PetMuse Privacy Policy

Introduction

Welcome to PetMuse ("we," "our," or "us"). We are committed to protecting your privacy and ensuring you understand how we collect, use, and safeguard your personal information when you use our mobile application ("App").

This Privacy Policy explains our practices regarding the collection, use, and disclosure of information when you use PetMuse, and tells you about your privacy rights and how the law protects you.

By using PetMuse, you agree to the collection and use of information in accordance with this Privacy Policy.

1. Information We Collect

1.1 Information You Provide Directly

Account Information

• Email address (required for account creation)
• Password (stored securely using industry-standard encryption)

Pet Information

• Pet names you create within the App
• Pet photos you upload to the App (stored locally on your device, not on our servers; temporarily transmitted to Google's Gemini API via our server-side function during artwork generation)

User Content

• Preferences and selections made within the App (art styles, formats, resolutions)

1.2 Information Collected Automatically

Usage Data

• Generation history (metadata including style selected, format, resolution, timestamp)
• Credit balance and transaction history
• App interaction patterns for service improvement

Device Information

• Device type and operating system version
• Unique device identifiers for session management
• App version

We Do NOT Collect

• Location data
• Contact lists or address books
• Microphone or camera access beyond photo selection
• Browsing history outside the App
• Advertising identifiers for ad targeting

1.3 Information from Third Parties

Apple App Store

When you make in-app purchases, Apple processes your payment. We receive a transaction receipt but do NOT receive your payment card details, billing address, or Apple ID password.

2. How We Use Your Information

We use the information we collect for the following purposes:

2.1 To Provide Our Service

• Creating and managing your account
• Maintaining pet profile metadata and displaying your pet photos (which are stored locally on your device)
• Generating AI artwork of your pets using Google's Gemini AI
• Tracking your credit balance and purchase history
• Saving your generation history metadata

2.2 To Process Transactions

• Validating in-app purchase receipts with Apple
• Adding credits to your account after successful purchases
• Maintaining purchase records for customer support and legal compliance

2.3 To Communicate With You

• Responding to customer support inquiries
• Sending transactional notifications (e.g., purchase confirmations)

2.4 To Improve Our Service

• Understanding how users interact with the App
• Identifying and fixing bugs or issues
• Developing new features based on usage patterns

2.5 To Comply With Legal Obligations

• Responding to lawful requests from authorities
• Maintaining records required by law (e.g., financial transaction records)

3. Data Storage and Security

3.1 Where Your Data Is Stored

Cloud Database (Supabase)

Your account information and metadata are stored securely using Supabase, a cloud database platform. This includes your email address, pet profile names, generation history metadata (style, format, resolution, timestamps), credit balance, and purchase records. Supabase:

• Uses Amazon Web Services (AWS) infrastructure
• Encrypts data in transit using TLS/SSL
• Encrypts data at rest using AES-256 encryption
• Implements Row-Level Security (RLS) ensuring you can only access your own data
• Maintains SOC 2 Type II compliance

Important: Pet photos and generated images are not stored on our servers. Only metadata (such as filenames and associations) is stored in the cloud database.

Local Device Storage

Pet photos and generated AI artwork images are stored locally on your device in the App's private document directory. These files:

• Are NOT uploaded to or stored on our servers
• Are accessible only within the App on the device where they were created
• Are backed up to your iCloud if you have iCloud backup enabled for the App
• Can be explicitly saved to your Camera Roll at your discretion

Device switch or reinstall: Because pet photos and generated images are stored only on your device, they will not be available if you switch devices or reinstall the App. Pet photos can be re-uploaded from your Camera Roll. We recommend saving generated images to your Camera Roll (Photos), where iCloud handles cross-device sync.

3.2 Security Measures

We implement appropriate technical and organizational security measures including:

• Secure session tokens stored in iOS Keychain (expo-secure-store)
• HTTPS encryption for all data transmission
• Row-Level Security policies ensuring data isolation between users
• API authentication for all server requests
• Regular security reviews and updates

3.3 Data Breach Notification

In the unlikely event of a data breach that affects your personal information, we will notify you via email within 72 hours of becoming aware of the breach, as required by applicable law.

4. Third-Party Services

4.1 Google Gemini AI

We use Google's Gemini AI model to generate artistic images of your pets. When you request an image generation:

• Your pet photos are read from local device storage and transmitted from your device to our server-side function, which forwards them to Google's Gemini API
• Photos are used solely to generate your requested artwork and are not stored on our servers
• Google processes these images solely to generate your requested artwork
• Google's use of this data is governed by Google's Privacy Policy

Important: All AI-generated images contain an invisible digital watermark called SynthID, embedded by Google's AI system. This watermark identifies content as AI-generated and cannot be removed.

4.2 Apple In-App Purchases

Credit purchases are processed through Apple's App Store. Apple:

• Handles all payment processing
• Does not share your payment details with us
• Provides us only with purchase receipts for validation
• Is governed by Apple's Privacy Policy

4.3 Supabase

Our backend infrastructure is provided by Supabase Inc. Their services are governed by Supabase's Privacy Policy.

5. Data Retention

5.1 Active Accounts

5.2 Deleted Accounts

When you delete your account:

1. Immediate: Your account is soft-deleted and you can no longer sign in
2. 30-Day Grace Period: Your server-side data is retained in case you change your mind
3. After 30 Days:
   • All pet profile metadata is permanently deleted from our database
   • All pet photo metadata records are permanently deleted from our database
   • All generation metadata is permanently deleted from our database
   • Your user record is permanently deleted
   • Only anonymized purchase records are retained (for legal/financial compliance)

Locally stored files: Pet photos and generated images stored on your device are not affected by account deletion. These files remain on your device until you delete them manually or uninstall the App.

5.3 Locally Stored Images

Pet photos and generated artwork images are stored locally on your device and remain there until you delete them manually or uninstall the App. We do not have access to or control over files stored locally on your device.

If you switch devices or reinstall the App, locally stored files will not be available. Pet photos can be re-uploaded from your Camera Roll. Generated images that you have saved to your Camera Roll (Photos) will be available via iCloud sync.

6. Your Privacy Rights

6.1 Rights for All Users

Regardless of your location, you have the right to:

• Access: Request a copy of the personal data we hold about you
• Correction: Request correction of inaccurate personal data
• Deletion: Request deletion of your account and associated data
• Portability: Request your data in a machine-readable format (JSON)

To exercise these rights, please contact us at support@petmuse.app, or use the in-app account management features.

6.2 Additional Rights for European Union Residents (GDPR)

If you are located in the European Economic Area (EEA), you have additional rights under the General Data Protection Regulation (GDPR):

• Right to Access (Article 15): You can request a copy of all personal data we process about you.
• Right to Rectification (Article 16): You can request correction of inaccurate data.
• Right to Erasure / "Right to be Forgotten" (Article 17): You can request deletion of your personal data. Use the "Delete Account" feature in Settings.
• Right to Data Portability (Article 20): You can request your data in a structured, machine-readable format.
• Right to Withdraw Consent: Where we rely on consent for processing, you can withdraw it at any time.
• Right to Lodge a Complaint: You have the right to lodge a complaint with your local data protection supervisory authority.

Legal Basis for Processing: We process your data based on:

• Contract: To provide you with our service (account, generation, purchases)
• Consent: For optional features and communications
• Legal Obligation: For financial record-keeping requirements

6.3 Additional Rights for California Residents (CCPA)

If you are a California resident, you have additional rights under the California Consumer Privacy Act (CCPA):

• Right to Know: You have the right to request disclosure of the categories and specific pieces of personal information we have collected about you.
• Right to Delete: You have the right to request deletion of your personal information, subject to certain exceptions.
• Right to Opt-Out of Sale: We do NOT sell your personal information to third parties. Therefore, there is no need to opt-out.
• Right to Non-Discrimination: We will not discriminate against you for exercising your CCPA rights.

Categories of Information Collected (in the past 12 months):

• Identifiers (email address, device identifiers)
• Commercial information (purchase history)
• Internet or network activity (app usage data)
• Visual information (pet photos you upload)

Categories of Information Sold: None. We do not sell personal information.

Categories of Information Disclosed for Business Purposes:

• Pet photos sent to Google Gemini for AI processing
• Purchase receipts sent to Apple for validation

To exercise your CCPA rights, contact us at support@petmuse.app.

7. Children's Privacy

PetMuse is not directed at children under the age of 13. We do not knowingly collect personal information from children under 13. If you are a parent or guardian and believe your child has provided us with personal information, please contact us immediately.

If we discover that we have collected personal information from a child under 13, we will take steps to delete that information as soon as possible.

8. International Data Transfers

Your information may be transferred to and processed in countries other than your country of residence, including the United States, where our service providers (Supabase, Google) operate data centers.

When we transfer data internationally, we ensure appropriate safeguards are in place:

• Standard Contractual Clauses approved by the European Commission
• Service providers with adequate data protection certifications
• Encryption of data in transit and at rest

9. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will notify you of any changes by:

• Posting the new Privacy Policy in the App
• Updating the "Last Updated" date at the top of this document
• For material changes, notifying you via email or in-app notification

We encourage you to review this Privacy Policy periodically for any changes. Changes are effective when posted.

10. Contact Us

If you have any questions about this Privacy Policy, your privacy rights, or our data practices, please contact us:

Email: support@petmuse.app

Response Time: We aim to respond to all privacy-related inquiries within 30 days.

For EU residents, you may also contact your local data protection authority if you have concerns about how we handle your personal information.

11. Summary of Key Points

This Privacy Policy is effective as of April 22, 2026.