Privacy Policy

Last updated: October 2026

1. Data Controller

Wolfie (wolfie.app) is a product of Blanik.dev.

The controller of personal data is:

Blanik.dev
Sole trader (JDG), Poland, European Union
Tax ID (NIP): PL6472574467
Email: [email protected]

For all data protection inquiries, please contact us at the email above.

2. Scope and Application

This Privacy Policy applies to the mobile application (“App”), our websites — wolfie.app (information about Wolfie), app.wolfie.app (the web application), and wolfie.page (public pages published by breeders and businesses who use Wolfie) — related backend infrastructure, AI-powered features, and associated services (collectively, the “Service”).

This Policy is provided in accordance with:

• Regulation (EU) 2016/679 (General Data Protection Regulation – GDPR)
• Applicable national data protection laws
• Apple App Store privacy requirements
• Google Play Data Safety requirements

By using the Service, you acknowledge that your personal data may be processed as described in this Policy.

3. Categories of Personal Data Processed

We may process the following categories of data:

3.1 Information You Provide

• Email address
• Account identifiers
• Authentication credentials (via secure providers)
• Content submitted within the App

3.2 Automatically Collected Data

• IP address
• Device type and operating system
• Application version
• Log data
• Usage interactions
• Crash reports and diagnostics

3.3 Analytics Data

• Session data
• Aggregated usage statistics
• Feature interaction data
• A pseudonymous analytics identifier stored on your device or in your browser (see 3.5)

3.4 Subscription and Payment Data

• Subscription status and plan
• Purchase and transaction history
• Transaction and receipt identifiers

Full payment card details are processed directly by our payment providers (Apple, Google, or Stripe) and are not collected or stored by us.

3.5 Cookies and Similar Technologies

Our websites use cookies and equivalent browser storage (local storage) in two distinct ways.

Strictly necessary storage. Required for the site to work at all: keeping you signed in on app.wolfie.app, remembering your chosen language, and remembering your answer to the cookie banner itself. These are set without consent, because the Service cannot be provided without them.

Anonymous measurement, with or without your consent. Before you answer the banner, and if you decline, one tool runs: PostHog, in a storage-free mode and in its European Union region. No cookie is written or read, no identifier outlives the page you are on, no profile is created, and two visits cannot be linked to each other. What remains is a count of pages viewed and errors encountered, which cannot be traced back to you or to this browser. Because nothing is stored on or read from your device, this does not require consent under Article 5(3) of the ePrivacy Directive; our legal basis is our legitimate interest in knowing whether our sites work and how they are used (Art. 6(1)(f) GDPR). Google Analytics is not loaded at all until you accept, since a request to it would reach Google even without cookies.

With your consent. Accepting in the banner starts Google Analytics and allows both tools to store an identifier in your browser, which lets us tell a returning visit from a new one, follow how a feature is used across your visits, and — in the web application — connect that to your account:

• Google Analytics 4 — how many people visit each site and how they arrive. Its identifier expires up to 2 years after your last visit.
• PostHog — which features are used, and JavaScript errors encountered in the browser. Its identifier expires 1 year after your last visit.

Both are limited to measuring our own sites. We do not use advertising cookies, we do not allow advertising personalisation on this data, and we do not track you across other companies’ websites.

Withdrawing consent. You may withdraw your consent at any time using the “Cookie settings” link in the footer of our websites, or under Settings → Legal in the web application. Withdrawal deletes the identifiers described above, switches Google Analytics off again and returns measurement to the anonymous mode; it does not affect the lawfulness of processing carried out beforehand. Clearing this site’s cookies and site data in your browser has the same effect.

The App itself does not use cookies. Diagnostics inside the App are covered by 3.2 and 3.3.

3.6 Location Data

Only if you allow location access on your device. You can refuse it or withdraw it at any time in your device settings; you can then still choose a place on the map by hand.

• Danger reports — your current location (precise or approximate, as you allow) is sent to our servers to show the reports near you. It is used for that request only and is not stored. When you submit a report, the report's location (your current location or a point you choose on the map) is stored with it and shown to other users on the danger map.
• Vets near you — searching for veterinary clinics sends your location (or the area shown on the map), rounded to about 100 metres, to our servers, which ask Apple Maps for clinics nearby. Results are cached for up to 24 hours by that rounded location, without your account.
• Dashboard widgets — the nearby-dangers and vet widgets use your location to show reports near you and the distance to your vet. It is used for that request only and is not stored.
• Pet services near you (Wolfie.app for Business) — searching for groomers, vets, trainers, pet sitters and other pet businesses near you sends your location (or the area shown on the map) to our servers to list the businesses nearby. It is used for that request only: it is not stored, not logged and not used for analytics.

We do not track your location in the background, do not keep a location history and do not use your location for advertising.

3.7 Wolfie.app for Business

Wolfie.app for Business lets pet businesses — for example groomers, vets, trainers, behaviourists, pet sitters, dog walkers, pet hotels and daycares — take bookings from Wolfie users and run their day in Wolfie. Wolfie does not process payments for these services: clients pay the business on site, and Wolfie takes no commission.

If you run or work for a business, we process:

• Research programme application — the details you enter in the join form: your name and email address, the business's name, type, country, city and phone number, how it provides its services (at its premises, at the client's home, or both), team size, the tool you use today, the website and Instagram profile (optional), your message (optional), and the answers specific to your type of business (for example the species you groom and visits per week, the number of vets and the practice registration number, specialisations and certifications, the areas you serve, or the number of pets you can take). We also record your acceptance of this Privacy Policy, the decision on the application, whether it was accepted automatically or by our staff, and our staff's internal notes. While the programme has free places, applications are accepted automatically; otherwise they are reviewed by our staff.
• Business profile — name, description, contact details (phone, email, website, Instagram), address and map location (or only the city, if the business chooses not to show its exact address), the area it serves, time zone, currency, opening hours, services, add-ons and prices, accepted payment methods, booking rules, logo and photos. A published profile is public (see 9.2).
• Team members — the name shown on the calendar, job title, role and permissions, colour, photo, working hours, the services each person provides, time off and blocked time (with an optional note), and the email address an invitation was sent to. A person can be on the calendar without a Wolfie account; when they accept an invitation, their Wolfie account is linked to their place on the team.
• Visit and takings records — bookings and their history (who created, confirmed, moved, cancelled or completed them and when), the business's own notes about visits and clients, its client list (with visit and no-show counts), and the on-site payment records the business enters: amount, currency, method (cash, card, BLIK, transfer or other), time, who recorded it and an optional note. These are records only: no payment passes through Wolfie, and we do not receive or store card numbers or any other payment credentials.

If you book a business, we process:

• the booking — business, service and add-ons, team member, date and time, price, status and history, your note to the business, reasons given for a cancellation or a declined request, and, for a visit at your home, the visit address;
• your name, as it appears in your Wolfie profile, which the business sees as its client's name;
• the details of the pet you book for, as described in 9.2;
• your reviews, as described in 9.2.

We do not pass your email address or phone number to the business. A business may add contact details that you give it directly.

We do not intentionally collect special categories of personal data (Art. 9 GDPR). If such data is voluntarily submitted, it is processed solely for providing the Service.

4. Purposes and Legal Bases for Processing

We process personal data strictly for the following purposes:

Where required by law, processing is based on user consent (Art. 6(1)(a)).

5. AI Processing Disclosure

Certain features of the Service may use artificial intelligence models.

User-submitted content may be processed by external AI providers to generate requested outputs. Except as described in Section 5.1, providers process it solely for that purpose.

AI providers may include:

• OpenAI
• Anthropic
• Google
• OpenRouter, a routing service that forwards a request to the provider running the selected AI model

We send AI requests through a gateway we operate ourselves, which passes each request to the provider of the model in use. When a request goes through OpenRouter, the model provider it reaches also receives the content of that request.

The AI provider may change over time due to infrastructure decisions, testing, or service optimization.

Photos and documents you submit for reading (for example a pedigree, a receipt, a certificate, or a pet's vaccination booklet or vet invoice) are sent to the AI provider only to read the details you asked for. We do not store the files; only the details you choose to save are kept.

We:

• Do not sell personal data to AI providers
• Require contractual safeguards
• Require processing solely for service delivery
• Do not permit training on user data, except as described in Section 5.1

Users should not submit confidential, regulated, or sensitive data unless necessary for intended functionality.

5.1 Free and preview AI features

Some AI features are provided free of charge — AI features on the Free plan — or are clearly marked in the Service as a beta, preview or experimental AI feature at the point where you use them. To offer these features, we may use AI models whose providers keep the content of requests and may use it to improve or train their models, under their own terms. The content you submit to these features (for example your chat messages) may therefore be used by those providers for that purpose.

This exception does not apply to reading photos or documents, or to AI features on the paid Plus and Pro plans (including Wolfie.app Pro), which are processed only as described above.

Please do not enter information about yourself or other people in these features that you would not want used this way.

6. Service Providers (Data Processors)

We use third-party processors to operate and secure the Service.

Infrastructure & Hosting

• Netcup (primary application servers, located in Germany)
• Hetzner (application servers, located in Germany)
• Backblaze (encrypted backup storage)
• Cloudflare (content delivery, DNS, and security/proxy services)

Authentication

• Google Firebase – Firebase Authentication
• Sign in with Apple (Apple Inc.)
• Sign in with Google (Google LLC)

Analytics & Diagnostics

• Google Firebase
• Google Analytics (websites and App)
• PostHog (website product analytics and browser error tracking; EU region)
• Sentry (error and crash monitoring)

AI Features

• OpenAI
• Anthropic
• Google (Gemini API)
• OpenRouter, and the model providers it routes requests to

Maps

• Apple – Apple Maps (maps in the iOS app and on the web, search for vets near you)
• OpenStreetMap Foundation (map tiles in the Android app)
• Google – Android geocoding (the address of a point you pick on the map, Android app)

Payments & Subscriptions

• Apple – App Store In-App Purchase
• Google – Google Play Billing
• RevenueCat (subscription management)
• Stripe (payment processing for direct purchases)

We host our primary servers within the European Union (Germany) for as long as a suitable EU-based option is available. All providers process data under applicable data processing agreements (DPAs).

7. International Data Transfers

Some providers may process data outside the European Economic Area (EEA).

Where such transfers occur, we rely on:

• European Commission adequacy decisions
• Standard Contractual Clauses (SCCs)
• Additional safeguards where required

Providers that may process personal data outside the EEA — including Google (Firebase, Google Analytics, Sign in with Google, Gemini API), Sentry, RevenueCat, Stripe, Cloudflare, and the AI providers listed in Section 6 (OpenAI, Anthropic, OpenRouter and the model providers it routes requests to) — do so under Standard Contractual Clauses and, where applicable, the EU–U.S. Data Privacy Framework.

PostHog is configured to process data in its European Union region, so website analytics data is not transferred outside the EEA.

Data transfers are performed in accordance with Chapter V of the GDPR.

8. Data Retention

We retain personal data only as long as necessary for:

• Providing the Service
• Fulfilling contractual obligations
• Complying with legal requirements
• Resolving disputes
• Ensuring security

Data may be deleted or anonymized when no longer required.

Users may request deletion of their account and associated personal data, subject to legal retention obligations.

A danger report keeps its location for as long as the report exists. A location used only to show nearby reports, vets, pet services or widgets is not stored.

Wolfie.app for Business:

• Booking and payment records are kept for as long as the business account exists, because they are the business's records of its visits and takings.
• If a client deletes their account, their upcoming bookings are cancelled and the businesses are told. Past bookings remain in the businesses' records but are anonymised: the client is shown as "Former client", their name and contact details are removed, the pet details are reduced to species and size, and the notes and visit address are deleted. On-site payment records are kept, so that the business's takings stay correct. Reviews remain, shown as written by a "Former client".
• If a team member deletes their account, their account is unlinked from the business, but their name stays on the calendar and in the history, so that the business can reassign their visits.
• If the owner deletes their account, ownership passes to another team member with a Wolfie account (a manager first); if there is none, the business is closed, its upcoming bookings are cancelled and its clients are told.
• When a business is closed, its profile is no longer public and no new bookings can be made. Its records are deleted or anonymised once they are no longer needed, subject to legal retention obligations.
• A research programme application is kept as a record of the programme for as long as the programme runs. If you delete your account, the application is unlinked from it; you can ask us to delete it at any time (see Section 10).

9. Data Sharing and No Sale of Data

We:

• Do not sell personal data
• Do not share personal data for advertising purposes
• Do not engage in data brokerage

Personal data is shared only with service providers necessary for operating the Service.

9.1 Community (content you publish)

Community is a place where Wolfie users ask questions and share experience. What you post there is meant to be read by others:

• Questions, discussions, replies and photos you post in a public community can be read by every signed-in Wolfie user and found through Community search. In a private community they can be read by its members. They are shown with your first name and the initial of your last name.
• Your pet's details are shared only if you choose them when you post: you tick which ones (for example name, breed, sex, age, life stage or weight). We copy only those details into the post at that moment; they are not updated from your pet's profile afterwards, and nothing else from your pet's profile (health records, vet, location) is shared. You can remove the shared pet details from a post at any time.
• We record when you accept the community guidelines, the communities you join, what you mark as helpful, save, report or block, and moderation actions, to run Community and keep it safe. Reports are reviewed by the community's moderators and by Wolfie staff; the person you report is not told who reported them.
• You can edit or delete what you posted. If you delete your account, your posts stay in their discussions but are shown as written by a "Former member": your name, the link to your account, the shared pet details and your photos are removed.

9.2 Wolfie.app for Business (bookings with businesses)

Who is responsible for what. Each business on Wolfie.app for Business is an independent business, not part of Wolfie. Wolfie provides the platform: we are the controller of the data we need to run it — your account, the booking flow, research programme applications, reviews and their moderation, and the security of the Service. Each business is a separate, independent controller of the information it receives about its clients and their pets and of the records it keeps of its own visits, clients, team and takings, which it uses to provide its services under its own responsibility. We store and process those records in Wolfie on the business's behalf, only to provide the business tools, and we do not use them for our own purposes. Questions about how a business uses your information should be sent to that business; you can also write to us, and we will help.

What a business receives when you book. When you book, you choose one of your pets. The business always receives the pet's name and species. Unless you switch off sharing on the booking screen (it is on by default), it also receives the breed, sex, whether the pet is neutered, its age, size, latest weight and the care notes you write for the visit, so that it can prepare. These details are copied into the booking at that moment; they are not updated from your pet's profile afterwards, and the business never gets access to your pet's profile, its health records, vet, microchip number or your account. The business also receives your name, your note, the booking details and, for a visit at your home, the visit address. You can change the care notes and your note until the visit starts.

On-site payments. You pay the business directly, on site. The business may record in Wolfie what was paid and how, for its own takings. Wolfie does not handle the payment.

Public business profiles. A business's published profile — name, description, contact details, address and map location (or only the city), services and prices, opening hours, team members who can be booked (name, title and photo), photos, rating and reviews — is public on wolfie.page and in the App, and can be seen without signing in.

Reviews. After a completed visit, you can leave one review of the business (a rating and an optional comment). Reviews are public: they are shown with your first name and the initial of your last name, your pet's name and the service, and the business may reply. You can edit a review for 7 days and delete it at any time. Reviews can be reported; Wolfie staff may remove a review that breaks our rules. A business cannot delete reviews.

Team members. Members of a business's team see the business's calendar, bookings and the client and pet details described above, according to the role and permissions the business gives them.

10. User Rights (GDPR)

If you are located in the European Economic Area, you have the right to:

• Access your personal data
• Rectify inaccurate data
• Request erasure
• Restrict processing
• Object to processing
• Request data portability
• Withdraw consent (where applicable)

Requests may be submitted to: [email protected]

You have the right to lodge a complaint with a supervisory authority in your EU Member State.

11. Security Measures

We implement appropriate technical and organizational measures, including:

• Encryption in transit (TLS)
• Access controls
• Authentication safeguards
• Monitoring and logging
• Data minimization practices

However, no system can guarantee absolute security.

12. Children’s Privacy

The Service is not directed to children under 16 (or lower age permitted by national law). We do not knowingly collect personal data from children without required consent.

If we become aware of such processing, we will delete the data.

13. App Store & Platform Compliance

In accordance with Apple and Google requirements:

• Data collection practices are transparently disclosed
• Tracking for advertising purposes is not performed
• Sensitive permissions are requested only when necessary
• Users may request account deletion
• Data is processed only for specified purposes

14. Limitation of Liability

To the maximum extent permitted by applicable law:

• We are not responsible for independent processing performed by third-party providers.
• We are not liable for service interruptions or security incidents beyond our reasonable control.
• Users are responsible for ensuring that submitted content complies with applicable laws.

15. Changes to This Policy

We may update this Privacy Policy from time to time.

Material changes will be communicated via the App or website. Continued use of the Service after updates constitutes acceptance of the revised Policy.