Privacy Policy

This policy explains what personal data we process when you visit paw-paw.pet or use the Paw-Paw app, why we process it, and the rights you have. It is written to meet the requirements of the EU General Data Protection Regulation (GDPR).

1. Who we are

Paw-Paw is operated by Daystrom OÜ, a private limited company registered in Estonia (registry code 17537299), at Tornimäe tn 5, Kesklinna linnaosa, Tallinn 10145, Harju maakond, Estonia. Daystrom OÜ is the "data controller" for the personal data described in this policy.

Full provider details are in our legal notice. For any privacy question or request, email privacy@paw-paw.pet.

2. What we collect & why

We try to collect as little as possible. In practice there are four situations:

• When you browse the site — our hosting provider and our cookieless analytics process basic technical data (such as the pages you view, your approximate region, browser type, and your IP address as part of serving the page). This is used in aggregate to understand traffic and keep the site secure. We do not build a profile of you.
• When you click a download link — we record an anonymous "Download" event and the channel you arrived from (e.g. "reddit", "search", "direct"). No personal identifiers are attached.
• When you use the contact form — we receive the name, email address, category, and message you submit, so we can read and reply.
• When you use the app — only if you opt in, the app sends pseudonymous usage analytics and/or technical crash and error reports. Both choices are explained in section 6, start off, and can be changed later.

Our legal bases under the GDPR, by purpose, are:

• Website analytics & download attribution — legitimate interests (Art. 6(1)(f)): measuring aggregate traffic and which content leads to downloads.
• Contact-form messages — legitimate interests (Art. 6(1)(f)): reading and responding to enquiries you send us.
• Anti-spam rate-limiting (IP address) — legitimate interests (Art. 6(1)(f)): protecting the form from abuse and keeping the site secure.
• App usage analytics — your consent (Art. 6(1)(a)), which you give in the app and can withdraw at any time.
• App crash & error reports — your consent (Art. 6(1)(a)); Sentry starts only after you explicitly enable it and can be switched off later.
• Aggregate install & activity counting — legitimate interests (Art. 6(1)(f)): estimating how many people use Paw-Paw from anonymous, aggregate download and update-check counts (no identifier, no stored IP).

Where we rely on legitimate interests, we keep the impact on you minimal — no advertising cookies, no cross-site tracking, no profiling.

3. Cookies & tracking technologies

Paw-Paw does not use any tracking, advertising, or analytics cookies. Because of that, there is no cookie consent banner to click through — there is nothing to consent to.

The only browser storage we use is a single sessionStorage entry called pp_source. It records the channel you arrived from (for example "reddit" or "direct") so that, if you click a download link, we can credit the right source. This entry:

• is first-party only — it never leaves your browser except as an anonymous label on analytics events;
• contains no name, email, or other identifier;
• is automatically erased when you close the browser tab.

We may also use strictly necessary, first-party storage that your browser needs to display the page. These are exempt from consent requirements under the ePrivacy rules.

Our fonts are served from our own server, so loading a page does not share your IP address with any third-party font provider. The providers we do rely on to host and deliver the site are listed in section 7.

4. Analytics & attribution

We use Vercel Web Analytics, a privacy-friendly analytics tool provided by our hosting platform. It is cookieless and is designed not to identify individual visitors or track you across other websites. It gives us aggregate figures such as page views, referrers, and rough geography. Vercel processes your IP address transiently to derive this aggregate data and does not store it in a way that identifies you to us.

Alongside this, a small first-party script of ours records anonymous "Download" events together with the arrival channel and the page the click happened on (see section 3). This helps us understand which content leads people to try Paw-Paw. None of it is linked to an identifiable person.

5. The contact form

When you submit the contact form, we process the name, email address, category, and message you provide. Our server also briefly records the request's IP address and a timestamp to prevent spam and abuse (rate-limiting).

Your message is logged in our hosting provider's function logs and may be forwarded to us by email via Resend so that we see it and can reply. The server also supports an optional internal webhook; if one is configured, we will name that provider and its handling here before relying on it. We use this information solely to respond to you and to improve Paw-Paw based on your feedback. We do not add you to a mailing list or use your email for marketing.

6. The Paw-Paw app (analytics & crash reports)

The Paw-Paw macOS app runs locally on your computer. Your chosen pet, collected cosmetics, and settings are stored on your own device — there is no account, no login, and no cloud sync.

The app collects two kinds of diagnostic data, and you control both:

• Usage analytics — off by default (opt-in). If you turn it on, the app sends pseudonymous usage signals through TelemetryDeck, an EU-hosted, cookieless analytics service that stores no IP address. The signals are: app launch (with your selected pet and equipped hat), changing your pet, equipping or unequipping a cosmetic (item and rarity), and collecting loot. TelemetryDeck also attaches standard technical details (operating-system version, app version, device model, language) and a salted, hashed anonymous identifier. We ask for your choice the first time you run the app, and you can change it anytime in Settings → Privacy. Legal basis: your consent.
• Crash & error reports — off by default (opt-in). If you enable them, the app sends technical diagnostics through Sentry (EU data region). Reports can include a crash stack trace, app and macOS versions, device characteristics, and technical error details. The client disables automatic and network breadcrumbs and strips user and request objects before sending. As with any network request, Sentry receives the source IP in transit; we do not currently make a website claim about the project-side IP storage setting until it has been verified in the Sentry dashboard. The first-run choice is unchecked until you enable it, and you can turn it off later in Settings → Privacy. Legal basis: your consent.

Two further network activities are simply part of distributing the app:

• Downloads & updates. Downloading the app, and the app's automatic check for new versions, contact our content-delivery network at cdn.paw-paw.pet. As with any download, this necessarily reveals your IP address and the app version to the CDN so the file can be served. We also count these requests in aggregate, by day, to estimate how many people are actively using Paw-Paw — this counting uses no identifier and we do not store your IP address for it.
• Attribution parameter. A download link may carry a non-personal utm_source label (e.g. "reddit") so we can count installs per channel in aggregate.

7. Hosting & service providers

We rely on a small number of trusted providers ("processors") to run the site. They only process data on our behalf:

Provider	Purpose	Data involved
Vercel Inc. (USA)	Website hosting, serverless contact endpoint, cookieless analytics	Technical request data, IP address, contact-form submissions
Cloudflare, Inc. (USA)	App download & update delivery (cdn.paw-paw.pet)	IP address, app version, requested file
Resend (USA)	Delivering contact-form messages to us by email	The contents of your message and your email address
TelemetryDeck GmbH (Germany, EU)	App usage analytics (only if you opt in)	App/OS version, device model, language, salted hashed anonymous ID, in-app event signals
Functional Software, Inc. / Sentry (EU data region; US parent)	Optional app crash & error reporting	Crash stack traces, device characteristics, OS/app version, technical error details, and source IP in transit; project-side IP storage setting pending dashboard verification

We may add or change providers as the project grows and will keep this list up to date.

8. International transfers

Our app analytics (TelemetryDeck) and crash reporting (Sentry) are processed on servers inside the European Union.

Some providers are based in the United States, so some data may be processed outside the European Economic Area. Transfers are handled under each provider's applicable data-transfer mechanism, which may include the EU–U.S. Data Privacy Framework and/or Standard Contractual Clauses. We will verify the applicable safeguards before adding or materially changing a provider; you can request current information by emailing privacy@paw-paw.pet.

9. How long we keep data

• Website analytics is aggregated and cookieless; it is retained in aggregate form and does not identify you.
• Server & function logs (including IP addresses) are retained according to our active Vercel plan and observability settings and rotated automatically. You can ask us for the currently configured period.
• Contact-form messages are kept only for as long as needed to handle your request, reasonable follow-up, and any applicable legal obligations. Copies may exist in Vercel logs and Resend email under their configured retention periods. You can ask us to delete your message sooner where the law allows.
• App usage analytics (TelemetryDeck) is retained in aggregate and is not tied to an identifiable person.
• Crash reports (Sentry) are retained for the period configured in our Sentry project and then deleted automatically. You can ask us for the currently configured period.

10. Your rights

Under the GDPR you have the right to:

• access the personal data we hold about you;
• have inaccurate data corrected;
• have your data erased;
• restrict or object to our processing;
• receive your data in a portable format;
• withdraw consent at any time (without affecting prior processing).

To exercise any of these, email privacy@paw-paw.pet. You also have the right to lodge a complaint with a supervisory authority — in our case the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon), or the authority in your own country.

11. Children

Paw-Paw is a general-audience app and is not directed at children under 16. We do not knowingly collect personal data from children. If you believe a child has sent us personal data through the contact form, contact us and we will delete it.

12. Changes to this policy

We may update this policy as Paw-Paw evolves or as our providers change. When we do, we'll revise the "last updated" date at the top. Significant changes will be highlighted on this page.

13. How to reach us

Questions, requests, or concerns about privacy? Email privacy@paw-paw.pet and we'll get back to you.