What we hold, what we never receive, and how to delete it

Who we are

KennelOS makes the KennelOS apps (Lite, Pro, the demo and Furever) and this website. Questions about this policy, or about anything we hold: email admin.kennelos@gmail.com.

The short version

• The apps keep your records in your own browser, on your own device. Without cloud backup, we receive none of them.
• Cloud backup is optional, free, and off until you turn it on. It copies your kennel records so you can get them back on a new device. Your contacts' phone numbers, emails and addresses, prices, Financials, contracts and private notes never leave your device, unless you also turn on private backup, which encrypts them on your device first so that we can't read them.
• We don't keep your email address, only a scrambled (keyed-hash) form of it, so we can recognise you when you sign in.
• No analytics, no tracking, no advertising, on this website or in the apps. We never sell anything about you.
• You can delete everything we hold, from inside the app, at any time.

Without cloud backup

Everything you type is stored in your browser's own storage on that device. It is not sent to us. The apps contact other services only when you use a feature that needs them:

• Pro's license key is checked with Lemon Squeezy, our payment provider. They hold your billing details and the key; we never see a card number.
• Dropbox (Pro), if you connect it: your backup file goes to a folder in your own Dropbox account.

With cloud backup on

What we keep

• Your account: a keyed hash of your email address (not the address), when you joined, and for each device you sign in on: the name you gave it, when it was last used, and on Pro, the id of that device's license activation (so you can free it if the device is lost; it's useless without your license key, which we never receive).
• Your kennel records: dogs (names, registrations, pedigree links, dates, microchip numbers, health-test plans), your kennels (including location, website and logo), pairings, litters, puppies, health and history events (without free-text notes), sales and stud services without their money, contract dates and types, feeding schedules, and your contacts' names and types.
• Documents: health-test results, pedigrees and registration papers you've attached to dogs. Receipts, contracts and other documents stay on your device.
• Pro's waitlist: your waitlist settings (including the fee you charge and your payment instructions), the list's order and status, and each applicant's name and email. Nothing else from an application, and no family's fee or payment details.

What we can never read

Your contacts' phone numbers, email addresses and postal addresses; the prices, deposits, fees and payments on your sales, stud services and litters, and each waitlist family's fee and payments; your Financials (income and expenses) and receipts; contracts and their terms; and every free-text note, on any record. Without private backup they never leave your device. With it, they reach us only encrypted (below). (Your own waitlist settings, listed above, are the one place a fee amount is kept readable: the one you charge.)

Private backup (optional, encrypted)

Off unless you turn it on, separately from cloud backup. With it on, each backup also carries a copy of all your records, private details, receipts and contracts included, encrypted on your device before it's uploaded, with a key that only your devices hold. We store that copy, its size, and when it was made. We can't open it, and neither can anyone who gets into our servers.

• Your recovery code is shown once, on your device. We never receive it. We keep the vault key locked under it, which is useless without the code.
• A passkey, if you add one, unlocks private backup on a new device with Face ID, a fingerprint or the device PIN. It lives in your device's password manager (for example iCloud Keychain or Google Password Manager). Your fingerprint or face never leaves your device; we keep only the passkey's id, a random value it needs, the vault key locked under it, and the name you see in the list. A passkey here never signs you in.
• Unlocking from another device passes the key between your two devices through our server, locked with the code you type on the other device. We delete the request when it's answered or after 10 minutes.

If you lose your recovery code and every passkey, and have no other unlocked device, we can't unlock your private backup for you. Your devices and file backups are unaffected.

How long we keep it

• Backups: the newest one always, plus one per hour for the last day and one per day for 30 days. Older ones are deleted automatically, and so are documents no remaining backup uses. A backup's encrypted private copy goes with it.
• Turn off private backup (Import/Export → Cloud backup → Private backup) deletes its locked keys at once, so nobody can unlock it again; the encrypted copies already made are deleted within 30 days.
• Sign-in codes expire after 10 minutes. A signed-out device's record is deleted after 30 days.
• To limit abuse, we count sign-in requests per email (hashed) and per network address (also hashed, never stored as-is), counted per hour and deleted after a day.
• Delete my cloud data (Import/Export → Cloud backup → Account) deletes your backups, documents, devices and account immediately. Your records on your devices are not touched.

Who else is involved

• Cloudflare runs our backup service and stores the backups, encrypted at rest. Like any web host, it handles the network address your app connects from.
• Resend sends your sign-in codes. It sees the address each code is sent to; we keep its log retention as short as it allows. The email is plain text, with no links or tracking.

We don't log the contents of anything you send: never an email address, a code or a record.

A lost or stolen device

If a device had cloud backup on, you can erase KennelOS on it from another device (Import/Export → Cloud backup → Your devices). The erase happens the next time that device opens KennelOS with an internet connection; it can't reach a device that stays offline. Erasing a device, signing out your other devices and deleting your cloud data each ask you to confirm with a fresh sign-in, so someone holding your old phone can't do them.

If we ever stop running cloud backup

We'll say so inside the app well ahead of time. The apps keep working without it, and your records on your devices are untouched. We never email you unprompted, so the notice appears in the app.

Children

KennelOS is made for breeders and isn't directed at children.

Changes to this policy

If what we hold changes, we update this page first and change the date at the top.