Privacy Policy

The Fur Stories ("we", "us", "our") is committed to protecting your privacy. This Privacy Policy explains what personal data we collect, how we use it, with whom we share it, and your rights in relation to it. It applies to all users of our website and application (the "Platform") and is governed by the Information Technology Act, 2000, the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 ("SPDI Rules"), and the Digital Personal Data Protection Act, 2023 ("DPDP Act") to the extent its provisions are in force.

If you have any questions about this Policy, contact us at hello@thefurstories.com.

1. Data We Collect

1.1 Data You Provide Directly

• Account information: name, email address, password (hashed by Supabase Auth), profile photo
• Pet profiles: pet name, species, breed, date of birth, gender, weight, photo, and health notes
• Health records: vaccination dates, medications, lab results, vet visit notes, scanned medical documents
• Daily logs: activity logs, water intake, food/meal logs, weight entries, poop logs, caretaker observations
• Contact details for your pet's care team: vet name, phone, email, address; emergency contacts; walker/groomer details
• Household members: email addresses of secondary caregivers you invite to your household
• Communications: messages you send us via feedback forms or email

1.2 Data Generated by Your Use of the Platform

• Usage data: pages visited, features used, timestamps of actions, and error logs (via our action_log system)
• AI interaction data: prompts sent to the vet chat assistant and document scanner; AI-generated responses are not stored beyond your session unless you explicitly save them
• AI usage telemetry: token counts and model usage for cost management (stored with no personally identifiable content)
• Device and browser data: IP address, browser type, operating system, timezone — collected automatically when you use the Platform
• Product analytics: pages and screens viewed, clicks and other interactions, approximate location derived from IP address, and a persistent identifier that links these events to your account after you sign in. Collected automatically by PostHog and Google Analytics — see 4.1

1.3 Data from Third Parties

• Google OAuth: if you sign in with Google, we receive your name, email address, and profile picture from Google in accordance with Google's privacy policy

2. Sensitive Personal Data

Under the SPDI Rules and the DPDP Act, certain categories of data receive heightened protection. Under the SPDI Rules, "Sensitive Personal Data or Information" (SPDI) includes health-related data. Of the data we collect, the following may qualify as SPDI: health-related data you enter about your pets where it is associated with your identity, and your account password (which is encrypted and never stored in plaintext by us). The DPDP Act further classifies all identifiable personal data as "personal data" subject to consent, purpose limitation, and data minimisation obligations.

We collect SPDI only with your explicit consent, which you provide by creating an account and entering data into the Platform. You may withdraw consent at any time by deleting your account.

3. How We Use Your Data

We use the data we collect to:

• Provide, operate, and improve the Platform and its features
• Send you email reminders for your pet's care schedules (medications, vaccinations, vet visits)
• Enable household sharing — allowing invited secondary caregivers to view shared pet records
• Power AI-assisted features (vet chat, document scanning, pet story generation) using anonymised or session-scoped prompts
• Monitor and analyse Platform usage to improve performance and fix bugs
• Respond to your support and feedback messages
• Comply with applicable Indian laws and legal obligations
• Detect and prevent fraud, abuse, or security incidents

We do not use your data for targeted advertising. We do not sell your personal data to third parties.

4. Data Sharing

We share your data only with:

4.1 Service Providers (Data Processors)

To operate the Platform, we engage third-party service providers for functions including database storage, authentication, cloud hosting, AI processing, and email delivery. These providers are located primarily in the United States and are contractually bound to process data only on our behalf and to maintain appropriate security standards. If you wish to know which processors handle your data, you may submit a request to hello@thefurstories.com and we will respond within 30 days.

We name our analytics processors specifically, because they observe how you use the Platform rather than only storing what you enter:

• PostHog — product analytics. Records page and screen views, interactions, and, once you sign in, associates them with your account identifier so we can understand how features are actually used. Requests are routed through our own domain, which means ad-blocking extensions may not block them.
• Google Analytics — aggregate traffic measurement for our public pages.

We use analytics to understand and improve the Platform. We do not use it for advertising, we do not sell the data, and we do not combine it with your pets' health records.

4.2 Household Members

If you invite a secondary caregiver to your household, that person will be able to view all pet records for pets in your household. They will not see your account profile, contact information, or billing details. You control who has access and can revoke it at any time.

4.3 Legal Disclosure

We may disclose your data to government authorities, law enforcement, or courts when required by applicable Indian law, court order, or legal process.

5. Data Retention

We retain your personal data for as long as your account is active. When you delete your account, we permanently delete:

• Your profile and all pet profiles
• All health records, logs, and medical documents stored in our systems
• All associated files in our storage buckets

The following categories of data are retained after account deletion for legitimate business and legal purposes:

• Feedback submissions: anonymised product feedback (your name/email is removed but the feedback content is kept for product improvement)
• AI usage logs: token-count telemetry with your user ID replaced with a null reference, kept for billing analysis
• Legal holds: where required by applicable law, we may retain specific data for up to 5 years

6. Data Security

We implement reasonable security practices as required by the SPDI Rules and the DPDP Act, including:

• All data is transmitted over HTTPS/TLS encryption
• Passwords are hashed and never stored in plaintext
• Database access is governed by Row Level Security (RLS) policies enforced at the database layer — users can only access their own data
• Medical documents are stored in a private storage bucket accessible only via time-limited signed URLs
• Service-role database access (which bypasses RLS) is restricted to system-level cron jobs and admin operations, never reachable by ordinary users
• AI prompts containing pet data are processed over encrypted connections; we do not log the full content of AI conversations

No system is completely secure. In the event of a data breach affecting your personal data, we will notify you as required by applicable law.

7. Your Rights

Under the IT Act, SPDI Rules, and the DPDP Act, you have the following rights as a "Data Principal":

• Access (§11 DPDP Act): request a summary of the personal data we hold about you and the purposes for which it is being processed
• Correction & Updating (§12 DPDP Act): request correction of inaccurate or incomplete data (most data can be updated directly in the Platform)
• Erasure (§12 DPDP Act): request deletion of your personal data when it is no longer necessary for the purpose for which it was collected, subject to our legal retention obligations
• Grievance redressal (§13 DPDP Act): raise a complaint with our Consent Manager / Grievance Officer and, if unresolved, escalate to the Data Protection Board of India once operational
• Withdrawal of consent (§6 DPDP Act): withdraw consent at any time; ease of withdrawal is as easy as giving consent — account deletion achieves this
• Nominate (§14 DPDP Act): nominate another individual to exercise your rights on your behalf in the event of death or incapacity

To exercise any of these rights, email us at hello@thefurstories.com with the subject line "Privacy Request". We will respond within 30 days.

8. Grievance Officer

In accordance with the Information Technology Act, 2000, the SPDI Rules, and the DPDP Act, 2023, we have designated a Grievance Officer to address concerns about your personal data. Under the DPDP Act we act as a Data Fiduciary in respect of the personal data you provide. If you have a complaint about how we handle your data, you can contact:

9. Cookies and Local Storage

We use cookies and browser local storage to:

• Session cookies: maintain your login session (set by Supabase Auth; essential for the Platform to function)
• Preference storage: remember your dark mode preference (stored in local storage; no data leaves your device)
• Analytics cookies and identifiers: set by PostHog and Google Analytics to recognise a returning browser and measure how the Platform is used (see 1.2 and 4.1). These are not essential to the Platform working.

We do not use advertising cookies and we do not use any of this data for targeted advertising.

Turning analytics off. We do not yet offer an in-product control for this, and we would rather say so than imply otherwise. Today you can block analytics with your browser's tracking protection or an ad-blocking extension — noting that our PostHog requests are served from our own domain, so some blocklists will not catch them. Deleting your account removes the link between past analytics events and you. An in-product opt-out is planned.

10. Children's Privacy

The Platform is not intended for use by persons under 18 years of age. We do not knowingly collect personal data from minors. If you believe a minor has created an account, please contact us and we will delete the account promptly.

11. Cross-Border Data Transfers

Your data is stored and processed on servers operated by our service providers, some of which are located outside India (primarily in the United States). By using the Platform you consent to your data being transferred to and processed in the United States and other countries, which may have different data protection laws than India.

We take reasonable steps to ensure that our service providers maintain adequate data protection standards.

12. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or applicable law. When we make material changes we will update the effective date and notify you by email where practicable. We encourage you to review this Policy periodically.