SmallFriendFiles Privacy Policy

Version: 0.2 (draft, open beta) Effective date: 30 August 2026 Last updated: 12 October 2026

Not a final legal document. This is a working draft for the open free beta of SmallFriendFiles. Before the public paid launch (V1.1), it must be reviewed by a Spanish data-protection lawyer. Its draft status does not limit any of the rights granted to you by applicable law.

This document is available in Spanish, Russian, English and Ukrainian. In the event of any discrepancy between versions, the Spanish version shall prevail, without prejudice to the rights granted to you by mandatory consumer-protection law.

1. Who we are

The SmallFriendFiles service (the "Service", "we") is provided by:

• Data controller (Responsable del tratamiento): Ekaterina Pustovaia, registered as an autónomo (self-employed sole trader) in Spain
• NIF/NIE: Z2391039X
• Address for notices: Avenida de Francia, 79, bloque B, planta 10, puerta 8, 46024 València (Valencia), Spain
• Email for data-protection requests: privacy@smallfriendfiles.fyi
• Support: support@smallfriendfiles.fyi

Because the controller is established in Spain, the processing of personal data is governed by:

• Regulation (EU) 2016/679 (GDPR) — the General Data Protection Regulation
• Ley Orgánica 3/2018 (LOPDGDD) — the Spanish data-protection act (Organic Law 3/2018 on the Protection of Personal Data and Guarantee of Digital Rights)
• Other applicable EU and Spanish law

Supervisory authority: Agencia Española de Protección de Datos (AEPD) (Spanish Data Protection Agency) — https://www.aepd.es.

2. What data we collect

2.1. Account data

• Email
• Name (if you provided it)
• Google identifier (if you signed up via Google OAuth) — only the sub claim and email, no long-lived tokens
• Hashed password (if you signed up with email/password) — bcrypt; we never see your password in plain text
• Interface language, chosen or detected
• Record of your acceptance of the Terms of Service: document version, date and time, and the language in which it was displayed

Which data is mandatory. To create an account you need an email address and a password, or to sign in with Google; without them we cannot create the account or provide the Service to you. To create a pet profile, the pet's name and species are required; all other pet data is optional. Uploading documents, photos or notes, creating share-links and sending support requests is voluntary: if you do not do so, you simply will not be able to use the corresponding feature.

2.2. Pet data

• Pet's name, species (dog/cat/other), breed, date of birth, weight, sex
• Free-text notes about the pet (entered by the owner, up to 1,000 characters)
• Pet photo (stored in the Service's file storage — see section 5)

2.3. Storage contents (Vault)

• Uploaded documents: PDF, JPEG, PNG, WebP, up to 15 MB per file (veterinary reports, lab results, receipts, vaccination passports, etc.)
• Document metadata: type (vaccine/lab result/receipt/passport/other), vet/clinic name (entered by the owner as free text), document date, tags, notes
• Data from the pet's veterinary passport: microchip number and date of microchipping, passport number, issued by whom and where, registration registry, vaccination history, and also the owner's contact details stated in the passport — name, address, phone number, email. This data is extracted automatically from the passport pages you upload. The card as a whole can be deleted together with the pet or the account; editing of individual fields will become available together with the passport screen.

Data of other people. Document contents and metadata may include personal data of persons other than you: names of veterinarians and professional details of clinics and, if the pet had a previous owner, that owner's contact details as stated in the passport or on a receipt. We process this data only as part of the pet's records that you keep, without searching for it or combining it with other sources, on the basis of your and our legitimate interest (Art. 6(1)(f) GDPR) in having complete veterinary records that are faithful to the original document. Your consent does not replace the lawful basis concerning those persons, who are not party to the contract with you. Since we do not have their contact details or any reasonable means of contacting them, we provide them with the information required by Art. 14 GDPR through this policy (Art. 14(5)(b)), and they can exercise their rights by writing to privacy@smallfriendfiles.fyi. We ask you not to upload documents unrelated to your pet and to delete third-party data you do not need.

AI document recognition. Every uploaded document is sent to a third-party AI service (Google (cloud AI services), USA and other countries where Google operates) to extract metadata (document type, date, clinic, veterinarian, specialty, tags), to produce a short summary of the document and, where the document contains them, to extract vaccinations. The interface language and the pet's name are sent together with the document, so that the result is written in your language and the summary refers to the pet by name. The same document may be sent again if the connection to the provider fails (automatic technical retries) or if you ask for it to be recognised again. This happens automatically on every upload — there is no separate toggle, and the only way not to send a document is not to upload it to the Service; you can enter the data manually instead of uploading the document. The file and its record are saved in the Service immediately on upload, before and regardless of the recognition result. The transfer is governed by Google's additional terms for its AI APIs: because the controller is established in the EEA, the paid-services data terms apply — Google does not use the content to improve its products and processes it under its DPA (EU-US Data Privacy Framework, otherwise SCC); logs are kept for a limited time to detect abuse (see section 4.2). The extracted metadata only pre-fills a form: you can edit or delete any field. If you upload pages of a veterinary passport, whatever is written on them is also sent to the same service — including your own contact details (name, address, phone number, email) if they appear in the passport.

Translating a shared pack for the vet. The first time a shared pack (share-link) is opened in a given language, the pack's title, the pet's breed and the titles of the documents in it are sent to the same AI service (Google (cloud AI services), USA and other countries where Google operates) to be translated into that language. Only this text is sent — not the document files or their contents. The translation is made once per language, stored with the pack and deleted together with it; if you rename a document, the new title is translated the next time the pack is opened. The pet's name is not sent to the service: it is converted to Latin script automatically, without AI.

Two technical details we want to be upfront about. Large documents (roughly 12 MB and above) are not sent to the provider in the request body but are uploaded to the provider's file storage, where a copy of the document exists for a limited time under the provider's rules. And the original recognition result is stored by us separately from your edits: we need it so that the AI-suggested version can be restored, and so that we can assess recognition quality. Your edits do not overwrite this reference copy; it is deleted together with the document.

About the passport card specifically. It belongs to the pet, not to a particular file: a single card is assembled from all the passport pages you have uploaded. Therefore, deleting a document page does NOT delete the card — neither its fields nor its recognition reference copy. The card (together with the owner's contact details from the passport and the entire vaccination history) is deleted when you delete the pet or the account, and this deletion is irreversible.

2.4. Share-links

• A random token (22 characters, URL-safe, 128 bits of entropy from a cryptographically secure random number generator)
• A link to the pet and a time range
• Validity period — 30 days from creation; the link can be extended by another 30 days or revoked at any time
• A revocation marker (if the link has been revoked by the owner)

2.5. Technical data

• IP address (in server logs and when the share page is accessed)

• User-Agent (browser and device type)

• Technical events and frontend/backend errors (via Sentry — for diagnosing failures). Sentry may record stack traces, code fragments and the IP address. We aim not to send document contents or personal pet data to Sentry — we filter sensitive fields on the SDK side.

• With the user's consent — product analytics via PostHog EU:

  • events: page views (path without the query string, identifiers in the address replaced with a template), clicks and form submissions without element text, repeated and "dead" clicks, a click heatmap, JavaScript errors, page-speed metrics (Web Vitals), starting and completing sign-up, creating a pet, uploading a document;
  • session recordings (session replay): a replayable recording of how you use the interface — scrolling, pointer movements and clicks, moving between screens. All text on the page and all input fields are masked in your browser before anything is sent; images, documents and their previews are not recorded at all; network requests are not recorded; no recording takes place on public share pages;
  • link to your account: after you sign in, events and recordings are linked to your account's internal identifier (UUID) — without your email or name — so that one user's journey can be followed across visits.

  For this, PostHog stores random device and session identifiers in your browser (a cookie and localStorage, see section 11). When receiving events, the PostHog server receives your IP address and User-Agent; the IP address is not stored. Names, emails, pet names, document and chip numbers, file names and document contents are not sent to PostHog.

• Authentication cookies (necessary for the Service to work — without them you cannot sign in)

2.6. Support requests

The text of the request, the selected category, attached screenshots and videos (JPEG / PNG / WebP / MP4 / MOV / WebM, up to 50 MB) and technical context: the page from which the request was sent, the browser window size and the User-Agent. The request is sent by email to the controller; links to attachments in that email are valid for 7 days.

2.7. What data we do NOT collect

• Payment data — in V1 (free beta) there are no payments. In V1.1, once we connect Stripe, we will redirect you to Stripe Checkout — Stripe collects payment data itself; we receive only the subscription status and the customer identifier.
• Biometric data, human health data, precise geolocation, voice, phone contacts — we do not request them, and the Service is not intended for them.
• Special categories of data under Art. 9 GDPR (data concerning human health, racial/ethnic origin, etc.) — the Service is not designed for human medical documents, and uploading them is prohibited (Terms of Service, section 5). We do not technically inspect the contents of uploaded files, so we ask you not to upload documents containing human health data.

Note on health data: the GDPR classifies data concerning the health of natural persons as a special category. Medical data of animals does not fall under Art. 9. However, the general GDPR principles apply to it.

3. Why we process this data and on what basis

We rely on legitimate interest only where it does not override your rights and freedoms. You may object to processing based on legitimate interest (see section 8).

4. Who sees your data

4.1. Within the team

In V1 — only the author-developer (see section 1), who has access to the Supabase administrative tools. We minimise actual viewing of user data: we look at specific records only in the event of an incident or at the user's explicit request.

4.2. Sub-processors (processors acting on our instructions)

Google as a sign-in provider. If you choose "Continue with Google", Google (Google Ireland Ltd. / Google LLC) authenticates you under its own terms and its own privacy policy, as an independent controller of that processing, and passes to us only your account identifier and your email. It is not a processor acting on our behalf.

You can request a copy of the safeguards applicable to each international transfer (contractual clauses or certification) by writing to privacy@smallfriendfiles.fyi.

The list of sub-processors may change. We will notify you of material changes at least 30 days before they take effect — by updating this page with a new date in the header and, if we have your email, by email — so that you have the opportunity to object.

Upstash (rate-limiting cache)

What: an Upstash Redis database stores rate-limiting counters for sign-in and sign-up, data export, support requests and public share pages. What data: IP address (for pre-sign-in endpoints and for public share pages), your internal identifier or a hash of your email (for in-account actions), attached to a counter with a TTL of 1 minute to 1 day. It does not store request contents or your documents. Where: EU region (Frankfurt). DPA: signed self-service.

Sentry — user-id pseudonymisation

User-id pseudonymisation: in Sentry events your internal identifier is sent as a short irreversible hash instead of the UUID. Email, IP address and request query strings are scrubbed before sending.

4.3. Disclosure to third parties at your initiative (share-links)

When you create a share-link and pass the URL to a veterinarian (or another recipient), you voluntarily disclose the contents of the share page to a third party. SmallFriendFiles does not control to whom exactly you send the link.

Protective measures we apply by default:

• Validity period — 30 days
• Can be revoked at any time with the revoke button
• Token — 22-character URL-safe random (128 bits of entropy)
• <meta name="robots" content="noindex,nofollow"> — search engines should not index the share page
• No advertising or product analytics on the share page. Only technical error and performance monitoring runs there (Sentry, EU instance): it receives the error type, the stack trace and an anonymised URL — without email, IP or document contents

As the owner, you are responsible for choosing the recipient, for the security of the channel through which you pass the link (messenger, email) and for revoking the link promptly after the visit.

4.4. Other disclosures

We may disclose data:

• Upon a binding order of a public authority (court, AEPD, tax authority) — only to the extent required by law
• To protect rights, life or safety (force majeure)
• In the event of a sale/merger of the business — with prior notice and with the terms of this policy preserved

We do not sell or rent your data to third parties for advertising purposes.

5. Where the data is physically stored

• Main database and authentication data: Supabase, region Switzerland (Zurich). This is where your account, pet profile and document metadata are kept.
• The files themselves (Vault documents, pet photos, support-request attachments): Cloudflare R2, EU jurisdiction. Cloudflare is a US company; processing is covered by the Cloudflare DPA, and storage is in the selected jurisdiction.
• Application server side: Vercel, region Germany (Frankfurt, region fra1). The code that reads and writes your data runs there; the application's static assets are additionally cached on edge nodes worldwide. This means that while a request is being processed, your data is transferred between the storage region and the compute region.
• Sentry logs: EU instance (ingest.de.sentry.io).
• PostHog events and session recordings: EU Cloud (Frankfurt).
• AI recognition: Google (cloud AI services), USA and other countries where Google operates.
• Sign-in with Google: Google's infrastructure, under its own terms (see section 4.2).

Transfers outside the EEA. Switzerland is not part of the EEA, but it is recognised by the European Commission as providing an adequate level of data protection — transfers there do not require additional safeguards.

Server functions run in Germany; this does not in itself constitute an international transfer. However, several processors are US companies or belong to US groups (Vercel, Cloudflare, Sentry, PostHog, Upstash, Resend) and may access or process data outside the EEA, for example for support or security purposes or through their sub-processors. In addition, the AI recognition service (USA and other countries where Google operates) and Resend (USA) process data outside the EEA. In all these cases the transfer is covered by the safeguards stated in the "Contract/DPA" column of section 4.2: the EU-U.S. Data Privacy Framework, where the provider is certified, or the European Commission's Standard Contractual Clauses (SCC) included in its DPA. You can request a copy of these safeguards (see section 4.2).

Note for users from the Russian Federation

SmallFriendFiles does not host any database in the territory of the Russian Federation. The Service is provided by a controller established in Spain (autónomo), in accordance with EU law (GDPR); the database is in Switzerland (Zurich), files in Cloudflare R2, EU jurisdiction, server functions in Germany (Frankfurt, region fra1).

Russian personal-data legislation (in particular, Art. 18 of Federal Law No. 152-FZ) contains database-localisation requirements. The Service is not set up to meet those requirements, and its infrastructure is located in the EU and Switzerland. We inform you of this so that you can make an informed decision on whether to use the Service; this information does not transfer to you any obligation that rests with the controller.

6. How long we keep data

Once deleted from our operational systems, data is erased permanently. Database records may remain for some time in its automatic backups (at most 7 days) — there is no operational access to them, and the backups are overwritten when that window expires. Files are deleted from storage at the moment of deletion; if the storage does not respond at that moment, deletion is retried automatically every night until it completes, and in the meantime no link exists through which they can be accessed. There are no file backups.

Where a legal provision requires us to retain certain data (for example, accounting records from V1.1), we will keep it blocked — that is, available only to judges and courts, the Public Prosecutor's Office or the competent public authorities — for the corresponding limitation period, and will destroy it afterwards (LOPDGDD, art. 32).

7. Deleting your account and data

You can delete your account at any time — yourself, in the app: Profile → Danger zone → "Delete account". We will ask you to confirm the action with your password; if you sign in with Google, you will need to type a confirmation word instead of a password. Access to the account and all its data is disabled immediately, and the deletion is irreversible. The data is erased from our operational systems at that same moment; the exceptions (backups, files whose deletion has to be retried, copies of support requests in email, and data we must retain by law) are described in section 6.

If you can still sign in but prefer to contact us, write via Profile → Help. If you have lost access to your account and the form is unavailable — it only opens after signing in — write to the contact address in section 13. We fulfil a request received through any of these channels without undue delay and in any event within one month of receipt (Art. 12(3) GDPR), and confirm completion by email. Before deleting an account on an email request, we may ask you to prove that you are its holder.

When an account is deleted:

• the pet profile, Vault documents and files in storage are deleted irreversibly;
• all share-links stop opening;
• support requests and the files attached to them are deleted together with the account; the copy in the controller's email inbox is deleted in accordance with section 6.

Separately from account deletion, you can at any time delete a specific document (immediately and permanently) or a pet — the pet remains in a "frozen" state for 90 days so that the deletion can be undone, after which it is deleted automatically.

8. Your rights (GDPR Arts. 12-22)

You have the right:

1. To be informed about which of your data we process (Arts. 13-14) — this policy is the fulfilment of that right
2. Of access to your data — to request a copy of what we hold (Art. 15)
3. To rectification of inaccurate data (Art. 16)
4. To erasure ("right to be forgotten", Art. 17) — see section 7
5. To restriction of processing in certain cases (Art. 18)
6. To data portability (Art. 20) — export of your data in the machine-readable JSON format (files are provided via temporary links contained in that JSON)
7. To object to processing based on legitimate interest or for marketing (Art. 21)
8. To withdraw consent at any time (Art. 7) — where the basis is consent
9. Not to be subject to automated decisions producing legal or similarly significant effects (Art. 22). In V1 we do not take automated decisions concerning you.
10. To lodge a complaint with the AEPD (Agencia Española de Protección de Datos, https://www.aepd.es) or with the supervisory authority of the Member State of your habitual residence, your place of work or the place of the alleged infringement (Art. 77 GDPR).

Right to portability (Art. 20): the "Profile" page has a "Download my data" button. It returns a JSON file containing all your pet data and document metadata, together with temporary links (24 hours) to the files themselves in storage. You download the files separately via these links.

To exercise any of these rights, send a request through the in-app feedback form — Profile → Help: this channel already works and reaches the controller directly. You can also write to privacy@smallfriendfiles.fyi. We will respond without undue delay and in any event within one month of receiving the request. That period may be extended by two further months where requests are complex or numerous; in that case we will inform you of the extension and the reasons for it within the first month (Art. 12(3) GDPR). If we have reasonable doubts about your identity, we may ask you for additional information to confirm it.

This is free of charge. If a request is manifestly unfounded or excessive (repetitive), we may charge a reasonable fee or refuse with reasons.

9. Security

Technical and organisational security measures:

• TLS 1.2+ for all traffic (HSTS enabled)
• Encryption of data at rest on the Supabase side (AES-256)
• bcrypt for passwords; OAuth tokens are not stored in long-lived form
• Row Level Security (RLS) at the Postgres level — each user sees only their own data
• Access to administrative tools only via MFA
• Access to the production environment only for the author-developer
• 22-character random tokens for share-links (URL-safe alphabet, 128 bits of entropy) — brute-force guessing is infeasible
• Private file storage: the path of every file starts with the owner's identifier, and the server verifies ownership before issuing any link — for both upload and read. Files are served only via signed links with a limited lifetime: 1 hour — viewing in the app and on the share page, 24 hours — data export, 7 days — support-request attachments
• Regular database backups (Supabase managed); file storage runs without versioning
• Pet photos are re-encoded directly in the browser, which strips EXIF (including GPS coordinates). For document images this happens only when compressing files larger than 2 MB — small images and PDFs are stored as they are, together with their metadata

Despite the measures we take, no system is absolutely secure. If a security breach affecting personal data occurs, we will notify the AEPD without undue delay and, where feasible, within 72 hours of becoming aware of it, unless the breach is unlikely to result in a risk to the rights and freedoms of individuals (Art. 33 GDPR). If the breach is likely to result in a high risk to you, we will also inform you without undue delay (Art. 34 GDPR).

10. Children

The Service is intended for persons aged 18 and over. We do not knowingly collect data of minors. If you are a parent/guardian and discover that a minor has created an account, write to privacy@smallfriendfiles.fyi — we will delete the account.

In Spain, the age of consent to data processing under the LOPDGDD is 14, but we set a higher threshold of 18 to simplify compliance and because the Service may contain receipts/documents with financial data of adult pet owners.

11. Cookies and similar technologies

The Service uses only its own (first-party) cookies. No advertising cookies or marketing pixels are used. Simply visiting the public product page does not set any of our cookies.

The session cookies, pawfile_recovery and pf_pet_gate are technically necessary for sign-in, security and the pages you request. pf_active_pet, pf_locale and pf_welcomed store only settings or actions you expressly chose and serve to provide the service you asked for; pf_analytics_consent stores your own cookie choice. Under Art. 22.2 LSSI-CE (Spanish Act 34/2002 on Information Society Services) and the AEPD Guide on the use of cookies, these cookies are exempt from consent, but we inform you about them in this policy. None of them is used for profiling or advertising.

Analytics (PostHog). The product analytics and session recordings described in sections 2.5 and 3 are switched on only after you click "Allow" in the banner. Only then does PostHog set the ph_…_posthog cookie and write to localStorage/sessionStorage. If you have not allowed analytics, PostHog is not loaded, stores nothing and no events are sent. If you allowed analytics before 12 October 2026, when it ran without session recordings and without cookies, we will ask you again.

Changing or withdrawing your consent. You can change your choice at any time via the "Cookie settings" link at the bottom of the public page, at the end of this policy and in Profile. If you withdraw consent, the Service immediately stops sending events and recording the session, and the PostHog identifiers are reset, including in other open tabs as soon as you return to them; PostHog keeps only an opt-out marker in your browser. Withdrawing consent is as easy as giving it and does not affect the lawfulness of processing before the withdrawal.

12. Changes to this policy

This policy is an information notice: you do not need to accept it, and its content does not by itself extend the processing we carry out. We will inform you of material changes at least 30 days in advance by email and by a notice in the Service. Less significant edits (typo fixes, clarifications of wording) are published without prior notice — with the "Last updated" date at the top of the document updated.

If a change requires your consent (for example, new processing based on consent), we will ask for it expressly and separately; merely continuing to use the Service will not be regarded as consent.

13. Contact us

• On personal-data matters: privacy@smallfriendfiles.fyi
• On general matters: support@smallfriendfiles.fyi
• Postal address: Ekaterina Pustovaia, Avenida de Francia, 79, bloque B, planta 10, puerta 8, 46024 València (Valencia), Spain

Appendix: glossary

• Controller (Responsable): determines the purposes and means of processing. In our case — the autónomo in Spain (see section 1).
• Processor (Encargado): processes data on behalf of the controller. These are Supabase, Vercel, Sentry, etc.
• Sub-processor: a processor engaged by another processor (for example, Supabase's AWS region = a sub-processor of Supabase).
• DPA (Data Processing Agreement): an agreement between the controller and a processor on data protection under Art. 28 GDPR.
• SCC (Standard Contractual Clauses): the European Commission's standard contractual clauses for transferring personal data outside the EEA.
• DSAR (Data Subject Access Request): a data subject's request to exercise rights under Arts. 15-22 GDPR.

Cookie settings