Privacy information for the Paw Agenda mobile application
Effective date: 2026-10-20
Scope: local pet-care records and optional features in Paw Agenda 1.2.0 and 1.2.1 for iOS and Android. Where the two versions differ, this policy names the version each statement applies to. Optional Firebase Analytics is part of the 1.2.0 native binaries on both platforms; previously published versions do not acquire it through this policy or a server setting.
Developer: Eren Avar
Privacy contact: erenavar@gmail.com
Public policy URL: Paw Agenda Privacy Policy
Paw Agenda helps users record pet care, health history and reminders. It is intended for users aged 13 and older. It does not require a registered Paw Agenda account, display ads, sell personal data or track users across apps and websites owned by other companies. Pet records and selected files are stored locally in an encrypted vault. Versions 1.2.0 and 1.2.1 on iOS and Android include optional Firebase Analytics, which stays off unless an adult user turns it on through the eligibility and permission steps described below. The app also uses operating-system notifications, file selection, sharing, anonymous technical authentication for live caregiver sharing and optional store purchases. On Android, the Google Play Billing Library used for store purchases sends Google technical diagnostics each time the app connects to Google Play, independently of the Analytics choice, as described under Optional Plus Plans And Payments. Temporary export files, the optional widget count and live caregiver sharing have the separate handling described below.
Local records include pet profiles and selected photos; care-journal entries and food, water, activity-duration and weight measurements; health-passport notes and selected documents; reminder schedules, routine links and completion history; and notification, security, language and appearance preferences. Records and selected document contents are encrypted before being written to the local database. The vault key is held in the device’s secure storage. Paw Agenda does not upload these records to the developer or operate general cloud synchronization. The deliberately limited, encrypted routine payload used for live caregiver sharing is described below.
Charts and period comparisons are calculated from the measurements entered on the device. They do not involve an external analysis service.
The user chooses a care template, date, time and repeat interval, or links a suitable existing reminder. A completed plan either creates a care-journal entry or links an entry the user explicitly selects. The planned occurrence and actual care record are stored together in the encrypted vault and included in password-protected backups. Deleting a plan does not automatically delete historical care entries; deleting a care entry does not reverse the reminder’s completion history.
Paw Agenda offers a monthly auto-renewing subscription, a yearly auto-renewing subscription and a one-time Plus Lifetime purchase. All three plans provide the same Plus features: unlimited pet profiles and active reminders, all visual themes, measurement charts and period comparisons, PDF veterinarian summaries, document-archive additions, sitter handoff PDF sharing, starting live caregiver sharing and the optional widget count. Document capacity limits still apply with Plus. The invited caregiver does not need Plus to use a list that an owner has shared, and the owner of a live caregiver share can end the caregiver’s access without Plus.
In version 1.2.0, basic care and measurement logging, routine templates, existing-record access, plain-text veterinarian summaries, pet cards and the widget shortcut remain available without Plus, subject to the displayed Free profile and reminder limits. Saved archive documents remain accessible, exportable and deletable after Plus ends.
From version 1.2.1, the Free plan includes one pet profile and one active reminder, encrypted backup and restore, pet cards and the Classic theme. Care-journal entries, care templates and routines, health-passport records and archive documents, measurements, plain-text and PDF veterinarian summaries and sitter handoffs require Plus. Without active Plus, pet profiles and reminders above the Free limits and records that require Plus become inactive: they are hidden in the app, but they are not deleted. They stay in the encrypted vault, are included in encrypted backups and return unchanged when Plus is active again. A vault wipe still deletes them. The app keeps the Free plan’s selected pet and notice status in local app storage on the device; this contains no pet names or record contents and is not included in backups.
Apple or Google processes payment and maintains the applicable store purchase history. Paw Agenda does not ask for, receive or store payment-card information. When the app starts and when it returns to the foreground, it asks the platform store’s purchase service on the device to confirm purchase rights and, on Google Play, acknowledges completed Plus purchases as Google Play Billing requires. It does not operate a developer-hosted purchase database or send pet records, photos, documents or backup contents to the store for this purpose.
On Android, these purchase functions use the Google Play Billing Library, a Google component built into the app. Because the app connects to Google Play billing each time it starts, this happens on every Android device where the app runs, whether or not Plus is purchased and independently of the optional Analytics choice. The library sends Google technical diagnostics about these store requests over an encrypted connection: success or error codes and response times; the app’s package name and version; the library and Android versions; the device brand, manufacturer, model, build fingerprint and memory size; language, country, mobile network code, time-zone offset and network type; and a random number created for each store connection. As with any connection, Google also receives the device’s IP address. The library may hold this information briefly on the device and send it in batches. Google uses it to improve the Play Billing Library and support error diagnosis, and handles it under the Google privacy policy. It contains no pet records, photos, documents, backup contents, advertising identifiers or Firebase identifiers, and Paw Agenda does not use it for Analytics. Because it carries no identifier available to the developer, the developer cannot locate or delete it.
Subscriptions renew automatically unless cancelled in the purchaser’s Apple or Google account settings. Access continues for the paid subscription period. Plus Lifetime is a personal, non-consumable licence restored with the same store account used for purchase. Family Sharing is not enabled for the Apple Lifetime product. Backup files do not transfer purchase rights, and purchases do not automatically transfer between Apple and Google stores. Prices and purchase terms are displayed by the applicable store.
Backups are created on request and protected with a password chosen by the user. Paw Agenda does not store or recover that password. They include the supported local pet, reminder, care and health records, selected documents and routine links. Versions 1.2.0 and 1.2.1 create v7 backups and accept v1–v6 backups. Widget snapshots, Analytics age/permission choices, Analytics installation identifiers, caregiver-sharing access keys and Plus purchase rights are not included.
From version 1.2.1, Settings shows the date of the last backup made on the device and can offer an optional backup reminder, which is off by default and uses generic notification text. The date and the reminder setting are kept in local app storage on the device only; they are not included in backups and are not sent anywhere.
The user selects a destination through the operating system’s directory picker or share sheet and selects a file when restoring. Paw Agenda does not automatically upload backups. External copies remain at the destination chosen by the user, under that destination’s terms and privacy practices.
Users may select PDF, JPEG or PNG documents such as test results, prescriptions and vaccination records. Document content is stored inside the encrypted health record. A picker-owned temporary copy is removed after it is read; the original provider file is not deleted. When the user exports a document, a readable temporary copy is created for the share sheet and removed when the share flow returns. Archive-specific leftover temporary files are also cleaned at the next cold load and during a vault wipe.
Paw Agenda does not add password protection to exported archive files or automatically include their contents in veterinarian or sitter summaries. Deleting a pet profile can remove its documents or retain them under former profiles, according to the user’s choice.
Summaries are generated locally from the selected pet’s care journal, medication reminder history and health-passport records for the chosen period. In version 1.2.0, plain-text summaries are free and Plus also provides PDF summaries with measurement charts; from version 1.2.1, both require Plus. They describe user-entered records and do not provide diagnosis or treatment recommendations. Archive file attachments are not automatically included.
The user reviews the included information and chooses whether and where to share through the system share sheet. Paw Agenda does not automatically send the report to the developer or a veterinarian. Exported text and PDF reports are not password-protected by Paw Agenda. Temporary report files are deleted when the sharing flow returns.
Cards are generated on the device from the selected pet’s photo and name, a template and an optional caption. The preview shows the content that will be exported. Care records, health history and contact information are not automatically included. The user chooses whether and where to share the PNG image. Native temporary image files are released when the sharing flow returns.
Users can enter care instructions and contacts, and select individual health notes and active reminders for a sitter handoff. Form instructions and contacts are kept in memory while that screen is active and cleared when leaving the screen or changing the pet. They are not saved as a persistent draft or uploaded to a service.
In version 1.2.0, the preview is free and sharing the locally generated PDF requires Plus; from version 1.2.1, sitter handoffs require Plus. Photos, archive attachments and medication-administration history are not automatically included. The PDF is not password-protected and represents the information at the time it was created. It does not enable live collaboration or update a recipient’s copy when the app’s records change. Its temporary file is deleted when the sharing flow returns.
A Plus owner may create an in-app routine list for one caregiver. The feature uses two Google services as processors for this purpose only: Firebase Authentication and Cloud Firestore. When the owner starts a share or a caregiver accepts one, Firebase Authentication creates an anonymous technical identifier on that installation without requesting an email address, phone number or social-login profile. Nothing is sent to these services until a user opens the caregiver-sharing flow.
The shared content is limited to the pet name and the titles, categories, planned dates and planned times of the owner’s current routine-care tasks (at most 50). It is encrypted end to end with AES-256-GCM in the app before upload. The encryption key is never written to the server: it travels only inside the owner-created invite link or QR code and is held in the owner’s and caregiver’s device secure storage. Users should send the invite only to a trusted caregiver. Health-passport records, documents, photos, free-form notes, contacts, medication-administration history, local backups and local-vault keys are not included.
The server holds only what is needed to run the share: the encrypted content and its revision number; random share and invitation identifiers; a random local pet-record identifier; the anonymous identifiers of the owner, the accepted caregiver and the last writer; the share and invitation status; the invitation expiry; and creation, acceptance and update times. Firebase Authentication keeps the anonymous account record (identifier and sign-in times). Google also processes technical request data, such as IP addresses, to provide these services. Firestore data is stored in Google Cloud’s European multi-region location. The anonymous sharing identifier is never assigned as an Analytics user ID.
An invitation remains open for up to seven days and can be accepted by one caregiver. The caregiver can mark a shared task complete; completion appears in the live list and does not automatically write an entry to the owner’s local Care Journal. The owner can end access at any time. Ending access marks the share as revoked, prevents the caregiver from reading or updating the list under Firebase security rules and clears the device-held access key. In version 1.2.0, deleting a pet profile does not end its share, so the owner should end access before deleting the pet. From version 1.2.1, deleting a pet profile also ends the shares for that pet that the owner started on the device, and the sharing screen lists any remaining share of a deleted pet started on the device so the owner can end it. If ending a share fails, for example offline, the app keeps only the share identifier in local app storage on the device and tries again the next time the app is opened or returns to the foreground. The app does not run an automatic cloud-deletion job, so the encrypted, inaccessible share record and the anonymous account record can remain in Firebase storage after access ends. Without the key, the encrypted content cannot be read by the developer or Google. To ask for these records to be deleted, email the privacy contact with the approximate date and time the share was created or ended. Because there is no account and the server cannot read the shared content, the developer may be unable to identify a record without enough detail. Live caregiver sharing depends on an online service and is offered under fair use; it may be limited or paused to keep the service reliable.
Paw Agenda is intended for users aged 13 and older. Analytics is optional and off by default on both platforms. It turns on only after the user both declares they are 18 or older and gives separate explicit permission. No birth date is requested. Under-18 users, users who do not declare their age, and users who reject permission remain outside Analytics measurement. Declaring an adult age alone does not enable collection. Parental permission does not unlock Analytics for under-18 users. Declining or withdrawing has no effect on pet records, Free functions or Plus access.
In Settings → Privacy & Data → Optional measurement, the user first chooses an age group and then separately chooses whether to allow measurement. Nothing is preselected. The same screen offers rejection and, after permission, withdrawal. The gating is identical on iOS and Android; only the technical starting point differs:
On both platforms the choice is not transferred in a Paw Agenda backup; backup restoration and vault wiping reset it to off, and reinstallation requires a new choice. Storage or configuration errors leave collection off.
With permission, Firebase/Google receives two installation identifiers: the Google Analytics app instance ID and a Firebase installation ID. When measurement starts, the Firebase installations service creates the Firebase installation ID on the device and registers it with Google, together with technical details such as the app’s identifier, Firebase SDK versions and basic device information; Google Analytics may use it for analytics and attribution. Firebase/Google also receives the app version, device and operating-system characteristics, language, sessions and automatically recorded events such as the first app opening after installation or reinstallation. It may derive approximate location from network information and record supported in-app purchase and subscription events from the platform store. On Android, Analytics may also read the Google Play install referrer to attribute the installation. These data are used to understand app use and to measure installations, including reporting installation conversions to Google Ads through the Firebase/Google Analytics link. Consent to Analytics storage is granted only after the two choices. Advertising storage, advertising user-data sharing and advertising personalization consent remain denied. On iOS the SDK excludes IDFA support, and IDFV collection is disabled. On Android the advertising-ID permission is removed and advertising-ID and Android ID (SSAID) collection are disabled. Automatic screen reporting and ad-personalization signals are disabled on both platforms, and the app logs no custom Analytics events. These installation identifiers still distinguish an app installation; Analytics is not described as anonymous.
Pet names, photos, care and health records, free-form notes, documents, backups, invite secrets and local-vault keys are not supplied to Analytics events or user properties. The separate anonymous Firebase Authentication identifier used for caregiver sharing is not assigned as an Analytics user ID. Paw Agenda does not display ads, enable personalized-advertising audiences or track users across apps and websites owned by other companies.
Withdrawal disables collection and Analytics/ad storage and resets the Analytics app instance ID and local Analytics state. What then happens to the Firebase installation ID depends on the app version:
In every version, clearing the app’s data or uninstalling the app on Android, or uninstalling it on iOS, also removes the Firebase installation ID from the device. Withdrawal stops future app measurement; it does not automatically erase data previously received by Google. To request deletion of retained Analytics data, open Settings → Privacy & Data → Optional measurement → Deletion information for uploaded data, copy the installation identifiers shown there (the Analytics app instance IDs), and email them to the privacy contact above with a deletion request. The developer uses those app instance IDs to submit a user-data deletion request in Google Analytics. That screen does not show the Firebase installation ID, which is handled as described above for each version. No email is sent automatically. Previously used app instance IDs are retained only on this device for this purpose, including after withdrawal; a vault wipe removes that local list. Make a deletion request before wiping or uninstalling if you need those identifiers. Without an identifier the developer may be unable to locate prior Analytics records. Exported copies and encrypted caregiver records follow their separate rules above.
The Google Analytics property configuration checked on 30 September 2026 retains event data for two months and user data for fourteen months, with new activity resetting user-data retention. These settings apply to the property’s iOS and Android app streams. Aggregate reports can have different retention rules, and user-data deletion does not necessarily change historical aggregate reports. Google handles Analytics data according to its service terms and privacy policy, including processing outside the user’s country where applicable.
The Google Ads link has personalized advertising disabled. Optional measurement may be used for advertising and conversion measurement on both iOS and Android. On iOS, the existing first-open conversion is used; on Android, the installation conversion in Google Ads comes from Google Play. A direct installation without an eligible ad interaction may appear in Analytics without increasing Ads’ ad-attributed conversions. Advertising user-data consent is denied, so this policy does not promise individual-level ad attribution or an Ads count for each installation.
Services: Google privacy policy, Firebase Analytics collection controls, and Google Analytics data collection.
The free widget shortcut opens the care journal; from version 1.2.1, where the care journal requires Plus, it shows the Plus notice on the Free plan. An optional Plus count is off by default. If enabled, the date and total number of today’s care entries for current pet profiles are copied outside the encrypted vault into on-device widget storage: an iOS App Group or private Android app preferences. Display labels, language information and an expiry time are also used to render the widget. The widget does not receive pet names, photos, notes, quantities, record identifiers or the vault key.
Enabling the app lock, turning the count off, restoring a backup or wiping the vault replaces the published count with a generic shortcut. The app also hides it when it determines that Plus is inactive. Tapping the widget uses the existing app unlock flow. Widget updates are controlled by the operating system, so a previously rendered image may remain visible until the system refreshes it. The count is dated and scheduled to return to a generic shortcut when the day changes. Paw Agenda does not upload widget snapshots or start remote widget notifications.
Paw Agenda does not sell personal data, display advertisements or track users across apps and websites owned by other companies. Optional adult Analytics and installation measurement are described above. Users can explicitly export encrypted backups, text/PDF summaries, pet cards and archive documents, or create the limited live caregiver share described above. The selected destination and any recipients control exported copies; deleting a record or wiping the app does not delete those copies.
Local records remain until the user deletes them or wipes the vault. A vault wipe removes encrypted records, the device-held vault key and reminder schedules, resets preferences, cleans archive temporary files and replaces the widget count with a generic shortcut. The operating system controls rendered widget images and app removal behavior. The app’s normal export cleanup runs when the sharing flow returns; it cannot guarantee that cleanup completes if the process or device stops during an export. Temporary files may remain in the app’s cache until cleaned or removed by the operating system.
Paw Agenda has no registered account system or developer-hosted readable pet-record database, so the developer cannot remotely identify or erase records on a user’s device. Deletion requests for data held by Google services are handled by email: Analytics data by app instance ID, as described above, and caregiver-sharing records as described in the Live Caregiver Sharing section. Firebase installation records are deleted as described in the Analytics section: from version 1.2.1 the app asks Google to delete the record when measurement permission ends, and otherwise Google deletes it after the inactivity period. Google Play Billing Library diagnostics carry no identifier available to the developer and are handled by Google, as described under Optional Plus Plans And Payments. A live-share owner can end the caregiver’s access from the app at any time. If a user emails the privacy contact, the developer receives the message and information the user chooses to include through that email service. Users should include only information needed for their request.
Paw Agenda receives application-code updates for versions 1.2.0 and 1.2.1 only through the Apple App Store or Google Play. It does not activate Expo Application Services Update (EAS Update) or another remote-code update service. It has no app-owned error-reporting endpoint and includes no crash-reporting SDK. From version 1.2.1, a failed backup restore shows a short technical code (a processing step and a system error code) on screen to help with support questions; it contains no record data, password or file name and is not sent anywhere. Firebase Analytics in the 1.2.0 and 1.2.1 binaries is described above; previously published binaries do not gain that SDK from a server-side setting. Store purchase services and links opened by the user operate separately from local record storage. The technical diagnostics that the Google Play Billing Library in the Android app sends to Google are described under Optional Plus Plans And Payments. Other operating-system and store diagnostics are governed by their respective platform settings and policies.
Paw Agenda is intended for users aged 13 and older, including teenagers and adults. It is not directed to children under 13, and the developer does not knowingly collect personal information from children under 13. The app does not create registered user accounts, display ads or provide free-form communication between users. Optional Plus purchases use the platform store. Teenagers should involve a parent or guardian in decisions about purchases and about exporting photos, documents or contact details to other apps. A parent or guardian who believes a child under 13 has provided information through the app may contact the developer at the privacy contact above.
Analytics collection is off by default on iOS and Android. It is available only after an 18+ self-declaration and separate explicit permission. Users aged 13 to 17 and unknown-age users remain outside Analytics; parental permission does not unlock Analytics for them. Rejection and withdrawal remain available without loss of app features.
Paw Agenda is a recording and reminder tool, not a medical device. It does not provide veterinary diagnosis, treatment or emergency guidance. Users should consult a qualified veterinarian for medical decisions.
The app uses encryption for stored records, secure key storage, optional app locking, generic notification text, password-protected backups and end-to-end encryption for live caregiver sharing. Readable exports and the widget cache are handled as described above. No system can guarantee absolute security.
Material changes to data handling will be reflected in an updated effective date and made available at the public policy URL before the relevant release. This includes any future account, general cloud-sync, analytics, advertising or developer-operated data-collection service.