Privacy
Privacy Policy
How the Tail Buddy service — the tail-buddy.pet website, the mobile app and the Telegram bot — processes users' personal data.
Updated: 2026-10-06
1. General
1.1. This Policy sets out what personal data the Tail Buddy service (the Service) processes, why, on what basis, who may receive it, and what rights users have. 1.2. It follows Russian Federal Law No. 152-FZ of 27.07.2006 “On Personal Data” and Federal Law No. 149-FZ of 27.07.2006 “On Information, Information Technologies and Information Protection”. 1.3. It covers all data the Service receives through the tail-buddy.pet website, the Tail Buddy mobile app and the Service's Telegram bot. 1.4. By registering, a user confirms they have read this Policy. Consent to the processing of personal data is given separately — a box of its own at registration, on the terms of the “Consent to Personal Data Processing” (tail-buddy.pet/consent). 1.5. The Russian version of this Policy prevails.
2. The operator
2.1. Personal data operator: The owner of the Tail Buddy service. 2.2. Contact for personal data requests: privacy@tail-buddy.pet.
3. What we process
3.1. Account data: name, email address, phone number (if given), time zone. The password is stored only as a cryptographic hash; the Service never knows it. 3.2. Telegram link: the chat identifier, if the user links Telegram to the account. 3.3. Pet data entered by the user: name, species, breed, sex, date of birth, weight, blood type, microchip and registration numbers, insurer, sterilisation, photo, allergies, notes, and the vet passport — vaccinations, parasite treatments, vet visits, tests and imaging, diagnoses, prescriptions, reproduction records, reminders, and uploaded files (document scans, discharge summaries, test results, photos). 3.4. Technical data: the IP address, recorded in server logs; browser or device details, kept in the list of active sessions; the cookies needed to sign in and to remember the language (section 7). 3.5. The Service does not process special categories of personal data or biometric data. Health data the user enters concerns their animal, not them. 3.6. The user is responsible for the accuracy of what they enter and for the right to publish it. A user who enters details of another person — for example, a family member's phone number as a contact on the pet's public card — confirms that person has agreed to it.
4. Purposes
4.1. Creating the account and giving access to the Service from several devices. 4.2. Keeping the pet's profile, vet passport, health history and documents, and syncing them between the website and the app. 4.3. Reminders and notifications: by Telegram if the user linked it — including a notice that someone has scanned the pet's QR tag — and as the mobile app's notifications on the user's device. By email the Service sends only account-related messages (section 4.5). 4.4. Running the pet's public card behind a QR code or NFC tag, so whoever finds a lost animal can reach its owner (section 6). 4.5. Confirming the email address, restoring access and changing the address. 4.6. Protecting the Service and its users from abuse: rate limits, reCAPTCHA, detecting suspicious sign-ins. 4.7. Answering users' requests and meeting legal obligations.
5. Legal basis
5.1. The user's consent, given at registration separately from any other document (Art. 6(1)(1) of Law No. 152-FZ; tail-buddy.pet/consent). 5.2. Performing the agreement with the user on using the Service (Art. 6(1)(5) of Law No. 152-FZ). 5.3. Duties imposed on the operator by the laws of the Russian Federation.
6. The pet's public card
6.1. If the user binds a QR code or an NFC tag to a pet, anyone who scans it sees the public card: the pet's name, species, breed, sex, weight, microchip number, photo, allergies and tagline, and the owner's name, phone number and Telegram contact if the account has them. 6.2. The card exists so a lost animal can come home. The user decides which of these details to fill in, and can unbind the tag or issue a new code at any time — the old one then stops opening the card. 6.3. A tag's code is a random string that cannot be guessed; the card cannot be reached by a pet's or a user's number. 6.4. The owner is notified of every scan. The Service collects nothing about the person who scanned the tag beyond the technical data in section 3.4.
7. Cookies
7.1. The Service uses only the cookies it cannot work without: sign-in tokens, the chosen interface language, and a mark that the cookie notice was accepted. The chosen colour theme is kept in the browser itself and never sent to the server. 7.2. The Service uses no advertising or analytics cookies. 7.3. The registration and password-reset forms use Google reCAPTCHA, which may set its own cookies (section 8).
8. Who receives data
8.1. The Service does not sell personal data and does not share it for advertising. 8.2. Data is stored on servers of a hosting provider under contract with the operator; the provider does not use it for its own purposes. 8.3. Emails (address confirmation, password reset, address change) are sent through an email provider's mail server, which receives the recipient's address and the message. 8.4. If the user links Telegram, notifications are delivered through Telegram Messenger, which receives the notification text and the chat identifier. Telegram is operated outside the Russian Federation; by linking it, the user consents to this cross-border transfer. 8.5. The registration and password-reset forms are protected by Google reCAPTCHA (Google LLC, USA), which receives the IP address and technical browser details to tell a person from a program. This is a cross-border transfer the user consents to by submitting such a form. Google's policy: policies.google.com/privacy. 8.6. Data may be disclosed to public authorities where and as the laws of the Russian Federation require.
9. Retention and deletion
9.1. Data is kept for as long as the user's account exists. 9.2. Deleting a record, a document or a pet is immediate and permanent: the data leaves the working database and uploaded files leave the disk. The Service asks for confirmation first. 9.3. The whole account can be deleted in the account settings; all its pets, records, reminders and files go with it at once. 9.4. Deleted data may remain in database backups until those are deleted; backups are used for nothing but restoring the Service after a failure. 9.5. Server logs with technical data are kept for a limited time and overwritten.
10. Security
10.1. Connections to the Service are encrypted (HTTPS). 10.2. Passwords and sign-in tokens are stored only as hashes. Each session belongs to one device, and the user can end any of them in the settings. 10.3. Uploaded documents are available only to the account owner after signing in; only the pet's photo and the public card (section 6) are public. 10.4. Access to the servers and the database is restricted by the operator.
11. Your rights
11.1. A user may learn how their personal data is processed, ask for it to be corrected, blocked or deleted, and withdraw consent. 11.2. Most of this can be done directly in the account: edit profile and pet data, unlink Telegram, delete records, pets or the whole account. 11.3. Requests and withdrawals of consent can be sent to privacy@tail-buddy.pet. They are answered within the term set by Law No. 152-FZ — no more than 10 working days. 11.4. A user can take their data with them: export the pet's vet passport as a PDF and save a backup in the mobile app. 11.5. A user may complain about the operator to Roskomnadzor (the Russian data protection authority) or to a court.
12. Changes
12.1. The operator may change this Policy; a new version applies from its publication on this page, and the date of the update is shown at the top. 12.2. Users are told about significant changes by email or in the Service.
13. Final provisions
13.1. This Policy is governed by the laws of the Russian Federation. Matters it does not cover are decided under Law No. 152-FZ and other regulations. 13.2. This Policy applies to the Service only. The Service is not responsible for third-party sites a user may follow links to, or for how they process data. 13.3. This Policy applies for as long as the user uses the Service, and to data the operator still holds after the account is deleted (section 9.4).