Privacy Policy
TINKL. is a pet-care tracker. It is designed to work offline and to keep your data on your own device by default. This policy explains what is collected when you use optional features such as an account and cloud backup.
1. What stays on your device
Your pets, logs, reminders, medications, vaccinations, weights, notes, photos and settings are stored in your browser or app storage on your device. If you never create an account, none of this is sent to us.
2. What we collect when you use online features
| Data | Why | When |
|---|---|---|
| Email address, optional name | Create and secure your account; sign you in | When you create an account |
| Password | Authentication. It is never stored in readable form — only a salted, peppered hash | When you create an account |
| Terms acceptance (version and time) | Record that you agreed to the Terms and this policy | When you create an account |
| Cloud backup (a snapshot of your pet data, which can include names, breeds, photos, weights, medications, vaccinations, notes, app settings, your Care Team providers' contact details — name, phone, email and address — your appointments, and your Pet Care entries such as vet practice details, symptoms and visit-prep notes, and food and treat reorder items) | Let you restore your data on another device | Only when you tap “Back up” (or auto-backup runs while signed in) |
| Push-notification subscription (endpoint and keys issued by your browser’s push service) | Deliver reminders when the app is closed | Only if you turn push notifications on |
| IP address | Abuse and rate-limit protection. Used transiently; we do not build profiles from it | When you call the API |
| Passkey public keys (and a counter) | Let you sign in with your face or fingerprint. Only the public key is stored — your private key and biometric never leave your device | When you add a passkey in Settings → Account |
| Recovery-link records (a hash of the token, not the token) | Let you sign back in if you lose your password. The link itself is emailed to you and works once, for 15 minutes | When you ask for a sign-in link |
We do not use advertising, analytics or tracking scripts, and we do not sell your data. All fonts and libraries are served from our own site; the app makes no requests to third-party trackers.
3. Where data is processed
Our website and API run on Cloudflare (Pages, Workers and Durable Objects). Cloudflare may process and store data in the countries where it operates. Cloudflare also processes standard request metadata (such as IP address) as our infrastructure provider.
4. VetPass links
A VetPass is a read-only health summary you choose to share. There are two kinds of link, and they work differently:
Private link (works without an account). The report is encoded inside the link itself (in the part after “#”, which browsers do not send to servers) and is not stored by us. Anyone who has the link can read the report, and the link does not expire — share it only with people you trust, and treat the link like the report itself.
Secure link (signed in only). The report is encrypted in your browser before it leaves your device, and only the encrypted version is stored by us. The decryption key stays in the part of the link after “#” and is never sent to us, so we cannot read the report. A secure link expires after 24 hours, 7 days or 30 days (you choose when you create it), and you can revoke it at any time under Providers → Shared links — a revoked link stops working immediately. Until it expires or is revoked, anyone who has the link can read the report, so share it only with people you trust.
Clinic request links work like secure links: the request is encrypted in your browser and decrypted in the clinic's browser. The clinic needs no account. A clinic's reply — whether it confirmed, proposed another time or declined, the time it proposed or confirmed, its message and the name of the person replying — is stored by us in plain text so it can be shown to you in your Appointments tracker. We also store a view count and last-viewed time for each secure and request link, shown to you in Shared links. We store only a generic label for each link; any friendly names you see for your links are kept on your own device and are erased when you sign out.
5. How long we keep data
We keep your account and cloud backup until you delete them. In the app, Settings → Account → Delete account permanently removes your account, cloud backup and push subscriptions from active storage immediately. Residual copies may persist briefly in our infrastructure provider’s systems according to its own retention practices. Data on your own devices is not affected; you can erase it with Settings → Reset all data.
Secure and request link content is deleted when the link expires or is revoked. A metadata-only record of an expired link is kept for 7 days, and finished links stay listed in your Shared links for 30 days past expiry (metadata only — no report content). Deleting your account revokes all of your links first, so their stored content is deleted with the account.
6. Your choices and rights
- Access / portability: Settings → Account → Download my data gives you a machine-readable copy of your account and cloud backup. Settings → Export exports your on-device data.
- Deletion: delete your cloud backup or your whole account in the app at any time.
- Correction: edit your data in the app and back up again.
- Other requests: if you are in the EEA/UK or California, you may have additional rights (access, rectification, erasure, restriction, objection, and to complain to a regulator). Contact info@techguruofficial.us.
7. Security
Connections use HTTPS. Passwords are hashed with a salted, peppered key-derivation function. Each account’s data is stored separately and only accessible with that account’s session. Sessions can be revoked (“Sign out everywhere”). No system is perfectly secure; please use a strong, unique password.
8. Children
TINKL. is not directed to children under 13 (or under 16 in the EEA/UK), and we do not knowingly collect their personal information. If you believe a child has created an account, contact us and we will delete it.
9. Veterinary clinics
If a clinic reads a VetPass or answers a request link with a client’s permission, the clinic is responsible for its own handling of that data under its own policies once it has read it. Pet health information in TINKL. is entered by owners and is not a veterinary medical record. A clinic's reply to a request link is stored by us as described in section 4 so the owner can see it.
10. Passkeys and account recovery
A passkey lets you sign in with your device's face recognition, fingerprint or PIN instead of a password. When you add one, your device creates a private key that never leaves the device and a public key that we store. Your biometric data is never sent to us or stored by us. You can remove a passkey in Settings → Account at any time; removing it here removes it from your account (also remove it in your device's password settings if you want it gone there too). A passkey created on tinkl.techguruofficial.us does not work on other domains, and vice versa.
A magic sign-in link is an alternative way back in if you forget your password. You ask for one from the sign-in screen; we email a single link to the address on your account. The link works once and expires after 15 minutes. It is delivered in the part of the link after “#”, which browsers do not send to servers, and we store only a hash of it — never the link itself. Using it signs you in and signs out all other devices; you can set a new password in the same step. If email sending is not configured, the app tells you so plainly instead of pretending a link was sent.
Password changes require your current password, except when you arrive through a valid sign-in link, which itself proves you control the email address.
11. Changes
If we change this policy in a meaningful way we will update the version above and ask you to accept the new version where required.