Privacy Policy

Last updated: 2026-09-14

Pet's Deary ("we") respects your personal data. This policy explains what data we collect in the app and in this website's "Starlight Mailbox" experience, why we collect it, how long we keep it, and how you can exercise your rights. It is written in accordance with Taiwan's Personal Data Protection Act (PDPA).

1. What We Collect

When you use the app

• Account data — the user identifier, email address and display name provided to us by your chosen sign-in method (LINE, Google or Apple). We never receive your passwords for those services.
• Pet profiles — the name, species, personality tags, description and (optional) avatar photo you enter.
• Diary & memories — the words you write and the photos you upload.
• Letters & AI replies— the letters you write to your pet, and the AI's responses in your pet's voice.
• Subscription status — your current plan and its expiry date. Payment is handled by Apple; we never receive your credit-card or payment details.
• Error & crash logs — technical information when the app hits an error (device model, OS version, stack trace), used to find and fix problems.

When you complete the website's "Starlight Mailbox" experience

• Phone number (hashed) — used to make sure each number can only try the experience once, and to send a verification code through Firebase. The original number is kept only briefly during verification; after that only the SHA-256 hash is stored. We cannot recover the number from the hash.
• Pet information — the name, species, personality tags, one-line description and (optional) photo you enter.
• Letter content & AI reply— the letter you write to your pet, and the AI's response in your pet's voice.
• Feedback — the rating, whether you intend to keep using the service, and the free-text suggestions you give after the experience.
• Device & connection information (hashed) — hashed IP address and browser type, used only for abuse detection and routine statistics. Original IPs are not kept.

2. Why We Collect It

• To create your account and let you access the diaries and letters you have written on your own devices.
• To have Google Gemini generate AI replies based on your pet's personality.
• To confirm your current subscription plan and the features available to you.
• To run the "Starlight Mailbox" experience flow, and to keep repeat runs on the same phone number from affecting other users.
• To analyse the user experience and improve the app's reply quality and flows.
• To detect and prevent bots, SMS abuse, malicious traffic and similar behaviour.

3. Third-Party Services

Behind the scenes the service calls the following third parties, and some data is sent to them:

• Google Gemini (Google LLC) — receives your letter content, pet personality tags and (optional) photos in order to generate AI replies. Google does not use this data to train its models (the paid Gemini API tier does not train on inputs by default). We also automatically scan your letters for signs of distress or self-harm; if we find these signals, we show you crisis resources in the reply.
• LINE, Google and Apple sign-in — the sign-in service you choose provides us with a user identifier, email address and display name, used to create and recognise your account.
• Apple (in-app purchase) and RevenueCat— process subscription payments and keep subscription status in sync. Payment details stay with Apple; we only receive "which plan this account is on, and until when".
• Firebase Authentication (Google LLC)— used only for the website's "Starlight Mailbox" experience; receives your phone number to send the SMS verification code. After verification, we do not store the original number in our own database.
• Sentry— receives the app's crash and error logs, used for debugging.
• Email delivery service — used to send account-related notices (for example the archive reminder email for long-unused accounts).
• Cloudflare— our website, backend API, photo storage and traffic analytics all run on Cloudflare's infrastructure. Traffic passes through Cloudflare's network.

Data processors. Your letters and photos are processed by two US-based processors: Google LLC (for AI reply generation and safety analysis) and Cloudflare, Inc. (for storage and delivery on our global network).

We do not sell your data to advertising platforms, use it for remarketing, or share it publicly.

Each of these companies is bound by a written agreement to protect your data to the same standard set out in this policy, and to use it only to provide the service we have asked them for. They may not use it for their own purposes.

Where your data is processed. Pet's Deary is operated from Taiwan, and the third parties above process data on infrastructure outside your country — principally Cloudflare's global network and Google's data centres. If you use the service from the United Kingdom, the European Economic Area, Singapore, New Zealand, Australia, the Philippines or Malaysia, your personal data will be transferred outside that jurisdiction in order to provide the service. Those transfers are made under written contracts requiring each provider to protect your data to the standard set out in this policy; we rely on no other basis for them.

4. How Long We Keep It

Your diaries, memories, letters and AI replies are kept until you ask us to delete them. That is the reason this service exists — what you choose to keep should stay kept.

The one exception is long-idle free accounts: after more than 180 days of inactivity we first send a reminder email, and only 30 days after that do we move the content into an archived state. Archiving is not deletion — you can come back and reactivate at any time, free of charge.

Data from the "Starlight Mailbox" experience is kept in the same way, so you can come back later and re-read that reply.

You can ask us to delete your data at any time (see section 6).

5. Cookies and Similar Technologies

This website uses one essential cookie (demo_session_id) to recognise you across the steps of the "Starlight Mailbox" flow — HttpOnly + Secure, with a 30-day TTL. There are no tracking or advertising cookies.

The app does not use cookies — your signed-in state is maintained by a credential (token) stored on your device.

Traffic analytics uses Cloudflare Web Analytics — a privacy-friendly service that sets no cookies, does not track you across sites, and shares no personal data.

6. Your Rights

Under Article 3 of Taiwan's Personal Data Protection Act, you may ask to review your personal data, request a copy of it, have it supplemented or corrected, have its collection, processing or use stopped, or have it deleted. We currently fulfil these requests manually — there is no self-serve export in the app or on the website.

For the deletion steps, see the Data Deletion Instructions. To exercise any of the rights, email petsdeary@gmail.com with the subject line "Personal Data Rights Request", and we will complete the request within 30 days (sooner where your local law requires it). Copies of your data are prepared in a common electronic file format and emailed to you — the reply may arrive from a different Pet's Deary team address than the one you wrote to. If more than 30 days pass with nothing received, please send your request again.

If you are outside Taiwan. Your local law may give you additional or differently named rights — for example access, correction, erasure, restriction, objection, portability, and withdrawal of consent. We apply the rights described above to every user wherever they live, and we will honour any further right your local law grants you. If you believe we have handled your personal data wrongly, you may also complain to your data protection authority: the Information Commissioner's Office (United Kingdom), the Personal Data Protection Commission (Singapore), the Office of the Privacy Commissioner (New Zealand), the Office of the Australian Information Commissioner (Australia), the National Privacy Commission (Philippines), or the Personal Data Protection Department (Malaysia).

7. Data Security

We store sensitive data (such as phone numbers) as SHA-256 hashes with a random salt; photos are stored in Cloudflare R2; and all transport uses TLS (HTTPS). No online service can guarantee 100% security — if a major data breach occurs, we will notify affected users within 72 hours.

8. Children's Privacy

This service includes AI-generated content and may touch on emotional themes around parting with a pet. It is for users aged 18 and over only. We do not knowingly collect personal data from anyone under 18. If you discover that a minor is using the service, please email us and we will delete their data immediately.

9. Changes to This Policy

If this policy changes in a material way, we will update the "Last updated" date on this page and notify you through the app (if you have it installed). We recommend checking back from time to time.

10. Contact Us

Pet's Deary privacy contact:
petsdeary@gmail.com

Privacy matters are handled by our designated Privacy Officer, who is also the data protection contact for the purposes of Singapore's Personal Data Protection Act and New Zealand's Privacy Act 2020. Write to the address above and mark your message for the Privacy Officer.

This policy was drafted by Pet's Deary ourselves and has not been reviewed by a lawyer. If anything concerns you, please write to us — we will keep refining its wording and content.