Mooki App ("Mooki", "we", "us") is operated by Lilit Arutyunyan, a sole trader based in Lisbon, Portugal. We are the data controller for personal data processed through this app.
Contact: hello@mookiapp.com
We collect only what is needed to provide the service.
Account data
Email address and password (hashed — we never see your plain-text password).
Legal basis: contract (Article 6(1)(b) GDPR) — you need an account to use the app.
Dog profile data
Dog name, breed, size, sex, neutered status and neutering plan, birthdate, weight, country, allergies, microchip number, pet passport status, acquisition type, adoption date, photo.
Legal basis: contract — the core features of the app depend on this data.
Life event and health data
Health events you log (vaccines, vet visits, treatments), life moments, notes, dates, photos attached to events.
Legal basis: contract.
Weight logs
Weight entries you record over time.
Legal basis: contract.
Push notification tokens
FCM (Android) or APNs (iOS) device token, stored alongside your user ID and platform type. Used only to send you reminders you have requested (vaccine due dates, medicine dose reminders).
Legal basis: consent — you grant notification permission through your device OS.
App preferences (on your device only)
Theme setting and other app preferences are stored in your browser/app's local storage and never sent to our servers.
Technical data
We do not collect IP addresses, device fingerprints, or behavioural analytics data beyond what Supabase logs at the infrastructure level for security purposes, and beyond the product analytics described in Section 3.
Mooki uses PostHog, a product analytics tool hosted in the EU (eu.posthog.com), to understand how the app is used and to catch errors. Analytics only runs in the live production app (never in development or testing), and only starts recording after you actively consent via an in-app banner (Accept All / Reject All, presented with equal visual weight).
PostHog records product-usage events (for example, which tab you open) and technical error reports — never your screen, keystrokes, or activity outside Mooki, and never session recordings. You can change your choice at any time in Settings; declining or opting out stops tracking immediately and does not limit any feature of the app. Your consent choice is stored only on your device, never on our servers.
Legal basis: consent (Article 6(1)(a) GDPR).
We do not use tracking cookies, cross-site trackers, or third-party advertising pixels.
All data is stored in Supabase (supabase.com), our database and storage provider. Supabase acts as a data processor on our behalf under a Data Processing Agreement.
Dog photos and life event photos are stored in Supabase Storage in a public-access bucket. This means photo URLs, if shared or guessed, are accessible without authentication. We recommend not uploading photos you consider sensitive.
We do not use any advertising networks or marketing trackers.
We do not sell your data. We do not share your data with third parties for advertising or marketing purposes.
Sub-processors we use:
| Sub-processor | Purpose | Location |
|---|---|---|
| Supabase, Inc. | Database, authentication, file storage | EU (AWS eu-west) |
| Google Firebase | Push notification delivery (FCM) | Google Cloud (US) |
| Vercel, Inc. | App hosting and delivery | Global CDN |
| Resend | Transactional email delivery (account confirmation, password reset) | US |
| PostHog | Product analytics (see Section 3) | EU |
Where a sub-processor is located outside the EEA (Google Firebase, Resend, and Vercel, all US-based), the transfer is safeguarded by that provider's adherence to the EU-US Data Privacy Framework and/or Standard Contractual Clauses, as published in their respective privacy and data processing terms.
We may disclose data if required by law or to comply with a valid legal request.
We retain your data for as long as your account is active. When you delete your account (Settings → Delete Account, or by emailing us — see below), we permanently delete your dog's profile, all records, all attached photos, your authentication record, and your push notification tokens. Deletion is irreversible and there is no separate retention period afterward.
Under the GDPR you have the right to:
To exercise any of these rights, email hello@mookiapp.com. We will respond within 30 days.
You also have the right to lodge a complaint with the Portuguese data protection authority, the CNPD: www.cnpd.pt
Mooki App is not directed at children under the age of 16. We do not knowingly collect personal data from children under 16. If you believe a child under 16 has created an account, please contact us at hello@mookiapp.com and we will delete the account promptly.
We use HTTPS/TLS for all data in transit. Supabase uses row-level security policies so users can only access their own data through the app. Passwords are hashed by Supabase Auth and never stored in plain text. If you become aware of a security issue, please contact hello@mookiapp.com. In the event of a data breach affecting your personal data, we will notify affected users and, where required, the CNPD, without undue delay.
We will notify registered users by email if we make material changes to this policy. The "last updated" date at the top of this page will always reflect the most recent version.
Lilit Arutyunyan
hello@mookiapp.com
Lisbon, Portugal