ZooMate ("we," "our," or "us") respects your privacy. This Privacy Policy explains what information we collect when you use the ZooMate mobile application and related services, why we collect it, who we share it with, and the choices you have. We've tried to write it in plain English instead of legal jargon. If anything is unclear, email us at zoomateserver@gmail.com.
1. Information We Collect
Account information you provide:
- Username, email address, first name, and last name when you register.
- Profile photo, bio, and account type (private or public).
- If you sign in with Apple, an Apple-issued user identifier (a stable opaque ID, not your Apple ID email unless you choose to share it) plus a refresh token we use to verify the account on future logins.
Animal-care content you create:
- Information you enter about your animals and enclosures, including names, species, photos, health records, vet documents, schedules, expenses, and notes.
Social content you create:
- Posts, comments, likes, and follow relationships.
Device and technical information:
- An Apple Push Notification (APNs) device token, used so we can send the schedule reminders and care alerts you've set up.
- Your IP address and User-Agent string, captured automatically in our server access logs and used for rate limiting, abuse prevention, and debugging (see Section 6).
- App version and basic device type, sent in standard HTTP headers.
Subscription and purchase information:
- If you buy a Premium subscription or a lifetime upgrade, Apple processes the payment and sends us a signed receipt. We store transaction identifiers (including the originalTransactionId), purchase date, expiration date, and the entitlement tier (Pro / Pro+ / Lifetime). We never see your credit card number, billing address, or Apple ID password.
Advertising identifiers (only with your permission):
- If you grant App Tracking Transparency permission when prompted, your iOS Advertising Identifier (IDFA) is shared with Google AdMob to serve and measure ads. If you decline (or have system-wide tracking disabled), the IDFA is not shared and ads are served using Apple's privacy-preserving SKAdNetwork attribution instead. See Section 3 for more.
2. How We Use Your Information
We use the information above to:
- Run the app — store and display your animals, schedules, expenses, photos, posts, and other content you create.
- Send the push notifications you've configured (schedule reminders, social notifications).
- Send transactional emails — account verification, password reset, data export confirmations.
- Verify subscription status by validating Apple-signed StoreKit receipts on our server.
- Serve ads (free tier only) via Google AdMob.
- Detect and prevent abuse — rate limit suspicious traffic, lock accounts after repeated failed login attempts, and block credential-stuffing attacks.
- Diagnose crashes and bugs.
- Respond when you contact support.
We do not use your animal records, photos, posts, or messages to train any machine learning model.
3. Third Parties We Share Data With
We do not sell your personal information. We share specific data with the following named third parties, each only for the purposes listed:
Apple Inc.
- Sign in with Apple: if you use this option, Apple sends us an opaque user identifier and (optionally) your name and an Apple-relay email address.
- In-app purchases: Apple processes all payments and sends us signed receipts. Apple, not us, holds your payment method.
- Push notifications: APNs delivers our notification payloads to your device.
- App Store Server Notifications: Apple notifies our server when subscriptions renew, refund, or expire.
- SKAdNetwork: Apple's privacy-preserving ad-attribution framework (configured in our app's Info.plist). Lets advertisers measure campaign performance without identifying you individually.
Google AdMob (Google LLC)
- Used to serve ads in the free tier of the app. AdMob receives ad-request metadata (approximate location derived from IP, device type, app version, and similar non-personal context) every time an ad is served.
- If — and only if — you granted App Tracking Transparency permission, AdMob also receives your iOS Advertising Identifier (IDFA). This enables more relevant ads and cross-app attribution.
- If you declined ATT (or have system-wide tracking disabled in iOS Settings), no IDFA is shared and AdMob serves contextual ads using SKAdNetwork attribution only.
- Google's privacy practices are described at policies.google.com/privacy.
- Premium subscribers do not see ads and do not have any data sent to AdMob.
Railway (Railway Corp.)
- Hosts our application servers and database in the United States. All data you store in ZooMate is stored on Railway-managed infrastructure.
- Railway's privacy practices: railway.app/legal/privacy.
Google Gmail API (Google LLC)
- Delivers our transactional emails (verification codes, password resets, export confirmations). Receives only the recipient's email address and the message contents.
- Not used for marketing email — we don't send marketing email.
Public profile content (your username, profile photo, public posts, public animal photos, follower counts) is visible to other ZooMate users by default. If you set your account to private, your posts and follower lists are hidden from non-followers. You can change this at any time in Settings.
4. Where Your Data Is Stored — International Transfers
Our servers are operated by Railway in the United States. If you use ZooMate from outside the United States, your information is transferred to and stored on servers in the United States, which may have data-protection laws different from those in your country. By using the app, you consent to that transfer.
We do not currently offer EU-region or UK-region hosting. If you are an EU/UK resident, see Section 5 for the rights you can still exercise.
5. Your Rights and Choices
Everyone, regardless of location:
- Access and export: Premium users can export their data (animals, schedules, expenses, photos) directly in the app. Free users can request an export by emailing zoomateserver@gmail.com.
- Correct: You can edit any account or content data in the app. For account-level fields you can't edit yourself, email us.
- Delete your account: Settings → Account → Delete Account. Your account and all associated content are permanently removed within 30 days. Some operational records (transaction IDs needed for chargeback/refund handling) may be retained for accounting/abuse-prevention purposes for up to 7 years.
- Stop tracking for ads: Settings → Privacy & Security → Tracking on iOS lets you revoke App Tracking Transparency permission at any time. Once revoked, no IDFA is shared with AdMob.
- Stop push notifications: iOS Settings → Notifications → ZooMate.
If you are a California resident (CCPA/CPRA): you have the right to know what personal information we collect about you, to request deletion, to correct inaccuracies, and to opt out of any "sale" or "sharing" of personal information. We do not sell personal information. The IDFA-to-AdMob flow described in Section 3 may qualify as "sharing" for cross-context behavioral advertising under CPRA — declining the App Tracking Transparency prompt opts you out of that sharing.
If you are an EU/UK resident (GDPR/UK GDPR): you have rights to access, rectify, erase, restrict processing, object to processing, and data portability. The legal bases we rely on are: (1) performance of a contract — to provide the app you signed up for; (2) consent — for App Tracking Transparency-gated IDFA sharing; (3) legitimate interests — for abuse prevention, security logging, and basic analytics. To exercise any right, email zoomateserver@gmail.com with the request and a way to verify it's you (typically a reply from the email associated with your account).
6. Security and Anti-Abuse Logging
We use industry-standard security measures including TLS encryption in transit, hashed passwords at rest, JWT-based authentication with short-lived access tokens, signed-receipt verification for all subscription changes, and per-account lockouts after repeated failed login attempts.
To protect the service from abuse, our server logs every API request with the source IP address, requested URL, response status, and User-Agent string. These logs are used for rate limiting, brute-force detection, debugging, and incident response. Logs are retained for up to 90 days and then rotated. Failed login attempt counters are tracked solely to enforce account lockouts and are never used for any other purpose.
No security system is perfect. If we ever discover a breach affecting your account, we will notify you and the relevant authorities as required by law.
7. Children's Privacy
ZooMate is not directed to children under 13, and we do not knowingly collect personal information from children under 13. If you believe a child has provided us personal information, email zoomateserver@gmail.com and we will delete the account and associated data.
8. Changes to This Policy
We may update this Privacy Policy from time to time. Material changes will be communicated via in-app notice or email at least 14 days before they take effect. The "Last updated" date at the top of this page reflects the most recent revision.
9. Contact Us
For privacy questions, data requests, or to report a concern, contact us at zoomateserver@gmail.com. We aim to respond to verified requests within 30 days.