PRIVACY POLICY

Last Updated: March 23, 2026 Effective Date: March 23, 2026

1. INTRODUCTION

Welcome to PokiPaw (“App”, “Platform”, “we”, “us”, “our”), operated by Trinx Solutions S.R.L., incorporated under Romanian law with registered office at Str. Loichita Vasile 1 Sc. D Et. 5 Ap. 41, Timisoara, Timis County, Romania (Registration No. J2025005179005, CUI: 51187826).

We take your privacy seriously. This Privacy Policy explains:

What personal data we collect and why
How we use, store, and protect it
Who we share it with
Your rights under the General Data Protection Regulation (GDPR) and Romanian law

This Policy applies to all users of the App across iOS, Android, and Web platforms, worldwide. By using the App, you acknowledge you have read and understood this Policy.

For questions or to exercise your rights, contact us at: privacy@pokipaw.com

2. WHO WE ARE (DATA CONTROLLER)

Trinx Solutions S.R.L. is the Data Controller for all personal data processed through the App, as defined under GDPR Article 4(7).


Company	Trinx Solutions S.R.L.
Address	Str. Loichita Vasile 1 Sc. D Et. 5 Ap. 41, Timisoara, Timis County, Romania
Registration	J2025005179005 / CUI 51187826
Email	privacy@pokipaw.com
DPO	No DPO currently appointed. Contact privacy@pokipaw.com for all data protection matters.

3. WHAT DATA WE COLLECT

We collect three categories of data: data you give us directly, data generated by your use of the App, and data from third-party sign-in providers.

3.1 Data You Provide Directly

Account Registration

Name (or display name)
Email address
Password — hashed by Supabase Auth (we never see or store plaintext passwords)
Profile photo (optional)

Pet Profiles

Pet name, species (16 supported), breed, sex, date of birth, weight
Pet photos
Microchip number (optional)

Pet Health Data (Special Category — Article 9 GDPR)

Vaccination records and dates
Medications, dosages, schedules
Vet visits, diagnoses, lab results, allergies
Body weight, activity, and journal entries (walks, food, water, sleep)
Uploaded documents (vaccine certificates, insurance papers)

This is pet health data, but because it is linked to you as the owner it can constitute special category personal data under GDPR Article 9. We process it only with your consent, given when you start using the health tracking features. You may withdraw consent at any time by deleting the data or your account.

Family Sharing

Join codes you create or enter
Membership in a family group (admin/member role)

Lost & Found and Adoption Posts

Photos, descriptions, contact preferences, and approximate location of a posted lost or adoptable pet

Expense Records

Category, amount, date, optional notes — entered by you

3.2 Data Generated Automatically

Device & Technical Data

Device type, model, OS version
App version
IP address (logged briefly at the server edge)
Crash reports (via Sentry) — stack traces, app state, no personal content

Usage Data (Analytics)

Screens viewed, features used, button taps
Session duration and timestamps
Captured by PostHog, proxied through api.pokipaw.com so the data stays first-party
Session recordings on the website are captured with maskAllInputs enabled — text in input fields is never recorded

Location Data (only when you use Community map features)

Approximate device location (city level) when you open the Community tab to find nearby vets, parks, or pet-friendly venues
Precise location only if you tap “Use my location” — used once and not stored long-term
You can disable location access at any time in your device OS settings

Push Notification Tokens

Device token issued by Firebase Cloud Messaging (FCM) / Apple Push Notification service, stored against your account so we can send reminders and family notifications

3.3 Data from Third Parties

Sign-In Providers (optional) If you choose to log in with Google Sign-In or Sign in with Apple, we receive from them only: your email address, display name, and (Google) profile picture. We do not receive your social passwords or contact lists.

App Stores Apple App Store and Google Play receive your purchase events and provide us with anonymized aggregate analytics (downloads, crashes, ratings).

We do not receive data from advertising networks. We do not use marketing pixels (Meta/Facebook, TikTok, Pinterest, etc.).

4. WHY WE USE YOUR DATA (LEGAL BASES)

We rely on the following GDPR Article 6 (and Article 9 for health data) bases:

4.1 Contract Performance — Article 6(1)(b)

Creating and operating your account
Storing your pets and their data
Family Sharing and group sync
Processing your Premium / Family Seats subscription (via Apple IAP / Google Play Billing)

Storing and analyzing pet health data
Sharing precise location in a Lost & Found post
Receiving push notifications
Analytics cookies on the website (see Cookie Policy at https://www.pokipaw.com/cookies)

You may withdraw consent at any time. Withdrawal does not affect the lawfulness of processing before withdrawal.

4.3 Legitimate Interests — Article 6(1)(f)

Improving the App using aggregated, anonymized usage data
Crash reporting and bug fixing
Platform security and abuse prevention
Responding to support requests

4.4 Legal Obligation — Article 6(1)(c)

Tax and accounting records for App Store / Google Play payouts
Responding to lawful requests from authorities
GDPR breach notification

5. HOW LONG WE KEEP YOUR DATA

Data Category	Retention Period
Account data	Duration of account + 30 days after deletion (then purged)
Pet profiles & health data	Duration of account; deleted upon account deletion
Subscription transaction records	7 years (Romanian accounting law)
Location data (Community map queries)	Not stored long-term; used per session
Lost & Found / Adoption posts	30 days after marked resolved, then archived
Crash logs (Sentry)	90 days
PostHog analytics events (raw)	365 days
Anonymized aggregate analytics	Indefinite (no longer personal data)
Inactive accounts	Notified after 6 months; deleted after 12 months if no response

When data is no longer required, it is securely deleted or irreversibly anonymized.

We do not sell your personal data. We share it only with the processors we need to run the service:

Processor	Role	Where data lives
Supabase	Primary database, authentication, file storage, realtime sync, edge functions	EU region
PostHog	Product analytics (proxied via `api.pokipaw.com`)	EU region
Sentry	Crash and error tracking	EU region
Firebase Cloud Messaging (Google)	Push notification delivery	Global (Google)
Google Maps Platform	Map tiles and place search for the Community tab	Global (Google)
Apple	IAP, Sign in with Apple, APNs push delivery	Global (Apple)
Google	Play Billing, Google Sign-In	Global (Google)

All processors are bound by GDPR-compliant Data Processing Agreements (Article 28). Where transfers leave the EEA, they rely on Standard Contractual Clauses (SCCs) or adequacy decisions.

Pet data shared inside a Family Sharing group is visible to all members of that group. The Family Admin manages who is in the group.

6.2 Other Users (Lost & Found / Adoption)

Posts you create are visible to other users in the relevant area. You control the photos, description, and approximate location you publish.

6.3 Legal Disclosure

We may disclose your data when required by Romanian or EU law, a court order, or to protect the rights, property, or safety of Trinx Solutions S.R.L., our users, or the public. We will attempt to notify you where legally permitted.

6.4 Business Transfers

In a merger, acquisition, or sale of assets, your data may transfer to the successor entity. We will notify you at least 30 days in advance and let you delete your account before the transfer.

7. INTERNATIONAL DATA TRANSFERS

Trinx Solutions S.R.L. is based in Romania (EU) and our primary database (Supabase) is in an EU region. Some processors (Google, Apple) operate globally. When data is transferred outside the EEA we ensure adequate protection via:

Adequacy Decisions by the European Commission, or
Standard Contractual Clauses (SCCs), or
Your explicit consent where required

The current list of processor locations is available on request at privacy@pokipaw.com.

8. DATA SECURITY

Technical measures:

Encryption of data in transit via TLS 1.2+
Encryption of data at rest (Supabase managed encryption)
Row Level Security (RLS) on all database tables — your data is only accessible by your account and Family Sharing group
Password hashing handled by Supabase Auth (bcrypt-equivalent)
Optional biometric lock for the mobile app (Face ID / Touch ID / fingerprint)
Optional screen capture protection

Organizational measures:

Least-privilege access for staff
Data Processing Agreements with all processors
Documented incident response

Data Breach Notification: We will notify the ANSPDCP within 72 hours of becoming aware of a breach likely to risk your rights (GDPR Art. 33), and you without undue delay where the risk is high (Art. 34).

No system is 100% secure. Use a strong password and tell us at privacy@pokipaw.com if you suspect unauthorized access to your account.

You have the following rights. To exercise any, contact privacy@pokipaw.com. We respond within 30 days (extendable to 60 days for complex requests, with notice).

9.1 Right of Access (Article 15)

Request a copy of the personal data we hold about you, in a structured, commonly used format (JSON).

9.2 Right to Rectification (Article 16)

Correct inaccurate data. Most fields are editable directly in the App settings.

9.3 Right to Erasure (Article 17)

Request deletion (“right to be forgotten”). Submit a request at https://www.pokipaw.com/delete-data or delete your account from inside the App. Some data may be retained where required by legal obligation (accounting records).

9.4 Right to Restriction (Article 18)

Ask us to limit processing while a rectification or objection is being assessed.

9.5 Right to Data Portability (Article 20)

Receive your data in a machine-readable format (JSON / PDF export). You can also export a pet’s health record as a PDF directly from the App.

9.6 Right to Object (Article 21)

Object at any time to processing based on legitimate interests. You have an absolute right to object to direct marketing.

Withdraw consent for analytics, location sharing, push notifications, or health data processing at any time. Withdrawal does not affect prior processing.

9.8 Right to Lodge a Complaint (Article 77)

ANSPDCP — Autoritatea Națională de Supraveghere a Prelucrării Datelor cu Caracter Personal B-dul Magheru 28-30, Sector 1, București, România 🌐 www.dataprotection.ro ✉️ anspdcp@dataprotection.ro

You may also contact the supervisory authority in your country of EU residence or place of work.

9.9 Automated Decision-Making (Article 22)

The Health Analytics screen produces informational summaries (weight trends, vaccination due dates, treatment schedules) from data you entered. These are informational only — no automated decisions with significant legal or similarly significant effects are made. Always consult a licensed veterinarian for medical decisions.

10. CHILDREN’S PRIVACY

The App is intended for users aged 16 and over. For users under 16, we require verified parental or guardian consent before collecting any personal data. We collect only the minimum data necessary and do not use children’s data for profiling or marketing. Parents may request access, correction, or deletion at privacy@pokipaw.com.

11. PET HEALTH DATA (SPECIAL CATEGORY)

Scope: pet health data only. PokiPaw collects pet health data exclusively — vaccines, weight, treatments, symptoms, and medication schedules that you enter about your pet. We do not collect human health data, do not integrate with Apple HealthKit, and do not write to iCloud Health.

Pet health data, when linked to an identifiable person (you), may constitute special category personal data under GDPR Article 9. We:

Process it only with your explicit consent
Store it in our Supabase backend (EU region) with Row Level Security
Make it visible only to you and Family Sharing members you authorize
Never share it with advertisers and never use it for profiling
Delete it upon your request

You can manage this consent in Settings → Privacy in the App.

12. COMMUNICATIONS & PUSH NOTIFICATIONS

12.1 Transactional Communications

We may email you essential service messages (subscription receipts, security alerts, policy updates). These are necessary for our contract with you.

12.2 Marketing

We currently do not send marketing emails. If we ever do, it will be opt-in only and unsubscribe will be one click away.

12.3 Push Notifications

With your permission, we send push notifications via FCM/APNs for vaccination reminders, medication doses, family activity, and lost pet alerts. You can disable them in Settings → Notifications in the App or in your device OS settings.

13. COOKIES & TRACKING TECHNOLOGIES

Our website uses only strictly necessary cookies plus (with consent) PostHog analytics. We do not use marketing or advertising cookies of any kind. See the full Cookie Policy at https://www.pokipaw.com/cookies.

Our mobile app does not use browser cookies. It uses on-device storage and the SDKs listed in Section 6 above. The app does not use advertising identifiers (IDFA / GAID) and does not run ads.

14. THIRD-PARTY LINKS

The App and website may link to external sites (vet practice websites, map listings, partner content). This Privacy Policy does not cover those sites — please read their policies.

15. CHANGES TO THIS PRIVACY POLICY

For material changes, we will notify you via in-app notification and/or email at least 30 days before the change takes effect, with a clear summary of what has changed. Where required, we will seek fresh consent.

The “Last Updated” date at the top reflects the most recent revision. Continued use after the effective date constitutes acceptance.

16. CONTACT & DATA SUBJECT REQUESTS

Trinx Solutions S.R.L. Str. Loichita Vasile 1 Sc. D Et. 5 Ap. 41, Timisoara, Timis County, Romania Str. Loichița Vasile 1 Sc. D Et. 5 Ap. 41, Timișoara, județul Timiș, România CUI: 51187826 | J2025005179005


Data Protection Email	privacy@pokipaw.com
Data Deletion Request	https://www.pokipaw.com/delete-data
Response Time	Within 30 days

Romanian Data Protection Authority: ANSPDCP B-dul Magheru 28-30, Sector 1, București 🌐 www.dataprotection.ro ✉️ anspdcp@dataprotection.ro