Privacy Policy

1. Data controller

Wufy is the controller of your personal data (for GDPR purposes) and the operator (for the purposes of Russian Federal Law No. 152-FZ "On Personal Data").

For any privacy-related questions or to exercise your rights, contact us at wufydog@gmail.com. Full legal entity details (including address) are available on request.

2. What we collect

We collect the following categories of data:

• Account data: your first and last name, username, profile photo, language, and time zone (received from your sign-in provider).
• Authentication identifiers: Telegram user ID, Apple user identifier, Google ID, and email address when provided by the sign-in provider.
• Dog and walk data: information you create in the app — dog name, breed, size, gender, photos; walks, events, lost-dog notices you create or join; reviews; chat messages and photos you share.
• Location data: approximate location (GPS coordinates, derived neighborhood cell, country) used to show nearby walks and events. You control location permissions in your device settings.
• Device and technical data: device model, operating system, app version, IP address, push notification tokens, session identifiers.
• Usage data: actions you take in the app — screens opened, features used, errors encountered — collected for product improvement and troubleshooting.
• Crash and diagnostic reports (including native crash reports on Android via Firebase Crashlytics).

3. Sign-in providers

You can sign in to Wufy using one or more of the following providers. We receive only the fields listed below:

• Telegram — Telegram user ID, first name, last name (optional), username (optional), profile photo URL (optional).
• Sign in with Apple — Apple user identifier and, only on first sign-in if you choose to share it, your name and email (Apple may provide a private relay email).
• Google Sign-In — Google account ID, email, name, and profile picture URL.

4. Legal bases for processing (GDPR)

We rely on the following legal bases under the EU General Data Protection Regulation (GDPR):

• Performance of a contract (Art. 6(1)(b)) — operating the Service you asked to use, including sign-in, profile, walks, chats, and subscriptions.
• Consent (Art. 6(1)(a)) — optional features such as precise location, push notifications, optional analytics. You can withdraw consent at any time.
• Legitimate interests (Art. 6(1)(f)) — service security, fraud and abuse prevention, product improvement, ensuring basic analytics.
• Legal obligation (Art. 6(1)(c)) — compliance with applicable laws and lawful requests from authorities.

5. Legal basis under Russian law

For users in the Russian Federation, we process personal data in accordance with Federal Law No. 152-FZ "On Personal Data". The processing is based on the need to perform the user agreement (Art. 6(1)(5) of 152-FZ), on the user's consent for optional features, and on our legitimate interests in security, abuse prevention, and service improvement.

6. How we use your data

• to provide and operate the Service — account, walks, events, chats, notifications;
• to personalize content based on your location, language, and preferences;
• to send service communications, walk reminders, join requests, and other notifications you have enabled;
• to detect, investigate, and prevent abuse, spam, and fraud;
• to improve the Service through aggregated usage statistics and crash reports;
• to comply with legal obligations and respond to lawful requests.

7. Who we share data with

We do not sell your personal data and do not share it with third parties for their own marketing. We share data only with the service providers that help us operate the Service:

• Amvera (Moscow, Russian Federation) — server hosting, database, background jobs.
• Yandex Cloud — object storage (S3) for user-uploaded photos.
• Telegram — when you sign in or use the Telegram Mini App, and to deliver messages via the Telegram bot.
• Apple — Sign in with Apple, Apple Push Notification service, App Store subscription billing.
• Google — Google Sign-In, Firebase Cloud Messaging (push notifications), Firebase Crashlytics (native crash reports on Android), Google Maps, Google Play subscription billing.
• Yandex Maps — map rendering (optional, when selected as map provider).
• Expo (Expo Application Services) — build, delivery, and push-notification transport for our mobile apps.
• Centrifugo — real-time messaging infrastructure for chat and live updates (self-hosted on Amvera).
• Other users of the Service — your profile information, dogs, walks, events, and chat messages are visible to other users as a core part of the Service.

8. Where your data is stored

Primary infrastructure is hosted in the Russian Federation (Amvera data centers in Moscow). User-uploaded photos are stored in Yandex Cloud object storage. Backups are retained in the same infrastructure.

Some third-party services (Apple, Google, Telegram, Expo) may process data in other countries as required to deliver their services (for example, push notifications and sign-in).

9. International transfers

When we transfer personal data across borders, we rely on appropriate safeguards — Standard Contractual Clauses adopted by the European Commission, adequacy decisions, or your explicit consent — as required by applicable law.

For users in the Russian Federation, cross-border transfer is carried out in accordance with Art. 12 of 152-FZ.

10. Retention

We keep your personal data while your account is active. When you delete your account, we delete or anonymize your personal data within 30 days, except where retention is required by law (for example, transaction records) or to resolve disputes and enforce our agreements.

Backup copies are cycled out on our standard backup schedule.

11. Your rights

Depending on your jurisdiction you have the following rights:

• access — obtain a copy of the personal data we hold about you;
• rectification — correct inaccurate or incomplete data;
• erasure ("right to be forgotten") — request deletion of your data;
• restriction — limit how we process your data;
• portability — receive your data in a machine-readable format;
• objection — object to processing based on legitimate interests;
• withdraw consent — for processing based on consent, at any time;
• lodge a complaint with your local data-protection authority (for example, Roskomnadzor in the Russian Federation or your national DPA in the EEA).

12. How to exercise your rights

To exercise any of the rights above, contact us at wufydog@gmail.com. We may ask you to confirm your identity before fulfilling the request. We respond within 30 days.

13. Cookies and analytics

We use essential cookies and local storage to keep you signed in, remember preferences, and protect against abuse. We do not use third-party advertising or cross-site tracking cookies. Basic server-side analytics help us understand how the Service is used so we can improve it.

14. Children

Wufy is not directed to children under 16 years of age. If you are under 16, please do not use the Service. If we become aware that we have collected personal data from a child under 16 without parental consent, we will delete that data promptly.

15. Security

We use industry-standard security measures — HTTPS/TLS in transit, secure password-less authentication, hashing of tokens, authenticated access to storage, and role-based access for our operators.

No method of transmission or storage is 100% secure. If we become aware of a security incident affecting your personal data, we will notify you and the appropriate authorities as required by law.

16. Changes to this Policy

We may update this Privacy Policy to reflect changes to the Service, to our practices, or to applicable law. When we do, we update the "Last updated" date at the top. Material changes will be communicated inside the app or by other reasonable means.

17. Contact

If you have questions about this Policy or want to exercise your rights, contact us at wufydog@gmail.com. Full legal entity details (including address) are available on request.