Privacy policy

Aibou is a pet care app published by i4c studio. This page says what the app does with information, in plain words. Questions go to support@i4c.studio.

The short version

• No account, no sign-in, no ads, and no analytics or tracking tools in the app.
• Your pets, schedules and records are stored on your phone. If you never turn on household sync, none of it is sent to us.
• Household sync is optional. When it is on, the household's data is kept on Aibou's server so the phones can share it.
• Payments are handled by Polar. Aibou never sees your card.
• This website (not the app) counts visits with Vercel Web Analytics, without cookies.

What stays on your phone

Pets, the traits you list for each pet (such as an allergy), feeding, medication and walk schedules, check-offs, the things you log (a meal, a walk, a treat, a worry or a note), vet records, weights, photos, notes and your settings live in the app's database on the device (the browser's IndexedDB, or the same thing inside the Android app). Appearance choices are kept in the browser's local storage. Aibou does not need an account and does not ask for your name, email or location.

If you make a sitter sheet, the contacts and house notes you type into it (your phone number, a backup contact, the vet's address, wifi or alarm details, anything you write) are saved in the settings on that phone so the form is filled in next time. They are not synced to other phones, not sent to Aibou's server and not included in backups. They only leave the phone inside the PDF you share.

The home-screen widget (Android)

If you add Aibou's widget to your Android home screen, it shows the first lines of Today: pet names, task titles and times, including those of a household you are sitting for. Anyone who can see your home screen can read them. The widget gets them from a small file the app keeps on the phone, which Android's device backup leaves out. It holds no notes, records or vet details.

Household sync (optional)

If you turn on sync, or join a household with a pairing code, Aibou sends the household's data to its server so your other phones can get it:

• the household name and the people in it (the names you chose),
• for each phone, a label made of your name and the phone's model (for example “Ana (Pixel 8)”, or “Browser” on the web) and when it last synced,
• pets (with their traits), schedules, check-offs, logs and vet records; when you delete one, the server keeps a deleted copy so the deletion reaches every phone,
• the photos attached to pets and records. When a photo is removed or replaced, or its pet or record is deleted, and nothing else in the household uses it, Aibou deletes it from the server too.

The shared copy stays until someone deletes the household data. Stopping sync on every phone does not delete it.

The server is hosted on Vercel and keeps its data in a Neon Postgres database. Each phone gets its own key when it turns on sync, joins or restores; the server keeps only a one-way fingerprint of it (a hash, which cannot be turned back into the key) and asks for the key on every request. The data itself is stored as readable records on the server. We do not read it, and we do not use it for anything except syncing your phones. We do not claim the stored data is hidden from the people who run the server.

Everyone in the household can see its list of phones in Settings: each phone's name, its label with the phone model, and when it last synced. Any member can remove another phone from the household. A removed phone stops syncing and keeps what is already on it.

For each phone the server also keeps how it joined (turned sync on, a pairing code, the license key, or the update to per-phone keys), when it joined and last synced, and, if it stopped syncing or was removed, when and which phone removed it. Every member's app can read these records: for phones still in the household, and for removed ones during the 30 days after the removal. The server itself keeps them, and the removed phone's name and colour, for as long as the household's shared copy exists. Deleting the household data removes them all.

A pairing code is eight digits, works once and expires after 10 minutes. It carries no key: claiming it makes a new key for the new phone. Expired codes are deleted the next time anyone uses pairing.

Hosting providers see ordinary connection details such as IP addresses in their logs. Aibou's server uses the address only to limit repeated requests.

Sitter access

A member of a household that syncs and has the household unlock can invite a sitter (free for the sitter) until a date they pick, up to 4 weeks ahead. The sitter enters an eight-digit code in Aibou on their own phone, under “I'm sitting for someone”. It gets its own sitter key that stops working at the end date, or earlier if anyone in the household taps “End access”, or if the member who invited the sitter is removed from the household. The household's list of phones shows each sitter with the end date, and the server keeps the sitter key's record like any phone's (above), except that a sitter's label is only the name they chose (no phone model) and its device code is a new random one for each invite, so the household cannot link it to the sitter's own household.

A sitter's phone receives:

• every pet, archived ones included, and deleted pets too (their deleted copy carries the same fields): the name, species, photo, order in the list, the vet's name and phone, and the traits you listed for it (such as an allergy); and the photo of every pet that is not deleted,
• every schedule, archived and deleted ones included: its title, type, times, repeat rule, start and end dates, reminder time and the schedule's notes,
• every member's name and colour, removed members included, and whether each one is a sitter,
• for every item it gets, who last changed it (a member it can match to a name) and when,
• check-offs due from 3 days before the invite onwards, by anyone, with their notes, skipped and unticked ones included,
• logs (a meal, a walk, a treat, a worry or a note) dated from 3 days before the invite onwards, by anyone, with their notes, deleted ones included.

It never receives records (visits, vaccines, weights, medication notes, attachments), breed, sex, birthday, adoption date, microchip, the pet's own notes, the phones' device codes or labels, the unlock, the license or recovery state, or the list of phones.

A sitter's phone can send only its own check-offs (marked done, never skipped, with an optional note of up to 280 characters, close to the time they are due and before access ends), unticking or editing the note of its own check-offs, its own logs (one of the five kinds above, with an optional note of up to 280 characters, dated within the last 48 hours and before access ends), changing or deleting its own logs, and its own name and colour. The server refuses anything else.

On the sitter's phone, the household it is sitting for is kept in its own database, apart from the sitter's own pets and household. It is never part of the backup files or exports the sitter makes in Aibou, and sitting never changes the sitter's own household, key or unlock. Android's own automatic device backup copies the app's storage as a whole and cannot leave one database out, so a device backup can include it; if that copy is restored onto another phone, Aibou deletes it there on first start without opening it. Pet photos for a sitter are not kept in the browser's cache.

When access ends, the sitter's phone stops getting updates at once. Aibou deletes that database and its reminders from the phone the next time the app is opened with a connection, or on its own once the phone's clock is about half a day past the end date, even offline. Reminders already scheduled on the phone can still go off until the app next runs. That is best effort: a changed app, a backup tool or a screenshot can keep what was already on the phone.

Buying the unlock

• The unlock is a one-time purchase for the household (to share with your household and your sitter), handled by Polar, who acts as merchant of record. Polar takes the payment and holds the buyer's email address and receipt. Aibou never sees card details.
• You get a license key. When you enter it, the app checks it with Polar (through Aibou's server, or directly if the server is unreachable). Turning on sync sends the key to Aibou's server, which checks it with Polar again before it creates the household; the server never stores the key itself.
• Polar labels each activation with the platform (Android or web) and a short device code. On Android that code is a one-way fingerprint of the phone's Android ID (a salted hash), not the Android ID itself. On the web it is a random code made by the app.
• If sync is on, the server also stores a one-way fingerprint of the license key linked to the household, and which phone's key linked it. That link is the household unlock (one key unlocks one household at a time), and it is what lets the license key restore the household on a new phone. The server also keeps Polar's id for the key (not the key), when the key was last checked, and when it last moved from another household. It re-checks the key with Polar about once a day. If the key was refunded, the link is removed and the server records when: after a refund, within a day the household stops syncing. Every phone keeps its pets and records. Entering a license key on any phone in the household turns sharing back on. If the key stops being valid for another reason, the link is removed and the household keeps syncing without the unlock. Whoever holds the license key can claim it for a new household at most once a month; a household can pause recovery in Settings to stop that. If the phone that linked it is removed from the household, the link stays with the household. The member who removes it can also pause recovery; the server then records when and by which phone, and the key restores nothing until someone in the household enters it again. Deleting the household data removes the link and that record.

Android permissions

The Android app asks for permission to show notifications and to schedule exact alarms, so reminders arrive on time. It also uses the internet (for sync and license checks), vibration (a small tap when you check something off), and the system settings that let reminders come back after the phone restarts. It does not ask for your location, contacts, camera or microphone. Photos come from the system camera or file picker you choose in.

Files you export

Backups (JSON), CSV exports, vet PDFs and sitter sheets are files you create yourself, and they are saved or shared wherever you choose. Aibou does not send them anywhere. Whoever you give a file to can read it.

Deleting your data

You can remove everything from your phone, and the shared copy from our server. See how to delete your data.

This website

The pages at aibou.i4c.studio outside the app (this page, the home page, support and delete-data) use Vercel Web Analytics to count visits. It records the page, the referring site, the browser, the operating system, the device type and the country, without cookies and without anything that follows you to other sites. Visits on the same day are told apart by a short-lived fingerprint of the request that Vercel discards after a day, so we only ever see totals. The web app at /app/ and the Android app do not use it.

Children

Aibou is not directed at children and we do not knowingly collect information from them.

Changes

If this page changes in a way that matters, the effective date above changes with it.

Contact

i4c studio, support@i4c.studio.