Privacy Policy

Last updated: May 31, 2026

EmberPaws keeps your dog's records in your private iCloud — your account, end-to-end encrypted by Apple, never visible to us. We have no servers that store your health data, no analytics, no tracking, and no third-party SDKs that touch your data. Vet Reports are shared only when you tap "Share." Medications never sync to any public database, and are off by default in shareable surfaces like the Vet Report and Sitter Info Sheet — see "Medications" below for the full rule.

What we collect

Nothing on our side. EmberPaws has no servers and no backend that stores your information. Every health record you create — weight, appointments, medications, stool scores, skin conditions, feeding schedules, walks, vaccinations, and grooming — lives on your iPhone and in your private iCloud.

iCloud sync (private CloudKit)

EmberPaws uses your private CloudKit database, which is part of your own iCloud account. This means:

• Your records sync across your iPhones automatically when you're signed in to the same Apple ID.
• Apple encrypts the data end-to-end. We have no read access — not now, not ever.
• If you delete iCloud data from your account, it's gone everywhere.
• If you sign out of iCloud, the app falls back to local-only storage on each device.

We did not make this opt-in because there is no privacy trade-off — it's the same iCloud that backs up your iPhone today.

GPS walk tracking (location)

When you start a GPS walk, EmberPaws uses your device's precise location to record the walk's route, distance, and time. The specifics:

• You start it, you end it. Location is used only while a walk is actively running — you tap "Start GPS walk" to begin and "End" to stop. EmberPaws does not access your location at any other time.
• It keeps recording in the background. So you can pocket the phone or lock the screen mid-walk, tracking continues in the background. iOS shows its system location indicator the entire time, and a lock-screen Live Activity displays the walk in progress with an End button.
• Where the route lives. The recorded route is saved with that walk in your dog's records — on your iPhone and in your private iCloud, exactly like every other entry. It is never sent to EmberPaws servers; we have none.
• If you share the dog. A walk's route is part of the dog's care record, so it travels only where that record already goes — to a household member via Family Sharing, or to a sitter via Sitter Mode, if you've shared that dog. It is never written to the public Walking Club database.
• Battery Saver. In Settings → Walk Tracking you can switch to a lower-fidelity mode (about 100m instead of 10m) — handy for all-day shifts. It records a less-detailed route by design. (The underlying location authorization is unchanged — both modes use precise location; Battery Saver just spends less battery chasing the finest fixes.)
• You can skip GPS. You can still log a walk manually (duration only), with no location used at all.

Family Sharing (CKShare, household only)

Family Sharing lets you share a dog's full care record with another iCloud user — typically the rest of your household. When you tap Invite to family in Settings, EmberPaws creates an Apple CKShare link tied to your private CloudKit zone and sends it via iMessage. The recipient accepts the share in iMessage's native acceptance UI, and a copy of the dog's records syncs to their device through Apple's CloudKit infrastructure — never our servers.

• What's shared: the full care record for the invited dog — vet appointments, weights, walks, feedings, routine logs, vaccinations, eye health, stool and skin scores, and medications. Family members are trusted household and need to see active medications if it's their turn to dose. Recipients can view, log, and edit; changes sync back to the owner.
• What's not shared: your other dogs that weren't invited to this share, your trail pins, your Walking Club RSVPs, and anything stored outside the shared dog's records.
• Where it lives: Apple's shared CloudKit, encrypted by Apple. EmberPaws has no servers; we cannot read what's in your shared zone.
• Revoking: as the owner, you can remove a family member at any time via Settings → Family Sharing. Their local copy is removed on their next sync.

Family Sharing is opt-in and only flows between iCloud users you've explicitly invited. It's separate from Apple's billing-level Family Sharing — this is per-dog access control inside EmberPaws.

Sitter Mode (CKShare, time-bounded)

Sitter Mode lets you hand off your dog's care to a sitter for a specific date range — a weekend, a vacation, a single afternoon. When you schedule a sit in Settings → Sitter Mode and tap Create & Invite, EmberPaws creates a per-sit Apple CKShare tied to a dedicated CloudKit zone for that one sit and gives you a link to send via iMessage, Mail, or any sharing destination. The sitter taps the link, the iOS native acceptance UI takes care of the rest, and a scoped copy of the dog's records syncs to their device through Apple's CloudKit infrastructure — never our servers.

• What's shared: the dog's name, breed, birthday, weight, allergies, care notes, feeding schedule, walk schedule, the primary vet contact (so the sitter can reach a vet in an emergency), and any notes you wrote for the sitter. The sitter can log meals, walks, gave-meds, and free-form notes back to you in real time.
• What's not shared: your other dogs, weight history, stool scores, skin condition records, vaccination history, full vet directory, trail pins, Walking Club RSVPs, photos, and any other data outside the sit's scope. Medications are off by default — see the Medications section below.
• Where it lives: Apple's shared CloudKit, in a dedicated zone per sit (so two simultaneous sits never share a database boundary). Encrypted by Apple. EmberPaws has no servers; we cannot read what's in the shared zone.
• Automatic cleanup: when the sit ends — either at the scheduled end date or when you tap "End sit now" — EmberPaws deletes the shared zone on Apple's servers. The sitter's local copy of your dog's records is removed on their next app foreground. No manual revocation required.

Sitter Mode is opt-in per sit, time-bounded, and scoped. The sitter sees only what they need to care for your dog during the dates you set, nothing else.

Walking Club (public CloudKit, event-only)

The Walking Club uses CloudKit's public database for one purpose: hosting walk events that you and others can RSVP to. Only the event details — meeting time, place, dog name, your first name, and an optional note — are shared. Health logs, weights, medications, vaccinations, vet records, and addresses are never in the public database. You opt in by creating or joining a walk.

Medications

Medications follow the strictest privacy rules in the app:

• Off by default in Vet Reports. Added only when you explicitly flip the "Include medications" toggle in the report before sharing — your preference is remembered.
• Never sync to any public CloudKit database (Walking Club, future Litter Network) — structurally excluded, no toggle exposed.
• Off by default in the Sitter Info Sheet. You have to flip an explicit "Include medications" toggle inside the sheet before they're added to the export. That preference is remembered for next time.
• Off by default in Sitter Mode. Each sit has its own "Include medications" toggle when you schedule it. Leave it off and the sitter never sees the med schedule or has a way to log doses; turn it on and the sitter can see the schedule and log doses given during the sit. The toggle is per sit, not a global setting.
• Sync only through Family Sharing (to household members you've invited) or Sitter Mode (to a sitter, only for the dates of that sit, only when you've flipped the per-sit toggle). These are the only auto-sharing paths for medications, because the people doing the dosing need to see the schedule.

Beyond these paths, there is no way for medication data to leave your iPhone.

Vet Reports and Sitter Info Sheet

When you tap "Share," EmberPaws composes a PDF or text summary and opens the iOS share sheet. You choose where it goes — Mail, Messages, AirDrop, etc. Nothing is sent automatically.

• Vet Report includes weight, vaccinations, recent stool/skin scores, and flea & tick history. Active medications (name, dosage, instructions) are added only if you toggle them on in the report — off by default.
• Sitter Info Sheet includes feeding, walks, vet contacts, allergies, and your "while I'm away" notes. Active medications (name, dosage, instructions) are added only if you toggle them on in the sheet — off by default.

Apple integrations (opt-in)

EmberPaws can talk to a few Apple services when you turn them on in Settings → Integrations. None are required, and all are off by default:

• Apple Health — write-only. Walks logged with a duration become Walking workouts in Health. EmberPaws never reads any Health data.
• Calendar — write-only. Vet and grooming appointments mirror to your iPhone Calendar. EmberPaws never reads your existing events.
• WeatherKit (Heat Warnings) — fetches today's forecast for your area to surface a heat advisory. Your location is requested once per day and never stored on our side.

Notifications

All notifications (appointment reminders, vaccination alerts, flea & tick due dates, grooming reminders, birthday reminders) are scheduled locally on your device using iOS's built-in notification system. No notification data is transmitted to any server.

Analytics and tracking

EmberPaws contains no analytics SDKs, crash reporters, advertising identifiers, or any other tracking technology. We do not know how you use the app.

Third-party SDKs

EmberPaws has no third-party SDKs that access or transmit user data. The app is built entirely with Apple's SwiftUI, SwiftData, CloudKit, HealthKit, EventKit, and WeatherKit frameworks.

Children

EmberPaws is rated 4+ on the App Store and contains no content inappropriate for any age. Because we collect no data on our side, there are no special considerations for younger users.

Contact

Questions about this policy? Email [email protected].