Privacy Policy

PetPill
Effective Date: August 5, 2026 · Last Updated: August 11, 2026

1. Introduction

This Privacy Policy applies to PetPill — the iOS app published by Anas Ben Mustafa, App Store ID 6760020801, bundle identifier benmustafaa.pillpet. PetPill is the name shown on your device and throughout the app; its App Store listing may appear under a longer descriptive title.

This Privacy Policy describes how PetPill ("the App," "we," "us," or "our") collects, uses, stores, and shares information when you use our mobile application and related services, including our iOS widget and Apple Watch companion app (collectively, the "Services").

By downloading, installing, or using the App, you acknowledge that you have read and understood this Privacy Policy. If you do not agree with the practices described herein, please do not use the App.

2. Information We Collect

2.1 Information You Provide Directly

The App collects only the information you voluntarily enter to manage your pet's care:

Pet Information: Name, species, photo, optional date of birth, and optional notes.
Medication Information: Medication name, dosage amount and unit, medication type, frequency/schedule, start and end dates, optional notes, and — if you enable inventory tracking — your recorded stock quantity and refill lead time.
Dose Logs: Timestamps of scheduled and administered doses, dose status (e.g., given, skipped, missed), optional per-dose notes, and the optional caregiver name described in Section 2.4.
Vet Appointments and Appointment Logs: Appointment type, date and recurrence, reminder timings, optional veterinarian name, optional clinic name and address, optional notes, and the completion status and timestamp of past appointments.
Weight Entries: Recorded weight, date, and optional note.

2.2 Clinic Locations

When you add a clinic to an appointment, you may search for it by name or address. The search text you type is sent to Apple Maps (MapKit) to return matching places; if you select one, the App stores that place's name, address, and map coordinates alongside the appointment so it can be displayed on a map.

These coordinates describe the clinic you chose, not you. The App does not request location permission, does not use CLLocationManager, and never reads or records your device's position.

2.3 Information We Do NOT Collect

We do not collect, request, or store any of the following:

Your email address, phone number, mailing address, or date of birth
Account credentials or passwords
Device identifiers (IDFA, IDFV, or similar)
Your device's location or geolocation (see Section 2.2 for clinic locations)
Health data about people (the App does not integrate with Apple HealthKit; all health information in the App concerns your pets)
Contacts, microphone, or camera data
Reading access to your calendar (see Section 7 — the App can write events, never read them)
Browsing history
Advertising identifiers, and any form of cross-app or cross-site tracking

The App does collect anonymous usage and diagnostic data, including a recording of the initial setup screens, which is described in full in Section 2.6 and which you can switch off.

2.4 Caregiver Name (Optional)

The App includes an optional "Your name" field in Settings. If you fill it in, the name you enter is:

Stored on your device and synchronized to your other devices via Apple's iCloud Key-Value Store;
Attached to each dose you log, so a dose record can read "Given 8:12 · Anna";
Visible to anyone you have shared a pet with through the family sharing feature described in Section 5.1, as part of those dose records.

This field is entirely optional and blank by default. If you leave it blank, no name is stored and dose records carry no attribution. If you have shared a pet with others, entering a name here means disclosing it to those people — that is the purpose of the feature. Names already attached to logged doses are historical snapshots and are not changed or removed if you later edit or clear the field; to remove them, delete the dose records concerned.

If you are signed in to iCloud and use family sharing, Apple additionally makes participants' Apple ID names and email addresses visible to one another through its own sharing interface, as described in Section 5.1. That information is handled by Apple, not by us.

2.5 Purchase Information

If you subscribe to PetPill Pro or purchase a lifetime license, the transaction is processed by Apple through the App Store. We use RevenueCat, Inc. ("RevenueCat") as a third-party service to verify your purchase entitlements. RevenueCat receives:

An anonymous, randomly generated user identifier (not linked to your Apple ID or personal identity)
Purchase receipt data (product identifiers, transaction status, subscription expiry)
The random per-installation analytics identifier described in Section 2.6, so that renewals and cancellations can be reported against the same anonymous user. This is sent only while Share anonymous usage data is switched on, and is cleared when you switch it off.

RevenueCat does not receive your name, email address, Apple ID, or payment method details. For more information, see RevenueCat's Privacy Policy.

2.6 Anonymous Usage and Diagnostic Data

To understand how the App is used and to find and fix crashes, we use PostHog as a third-party analytics and error-reporting service. PostHog receives:

App lifecycle events — that the App was installed, opened, sent to the background, or updated, with the time it happened and the App version
Crash and error reports — the technical diagnostic information produced when the App stops unexpectedly, such as a stack trace, the device model, and the operating system version
Which step of the initial setup flow you reached, and the shape of the answers you gave — for example that you chose "cat" rather than the animal's name, that you picked a weekly schedule at two reminders a day rather than what the medication is, whether you turned notifications on, and how many pets you said live at home
What you did on the upgrade screen — that it was shown, which plan was highlighted, and whether a purchase was started, completed, cancelled or failed, together with the price and currency shown to you
That you logged a dose, and its shape — that a dose was marked given or skipped, whether it was logged from the App or the Apple Watch, whether the medication is a pill, liquid, injection or another kind, and how many minutes before or after the scheduled time you logged it. We do not receive which medication it was.
The shape of the pets, medications and vet appointments you set up — for example that a pet is a cat, that a medication is a liquid measured in millilitres taken twice a day for fourteen days, that a vet appointment is a vaccination three weeks away that repeats every six months, and how many pets you have. We do not receive names, dosage amounts, birthdates, weights, or the clinic and vet you use — only, in some cases, whether you filled a field in at all.
That you used a feature — that a weigh-in was recorded (never the weight itself), that medication stock was refilled, that a pet was shared with someone or a share was accepted or left, and that the history screen was opened and how many filters were applied
When the App failed you — that reminder coverage ran out, whether notifications and Background App Refresh are permitted on your device, and whether the rating card was shown and how you answered it
A screen recording of the initial setup flow only — see the separate heading below

Alongside each event we send a small amount of context: whether the App is running a paid subscription, whether you have finished setup, and how many days ago the App was installed.

PostHog never receives:

The name of anything — your pets, their medications, your vet, or their clinic
Any note or free text you have typed anywhere in the App, including the observations you attach to an individual dose. We receive only whether a note exists, never a word of it.
Photographs of your pets, or any image from your device
The values you record about an animal's health — no weights, no dosage amounts, no birthdates. Where these appear above it is as a count, a unit, or a yes/no.
Your caregiver name (Section 2.4), your Apple ID, your iCloud account, or your email address
Your location — neither your device's location nor the address of any clinic you have saved

Anonymity, and its one limit. The App never asks you to identify yourself and never sends PostHog your name or email. Each installation is assigned a randomly generated identifier stored only in that copy of the App; it is not your device's advertising identifier (IDFA), vendor identifier (IDFV), or any other device or account identifier. Because the identifier is random and local, we cannot connect your activity across your own devices, and deleting the App destroys it permanently.

The one limit is this: if you buy a subscription, we pass that same random identifier to RevenueCat (Section 2.5) so that RevenueCat can report renewals and cancellations against it. The App is not running when a subscription renews or lapses, so this is the only way we can tell whether people who upgrade stay. It links your purchase record to your usage record; it does not link either of them to you, and neither service receives your name, email address or Apple ID. Turning the setting below off clears that link as well as stopping analytics.

Screen recording during initial setup. The first time you set up the App, PostHog records the setup screens so we can see where people get stuck. This recording covers the setup flow only — it stops the moment setup finishes and never runs anywhere else in the App, so your pets, medications, dose history and notes are never recorded. Within the setup flow, every text field and every place your pet's name is shown back to you is blacked out before the recording leaves your device, as are all images. Recording does not happen at all if you have switched the setting below off.

You can turn all of this off. Go to Settings → Privacy in the App and switch off Share anonymous usage data. No further events are sent, no recording is made, and the RevenueCat link described above is cleared. This setting is per-device.

Data is processed on PostHog's European Union infrastructure. For more information, see PostHog's Privacy Policy.

3. How We Use Your Information

We use the information described in Section 2 solely to:

Display and manage your pets' medication schedules, vet appointments, and weight records within the App
Deliver local notifications to remind you of upcoming doses, refills, appointments, birthdays, and weigh-ins
Synchronize your data across your personal devices via Apple iCloud
Enable optional family sharing so household members can coordinate pet care, including showing who logged a given dose
Verify your subscription or purchase status to unlock premium features
Display medication information in the App's widget and Apple Watch companion
Add an appointment to your calendar, and show a clinic on a map, when you explicitly ask for it
Measure, in aggregate and anonymously, how often the App is used, and find and fix crashes, using only the data described in Section 2.6

We do not use your information for advertising, marketing, or automated decision-making, and we do not build a profile of you. The anonymous data in Section 2.6 is not linked to you or to any account, and is used only in aggregate.

4. Data Storage and Security

4.1 On-Device Storage

All App data is stored locally on your device using Apple's Core Data framework in an encrypted SQLite database. The database resides within the App's sandboxed container and benefits from iOS file-level encryption (Data Protection).

4.2 iCloud Synchronization

If you have iCloud enabled on your device, the App uses Apple's CloudKit framework to synchronize your data across your personal devices signed into the same Apple ID. This data is transmitted to and stored on Apple's iCloud servers. Apple encrypts data in transit and at rest.

The App does not operate its own servers. We do not have direct access to your iCloud data. Your data is governed by Apple's iCloud Terms and Conditions and Apple's Privacy Policy.

4.3 App Group Shared Storage

The App shares a limited data container with its widget extension and Apple Watch companion to enable dose display and logging from these surfaces. This data remains on your device and within Apple's sandboxed environment.

5. Data Sharing and Disclosure

5.1 Family Sharing (User-Initiated)

The App offers an optional family sharing feature that allows you to share a pet's medication data with other iCloud users you designate. When you initiate sharing:

The invited individual receives read and write access to the shared pet's records, including pet information, medications, dose logs (with any caregiver names and per-dose notes attached to them — see Section 2.4), vet appointments and their logs, and weight entries.
Sharing is facilitated through Apple's CloudKit sharing infrastructure. Participant information (name and email associated with the participant's Apple ID) is managed by Apple.
You may revoke a participant's access at any time.

We do not control, access, or store participant identity information. Family sharing is governed by Apple's CloudKit and iCloud terms.

5.2 Third-Party Service Providers

Provider	Purpose	Data Received
Apple (iCloud/CloudKit)	Data synchronization	Pet, medication, dose log, appointment, and weight data
Apple (MapKit)	Clinic search	The clinic search text you type (Section 2.2)
Apple (EventKit)	Calendar export	Appointment details you choose to export (Section 7)
Apple (App Store)	Payment processing	Payment and transaction details (managed entirely by Apple)
RevenueCat, Inc.	Purchase verification	Anonymous user ID, purchase receipts, and (while analytics is on) the analytics ID from Section 2.6
PostHog, Inc.	Anonymous usage analytics, crash reporting, and a recording of the initial setup screens (Section 2.6)	App open/install/update events, crash diagnostics, a masked recording of the setup flow, a random per-installation ID, and the shape of what you do in the App — setup-flow progress, upgrade-screen interactions, and that a dose was logged, a pet or medication added, or a vet appointment recorded, expressed as types, counts and yes/no. No names, notes, photographs, weights, dosage amounts, or account data.

5.3 No Sale of Data

We do not sell, rent, lease, or trade your personal information or App data to any third party for any purpose.

5.4 Legal Disclosure

We may disclose information if required to do so by law, regulation, legal process, or governmental request, or where we believe disclosure is necessary to protect our rights, your safety, or the safety of others.

6. Notifications

The App requests your permission to send local notifications for medication dose reminders. These notifications are generated and delivered entirely on your device. No notification data is transmitted to our servers or any third party.

You may disable notifications at any time through your device's Settings.

7. Photos and Calendar

7.1 Photos

The App allows you to attach a photo to each pet profile using Apple's system photo picker (PhotosPicker). The App accesses only the specific photo you select — it does not access your full photo library. Selected photos are stored locally within the App's database and may be synchronized via iCloud as described in Section 4.2.

7.2 Calendar

From a vet appointment you may choose "Add to Calendar". The App requests write-only calendar access and, with your permission, creates a single event containing the appointment's type, pet name, date, and any clinic name, address, veterinarian, and notes you entered.

Write-only access means the App cannot read your calendar: it cannot see your existing events, and it does not know whether the event it created was later changed or deleted. The export is one-way and happens once, at your request — subsequent edits in the App are not synchronized to the calendar event, and vice versa. You can decline or revoke this permission at any time in your device's Settings; every other feature continues to work without it.

8. Children's Privacy

The App is not directed at children under the age of 13 (or the applicable age of digital consent in your jurisdiction). We do not knowingly collect personal information from children. Because the App collects no personal identification information from any user beyond the optional, blank-by-default caregiver name described in Section 2.4 — and holds no user accounts — no age verification mechanism is implemented.

If you believe a child has provided personal information through the App, please contact us at the address in Section 13 so we can take appropriate action.

9. Data Retention and Deletion

9.1 Retention

Your data is retained on your device and in iCloud for as long as you use the App. We do not independently retain any copy of the pet, medication, appointment or weight data you enter.

The anonymous usage and diagnostic data described in Section 2.6, including the setup-flow recording, is retained by PostHog under their standard retention periods. Because it contains no personal data and no identifier that can be traced back to you, it cannot be tied to you or individually deleted after the fact — switching the setting off stops any further data being sent, ends any recording, and clears the RevenueCat link described in Sections 2.5 and 2.6.

9.2 Deletion

You may delete your data at any time by:

Deleting individual records (pets, medications, or dose logs) within the App
Deleting the App from your device, which removes all locally stored data
Disabling iCloud sync or deleting the App's iCloud data through your device's Settings > Apple ID > iCloud > Manage Storage

Because we do not maintain independent servers or databases, deletion of your iCloud data removes all copies under our control.

10. Your Rights

Depending on your jurisdiction, you may have the following rights regarding your data:

Access: You may view all data stored in the App at any time through the App interface.
Correction: You may edit any record within the App.
Deletion: You may delete any or all data as described in Section 9.2.
Portability: Your data is stored in your personal iCloud account and is accessible across your Apple devices.
Objection/Restriction: We do not process data for marketing, profiling, or automated decision-making. You may object to the anonymous analytics described in Section 2.6 at any time by switching off Share anonymous usage data in Settings → Privacy.

For residents of the European Economic Area (EEA), United Kingdom, or jurisdictions with similar data protection laws: the legal basis for processing your data is the performance of a contract (providing the App's functionality to you) and your explicit consent (for iCloud synchronization and notifications). The anonymous usage and diagnostic data described in Section 2.6 is processed on the basis of our legitimate interest in maintaining and improving the App; it contains no personal data about you, and you may switch it off at any time as described above.

For residents of California (USA): under the California Consumer Privacy Act (CCPA), you have the right to know what personal information is collected, to request deletion, and to opt out of the sale of personal information. As stated in Section 5.3, we do not sell personal information.

11. International Data Transfers

If you use iCloud, your data may be transferred to and stored on servers located outside your country of residence, in accordance with Apple's data processing practices. Please refer to Apple's Privacy Policy for details on their international data handling.

The anonymous usage and diagnostic data described in Section 2.6 is processed on PostHog's European Union infrastructure.

12. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. When we make material changes, we will update the "Last Updated" date at the top of this document. We encourage you to review this Privacy Policy periodically.

Your continued use of the App after any changes constitutes your acceptance of the updated Privacy Policy.

13. Contact Us

If you have questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us at:

Email: ananasanas2301@gmail.com

14. Summary of Key Points

Question	Answer
Do we collect personal information?	Almost none. The App stores the pet, medication, appointment and weight data you enter. The only optional field about you is the "Your name" caregiver field (Section 2.4), which is blank by default.
Do we track your location?	No. The App never reads your device's position. Clinic coordinates describe a place you searched for (Section 2.2).
Can we read your calendar?	No. The App has write-only access, used solely to add an appointment you export (Section 7.2).
Do we use analytics or tracking?	Anonymous analytics only: that the App was opened, how far you got through initial setup, what you did on the upgrade screen, the shape of what you track (that a pet is a cat, that a dose was logged on time), crash reports, and a masked recording of the setup screens alone. Never the name of a pet, medication, vet or clinic, never a note, photograph, weight or dosage, and never linked to your name or email. You can switch it all off in Settings → Privacy. We do no cross-app tracking and use no advertising identifiers.
Do you record my screen?	Only the initial setup flow, once, with all text fields and pet names blacked out — never anywhere else in the App. Off entirely if you switch analytics off (Section 2.6).
Do we show ads?	No.
Do we sell your data?	No.
Where is data stored?	On your device and in your personal iCloud account. The anonymous analytics in Section 2.6 is the one exception, and is processed in the EU.
Who can see your data?	Only you, and anyone you explicitly invite via family sharing — who also see any caregiver name attached to dose records.
Can you delete your data?	Yes, at any time, from within the App or via iCloud settings.