Privacy Policy

01.Information We Collect

1.1 Identity information. Email address, display name, and profile photo (optional).

1.2 Dog information. Dog name, breed or mix, age, size, energy level, sociability, anxiety level, off-leash training status, and dog photo (optional).

1.3 Location information. Device location at the time of a check-in or map session, where you have granted permission, and a home neighborhood you may optionally specify.

1.4 Activity information. Check-ins (venue identifier and timestamp), ratings, written tips and notes, photos, dispute reports, and journal entries.

1.5 Device and usage information. Browser type, device type, IP address, and product analytics events that help us understand how the Service is used.

1.6 Communications. Records of emails we send to you, including delivery and open status for transactional and digest messages.

1.7 What we do not collect. We do not collect date of birth, government-issued identification, payment information beyond what a payment processor needs at the moment we offer paid features, or health information.

02.How We Use Information

2.1 To provide and improve the Service, including authentication, account management, and reliability.

2.2 To generate venue recommendations and personalized rankings.

2.3 To aggregate, anonymize, and derive datasets for purposes including improving model accuracy, generating public statistics, and licensing aggregate datasets to third parties as described in Section 3.

2.4 To communicate with you about transactional matters, optional digest emails (which you may unsubscribe from), and important changes to the Service.

2.5 To detect, prevent, and respond to fraud, abuse, and security incidents.

2.6 To comply with applicable law and respond to lawful requests.

03.How We Share Information

3.1 Service providers. We share information with vendors that help us operate the Service, under contractual data protection terms. Current providers include Supabase (database and authentication), Vercel (hosting), Resend (email), Mapbox and Google Places (mapping and venue data), OpenWeatherMap (weather), Anthropic and OpenAI (AI processing for content extraction and feature support), and PostHog (product analytics).

3.2 Aggregate and anonymized data. We may license aggregate, anonymized, or derivative datasets to third parties for commercial purposes. You may opt out of inclusion in these licensed datasets as described in Section 4.

3.3 Public surfaces. Statistics shown publicly within the Service apply a k-anonymity floor of five, meaning we do not display per-venue figures that identify fewer than five distinct contributing users.

3.4 Legal process. We may disclose information when we believe in good faith that disclosure is required by applicable law, legal process, or to protect the rights, property, or safety of users, the public, or Water Bowl Social.

3.5 Business transfers. If Water Bowl Social is involved in a merger, acquisition, financing, reorganization, bankruptcy, or sale of assets, your information may be transferred as part of that transaction. The acquiring entity will be required to continue protecting your information in a manner consistent with this Policy.

04.Your Rights and Choices

4.1 Right to access. You may request a copy of the personal information we hold about you. We aim to deliver a JSON export within thirty (30) days of a verified request.

4.2 Right to delete. You may request deletion of your account. Upon deletion, identifying records are deleted and your structured contributions are anonymized and retained as part of our aggregate dataset, as described in our Terms of Service.

4.3 Right to correct. You may correct your profile, your dog’s profile fields, and your contributions through the Service.

4.4 Right to opt out of sale and sharing. You may exclude your contributions from third-party data licenses described in Section 3.2. Opting out preserves your in-app experience and does not affect your account; it removes your contributions from datasets we license externally.

4.5 Right to portability. You may request your data in a machine-readable format.

4.6 How to exercise your rights. Email fromnothingtoallthings@gmail.com or use the in-app privacy controls when available. We may need to verify your identity before fulfilling certain requests.

4.7 Non-discrimination. We will not deny service, charge different prices, or provide a different level of quality because you exercised a privacy right.

05.Data Retention

5.1 Account data is retained until you delete your account.

5.2 Aggregate, anonymized contributions are retained indefinitely as part of our dataset and cannot be re-associated with you.

5.3 Server logs and analytics events are retained for ninety (90) days.

5.4 Backups containing your data are retained for ninety (90) days following deletion of the underlying records, after which they are purged in the normal course.

06.Security

6.1 We maintain a standard SaaS security posture, including TLS in transit, encryption at rest, row-level security in our primary database, secrets management, access controls, and an internal incident response process.

6.2 No system is perfectly secure. In the event we confirm a material breach affecting your information, we will notify affected users within seventy-two (72) hours of confirmation, consistent with applicable law.

07.Children

7.1 The Service is intended for users 18 years of age or older.

7.2 We do not knowingly collect personal information from anyone under 18. If we learn that we have collected personal information from a person under 18, we will delete that information.

7.3 If you believe a child has provided us with personal information, contact fromnothingtoallthings@gmail.com.

08.International Users

8.1 The Service is operated from the United States and is currently offered only to users in the United States.

8.2 If you access the Service from outside the United States, your information will be processed in the United States, where data protection laws may differ from those in your jurisdiction.

09.Cookies and Tracking

9.1 Strictly necessary cookies. We use cookies and similar technologies that are required for authentication and session management.

9.2 Analytics. We use PostHog to collect product analytics at the event level. Where feasible, we anonymize identifiers used in analytics.

9.3 No advertising trackers. We do not use third-party advertising or cross-site behavioral advertising trackers.

9.4 Browser controls. You can adjust cookie behavior in your browser settings. Disabling strictly necessary cookies may prevent the Service from functioning.

10.Changes to This Policy

10.1 We may update this Privacy Policy from time to time. The effective date at the top of the Policy reflects the latest version.

10.2 For material changes, we will provide notice by email to the address associated with your account or through an in-app notice before the change takes effect.

11.Contact

For privacy-specific requests, please include “Privacy Request” in the subject line.