Privacy Policy

• Privacy / data-protection contact: privacy@spawk.app
• Brazil — Encarregado (DPO) under the LGPD: dpo@spawk.app [appoint & name the encarregado before BR launch]
• EU/EEA & UK — Article 27 representative: [appoint an EU and a UK representative and list name/address before EU/UK launch]

• Account data: name, email, phone (optional), password hash, Google/Apple identifier, profile photo.
• Pet & content data: pet name, breed, size, and the photos/videos/captions you upload.
• Booking & payment data: appointment details and reviews; for payments, Stripe returns only the payment-intent id, status, and amount — full card data never reaches our servers.
• Approximate (IP-based) location: coarse country/region/city from your IP, to tailor regional features and meet legal requirements; not precise, not shared with other users.
• Tracking-device location: if you activate a Spawk collar/tag — its position fixes, battery, and signal data, tied to your account (via LoRa/Helium, the Spawk Network, or Apple Find My).
• Precise / background device location:if you opt in to the Spawk Network — your device’s approximate location when it detects a nearby Spawk collar, including while the app runs in the background or is closed.
• Bluetooth detection data: when the Spawk Network is on — the rotating identifiers your phone observes from nearby Spawk collars and their signal strength. We do not scan for or identify people and do not access your contacts or other devices.
• Device & usage telemetry: user agent, IP, and event logs (page/screen views, clicks) for analytics and security.
• Custodial wallet: a Solana public key tied to your account; the private key is encrypted at rest (AES-256-GCM) and never sent to clients.

• Opt-in and off by default; turn it off in Settings or revoke permissions anytime.
• Collars broadcast rotating, non-identifying identifiers(not a stable id), so a collar can’t be tracked over time by third parties and a relaying phone can’t correlate detections to a pet.
• Detections are matched to a pet only on our servers; the relaying user is never told whose petthey detected, the owner is never told who relayed, and we do not attach the relayer’s identity to the stored location.
• We use the device’s last-known location rather than forcing a fresh GPS fix, and collect only an approximate location plus the observed identifier.

EU / EEA / UK (GDPR / UK GDPR). You may request access, rectification, erasure, restriction, portability, and object to processing based on legitimate interests; withdraw consent at any time; and not be subject to solely automated decisions with legal effects. You may lodge a complaint with your local supervisory authority (in the UK, the ICO). We respond within one month.

Brazil (LGPD). You may obtain confirmation of processing and access; correct incomplete or outdated data; request anonymization, blocking, or deletion of unnecessary or excessively processed data; request portability and deletion of data processed under consent; obtain information about sharing; and withdraw consent. You may contact our encarregado (dpo@spawk.app) and the Autoridade Nacional de Proteção de Dados (ANPD).

United States (California & other states). Subject to your state’s law (e.g., CCPA/CPRA, Virginia, Colorado, Connecticut, Utah, Texas), you may request to know, access, delete, and correct personal information, and to limit the use of sensitive personal information (which includes precise geolocation — used only to provide the features you enable, not to infer characteristics). We do not “sell” personal information or share it for cross-context behavioral advertising. You may use an authorized agent and appeal a denial. We will not discriminate against you for exercising these rights.

To exercise any right, email privacy@spawk.app (we verify identity first), or use in-app controls: delete your account in settings, turn off the Spawk Network and tracking, and revoke Bluetooth/location permissions in your device settings.