Privacy

What you give us when you activate a tag

The profile you fill in: your pet’s name, breed, birth date (or as much of it as you know) and weight (with its unit); your name, phone number, email, city and the languages you speak; a trusted contact’s name, phone, relation to you, languages, messengers and a note; health details you choose to add (allergies, medication, rabies vaccinations — the date, and the vaccine and how long it is valid if you add them — microchip number, and the tick and flea treatments you record — the product, the date and how often it is repeated); sex, colour and marks; a vet clinic and its phone; any notes; and up to three photos. Only the pet’s name and your phone are required.

To sign in you use Google, Apple or a link sent to your email. We keep the email address that sign-in gives us and nothing else from that account.

If you connect Telegram from your dashboard, we keep the identifier of your Telegram account and chat, your username and the language you connected in — only to send you the reminders you asked for (a tick treatment or a vaccination about to run out). Nothing else is sent there. You can connect up to two of your own Telegram accounts. When you record a dose through the bot’s menu, your answers are kept only until the record is saved or a day passes. Disconnecting, on the dashboard or with /stop in the chat, removes the link at once.

You may add up to two trusted contacts per pet in Telegram, by sending them an invite link yourself. For each we keep the same identifiers, their username and first name, the name you gave them and which pet they are for; they get the same reminders about that pet (and, once it ships, the alert if the pet is found). They see nothing else — not the profile, not your details. Only you can add or remove them; they can leave with /stop. They are removed when the pet is handed over or deleted.

What a finder sees

Everyone who taps the tag, or has its link, sees the profile: the pet (including sex, colour and marks), your name, phone, email, city and languages, your trusted contact’s name, phone, languages, messengers and note, the health details you added (allergies, medication and whether it is needed regularly, the latest rabies vaccination, microchip number, and the latest tick treatment — never the earlier vaccinations and treatments, which only you see), the vet, the notes, and the portrait and side-view photos. No sign-up, no app — a stranger with your dog on a lead must be able to call you at once.

The nose close-up is different. It is private: stored separately, with no public link at all, visible to you only. It exists to help confirm the pet is yours if that is ever needed.

If the owner chose to hide their number, the page shows the “I found this pet” button instead (or shows the number only after you leave a contact). What you type there — a way to reach you, a message, a photo if you add one, and your location only if you tick the box — goes to the owner and the people they trust, by Telegram, and is kept for 30 days, then deleted. We also keep the coarse place (country, city) and the same salted address hash as for a tag read, to stop repeated or automated reports. Nothing you leave is published anywhere.

What we record when a tag is read

• the time, and what the reader got: a profile, an activation screen, an unknown tag, or an inactive one;
• the country and city, as our hosting provider resolves them from the connection — we never look up an address ourselves;
• the kind of device, from what the browser sends (roughly “iPhone or Android”);
• a salted hash of the network address — never the address itself. The hash lets us count how many different phones read a tag; it cannot be turned back into an address.

We use this for support — “which tag did the customer actually tap?” — and to understand how often tags are used. It is not shared and not sold.

Photos

Photos are re-encoded in your browser before they are uploaded. The location your camera embeds in a picture (EXIF, including GPS) is removed in that step and never reaches us.

The portrait and side view are served from a link with an unguessable name; whoever has the link can open the picture, which is the same rule as the profile itself. The nose photo is served from a private store and can only be opened by you.

How long we keep things

• Your profile and photos: for as long as the tag is active.
• A deleted profile: 30 days, so you can restore it if you change your mind. During those days the tag stays yours and shows nobody anything. After 30 days the profile and its photos are erased.
• Tag-read records: 12 months, then deleted.

What you can do

• Change anything from your profile’s edit page, at any time.
• Remove a photo, or all of them.
• Delete the profile; restore it within 30 days.
• Ask us to erase your data sooner, or to send you what we hold, at hello@bloomtag.me.

Who processes data for us

Supabase stores the database, the photos and the sign-in. Vercel hosts the site and resolves the country and city of a connection. We use no advertising trackers. Besides the tag-read records above there is one piece of analytics: Vercel Web Analytics counts page views on every page, including profiles — which page, when, from which country and on what kind of device. It sets no cookies and does not identify you; a visitor is told apart from the next one by a hash that is reset every day. The site itself keeps two cookies: your sign-in session, and the language you chose, so that it stays the same from one page to the next.

Changes

When this notice changes, the date at the top changes with it. Questions and requests: hello@bloomtag.me.