Privacy Policy

This app is designed to protect your information and to let you choose what you share. Every sentence on this page is a rule the app is built to, not an intention.

Your log

The log is what you came here to keep, and it is yours. It holds what you and your household enter about your dog — events and their times, amounts, tags, notes, weigh-ins, and a profile photo you pick from your library — under the household’s name, time zone, units, foods and tags. It is shared with everyone in your household, and with nobody else. An invite code lets one more person join, once, within a short window, and can be revoked before it is used; whoever joins can read and edit everything logged about your dog. The log is held in one database hosted by Supabase, on servers in the United States, wherever you are; Supabase stores it and does nothing else with it. The database enforces who may read which rows rather than trusting the app, so a request for another household’s log comes back empty. The developer who runs the database has the administrative access running one requires, and uses it to keep the service working and to investigate faults — not to read your log. If your phone has no signal, what you log is saved on the phone and sent the next time it has some. Nothing is lost and nothing is sent twice. You can read, correct and delete anything in the log from inside the app, at any time. The log is kept until you delete it. For a copy of it, Export your data, in Settings under Account, writes every event and every weigh-in to two spreadsheets and hands them to the share sheet; for the photo, or anything else, use Send feedback.

Your account

Your email address signs you in and lets you back in if you forget your password. Your password is kept by the sign-in service only in a form nobody — not the app, not the developer — can read back. The display name you choose is shown to your household. Two emails come from the app: a six-digit code when you create an account, and a link when you ask to set a new password. They are delivered by Resend, an email service, which sees your address and that message and nothing else. If your household subscribes, Apple takes the payment and keeps the payment details; the app never sees them. The purchase carries your household’s id so that Apple’s record of it can be matched to your household, and the app keeps only the date the household’s access runs to. Your signed-in session is kept in the iOS Keychain, which is encrypted by the operating system. Your appearance setting and a few view preferences are kept on the phone and never sent anywhere. You can delete your account from Settings, under Your account. Shared history stays for another household member if there is one; a household with no other member is deleted with its data.

Diagnostics

Diagnostics are designed to protect your information and to let you choose what you share. With your permission, the app can automatically record what broke and how it performed, and send that to the developer’s own database, so a crash can be found and fixed without asking you to describe it. It is on unless you switch it off, it is sent only while Share diagnostics is on, and it carries your household’s id — so a fault can be matched to a household that writes in about it — and nothing else about you. Further details If you share diagnostics, they may include: • Details of a crash — the error, and a short trail of which screens and buttons were used just before, drawn from a fixed list like “activity / log-pee” • Timings, such as how long a tap takes to appear in the feed • Counts of moments that suggest something is hard to use, such as pressing undo • The app version and which build the phone is running • Your household’s id Diagnostics never include anything you typed, anything about your dog, your email address, your location, or anything that identifies your phone or its owner. Diagnostics are sent automatically when: • The app breaks • A few timings have built up, a handful of times a day They are sent over your internet connection. If the phone has no signal they are saved on the phone and sent the next time it has some; a phone that stays offline keeps only the most recent and drops the rest. Diagnostics are deleted from the database 90 days after they arrive. They are shared with nobody — there is no analytics company, no partner and no advertiser involved. Opt out of sharing diagnostics You can stop sharing diagnostics at any time, in Settings › General › Share diagnostics. With it off, nothing is recorded and nothing is held back for later. See what is waiting to be sent Anything recorded on this phone and not yet sent is counted in Settings › Support, as Waiting to send.

Feedback

Anything you write on the feedback screen goes to the person who builds this app. It is saved in the same database as the log, and a copy is emailed to the developer’s inbox through Resend with your email address, your household’s name and id, and the app version, so it can be answered and reproduced. It is sent when the phone has signal and held on the phone until then. Feedback is kept until it has been answered and acted on, which can be a long time. Please do not put personal information in a feedback message that you would not want kept.

AI access

AI access is designed so that an AI sees your log only because you connected one yourself. With your permission, an AI service you use — Claude, ChatGPT, or anything else that accepts a connector — can read your household’s log. Connecting works like signing in: your AI sends you to our website, you sign in there with your own TanStan account and approve it, and the AI receives its own credential from that approval. The app never sends anything to an AI on its own, and nothing here can write or change your log: the connection is read-only. Further details If you switch AI access on and approve an AI, it may read: • Every event in the household’s log — times, amounts, tags and notes • Weight readings, and your dog’s profile (name, birthdate, sex, breed) • The household’s name, its timezone, and the display names of its members It is read only when your AI asks — typically when you ask your AI a question — and only while the switch is on. What that service then does with what it reads is governed by its own privacy policy, not this one; the reading happens on your account with them, not ours. The address an AI connects to is on our website, so what it reads passes through Cloudflare, the website’s host, on its way from the database to your AI. An approved AI never sees your password, and it cannot reach any other household’s data. Opt out AI access is off until you switch it on, in Settings › General › Bring your own AI. Switching it off cuts every AI you approved immediately — the next time one tries to read, it is refused. Each person in the household controls their own switch and their own approvals, and losing membership of the household ends that access with it. Whoever set the household up can also switch AI access off for the whole household: doing so ends every member’s access at once, and everyone’s own switch is left off — while it is off nothing can be connected, and switching it back on does not restore anyone’s access, it only lets each person switch their own on again. See its use The Bring your own AI page shows when your AI last read the log.

The website

tanstanapp.com is served by Cloudflare. Two of its pages sign you in — approving an AI, and setting a new password from the emailed link — and they talk to the same sign-in service the app does; that sign-in stays in your browser and nothing else is kept. The address a connected AI reads through is on the site too, and hands each request straight to the database and the answer straight back. The site sets no cookies of its own and runs no analytics. Cloudflare, like any host, sees the requests it serves.

Who else handles anything

Four companies, each for one job: Supabase holds the database and the sign-in service; Resend delivers the app’s emails; Apple handles subscriptions; Cloudflare serves the website, including the address a connected AI reads through. None of them is given the log for any purpose of its own, and there is nobody else.

What is never collected

Your location — the phone’s time zone is read on the phone, offered as the household’s time zone when the household is set up, and afterwards only compared with the household’s. Your contacts, camera or microphone. Any advertising or device identifier. There are no cookies, no web pages inside the app, no analytics SDKs and no third-party trackers. Nothing about you or your dog is sent to an advertising network or a data broker, and the app itself sends nothing to an AI model — the one way an AI can see the log is AI access, above, which only you can switch on. Nothing is sold, and nothing is used to build a profile of you. Nothing arrives from anywhere else, either: there is no sign-in through another company and nothing is imported, so the only way personal data gets here is that you, or someone in your household, typed it in. Reminders are scheduled on the phone itself; nothing about them leaves it.

Children

This app is for adults keeping a log about a dog. It is not directed at children, and no data is knowingly collected from anyone under 13.

Changes

This app was built for its own household first, and its developer’s dog is in the same database, kept under the same rules. If any of this stops being true, this page changes first and the date at the top changes with it.

Privacy questions

Email [email protected], or use Send feedback, in Settings under Support. Either reaches Ryan Schiller, the person who builds this app, and Send feedback works offline — anything written without signal is held on the phone and sent when there is some.