Short, because we collect only what the service needs.

On the waitlist

Your email address, whether you signed up as a dog owner or as a walker, and — only if you choose to share them — your name, a phone or WhatsApp number, and the area you're in. That's all the website collects.

One more thing, and it is about the link rather than about you: if you arrived through a link that says where it came from — a flyer's QR code, a post, a friend's message — we keep that one word, so we know which of the things we try actually brings people. It is a label from a short fixed list, it travels in the address you can see in your own address bar, and if it is anything we do not recognise we store “web”, which means we do not know. What we never store is the address of the page you came from, the full link you arrived on, or anything from your device: there is no cookie, no pixel, and no way for us to tell that two people came from the same place other than that they clicked the same kind of link.

In the app (private beta)

If you create an account in the Dog-Out! app, we additionally store: your email and password (the password is hashed by our auth provider — we never see it), your name, your dog's name, breed, size, care notes and any medical note you add, the pickup address you enter plus the access details that go with it (apartment, floor, buzzer or gate code), the neighbourhood you name, an emergency contact, your own phone number if you choose to add one, any one-off note you write for a specific walk, and a record of each walk you request — its timeline, duration and price — which we keep as a financial record.

What the walker sees, and when: before accepting a walk they see only the neighbourhood, your dog, a rough distance — how far away they are from you, in steps of a quarter mile and never less than a quarter mile, up to five miles — and, if you have marked them as a favourite, a note that says so, and never your location or your address. That distance is measured to the middle of the neighbourhood-sized square, about a kilometre across, that contains your pickup point, not to the point itself, so it is a ranking aid and not a measurement: a walker cannot narrow your pickup down to anything smaller than that square, even by trying many positions. Once they accept, they see your name, your street address, your access details, your phone number if you added one — so they can call you from the gate — your dog's name, your dog's safety profile (size, temperament, whether they are vaccinated or neutered, and any medical or care notes you added) and that walk's note; they need them to reach your door and to walk your dog safely, and that access ends shortly after the walk does — it stays available to that one walker for half an hour after the walk ends, because whoever is holding your dog still needs to know which door to bring them back to, and either of you can end a walk from your own phone. After that half hour it is gone for them, and it is never available to any other walker at any point. Photos a walker takes during a walk stay on the walker's own phone in this beta; nothing is uploaded, and they are deleted when the walk ends.

If you turn on walk notifications, we store a push token for your device — the address label Apple and Google use to deliver a notification to your phone. It is tied to your account, it is what lets us tell you “your walker is on the way” with the app closed, and the notification itself never carries your address, your access details, a phone number or a walk note — only the kind of event and a first name. Signing out unbinds the token, and deleting your account erases it immediately.

If you walk for us, we also hold a phone number for you — one that you give us when you join, that only we can see and that no owner is ever shown. It exists so that we can call you when a walk goes wrong at eight at night, which is the moment when an email is worth nothing. It is erased when you delete your account.

Also if you walk for us: each time you go online or go offline, we record that you did and when. Nobody is asked to be online at any hour — there is no shift to keep, no schedule assigned and nothing that happens if you do not appear — and we read it added up by day, to answer one question we cannot answer any other way: when someone asked for a walk, was there anybody available to take it? A walk nobody took because nobody was online and a walk nobody wanted are opposite problems, and they look identical without this. No owner and no other walker can see it, and it is erased when you delete your account.

If you report that something went wrong on a walk — your dog came back hurt, nobody showed up, a fight with another dog — we store what you chose from the list and what you wrote in your own words, tied to that walk and to your account. A person reads it. Unlike everything else on this page, these reports are NOT deleted when you delete your account: a report about what happened to a dog is evidence, it can matter to the other person involved and to us for years afterwards, and erasing one side of a dispute because that side closed their account is not something we are willing to do. What we do erase is the profile it points at — the name, address and phone are gone, exactly as described below.

When a walk ends you can give the walker one to five stars. We store that star count, tied to that walk and to your account, and it is what feeds the walker’s average. The walker is never shown who gave which star — not on any screen and not in the data they can read — because a rating that names its author is not a rating, it is a message to someone who knows where you live. Like the age confirmation below, a star you gave is not erased when you delete your account: it is part of another person’s standing, and once your profile is gone it is a number, a date and a uuid that no longer points at a name.

Dog-Out! is for adults, and the app asks you to confirm you are 18 or over before it creates your account. We keep that confirmation: the date and time we recorded it, which side you signed up as, and which version of that sentence you were shown. It is the only answer we would have if someone ever asked how we knew an account belonged to an adult, so — like the walker records below — it outlives the account itself; what goes with the account is everything that says who you were.

When something breaks in the app, it sends us a report so we can fix it: which part failed, the error message, your phone's platform, the app version, and the screen you were on — tied to your account, because a fault we cannot connect to anyone is a fault we cannot call you back about. We never attach what you typed, your address, your dog's details or your photos to it. The text of an error is written by the app or by your phone's system and not by you, so when the app itself crashes we shorten it and strip out quoted values, long numbers, email addresses and ids before it leaves your phone; that filter makes it very unlikely that something of yours rides along, and we do not promise it can never happen. It is capped at thirty reports an hour, we keep it for thirty days, and it is deleted with your account.

When you request a walk, the app also sends us the map position of the pickup address you chose from the suggestions — not your phone’s location. We round it on our own servers to about 100 metres, roughly one city block, and we never keep the exact point. We keep that approximate pickup location with the walk so that walkers who are nearby are offered it first, and so that you can see roughly how far away your walker was when they accepted. A walker never sees it: before accepting they see only the distance band described above, measured to the middle of a square about a kilometre across, and after accepting they see your address as described above. If no position is available, the request goes through without one. We keep it for at most thirty days after the walk ends, unless the walk is under review by our team, in which case until the review is resolved, and it is erased when your account is deleted.

If you walk for us, while you are online with the app open your phone also reads its location, only to rank the walks on offer nearest first. That position is sent to our servers each time the list refreshes and is used there to work out a distance band for each walk; we do not save it in our database — not with your profile, not with a walk and not in a log of positions. When you accept a walk, what we keep with that walk is only the distance band you were in when you accepted (for example, within half a mile), not your position, so that the owner can see roughly how far away you were; it is the band your phone reported, not something we measured. We keep it on the same terms as the pickup location above, and we erase it when your own account is deleted as well.

If you walk for us, your phone sends us its location while a walk is in progress and the app is open: a point every few seconds — latitude, longitude, the time, and how accurate the phone says it was. That starts when you check in at the door and stops when the walk ends; it is not sent on the way to the door, between walks, or at any time the app is closed or in the background. Outside a walk, the only time the app reads your location is while you are online with the app open, to rank the walks on offer, as described above, and it never asks your phone for location in the background. Once the walk is over, the owner and the walker of that walk can see the route drawn in the app as a line, with no street map under it, and nobody can watch it live while the walk is going. The people at FRMAA described under “Where it lives” can also read a route if there is a report or a dispute about that walk. When they read it through our operations console, that reading is written to the record of who looked that is described there — who, when and which walk, never the route itself. A read made directly with our database key, outside the console, is not recorded by that mechanism. A route begins at the owner’s door, so it is information about where they live, and we treat it that way: we keep it for at most thirty days after the walk ends, unless the walk is under review by our team, in which case until the review is resolved, and it is erased when either the owner’s or the walker’s account is deleted.

During a walk, the owner and the walker can send each other short messages inside the app, up to 500 characters each, while the walk is on and for two hours after it ends. The owner and the walker see them in the app; either one can block the conversation for that walk, which closes it for both, or report it, which reaches us like any other problem report. The people at FRMAA described under “Where it lives” can also read a conversation if there is a report or a dispute about that walk. When they read it through our operations console, that reading is written to the record of who looked that is described there — who, when and which walk, never the messages themselves; a read made directly with our database key, outside the console, is not recorded by that mechanism. We keep messages for at most thirty days after the walk ends, unless the walk is under review by our team, in which case until the review is resolved, and they are erased when either account is deleted — the whole conversation, including what the other person wrote, so that half of a conversation is never left lying around.

You can mark up to five walkers you have already finished a walk with as your favourites. If you do, we store that list with your account — which walkers you chose, and when — and nothing else about them; you can only choose someone you have walked with, and you can take them off whenever you like. When you ask for a walk and at least one of your favourites is online, free to take it and has notifications on, only your favourites can see that walk, and only they are notified about it, for the first ninety seconds; after that, or as soon as none of them can take it, every walker sees it as usual. To do that we keep a short record that a particular walk was held this way — that walk, the deadline and when it was released — and we delete it within a day or so. You are never shown whether a favourite is online, and nothing on your screen changes while a walk is held. A walker never sees your list of favourites and never learns who chose them: the one thing they can learn is that a client has marked them as a favourite, because a walk offered to them says so — and that offer still carries no name, no address and nothing else that identifies the client. The people at FRMAA described under “Where it lives” can read the list with our database key, as they can the rest of your account; our operations console has no screen that opens it, so such a read is not written to the record of who looked that is described there. The list and those records are erased immediately when either your own account or the walker’s account is deleted.

While a walk is under way you can share it with someone else — a partner, a parent, whoever is at home waiting for your dog. Tap share and we make a link, and anyone who has it can open a page that shows your dog’s name, the walker’s first name once there is one, where the walk stands — finding a walker, on the way, under way, finished or cancelled — and two times, when the walker checked in and when the walk finished. That is all: it never shows your name, your address, your neighbourhood, a phone number, a map, a distance, a route or a price, and nobody can watch a walk live from it. The link works until you stop sharing, until twelve hours after you made it, or until two hours after the walk ends, whichever comes first, and you can have up to five at once for the same walk. Whoever has the link can open it — there is no sign-in, so we cannot tell who that is — so send it only to people you trust. We do not keep the link itself: we store only a fingerprint of it, with the walk it belongs to, the account that made it and when it stops working, so a copy of our database does not contain a single working link. We clear that record out in routine housekeeping, a week after the link stopped working at the earliest, and it is erased at once when either your own account or the walker’s account is deleted. The walker is not told that you shared. Someone opening a link is not one of our own people looking at your file, so it is not written to the record of who looked that is described under “Where it lives”; the ordinary request logs of the service that runs our website may note that an address of that kind was opened, and when — the address contains the link itself — and we keep no profile of the people who open one: no cookie, no pixel, and visits to that page are left out of our traffic analytics.

If you walk for us: a client can share a page that shows their dog’s name, your first name and whether you are on the way, out walking or done, and the time you checked in and the time the walk ended — nothing else about you: not your last name, a photo, your rating, your phone number or where you are. You are not told when a client shares one and you cannot see it. Those links stop working after the walk, and they are erased when either your own account or the client’s account is deleted, so deleting yours takes the links of every walk you took part in with it.

Card payments are built into the app but have never been switched on, and they stay off until this page says otherwise: until then, the app never asks you for a card, we store no card and nothing is charged. If we ever switch them off again after they have been on, no new walk asks for a card, but a card you already saved stays on file — until you delete your account, which deletes it here and at Stripe as described below — and a walk that already had a hold on your card still ends with the charge for what it cost, as it would have. Here is what happens once we switch them on. You add a card on Stripe’s own page, which the app opens in your browser: the card number, its security code and the rest of what you type there go to Stripe, the company that processes our payments, and never pass through the Dog-Out! app or our servers. From Stripe we keep the brand of the card, its last four digits and its expiry month and year, so the app can show you which card is on file, and the customer reference Stripe gives your account. When you request a walk, we place a hold on that card for the most the walk can cost; when the walk ends we charge only what it actually cost and release the rest, and a tip is a separate charge. We keep the record of each hold, charge and refund on your walks — the amount, when it happened, whether it went through, Stripe’s reference for it, for a tip also Stripe’s references for the customer and the card it was charged to, and any note we wrote about it, such as the reason for a refund or why we tried a failed charge again — as part of the financial record of that walk. If you walk for us, we also keep the record of each payout we sent you: the period it covers, the amount and a reference. How long we have to keep payment records is something we are confirming with our accountant; until that is settled we keep them, and this page will state the period once it is.

When Stripe sends you back to our website after you add a card or confirm a hold, the address it uses can carry Stripe’s reference for that payment. The page you land on only offers you the way back into the app: from that address it reads only whether you were adding a card or confirming a hold, to open the right screen, and it does not read Stripe’s reference or store the address; it is left out of our traffic analytics, and the ordinary request logs of the service that runs our website may note that it was opened, and when.

Just as important, what we do NOT collect: no payment card until card payments are first switched on — and even once they are on, never the card number or its security code, which only Stripe sees — and no location other than what is described above — none while the app is closed or in the background. When photo uploads launch, this policy gets rewritten first and you'll see the new version before any of it turns on.

What we use it for

To run the walks you request, to email you — or, if you shared a phone number, message you — about the Dog-Out! launch and your spot on the waitlist, and to use the area answers in aggregate to decide which zone we open in first.

We don't sell your data or share it with advertisers. Ever.

Where it lives

Waitlist entries and app data are stored with Supabase (US-hosted), emails are delivered through Resend, and the website runs on Vercel. Address suggestions in the app come from Photon, a geocoder run by komoot in the EU: as you type in the address box, what you have typed so far is sent there to look up matches — never your device's location, and never anything else about you. Walk notifications are delivered through Expo's push service and then Apple's or Google's notification network — what travels there is the notification text described above and your push token, nothing more. All five act only on our instructions. Once card payments are switched on, cards are handled by Stripe, our payment processor, as described above; Stripe also applies its own privacy policy to what you enter on its page. And one flow that does not pass through us at all: when a walker taps Navigate during your walk, your pickup address opens in the maps app on their own phone — Apple Maps or Google Maps — to get walking directions; that request goes from their device to that provider, exactly like sharing an address to a maps app yourself. App data is protected with row-level security, so no other user of Dog-Out! can read your records. A small number of named people at FRMAA can: answering a support question, looking into a walk that went wrong or checking a walker's file all mean opening your details, and there is no honest version of running this service where nobody at all can. What we can promise is the shape of it — each of them signs in with their own credential rather than a shared one, and every time one of them opens your file we keep a record of who looked and when, which we ourselves cannot edit or delete. Traffic analytics are aggregate and cookie-free.

Deleting your data

Waitlist: reply to any email we send you, or write to admin@dogoutapp.com, and we'll delete your entry. That's it — no forms, no questions.

App account: tap Profile → Delete account inside the app. Your name, address, access details, neighbourhood, emergency contact, phone number, push token, dog profile, any walk notes, the approximate pickup location of your walks and, if you walked for us, the distance band you reported when you accepted, every error report we hold, your list of favourite walkers (and, if you walked for us, every entry in which an owner chose you), the short records of any of your walks that were held for favourites, the links you made to share a walk and every link to a walk you took part in, the route and the messages of every walk you took part in — the whole conversation, including what the other person wrote — and the card details we hold for you (its brand, last four digits and expiry, and the Stripe customer reference) are erased immediately, and the account is locked so nobody can sign back into it. Some things deliberately survive: the walk records themselves, anonymized, because they are the financial books; any problem report filed on a walk, because it is evidence about something that happened to a dog and it involves someone else too; and, if you walked for us, the record of what we checked before letting you take a dog out and any note we wrote when we approved or paused your account — the same reasoning, and it is the only answer we would have if someone ever asked us why we let a particular person take their dog; the confirmation that you were 18 or over, which is a date and a uuid once the profile it points at is erased, and is the only answer we would have to the same question about age; the record of the times someone here opened your file, because a log of who looked that vanishes when the subject leaves is not a log; the stars you gave a walker, for the reason described above; any note one of us wrote while resolving a walk that needed a human, because it explains a decision we made about money on a walk that happened; the record of each hold, charge and refund on your walks — including, for a tip, Stripe’s references for the customer and the card it was charged to, which point at nothing once Stripe has deleted them — and, if you walked for us, the record of each payout we sent you, because those are the financial books too, for as long as we have to keep payment records; and the sign-in email address, until our auth provider swaps it for an unreadable code in the ops pass that follows — a bare sign-in record, with an id and no email, stays behind there, because the walk records hang from it — write to admin@dogoutapp.com if you want that expedited and we'll confirm when it's done. If you had a card saved, deleting your account also asks Stripe to delete the card and the customer record it keeps for you under our account: the request goes out within minutes — or, if a charge on one of your walks is still being processed, as soon as that charge is settled one way or the other — and is retried if Stripe does not answer, and we keep the note that we asked Stripe to delete your card — which account it was for, the Stripe customer reference and when it was done — as the proof that it happened.