Privacy Policy

Last updated: October 15, 2026

This policy describes what data Laki (the "App") collects, how we use it, where it's stored, and what rights you have over it. It's meant to be short and clear: Laki is designed to collect the minimum information possible.

1. Who is responsible

Laki is developed by Hernán Anabalón. For any question or to exercise your data rights, email us at ask@laki-app.com.

2. What data we collect

2.1 Data you enter

• Your name (or nickname) — to identify who gave each dose within the group.
• Your pet's information — name and type (dog, cat, other).
• Treatments and medications — name, dose, frequency and schedule.
• Dose log — which dose was given, when, and who marked it.

2.2 Technical data generated automatically

• Anonymous identifier created by Firebase Authentication. It is not linked to your real name, email, or any personal identity, unless you choose to link an Apple or Google account (section 2.5).
• Push notification token (if you enable them), generated by Expo. It is used solely to send you reminders and group alerts.
• Delivery receipts for those alerts, returned to us by Expo. We use them to detect devices that no longer have the App installed and to drop their token; the rest of your group only sees the date from which that device no longer has the App, nothing else.
• Group identifier — a random UUID that links your session with your partner's.

2.3 What we do NOT collect

• We don't ask for email, phone number, or password. The one exception is optional: if you link a Google account, Google provides your email (section 2.5).
• We don't access your location: the App never asks for GPS permission and never reads your position. Our analytics does estimate your country and city from your IP address, the way any server you connect to can — see section 2.4.
• We don't access your calendar, contacts, messages, or gallery.
• The App has no ads and no advertising trackers (no Facebook Pixel, no ad networks), and we don't follow you across apps or websites. We do measure App usage anonymously — see section 2.4. The website is a different matter: there we use analytics only if you accept it — see section 12.
• We don't sell or rent your data to anyone.

2.4 Product analytics in the App

Laki is an app for two people coordinating a pet's medication. To know where the App fails people — instead of guessing — we measure how it is used. Here is what gets recorded and, more importantly, what doesn't.

None of this is sent without your permission. The App asks you the first time you open it, and nothing leaves your phone until you answer. If you say no, whatever would have been sent is discarded and nothing further is recorded.

• What we record: that you opened the App, which onboarding step you're viewing, that you created a first pet or a first treatment, that you marked a dose, what you answered to the notifications prompt, and that someone joined your group. If you link, unlink or sign out with an account, only the fact and the provider (Apple, Google or none) are recorded, never your email or name. When you delete your account, the analytics identity is reset.
• What NEVER leaves your device: your pet's name, the medication name, the dose, the schedule, and your name. Events only accept values from a closed, predefined list; there is no free-text field anywhere for that data to leak through. It's a guarantee of the design, not a promise.
• Who you are to us: the anonymous identifier of your session — the same UUID the App already uses. No email or name attached.
• What the provider adds automatically: device type, operating system, language, App version, screen size, and an approximate location (country and city) derived from your IP address.
• What we don't do: we don't record your screen or your taps, we don't automatically capture what appears on screen, and we don't use this data for advertising or combine it with other sources.
• How to turn it off: Settings → Privacy → "Help improve Laki". Turning it off stops the recording immediately and the provider forgets your identifier. You can turn it back on whenever you want.

The provider is PostHog, and the data is processed in the United States. PostHog's privacy policy.

2.5 Optional account with Apple or Google

You can use Laki without an account, with the same anonymous identity as always. Linking an Apple or Google account is optional, lets you return to your group from another phone or after a reinstall, and unlocks no features. The account is linked to that same anonymous identity; it does not create a new one.

• Apple: Laki does not ask for your email or your name. It only receives the stable identifier Apple assigns to your account for Laki, and Firebase Authentication stores it.
• Google: Google Sign-In provides your email and basic profile (name and photo). Firebase Authentication stores the email and may also store the name and the photo URL on your account record. Laki requests no additional Google permissions.
• What we don't do with that data: we don't show it to your group (others see the name you typed in Laki, never your account), we don't copy it to Firestore, we don't use it to write to you, and we don't send it to analytics.
• Unlinking: removes the provider and deletes from Firebase Authentication the email, name and photo that provider had copied. You go back to the anonymous identity and the group and history are untouched.
• Signing out on this phone: removes this device's notification token, turns off its local reminders and deletes the local copy of the group. It notifies nobody in the group, and the group and history are kept. With a linked account, the identity is closed on the phone and you return with "I have an account". Without one, the anonymous identity stays on the phone and is lost if you delete the app.
• One account, one group: if your account already belongs to another group, you choose which one to keep; Laki does not merge histories.

Apple and Google only take part to authenticate you, under their own policies: Apple, Google. What happens to them when you delete your account is in section 6.

3. What we use your data for

• Display and sync your pet's treatments between group members.
• Schedule and send you dose reminders.
• Keep the history of given doses to avoid duplicates.
• Notify the other group member when someone gives a dose or adds a treatment.

We don't use your data for advertising profiling, credit scoring, or commercial analysis.

4. Where it's stored

• On your device: your name and the group identifier are stored locally in hardware-encrypted storage (Keychain on iOS, Keystore on Android).
• In Firebase (Google Cloud): the group's shared data (pets, medications, doses) lives in Firestore. Firebase applies encryption at rest and in transit (TLS).
• Firestore security rules restrict access only to group members.

5. Who we share your data with

• With your partner or caregiver within the Laki group — this is the very purpose of the App.
• With Google (Firebase) as infrastructure provider. Firebase privacy policy.
• With Apple (Sign in with Apple) and Google (Google Sign-In), only if you choose to link an account and only to authenticate you. Apple privacy policy, Google privacy policy.
• With Expo to deliver push notifications (if enabled). Expo privacy policy.
• With PostHog as our product analytics provider, with the scope described in section 2.4. PostHog privacy policy.

We don't share data with advertisers, data brokers, or third parties for commercial purposes.

6. How long we keep your data

• While your account is active, we keep your data so the App works.
• If you delete your account from the App, we delete your profile, anonymize your name in the dose and meal history, remove you from the group, and delete your Firebase Authentication identity, including the Google email, name and photo if there were any. This is immediate and irreversible.
• If you had linked an account, we revoke Laki's access: with Apple, using the authorization code Apple gives once when you confirm the deletion (we do not store it); with Google, by disconnecting Laki from your account. Afterwards, Laki no longer appears among the apps with access to your Apple or Google account.
• Analytics events are the exception: deleting your account does not remove them from PostHog, because they are tied to an anonymous identifier rather than to you. They contain no name — yours, your pet's, or any medication's — only the record that certain steps happened. If you want them deleted anyway, email us.
• If the group is left with no members, the group's data becomes inaccessible.

7. Your rights

As a user, you have the right to:

• Access your data — it's visible from within the App.
• Rectify it — you can edit your name, pets, and treatments at any time.
• Delete it — from Settings → Delete my account, or by emailing us if you no longer have the App (below). If you only want to let go of your Apple or Google account, you can unlink it from Settings → Your account.
• Object to the processing of your data — email us at ask@laki-app.com.
• Portability — if you want to export your data before deleting it, contact us.

8. Children and minors

Laki is not directed at children under 13 and is not intended to be used by them — the account always belongs to a responsible adult. We do not knowingly collect data from a user under 13, in line with COPPA. If you believe a child is using the App without a responsible adult's consent, email us and we'll delete it.

If you track a person instead of a pet: Laki is built for pet care, but nothing stops you from using it for a family member's medication, a child's included. If you do, that data is about a person and is entered by whoever is responsible for them. It stays visible only to your group and is deleted along with the group. We recommend using a first name or a nickname.

9. Security

We apply several layers of protection: Firestore security rules that restrict access by group membership, encrypted on-device storage, server-side push token validation, and restrictions on Firebase API keys. No system is 100% impenetrable, but we do everything reasonable to minimize risks.

If a breach happens: if unsecured data of yours is exposed, we will notify the affected users and the relevant authority without undue delay, and describe what was exposed and what we did about it.

10. International transfers

Firebase may process and store data on servers located outside your country (mainly the United States and the European Union). PostHog, our analytics provider, processes the events described in section 2.4 in the United States. By using Laki, you accept these transfers. Both providers apply standard safeguards to protect data during transfer.

11. United States

We do not sell or share your personal information, as those terms are defined by the California Consumer Privacy Act (CCPA, as amended by the CPRA), and we never have. There is no advertising, no data brokers, and no cross-context behavioral advertising anywhere in the App or on this site. Because we do not sell or share, there is no "Do Not Sell or Share My Personal Information" link to offer.

Laki is run by an independent developer and does not meet the CCPA's applicability thresholds (annual revenue, volume of California consumers, or revenue derived from selling data). We still describe our practices here as if it applied, because you deserve to know regardless of which side of a revenue threshold we sit on. Residents of California and of other US states with comparable laws can exercise the rights in section 7 through the contact address, and we will not discriminate against you for doing so.

On health data: what you enter is about a pet. If you choose to use Laki for a person's medication instead, that information is about a human being's health, and we treat it under the same rules described in this policy: it stays inside your group, it is never sold or used for advertising, and it is deleted with the group. We are not a HIPAA covered entity and Laki is not a medical record.

12. The laki-app.com website

Everything above describes the App. The website is a separate, simpler case: no account is needed and we collect nothing that identifies you, unless you write to us through the support form yourself.

• Support form: if you write to us from /en/support or from Settings in the App, we collect your email address, the topic you choose and the message you write, plus your App version and operating system so we can reproduce the problem. We use it only to reply to you: it reaches our inbox and we send a receipt to that same address. It is delivered by Resend, acting as our sending provider. We do not store the message in any database: it lives in email, and we keep it for as long as the conversation is useful for supporting you. To keep spam out, Cloudflare Turnstile checks that the sender is a person; that check uses your IP address at that moment and we do not store it.
• Analytics with your consent: we use Google Analytics 4 to know which pages get visited and from which country. It only loads if you accept it in the notice shown on arrival. If you decline, nothing is downloaded from Google and no cookie is written.
• Cookies: if you accept, Google Analytics stores first-party cookies (_ga and _ga_*) to tell visits apart. We use no advertising or personalization cookies, and ad features are turned off in our configuration.
• If your browser sends the "Do Not Track" signal, we load no analytics and show you no notice.
• You can change your mind: your choice is stored in your browser. Clear the site data and the notice comes back.
• Hosting statistics: the site is served from Cloudflare Pages, which records aggregate traffic metrics without cookies or cross-site tracking, and processes the access logs needed to serve and protect the site.

More detail in Google's privacy policy and Cloudflare's privacy policy.

13. Changes to this policy

If we modify this policy, we'll update the "Last updated" date above. For substantial changes, we'll notify you within the App.

14. Contact

Any question, complaint, or to exercise your rights: ask@laki-app.com.