Privacy Policy

Who is responsible

Where Dogs Lead is a dog-walking and community app operated by STEPHEN WILLIAM ROBERTS, an individual developer trading as PocketForge Studio. PocketForge Studio is a trading name, not a registered limited company. The postal contact address is 12 Albert Avenue GRANGEMOUTH FK3 9AT United Kingdom. Where this notice says 'we', it means that individual operator, who is the data controller. Contact privacy@wheredogslead.co.uk about personal information and support@wheredogslead.co.uk for general help. Our public account-deletion information is at https://wheredogslead.co.uk/account-deletion.html.

Your account

Firebase Authentication handles registration, sign-in, email verification and password reset. It processes your email address, account identifier, account display name where supplied, credentials and technical authentication information. The app passes the password you enter to Firebase for authentication; passwords are not included in community documents or the app's profile database. Never send us a password by email. Deleting the Firebase sign-in account does not itself delete Firestore documents or data stored on a device.

Profiles, walks, location and photos

The app stores profile and dog details, selected or captured image references, saved walks, routes, distances, durations, dates and associated photo locations on your device. Main profile, dog and saved-walk database records are separated by signed-in account. The inspected app does not upload this main database or its photo files to Firestore or Firebase Storage as a cloud backup.

With the relevant Android permissions, an adventure you start records location points and can continue through a foreground location service when the screen is off or the app is minimised. Location is also used for map/location selection, nearby-place distances and weather outside an active walk. These uses should not be confused with continuous walk recording. Revoking permission limits the features that need it.

Local GPS diagnostic records can contain precise coordinates, times, accuracy, movement and device/permission information. The app also stores walk recovery state and pending unsaved adventures. You can choose to export and share a diagnostic file; the current code does not automatically send the raw diagnostic database to our servers. Anyone you choose to share a file with receives the information in it. Photos may be stored in app files or your gallery, and selected images may remain in their original location.

Community information other members can see

Places you submit include a name, category, notes, map coordinates, dog-friendly status and optional area, with a creator account identifier and creation time on new records. Reviews include a public name, account identifier, rating, comment and timestamp. These community records are readable by other signed-in members. Display names, place titles and review excerpts may also appear when identifying the target of a report or a saved block. Public names are not verified identities. Some older places have no creator identifier.

Your email address and private local profile, dog and walk records are not published as community fields by these features. However, an account identifier can link contributions together, and anything you put in public free text can identify you or another person. Community information is not anonymous merely because a screen abbreviates an identifier. Do not include private contact details, home locations or other unnecessary personal information in contributions.

Terms, blocks, reports and moderation

Terms receipts contain the accepting account's identifier, terms version and server-confirmed acceptance time. You can access your own receipt; authorised administrators can read receipts under the launch access controls.

Your own private block list contains blocked account identifiers and the time each block was created. Other members and ordinary administrator app sessions cannot read your list; authorised service operators with appropriate Firebase administrative access may access it. Blocking changes what you see and the ratings shown to you. It does not make public contributions inaccessible to the blocked person or delete those contributions. Legacy content without an attributable author cannot be filtered by author.

Reports contain the reporter's identifier, the reported place, review or attributable account identifiers, a reason, any permitted explanation, creation time and status. User reports may reference the review evidencing the reported author. Moderation can add reviewer identifiers, review time and private notes. Reports and notes are not readable by ordinary app users, including the reporter. Authorised administrators and service operators can review them. Reports can include information about you supplied by another member.

Posting-access records contain the affected account identifier, whether posting is suspended, and the administrator identifier and time of the latest change. You can check your own posting status; authorised administrators manage these records. They restrict new community submissions, rather than deleting your account. Report outcomes and posting suspensions are administrator actions; the current app does not use automated report scoring to decide them.

Why we use information

We use information to provide account access, the walk/profile/photo/map/weather features you request, community publishing, safety preferences, report handling and support, and to protect users and operate the service.

We rely on performance of our service contract (UK GDPR Article 6(1)(b)) where necessary to provide the features you request: account access, profiles, walks, optional photo features, maps/weather, publication of your contributions, your block preferences and the current terms receipt needed for posting. This does not justify unnecessary collection or unrelated uses.

We rely on legitimate interests (Article 6(1)(f)) for proportionate moderation, abuse prevention, security and diagnostic investigations, general enquiries and limited evidence genuinely needed for unresolved safety or security matters. Our interests are operating a safe, reliable service and protecting members and their information. We assess necessity and the impact on individuals, restrict access, minimise identifying details and review retention. You may object to processing based on legitimate interests; we will assess the circumstances and explain our response.

We rely on legal obligation (Article 6(1)(c)) where necessary to handle data-protection rights, including proportionate identity checks and erasure requests under the UK GDPR. A specific legal hold needs an identified obligation or justified purpose; there is no general requirement to retain all safety records. Service-related support is part of providing the requested service; other support is covered by the limited legitimate interests above.

Android permissions and Community Terms acceptance are not blanket GDPR consent. Optional features remain optional. The initial release is completely free, with no adverts, subscriptions or paid features. Any future optional premium offering or material change in data use will be reviewed and explained before introduction.

Service providers and sharing

Google Firebase Authentication and Cloud Firestore process account and community information for the app. Google Maps and Google Play services provide maps and device-location functions and can process the location/technical information needed for those services. Weather requests go directly from the app to Open-Meteo and include latitude and longitude in the request URL; its servers also receive ordinary connection information such as an IP address. The inspected request does not include your Firebase account identifier or email. Coordinates are not rounded by this request code and may be precise.

The current app configuration contains no Firebase Analytics or Crashlytics integration and no advertising integration was found. We do not sell personal information. If you contact support or share a diagnostic file or image, the recipient receives what you send; avoid including unnecessary information. Support correspondence used as deletion/moderation evidence follows the relevant case retention schedule below; it is separate from the in-app account database.

OpenMeteo GmbH describes itself as an independent controller for the API information it processes. Its published policy says troubleshooting logs may contain IP addresses and geographical coordinates and are deleted after 90 days. This provider period is separate from our own safety-record schedule; weather requests should not be assumed to be processed only in memory. The initial free, advert-free release uses the non-commercial API subject to its applicable terms. Commercial licensing will be reviewed before any future monetisation.

Our public website is hosted on GitHub Pages. It serves static pages; the inspected pages contain no analytics scripts, submission forms or cookie-setting responses. GitHub says it logs visitor IP addresses for security, whether or not the visitor has a GitHub account. This is not a promise that the hosting provider keeps no technical records.

Privacy and support emails are forwarded through hosts.co.uk to the operator's Gmail account. The forwarding service and Google process message, addressing and ordinary delivery/security information needed for correspondence. The operator checks the forwarded mailboxes, including spam, daily. Case-related correspondence follows the relevant case review schedule below. General enquiries are kept only while needed for the enquiry or a separately justified matter; no unverified fixed mailbox, spam-folder or provider-backup deletion period is asserted.

Provider information: https://firebase.google.com/support/privacy, https://firebase.google.com/terms/data-processing-terms, https://policies.google.com/privacy, https://docs.github.com/en/site-policy/privacy-policies/github-general-privacy-statement and https://open-meteo.com/en/terms. These links do not replace our responsibility to explain our own handling.

Where information is processed and protected

Local app records are held on your device. The default production Firestore database is in Google's eur3 European multi-region; the deletion service runs in europe-west1. These are not UK-only locations and do not establish where all provider or support processing takes place. Firebase states its Authentication service processes data exclusively in US data centres. Gmail, GitHub and other provider operations can also involve processing outside the UK. We do not claim Open-Meteo requests or forwarded emails remain within a particular country.

Google publishes Firebase data-processing terms and, for services governed by Google Cloud terms, the Cloud Data Processing Addendum. These include international-transfer provisions. Google and GitHub publish participation in the EU–US Data Privacy Framework and its UK Extension for covered transfers; Google's terms also provide contractual transfer safeguards where applicable. Coverage depends on the service, recipient and transfer: this is not a claim that every provider or transfer is covered by one mechanism. Contact privacy@wheredogslead.co.uk for relevant provider terms and available safeguard details for a particular request.

App and Firebase access controls restrict community/private records, and network services use encrypted connections in normal production operation. Operator access is separate from mobile security rules and must be restricted appropriately. No system can guarantee complete security. Clearing app storage or uninstalling can remove valuable local data and is not a substitute for deleting cloud records; this notice is not an instruction to do either.

Account deletion and signed-out recovery

After you confirm your current password, routine cloud cleanup starts automatically. A private request is bound to your account and device challenge. You do not need to email us or wait for an administrator to approve an ordinary request. Community posting is paused for that account during cleanup. Your sign-in account is kept until the required cloud cleanup is ready. Shared contributions, existing safety evidence or uncertain ownership may require individual review; the app explains when a request remains pending. Contact privacy@wheredogslead.co.uk for an exceptional or interrupted request.

The trusted process removes your linked reviews, Community Terms receipt and own/incoming blocking references. Places attributable to your account are removed where this can be done safely without deleting another member's contribution. Shared places are hidden privately pending review, with other members' reviews preserved. Useful non-identifying place information may be restored after its creator link and identifying text/location details have been reviewed and removed. Reports, posting suspensions and other safety evidence receive an individual necessity and retention decision rather than being blindly erased.

We keep minimal private request and recovery records where needed to resume interrupted work, verify completion and prevent deleted information being restored. Routine deletion does not require a manual approval dossier. These records and any necessary safety evidence remain subject to the necessity reviews, retention limits and justified holds below. No automatic evidence purge is enabled.

After cloud readiness, the app deletes the Firebase sign-in account and then removes that account's confirmed local profile, dog and saved-walk records and applicable per-account files/preferences. Interrupted steps remain pending and can be retried; some removals may already have happened. A private case journal, account/device binding and local deletion receipt may be needed until verified completion.

If the original Firebase session has ended, the operator can reconcile the original case without asking you to sign in as a deleted account. We require independent, verifiable historical account/case evidence for an unbound legacy request; an email address, a newly registered same-email account or a public account identifier alone is insufficient. The service checks the original Auth account is absent, required cleanup is complete and the device binding is valid before issuing a short-lived signed confirmation. A disabled account or failed lookup is not treated as deletion. Uncertain or conflicting cases stay pending for review.

Local ownership and external copies

Shared or legacy GPS diagnostics, exports, photos, local places, pending/recovery records and device-wide preferences may lack reliable account ownership. We preserve uncertain records while ownership is reviewed so that another account's walks, profiles or photos are not erased. Records confirmed to concern the deleting account need an agreed, narrowly scoped removal; unknown ownership is not a reason to report deletion complete. An operator review of the exact remaining data fingerprint is required before any supported recovery attestation can clear an ownership hold.

We do not ask you to clear all app storage, uninstall the app or delete shared media as an account-deletion shortcut. The app cannot automatically remove every gallery original, SDK cache or inaccessible device-only copy. Removing a creator identifier alone is not sufficient anonymisation if remaining text or coordinates still identify someone.

Copies you or others saved or shared outside the app are not remotely withdrawn by account deletion. We cannot erase files held solely on an inaccessible device through a website request. Contact privacy@wheredogslead.co.uk to identify a remaining-data concern; a web request must not require you to reinstall the app to begin it.

Retention and deletion requests

We remove ordinary linked account information through verified deletion unless a specific, reviewed need justifies retaining limited evidence. These are our operational retention limits and review targets, not legal minimum periods or a blanket security exception.

Dismissed or irrelevant reports: remove or irreversibly anonymise unnecessary information within 7 days of the decision, after checking any genuine outstanding hold. Resolved moderation cases and verified deletion/recovery cases: remove unnecessary identifying evidence, account/device bindings and related case correspondence or exports within 30 days of closure, sooner where no longer needed.

Contained security incidents: keep only necessary incident evidence for up to 90 days after containment, reviewing necessity every 30 days. Open moderation cases are reviewed every 30 days and escalated at 90 days. Unsafe shared places are reviewed within 7 days and weekly while unresolved, with escalation at 30 days. Pending deletion/recovery cases are reviewed weekly. These reviews do not permit indefinite retention by default.

A specific unresolved moderation, security or legal matter may require a documented exception. The operator records its purpose, minimum information needed, responsible person, next review and release condition, and minimises unnecessary identifiers and free text. Legal matters are assessed individually and reviewed at least every 90 days; unnecessary identifying material is removed within 30 days after the need ends. Missing a review target does not automatically delete evidence or another member's contribution. No automatic evidence-purge timer is used.

Uncertain local ownership stays under review rather than being resolved by an automatic deletion deadline. STEPHEN WILLIAM ROBERTS, trading as PocketForge Studio, is responsible for these reviews and the private request record. Email possession alone is not sufficient for legacy account verification, and passwords or routine identity-document copies are not required for support.

Request deletion through the app or email privacy@wheredogslead.co.uk, including enough information to identify your account and the information concerned. We may ask for proportionate proof that the request is yours, but not your password. A support request is not an immediate automated deletion. Any justified refusal to erase particular information must be explained; a generic reference to security is not a reason to retain all personal information without review.

Deletion from active services does not itself erase older recovery backups, email-provider backups or copies outside our control. Our restricted recovery backups are separate from the live database and are kept while a recovery need justifies them; no fixed backup-erasure deadline is promised here. A proposed restoration must account for subsequent erasure decisions before recovered information is put back into active use. Google currently states that, after Firebase Authentication deletion is initiated, associated authentication information is removed from its live and backup systems within 180 days. This is Google's stated process, not a promise that our case reviews take 180 days or permission to retain unnecessary evidence.

Your rights and questions

Depending on the circumstances, UK data-protection law gives you rights to access and correct your information, request erasure or restriction, object to relevant processing and receive qualifying information in a portable form. If a use relies on consent, you can withdraw it. Contact privacy@wheredogslead.co.uk to exercise your rights. Requests are normally handled without charge and responded to within one month, subject to lawful identity checks or extensions that will be explained where applicable. You may complain to the Information Commissioner's Office at https://ico.org.uk/make-a-complaint/.

Children and changes

Where Dogs Lead is intended for adults aged 18 and over. The app does not currently verify users' ages and does not operate a parental-consent service. It is not directed at children. If you believe a child has provided personal information, contact privacy@wheredogslead.co.uk so the concern can be assessed safely; stating an adult audience does not itself prevent children from accessing the app.

Material changes will be identified with an updated notice date. A privacy notice explains handling; it does not ask you to surrender your rights. Materially revised Community Terms require a separately planned version and acceptance process. This notice does not change the existing accepted Community Terms version 2026-10-22 or its acceptance records.