Privacy Policy

Pawprints Studio is a small suite of personal apps — PawsPort, OFC, MaxHP and Cards — built and run by one person. This policy covers twopaws.dev and all four apps.

When you sign in. PawsPort, MaxHP and Cards use Sign in with Google or Sign in with Apple. We receive your email address and the name on your account. We never see your password. If you use Apple’s Hide My Email, the only address we ever hold is Apple’s private relay address.

What you create. The trips, itineraries, packing lists and checklists you make in PawsPort; the workouts you log in MaxHP; the cards and benefits you track in Cards. Cards is not open for sign-up — it is used only by the operator’s household.

OFC has no accounts. There is no sign-in. Your player identity is a random id stored in your own browser, plus whatever display name you type. Game state is stored against the room id in the URL.

No analytics. No advertising. No third-party tracking of any kind. We do not sell, rent or share your information, we do not build profiles, and we do not use your content to train anything.

Only essential ones: a session cookie that keeps you signed in, and — in PawsPort — a short-lived cookie that carries a trip invitation through the sign-in round trip. There is no consent banner because there is nothing optional to consent to.

Supabase stores the database and runs sign-in. Cloudflare hosts and delivers the sites. Google and Apple handle sign-in only — they confirm who you are, and they do not receive anything you create.

Some things you do send a request straight from your browser to somewhere else: opening an address in maps, or loading a trip cover image from a URL you pasted. Those go to whoever you chose, the same as following any other link.

A trip is visible to the people on it. If you invite someone, they see that trip’s contents and your display name, and nothing from any other trip. Invite links carry an unguessable token and expire after seven days.

We keep your information until you ask us to remove it. Email privacy@twopaws.dev to request a copy of your data, or to have your account and everything in it deleted. It will be done within 30 days.

Sign-in is handled by Supabase, traffic is encrypted in transit, and database rules restrict a trip’s contents to the people on that trip. No service is perfectly secure, and this one is a personal project rather than a company with a security team — please keep your own copies of anything you would hate to lose.

These apps are not intended for children under 13, and we do not knowingly collect their information.

If this policy changes, the date at the top changes with it.

privacy@twopaws.dev