Privacy Policy
Version 1.0 · In effect from 29 July 2026
This Privacy Policy explains how PETNESTORY LTD collects, uses, discloses, and protects personal data when you use the PetNestory mobile application and this website, and sets out your rights under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.
Contents
- Data controller and contact details
- Scope of this policy
- Categories of personal data we process
- How we obtain personal data
- Purposes and lawful bases
- Special category data and criminal offence data
- Disclosure to other users
- Recipients and processors
- International transfers
- Content moderation and automated processing
- Retention
- Security
- Your rights
- Children
- Cookies and similar technologies
- Changes to this policy
- Complaints
1. Data controller and contact details
The data controller in respect of the personal data described in this policy is:
- PETNESTORY LTD
- Registered in England and Wales, company number 17252111
- Registered office: Flat 172 Marathon House, 33 Olympic Way, Wembley, England, HA9 0GF
- Email: support@petnestory.com
References in this policy to we, us, and our are to PETNESTORY LTD. References to you are to the individual whose personal data we process. We have not appointed a Data Protection Officer, as we are not required to do so under Article 37 UK GDPR; enquiries should be sent to the email address above.
2. Scope of this policy
This policy applies to the PetNestory iOS application (the App) and to this website. It does not apply to third-party services that you may reach from the App or the website, which are governed by their own privacy notices.
Information you record about an animal is not personal data under the UK GDPR, because data protection law protects identified or identifiable living individuals and not animals. However, records about an animal may indirectly reveal information about you as its keeper, and we therefore apply the protections in this policy to those records as well.
3. Categories of personal data we process
| Category | Data |
|---|---|
| Account data | Email address; a unique account identifier; the authentication method used (email and password, Apple, or Google); optional nickname; optional profile image; account creation and update timestamps. Where you register with a password, that password is stored by our authentication processor as a salted cryptographic hash and is not accessible to us. |
| Animal records | Name, species, breed, sex, date of birth, adoption ("gotcha") date, personality and description fields, and images of each animal you add. |
| Care records | Veterinary visits, vital signs including weight and body condition score, medication entries, appointment reminders, and lifestyle entries across exercise, rest, feeding, grooming, mental enrichment, outings, health, and custom categories, together with free-text notes and dates you enter. |
| Content data | The text, images, video, tags, and visibility setting of each story you publish, and technical metadata about uploaded media (pixel dimensions, duration, file size, MIME type, and a cryptographic hash used for de-duplication). |
| Social data | Friend requests sent and received and any message attached to them; the status and history of each connection; accounts you have blocked; and reports you submit concerning content or other users, including the reason selected. |
| Technical data | Push notification token (where you enable notifications); application version; device model; operating system version; crash diagnostics; and aggregate usage events generated by our analytics processor. |
We do not process location data. The App requests no location permission from your device and records no geolocation coordinates.
We do not sell personal data and do not use your content, your animals' records, or your social activity for advertising or for the purposes of any third party.
4. How we obtain personal data
We obtain personal data:
- directly from you, when you register, complete your profile, add animals and records, publish stories, or contact us;
- from Apple or Google, where you choose to authenticate using their sign-in services, which provide us with an account identifier and the associated email address;
- from other users, where they send you a friend request, or submit a report concerning your account or content; and
- automatically from your device, in the form of the technical data described above.
Providing account data is necessary to create an account. If you do not provide it, we cannot make the App available to you. All other data is optional and is provided at your discretion.
5. Purposes and lawful bases
We process personal data only where a lawful basis under Article 6 UK GDPR applies. The bases on which we rely are set out below.
| Purpose | Data | Lawful basis |
|---|---|---|
| Creating and administering your account and authenticating you | Account data | Article 6(1)(b) — performance of a contract |
| Storing your animals, care records, and stories and synchronising them across your devices | Animal, care, and content data | Article 6(1)(b) — performance of a contract |
| Making your stories visible to the audience you have selected | Content and social data | Article 6(1)(b) — performance of a contract |
| Enabling other users to find you and to send and answer friend requests | Account and social data | Article 6(1)(b) — performance of a contract |
| Sending push notifications concerning friend requests and reminders you have configured | Technical data | Article 6(1)(a) — consent, given through the iOS notification permission prompt and withdrawable at any time |
| Screening uploaded media for unlawful and harmful content, and investigating reports | Content and social data | Article 6(1)(f) — legitimate interests in maintaining a safe service and protecting users; and Article 6(1)(c) where a legal obligation applies |
| Applying publication limits and preventing abuse, fraud, and misuse | Account, content, and technical data | Article 6(1)(f) — legitimate interests in protecting the integrity and availability of the service |
| Diagnosing defects and analysing aggregate usage to maintain and improve the App | Technical data | Article 6(1)(f) — legitimate interests in operating and improving our service |
| Responding to your enquiries and support requests | Account data and correspondence | Article 6(1)(b) — performance of a contract |
| Complying with legal obligations and establishing, exercising, or defending legal claims | Any relevant data | Article 6(1)(c) — legal obligation; and Article 6(1)(f) — legitimate interests in enforcing our rights |
Where we rely on legitimate interests, we have carried out a balancing assessment and consider that our interests are not overridden by your interests or fundamental rights and freedoms. You may obtain further information about that assessment, and object to such processing, by contacting us.
6. Special category data and criminal offence data
We do not seek to process special category data within the meaning of Article 9 UK GDPR, nor personal data relating to criminal convictions and offences within the meaning of Article 10. Health information recorded in the App concerns animals and is therefore not special category data. You should not include special category data about yourself or any other person in free-text fields or in published content.
7. Disclosure to other users
Your account is discoverable by email address. The App permits a user to search for another user by exact email address or by nickname. A person who knows the email address associated with your account can therefore locate your profile and send you a friend request. If you do not wish to be discoverable in this way, you should register using an email address that you do not disclose widely.
Each story you publish carries a visibility setting that you select:
- Public — accessible to other users of the App;
- Friends only — accessible to accounts whose connection request you have accepted; and
- Private — accessible only to you.
Your nickname and profile image are visible to users who locate you through search or who are shown your content. Care records — veterinary visits, vitals, medication, and lifestyle entries — are not disclosed to other users in any circumstances, unless you elect to reproduce that information within a story.
Blocking a user prevents that user from viewing your content and from sending you connection requests, terminates any existing connection, and suppresses that user's content from your view.
8. Recipients and processors
We disclose personal data to the following categories of recipient, each of which acts as our processor under a written contract satisfying Article 28 UK GDPR and processes personal data only on our documented instructions.
| Processor | Processing carried out |
|---|---|
| Google LLC and Google Cloud EMEA Limited (Firebase) | Authentication; database hosting of account, animal, care, content, and social data; file storage; server-side functions; push notification delivery; product analytics; and crash reporting |
| Cloudflare, Inc. | Storage, transcoding, and delivery of images and video, and hosting of this website |
| Apple Inc. | Sign in with Apple, and delivery of push notifications to your device |
We may additionally disclose personal data:
- where required by law, court order, or a competent regulatory or law enforcement authority;
- where necessary to investigate a suspected breach of our Terms of Service or a risk to the safety of any person;
- to professional advisers, including lawyers, auditors, and insurers, where necessary; and
- to a purchaser or prospective purchaser in connection with a sale, merger, or reorganisation of our business, in which case we will notify you before your personal data becomes subject to a different privacy policy.
9. International transfers
Our processors operate internationally, and personal data may be transferred to and processed in countries outside the United Kingdom, including the United States. Where we make such a transfer, we ensure that an appropriate safeguard under Chapter V UK GDPR is in place, being one of:
- UK adequacy regulations in respect of the receiving country, including the UK Extension to the EU–US Data Privacy Framework where the recipient is certified under it; or
- the International Data Transfer Agreement, or the International Data Transfer Addendum to the European Commission's Standard Contractual Clauses, issued by the Information Commissioner under section 119A of the Data Protection Act 2018, supplemented where necessary by additional technical and organisational measures identified through a transfer risk assessment.
You may request a copy of the safeguards applicable to a particular transfer by contacting us.
10. Content moderation and automated processing
Images and video uploaded to the App are screened by automated means before they are made visible, in order to detect unlawful or harmful material. Content that does not pass screening may be withheld or removed. Where a user submits a report, we review the report and the content to which it relates and retain a record of the outcome so that repeated breaches can be identified.
We do not carry out automated decision-making producing legal effects concerning you or similarly significantly affecting you within the meaning of Article 22 UK GDPR. Where content is withheld or an account is restricted or suspended, you may request human review by contacting us, and we will review the decision and inform you of the outcome.
11. Retention
We retain personal data only for as long as necessary for the purposes for which it was collected, applying the following criteria.
| Data | Retention criteria |
|---|---|
| Account, animal, care, and content data | Retained while your account remains open. Deleted on deletion of the individual record, or on deletion of your account. |
| Backups | Residual copies may persist in our processors' backup systems after deletion and are overwritten in the ordinary cycle of those systems. |
| Blocking and moderation records | Retained after account deletion only to the extent necessary to give continued effect to a block, to protect other users, or to comply with a legal obligation. |
| Technical and diagnostic data | Retained for the period applied by the relevant processor, after which it is deleted or irreversibly aggregated. |
| Correspondence | Retained for as long as necessary to deal with the matter and thereafter for the period during which a related claim may be brought. |
You may delete your account at any time from Me → Delete Account in the App. For security you will be required to authenticate again before deletion proceeds. Deletion removes your profile, your animals, and your stories.
12. Security
We implement appropriate technical and organisational measures under Article 32 UK GDPR, having regard to the state of the art, the costs of implementation, and the nature, scope, context, and purposes of processing. These include encryption of personal data in transit and at rest, server-side access rules that restrict each account to its own records, storage of authentication credentials in the iOS Keychain, and access controls limiting administrative access.
Records are also cached in local storage on your device so that the App functions without a network connection. You should therefore protect your device with a passcode or biometric lock.
No method of transmission or storage is entirely secure. Where a personal data breach occurs, we will notify the Information Commissioner where required under Article 33 UK GDPR, and will notify you without undue delay where the breach is likely to result in a high risk to your rights and freedoms.
13. Your rights
Subject to the conditions and exemptions in the legislation, you have the right to:
- be informed about the processing of your personal data (Article 13–14);
- obtain access to your personal data and a copy of it (Article 15);
- have inaccurate personal data rectified and incomplete data completed (Article 16);
- have your personal data erased (Article 17);
- restrict processing in specified circumstances (Article 18);
- receive personal data you have provided in a structured, commonly used, and machine-readable format and transmit it to another controller (Article 20);
- object to processing carried out on the basis of legitimate interests (Article 21); and
- withdraw consent at any time, where processing is based on consent, without affecting the lawfulness of processing carried out before withdrawal (Article 7(3)).
To exercise any of these rights, contact support@petnestory.com. We will respond within one month of receipt, which may be extended by two further months where the request is complex or numerous, in which case we will inform you within the first month. No fee is payable, although we may charge a reasonable fee or refuse to act where a request is manifestly unfounded or excessive. We may require information to verify your identity before acting.
Consent to push notifications may be withdrawn at any time in the iOS Settings application without contacting us.
14. Children
The App is not directed at children under the age of 13, and we do not knowingly process the personal data of a child under 13. Where processing is based on consent and relates to an information society service offered directly to a child, section 9 of the Data Protection Act 2018 sets the relevant age at 13. If you believe that a child under 13 has provided us with personal data, contact support@petnestory.com and we will delete it without undue delay.
15. Cookies and similar technologies
This website sets no cookies and uses no analytics, tracking pixels, or similar technologies, and accordingly no consent is sought under the Privacy and Electronic Communications (EC Directive) Regulations 2003.
The App stores data locally on your device, including a cached copy of your records and authentication credentials held in the iOS Keychain. This storage is strictly necessary to provide the service you have requested.
16. Changes to this policy
We may amend this policy from time to time. The version number and effective date at the head of this page will be updated accordingly. Where a change materially affects you, we will give notice in the App or by email before it takes effect. We recommend that you review this page periodically.
17. Complaints
If you are dissatisfied with how we have handled your personal data, please contact us first at support@petnestory.com so that we may address the matter.
You also have the right to lodge a complaint with the Information Commissioner's Office, the UK supervisory authority for data protection:
- Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF
- Telephone 0303 123 1113
- ico.org.uk