, bio, and lifetime totals. It never shares your exact walk routes.
Walk photos you choose are resized and stripped of GPS metadata, then stored in your private iCloud space with a local copy for offline use. Family members can access them only when the walk belongs to the family’s private CloudKit share.
Share-card images are built on your device. Nothing is uploaded to make a share card.
The app has no ads and does not track you across other apps or websites. RevenueCat processes purchase history for access validation and subscription analytics.
You can export or delete everything from inside the app.

Who processes your data

Two places are described here for walk and profile data: your own iCloud private database, and the app's CloudKit public database. Purchase records are additionally processed by Apple and RevenueCat, as described below. The two walk/profile databases run on Apple's CloudKit infrastructure, inside the container iCloud.org.zebralabs.dogwalk. TODO: Legal entity name does not operate a separate application server or database.

Private data (your iCloud account)

The following stays in your private CloudKit database, inside your own iCloud account, under your own Apple ID and your own iCloud storage quota:

Your account settings (display name, default dog, preferred units).
Every dog profile you create: name, handle, breed, birthday, bio, and photo.
Every walk: start/end time, duration, distance, pace, and device it was recorded on.
The exact GPS route of every walk, down to the recorded point.
Every pee, poop, water-break, and note event, with its timestamp and coordinates.
The resized, metadata-free pictures you attach to completed walks.

TODO: Legal entity name has no technical access to this private database. Apple's CloudKit private database is scoped to the signed-in iCloud account; the developer's CloudKit role does not grant read access to another user's private records. If you delete your iCloud account or disable this app's iCloud access, this data becomes unreachable to the app.

A small local cache also lives on your iPhone and Apple Watch, for offline recording and fast app launches. This local cache never leaves your device except through CloudKit sync to your own iCloud account.

You can create or join a family of up to four people. The owner shares the app's private CloudKit zone through Apple's CloudKit sharing system, so accepted members can view and update the same dogs, walks, routes, events and shared account defaults. Other people cannot browse this content, and the developer does not gain access. A random invite code is stored for seven days in the public database; that record contains only the code, its expiry, and Apple's opaque share URL.

The shared account stores whether the owner's verified plan is lifetime access or the date through which it sponsors family members. It does not store payment-card or receipt details. Leaving a family removes its shared data from that member's devices and returns them to their separate private space.

Public data (opt-in only)

Nothing described in this section happens until you explicitly turn a dog's profile public. Public data lives in the app's shared CloudKit public database, which is readable by other users of the app. It contains only:

The dog's claimed handle (such as @kuki) and display name.
A resized public avatar image, re-encoded on your device with all metadata (including location EXIF data) stripped before upload.
An optional bio and breed, if you filled them in.
An optional country code, only if you explicitly enable it. No city or address is ever inferred or published.
Lifetime aggregate statistics: total distance, total walk count, total active time, and unique exploration-cell count.
Leaderboard rows, if you opt the dog into leaderboards: the same aggregate figures, broken down by week, month, and all-time.

Your exact GPS routes are never published, under any setting. The public database has no field that can hold a route, a coordinate list, or a list of exploration cells' coordinates — see Packages/AppCore/Sources/DogWalkCore/Privacy/PrivacyScrubber.swift for the code-level guard that checks this. Leaderboard and profile rows carry only pre-computed aggregate numbers.

Turning a profile back to private removes its public profile and leaderboard rows. Your claimed handle stays reserved to you so nobody else can take it while you decide whether to republish.

When you generate a share-card image from a completed walk, the map, route line, dog avatar, and statistics are composed entirely on your device using Apple's MapKit. Nothing about a share card is uploaded to make it. By default, the shared route hides the portion of the path near your start and end point, so a walk that begins or ends at home does not reveal your address. You can preview exactly what will be shared before you save or send it, and you choose where the finished image goes (Messages, Files, another app, or your Photos library) through Apple's standard share sheet.

Account and identity

The app uses Sign in with Apple for account identity. The app requests the minimum scope it needs — your name, to personalize the app — and does not request your email address unless a future version genuinely needs it. Your Sign in with Apple identifier is stored in your device's Keychain and, where needed for cross-device state, in your private CloudKit database. It is never placed in the public database and never shown to other users.

The app does not operate its own password database, and there is no separate application account outside of Sign in with Apple plus your iCloud account.

Location

The app uses your device's location only while a walk is actively being recorded, to draw the route and calculate distance and pace, including while your screen is locked or your watch wrist is lowered. Location access is not requested at first launch; it is requested the first time you start a walk. Background location tracking stops as soon as a walk ends.

The app shows weather with Apple WeatherKit. After you have allowed location access, the Home screen sends the device's last known location, or the start point of your latest walk, to Apple Weather to show the current weather. It does not start new location tracking for this. After a walk, the start point of the route and the start time are sent to Apple Weather to save the weather for that walk. The weather is stored with the walk in your private CloudKit database. Apple's handling of these requests is described in Apple's privacy policy.

Photos

You choose a photo for a dog's profile from your Photos library, or take one with the camera. Only the version you pick is used; it is resized and stored as part of that dog's private data, and a separate, further-resized copy with metadata stripped is used for the public avatar if the profile is public.

Completed walks can also have up to 20 pictures selected through Apple’s private photo picker. The app receives only selected pictures. Copies are resized to at most 2048 pixels on the longest edge, re-encoded as JPEG, and stripped of source metadata (including GPS and capture dates). They are cached locally and synced as assets in the same private CloudKit zone as the walk, so they restore on another iPhone and are available to accepted family members. Sharing opens Apple’s share sheet for one picture or all pictures from that walk. Removing a walk photo, its walk, or the account removes the app’s private copy without changing the original in your Photos library.

Moderation data

If you report a public dog profile, the report is stored as a restricted AbuseReport record that only the developer can read — it is configured with World: no access in CloudKit, so no other user of the app can browse reports. See Docs/moderation-runbook.md for how reports are handled. If you block a public profile, the block list is stored privately on your own device/account and is never shared with the blocked party or any other user.

What this app does not do

No advertising and no ad networks.
No advertising analytics. RevenueCat is used for purchase validation and subscription analytics; it does not receive your walk routes, photos or notes.
No tracking of you across other companies' apps or websites, and no data used for cross-app/cross-site advertising tracking.
No selling or renting of your data to anyone.
No public feed, comments, likes, or messaging in this version of the app.

Data retention

Private data is kept until you delete the specific walk, dog, or your account. Public profile and leaderboard rows are kept only while a dog's profile is public, and are removed when you make it private or delete your account. Abuse reports follow the retention policy described in Docs/moderation-runbook.md. Temporary local files used to render a share-card image are cleaned up automatically and are not retained.

Exporting your data

Settings → Export My Data builds a local export bundle containing your dog profiles, walks, events, and each walk's route as a GPX file, and saved walk photos under photos/<walk ID>/. It is generated entirely on your device and handed to you through the system share sheet — nothing is uploaded to build it.

Deleting your data

Settings → Account → Delete Account and All Data removes:

Your public dog profile(s) and leaderboard rows, first and with highest priority.
Your claimed handle(s).
Your private CloudKit records: events, routes, walks, dogs, and account.
Your local on-device cache and active-walk journal.
Your Sign in with Apple credentials from this device's Keychain, together with revocation of the Sign in with Apple token where the developer's token-revocation helper is available; otherwise the app shows you Apple's manual revocation steps (Settings → Apple ID → Sign in & Security → Sign in with Apple).

For a family member, deletion first leaves the family and does not delete the owner's dogs or walks. For the family owner, deleting the account deletes the shared family data for every participant.

If part of the deletion cannot complete immediately (for example, no network connection), the app keeps retrying in the background and does not report deletion as finished until it has actually happened.

Children

This app is not directed at children and does not knowingly collect data from children. TODO: confirm the intended App Store age rating and add any required children's-privacy language for your jurisdiction.

Changes to this policy

TODO: Legal entity name will update this document when the app's data practices change, and will update the "Last updated" date above.

Contact

TODO: support contact email/URL (see AppConstants.supportEmail / AppConstants.supportURL in the codebase for the current placeholder values, and confirm they are real, monitored addresses before submission).

Purchases and RevenueCat (subscription launch update)

Dog Walk Unlimited offers monthly and yearly auto-renewing subscriptions and a one-time, non-consumable lifetime purchase. Eligible subscription customers can receive an introductory free trial. Apple handles payment information; Dog Walk does not receive your card details.

RevenueCat validates purchases, restores access, and reports subscription performance. Its SDK sends purchase/transaction information and a pseudonymous app user identifier to RevenueCat. The current integration does not send your dog names, photos, walk routes, notes, sign-in name, or email to RevenueCat, and does not enable advertising attribution or customer attributes. Purchase history is used for app functionality and subscription analytics. See RevenueCat's privacy policy.

Cancelling a subscription keeps access through the remaining paid or trial period reported by Apple. Saved walks, photos, editing and export remain accessible after access expires. Deleting local dog/walk data does not cancel an Apple subscription or erase Apple's transaction records. Use Settings → Manage subscription to manage renewal. Contact the published support address for requests concerning purchase records held by RevenueCat; implement and verify the support process and applicable retention requirements before launch.

This section supersedes earlier claims that all data stays solely on-device or in CloudKit or that the app has no third-party analytics. The final published policy must reconcile the rest of this draft with the production services actually enabled at launch.