VitalLedger Privacy Policy

Who we are

VitalLedger is published by JC Mobile App Studio LLC, a one-person studio based in Pennsylvania, USA. We are responsible for the app and for the services it uses that we operate. "We" and "us" in this policy mean JC Mobile App Studio LLC. You can reach us at [email protected].

Short version

• No ads, no analytics, no trackers. We don't know how you use the app.
• Your pets, vaccines, vet visits, medications, weight history, photos and documents are stored on your device first. Cloud sync is optional and off until you turn it on.
• On iPhone, sync uses your own private iCloud account. On Android, sync uses a Google Firebase project that we operate, tied to the Google account you sign in with.
• Sitter Mode uploads a copy of the care card you create, including any contact details on it, so your sitter can open it from a link or QR code. Anyone with the link can view it until it expires or you revoke it.
• The assistant, scanning and visit transcription run on your device.
• We do not sell your data.

What VitalLedger stores

Mostly information about your pets, which is not personal information about you. Some of what you enter is personal information, though: the names, phone numbers, emails and notes of emergency contacts, vets and sitters, and, on Android with sync on, your Google account. This policy treats all of it with care.

Where your data lives

Everything you enter is stored locally on your phone or tablet. You can use VitalLedger without an account, and backup and restore work from a file you keep. Your device's own backup (iCloud Backup, or Android's Google backup) may also include the app's data, based on your device settings.

iPhone and iPad. If you turn on iCloud sync, VitalLedger syncs through Apple's CloudKit to your own private iCloud account. We cannot read your private iCloud data.

Android. If you turn on cloud sync, you sign in with a Google account and VitalLedger stores your records in Google Firebase (Cloud Firestore for records and Cloud Storage for photos and documents) in a project operated by JC Mobile App Studio LLC. Server rules allow your synced data to be read or written only by your signed-in account. Firebase gives us your account's email address and display name, which we use only to identify your account. We do not read your records or use them for anything other than syncing them to your devices. Turning sync off stops syncing but does not by itself delete what was already synced; see Your privacy rights below.

Sitter Mode

Sitter Mode creates a read-only care card and a link or QR code for whoever is looking after your pets. The QR code contains only the link. To make the link work, the app uploads a snapshot of the card:

• What is in it: each included pet's name, species, breed, birth date, microchip number and photo; feeding brand, amounts, meal times, allergies and current medications; recent symptoms, stool issues, abnormal temperatures and today's activity; the emergency and vet contacts on the card (name, role, phone, email, notes); and any note you add for the sitter.
• iPhone: the snapshot is stored in the public database of VitalLedger's Apple CloudKit container, which we operate, and shown by the viewer page at vitalledger.app. On Android, it is stored in our Firebase project, along with your account's internal user ID and a view counter.
• Who can see it: anyone who has the link or QR code, until it expires or you revoke it. Links are random and hard to guess, but please share them only with people you trust. If you choose "Never" for expiry, the card stays available until you revoke it.
• Sitter updates (Android): a sitter can log a walk, meal or dose back to the link. That entry contains only what they type, plus an optional name, and appears in your feed.
• Removal: on iPhone, revoking a card deletes it from CloudKit right away, and expired cards are deleted the next time you open the app. On Android, revoking or expiring a card stops it from being shown, but the stored copy is not yet removed automatically. Email us and we will delete it.

Sharing a pet with someone (iPhone)

On iPhone you can invite another iCloud user, such as a partner or family member, to share a pet. This uses Apple's iCloud sharing: the pet stays in your private iCloud and is shared only with the people you invite. We do not see this data. You can stop sharing at any time. Pet sharing is not yet available on Android.

Apple Wallet pet ID (iPhone)

If you add a pet's ID card to Apple Wallet, the app builds the pass on your iPhone. Wallet passes must be signed, so the app sends only a list of file fingerprints (hashes, not the pass contents) to a small signing service we run on Cloudflare Workers, together with an Apple App Attest check that proves the request comes from the real app. The service keeps the App Attest key for the device (not linked to your identity) for up to about 400 days, and Cloudflare keeps short-term request logs for us. The finished pass, with your pet's details and contacts, lives in your Wallet.

On-device intelligence

The assistant, weekly summaries, receipt and document scanning, and vet visit transcription run on your device. On iPhone they use Apple's on-device models and speech recognition. On Android they use Google's on-device ML Kit, Gemini Nano through AICore on phones that support it, and Android's on-device speech recognizer. Google may download a model to your phone, but VitalLedger does not send your records, questions or recordings to a server.

Visit recording. When you record a vet appointment, the audio is turned into text on the device as you go. The audio itself is not saved. The transcript and summary are saved in the visit record and sync only if you have sync on. Please ask your vet before you record.

Location

If you allow it, VitalLedger uses your location to find nearby vets (on iPhone this search is handled by Apple Maps; on Android it opens your maps app) and to measure walk distance while a walk is running. Only the total distance is saved. Coordinates are not stored or sent to us.

Recall alerts

VitalLedger downloads a public list of pet food and drug recalls from our website and compares it with your feeding brands and medications on your device. The request carries no information about you or your pets.

Subscriptions

VitalLedger Premium is processed by Apple's App Store on iPhone and by Google Play on Android. They handle the payment; we never see your card. The app checks with the store that your subscription is active, and that status is stored on your device.

Diagnostic information

If you opt in through your device's settings, Apple or Google may share anonymized crash reports and performance data with us. These do not contain pet records or contact details. You can turn this off in your device settings.

What we receive, and what third parties receive

What reaches services we operate:

• Sitter Mode cards you create (Apple CloudKit public database on iPhone, Firebase on Android).
• On Android with sync on: your synced records, photos and documents, plus your Google email and display name.
• Wallet pass signing requests (file fingerprints and an App Attest key, no pet details).
• Recall list downloads from our website, which carry no personal information.

What third parties handle under their own policies:

• Apple, for iCloud sync and sharing, CloudKit hosting, the App Store, Apple Maps, Wallet and App Attest. Privacy policy.
• Google, for Firebase hosting and sign-in, Google Play, on-device ML Kit models, location services and backups on Android. Privacy policy.
• Cloudflare, which hosts our website, the sitter viewer page and the Wallet signing service. Privacy policy.

Sale, sharing, and targeted advertising

We do not sell personal data or share it for targeted advertising. VitalLedger has no ads and no ad SDK on any platform.

Data retention

• On your device: until you delete it or uninstall the app.
• In your private iCloud: until you delete it in the app or in your iCloud settings.
• Android sync data in our Firebase project: until you delete it in the app or ask us to delete your account.
• Sitter cards: until they expire or you revoke them (see Sitter Mode for how removal works on each platform).
• Wallet signing: device App Attest keys up to about 400 days; request logs as Cloudflare keeps them.

Your privacy rights

Depending on where you live (for example California, Colorado, Connecticut, Virginia, Texas, Oregon, Indiana, Kentucky, Rhode Island and other US states, or the EU/UK), you may have the right to access, correct, delete, or get a copy of personal data, and to opt out of targeted advertising, sale, or profiling. Many of these laws may not apply to a studio our size, but we honor these requests from everyone.

You can export or delete your pet data with the controls in the app, and manage iCloud data at privacy.apple.com. To delete Android sync data or sitter cards we hold, or to make any other request, email [email protected], from the Google account you signed in with if it's about Android sync. We respond within 45 days, and we will not treat you differently for asking. If we decline your request, you can appeal by replying to our answer with "Appeal". We will respond within 45 days (or up to 60 days where the law allows). If your appeal is denied, you may contact your state attorney general.

Children

VitalLedger is not directed to children under 13. We do not knowingly collect personal information from children. If you believe a child has sent us information, contact us and we will delete it.

International users

Data we hold, such as Android sync data and sitter cards, is processed in the United States or wherever Apple, Google and Cloudflare operate the services we use.

Security

Data is encrypted in transit, and Apple and Google encrypt stored cloud data at rest. Synced Android data can only be read by your signed-in account. Your device passcode or biometrics and your Apple Account or Google account security matter most, so we recommend two-factor authentication on both.

Changes

When this policy changes, we update the "Last updated" line above and post the new version at this URL. Material changes are also noted in the app's release notes.

Contact

Questions or requests: [email protected]