Privacy Policy

1. Who we are

Furrigins is operated by Origae (ABN 21 237 258 402), a business name registered to a sole trader based in Melbourne, Victoria, Australia ("Origae", "we", "us"). Anyone can confirm who holds that ABN on the Australian Business Register (abr.business.gov.au). We handle personal information in line with the Privacy Act 1988 (Cth) and the Australian Privacy Principles, whether or not the Act strictly applies to a business of our size.

This policy covers the Furrigins iOS and Android apps, the web app they both load, and this website. Contact: support@furrigins.com.

2. There are no accounts

Furrigins has no sign in of any kind. We do not collect or hold your name, email address, phone number, postal address, date of birth, payment card details or any password. If you email us, we see your email address and what you write, and use it only to answer you.

3. What we collect

This is the complete list. If it is not here, we do not collect it.

3A. Pet photos

When you scan, you add up to 4 photos of your pet: the side, and if you like up to three more angles, such as the face or from above. The app shrinks each photo and re-draws it on your phone before upload, which removes the photo's hidden details such as the location it was taken, the time and the camera model. If the phone cannot re-draw a photo, the app does not upload it. Our server sends the photos to Google's Gemini AI to read, and on some scans to OpenAI (section 5). After your free first Origin Story, we store the photos on our server, in our MongoDB Atlas database (section 8 says where), for at most 30 minutes from your scan, so you can upgrade without taking them again. They are deleted when a Full Origin Story made from them finishes, or when the 30 minutes are up. Photos for a paid scan you start straight away, including a later Origin Story and every Full Origin Story, are read in memory and never stored. We never use your photos to train AI and never show them to anyone.

If you add a size reference, you pick an everyday object from a list in the app; which object and which photo it is in are kept with that scan. You never type anything about it.

The camera permission is used only to photograph your pet. You can refuse it and choose a photo instead. Furrigins asks for a pet photo only. If a person or your home is in the shot, the AI reads the photo as it is; we do not look for them and do not record them.

If you ask for the vet-ready PDF report of a Full Origin Story, the app sends your photos to our server again, only to draw them into the PDF. They are used in memory for that one report, are not sent to Gemini, and are never stored or written to a log. So that a report can only show the photos that scan actually read, when a Full Origin Story is made we keep a one-way fingerprint (a SHA-256 hash) of each of its two, three or four photos for 30 days, never the photos themselves. A fingerprint cannot be turned back into a photo. The facts in the report come from your stored result, and the PDF is sent straight back to your phone and not kept. To stop abuse, we count report requests per install ID, in windows of 10 minutes.

3B. Scan results

Your result (the breeds your pet looks like, the estimates made from your photos and the notes we show) is stored so you can reopen it, under a random 32-character code made on your phone. A free result (your first Origin Story) is deleted after 24 hours. A paid result, including every later Origin Story and every Full Origin Story, is kept for 30 days, so you can come back to something you paid for. Nothing in a result says who you are.

3C. What the app keeps on your phone

The first time you open the app, it makes a random install ID. The iOS app keeps the install ID in the iPhone's Keychain, for this app only. It stays after you delete and reinstall the app, so the free scan stays used; it never leaves the iPhone through a backup, and it is removed when the iPhone is erased. The Android app keeps the install ID in its own app storage, in a part Android never backs up, so it is not copied to another device. It stays through app updates, and it is removed when you uninstall the app or clear its data; a reinstall makes a new one. (In a web browser the same kind of ID is kept in that browser's storage, under the name furrigins.install.) It is a random number, not linked to your name, your Apple ID or your phone number. Our server gives the app a signed install token for that ID, valid for 30 days, so we know requests come from the real app. We record against the install ID whether its free scan has been used. The app also keeps the ids of your recent scans on your phone, so it can reopen your results, including ones you paid for. While a scan is in progress, the app keeps its side photo in the app's session storage so a refresh does not lose it; any other photos stay in the app's memory only. The recent scan ids are deleted when you delete the app; the in-progress photo is gone when the app is closed.

3D. DeviceCheck

Apple's DeviceCheck lets an app store two yes-or-no bits per device with Apple. We use one of them, "free scan used", so the free scan stays used if you delete and reinstall the iOS app. Apple does not tell us who you are or which device it is.

On Android, before your free scan the app asks Google Play Integrity to check that it is our real app from Google Play, running on a genuine Android phone. The app sends Google a one-way code made from your install ID, never the ID itself. Our server sends Google's answer back to Google to read it, and keeps only whether the check passed for that scan. Google does not tell us who you are. Play Integrity cannot remember a phone after the app is deleted, so on Android a reinstall gets a new free scan.

3E. Purchases

Origin Story and Full Origin Story are in-app purchases processed entirely by Apple. Apple sends the app a signed receipt for the transaction. From it we keep a one-way code that identifies the purchase without revealing it, the product bought, whether it was a sandbox (test) or production purchase, the time, and whether Apple later refunded it. We keep this for as long as the service runs, so one purchase can't be used twice and refunds are honoured. We never see your name, Apple ID, card or bank details.

In the Android app, the same purchases are processed entirely by Google Play. Google gives the app a purchase token, which the app sends to our server with the product's ID. Our server asks Google's Play Developer API whether that purchase is real, paid and ours, and then tells Google the purchase has been used. We keep the same record as for Apple: a one-way code made from Google's order number, the product bought, whether it was a test or real purchase, the time, and whether it was later refunded. We do not store the purchase token or the order number, and our logs never contain either. We never see your name, Google account, card or bank details.

3F. What arrives on its own

To stop abuse, we count requests per install ID and per IP address in 10-minute windows, and those counters expire after 10 minutes. The app's smaller requests, such as checking on a scan, reopening a result or asking whether the free scan is used, count per install ID in windows of 10 minutes too. We also count free scans (first Origin Stories) per IP address for 24 hours, so one network can't take many free scans; that counter expires after 24 hours. And we count free scans per install ID for 24 hours, so a free retake (when we can't tell the breed) can't be repeated endlessly; that counter also expires after 24 hours. Your browser or device type (the "user agent") arrives with every request; we read it only to tell the Furrigins app apart from a web browser. Our hosting provider, Vercel, keeps standard request logs (such as time, address requested and IP address) for a limited time set by Vercel. Our own server logs never contain your photo, your result, your install ID, your install token or your IP address.

3G. What we do not collect

No advertising or tracking pixels. We use PostHog for usage analytics and screen recordings, as described in section 9. No location from your phone: the app has no location permission and never asks for one. Your IP address (section 3F) can show roughly where you are, such as your country or city. We use it only to stop abuse and never work out or store a location from it. No contacts, no microphone, and no identifiers from your phone such as its advertising identifier. We do not collect health records about you.

4. Why we collect it

• Your photo: to produce your result and, if you ask for one, the vet-ready PDF report. That is its only use.
• The result we keep: so you can reopen it, and so what you paid for is still there when you come back.
• The install ID, its token, the DeviceCheck bit on iPhone and the Play Integrity check on Android: to give one free scan and to know requests come from the real app.
• Apple's purchase receipt or Google Play's purchase token: to confirm a purchase is real, unlock one result, and honour refunds.
• Your IP address and request counts: to keep the service safe from abuse.
• Your emails: to answer you.

We do not sell your information, use it for advertising, or build a profile of you.

5. Artificial intelligence

Your photo is read by Google's Gemini AI through the paid Gemini API. Under Google's Gemini API terms for paid services, Google does not use the photo to improve its products. We have not opted in to any training use, and our software sets nothing that would allow it. Google may keep what we send it for a short time to detect abuse, as those terms describe. That retention is Google's, not ours: we cannot switch it off or shorten it, and we have not verified it beyond reading the terms. Those terms belong to Google and can change; we will update this policy if they change in a way that matters.

The AI's answer is an estimate of what your pet looks like, not a fact about it. It can mistake the breed, age, size or weight of a pet. Section 4 of the Terms of Service explains what that means for you.

On a Full Origin Story, OpenAI's AI also reads the same photos, as a second opinion. On any scan, if Gemini fails or is too slow, OpenAI reads the photos instead. We use OpenAI's paid API. Under OpenAI's API data terms, data sent to the OpenAI API is not used to train or improve OpenAI models unless a customer opts in, and we have not opted in. We ask OpenAI not to store the request. OpenAI may keep it, usually for up to 30 days, to detect abuse, as those terms describe; that retention is OpenAI's, and we cannot switch it off. Those terms belong to OpenAI and can change; we will update this policy if they change in a way that matters.

If you use the app in Spanish, the text of your result (never your photos) is also sent to Google's Gemini AI, or OpenAI if Gemini is unavailable, to translate it. The translation is kept with your result for as long as the result is kept.

Before your first scan, the app tells you that your photos are read by Google's Gemini and, on some scans, by OpenAI, and asks for your permission. If you choose "Not now", nothing is sent. If this list of AI services changes, the app asks again. Our server also refuses a scan sent without that permission.

6. How long we keep things

7. Who else handles your data

Only these, and only for the purpose named:

• Google LLC (United States). Its Gemini AI reads your photo to produce your result. See section 5.
• Google (Google Play). On Android, processes your purchases and refunds, and runs Play Integrity, under Google's own privacy policy. Google takes the payment; we never see your card or your Google account.
• OpenAI, L.L.C. (United States). Its AI reads your photos as a second opinion on a Full Origin Story, and instead of Gemini when Gemini fails. See section 5.
• Apple Inc. (United States, operating worldwide). Processes your purchases and refunds under Apple's own privacy policy, and runs DeviceCheck. Apple takes the payment; we never see your card or your Apple ID.
• Vercel Inc. (United States). Runs our server and hosts this website, and keeps the request logs.
• MongoDB Atlas (MongoDB, Inc., United States). Our database: held photos, results, install records and purchase records.
• PostHog, Inc. (United States). Usage analytics and screen recordings, as described in section 9. It never receives your photos, your result or anything that identifies you.
• Upstash (Upstash, Inc.). Keeps the rate-limit counters, by install ID and IP address.
• Resend (Resend, Inc., United States). Holds the emails you send to support@furrigins.com in our support inbox, where we read and reply to them. It handles support emails only, never your photos.

We may also share information if the law requires it.

8. Where your data is stored and overseas disclosure

Our server runs in Vercel's Washington, D.C., United States region (iad1), so the photos you upload are sent to the United States. Our MongoDB Atlas database, which holds photos for up to 30 minutes after a free scan, and our Upstash counters are hosted in the United States (AWS us-east-1, Virginia). From our server your photo is sent to Google, and on some scans to OpenAI, to be read; both may process it outside Australia, including in the United States. Apple processes purchases and DeviceCheck in its own systems, and Google processes Android purchases in its own, both of which may be outside Australia. Emails you send to support@furrigins.com are held by Resend in the United States.

By using Furrigins you consent to those overseas disclosures. Those companies are subject to the laws of their own countries, which differ from Australia's, and we cannot make them follow the Australian Privacy Principles. We chose them because their published terms match what this policy says.

9. Usage analytics and screen recordings (PostHog)

Usage analytics and screen recordings (PostHog, United States). We count how the app is used, such as when a scan starts or an offer is shown, with a random ID that isn't linked to you. A recording happens only in our iPhone and Android app, never in a web browser, and only when we show you a paid option, such as an Origin Story offer; it then covers the screens you see after that in the same visit. It shows what was on screen and where you tapped. What you type is hidden, and your pet photos are hidden on your phone before anything is sent. We use this only to see where people get stuck and fix it, not to identify anyone or for advertising. PostHog keeps recordings for 30 days, then deletes them. In the EU, EEA and UK we count and record nothing.

10. Security

What is actually in place, not what would sound good:

• All traffic to our server is encrypted in transit (HTTPS).
• There are no accounts, so there are no passwords to steal and no profile to leak.
• Install tokens and purchase proofs are signed with a secret key only our server holds, so they can't be forged.
• Each result is filed under a random 32-character code made on your phone.
• Every request is checked for size and shape before it is processed, and request counts are limited as section 3F describes.
• Photos are held for at most 30 minutes, so there is little to expose. Held photos are encrypted while they are stored (AES-256-GCM), with a key kept apart from the database.
• The database is reachable only with credentials we hold. Its provider encrypts stored data by default; that is the provider's control, and we have not independently verified it.

No system is perfectly secure, and we will not claim otherwise. If a data breach occurs that is likely to result in serious harm, we will notify affected users and the Office of the Australian Information Commissioner as required by the Notifiable Data Breaches scheme.

11. Your rights

You may ask to see personal information we hold about you, ask us to correct it, ask us to delete it, or complain about how we have handled it. Write to support@furrigins.com and we will respond within 30 days. Never send card details.

Be aware of what we can and cannot find. Because there are no accounts, we hold nothing that connects a result to a person. If you ask for "your data", the honest answer is usually that we cannot identify any, not that we are refusing. If you send us the date and time of a scan, or the link to its result, we will delete what we can find.

12. Children

Furrigins is for a general audience and is not directed at children. We do not knowingly collect personal information from anyone under 16, and there is no account through which a child could give us any. The app asks for a pet photo only, and never for a photo of a person.

13. This website

www.furrigins.com is a set of plain pages served from our own domain, with the fonts self-hosted. On this website we count anonymous visits and the pages viewed with PostHog, without cookies and without storing anything on your device, so there is no cookie banner. We cannot tell who you are from this, and it is never linked to your pet photos or to the app. Vercel keeps the standard request logs described in section 3F.

14. Changes to this policy

We will update the date at the top when this changes. If a change materially affects how your photos are handled, which AI company reads them, or where data is stored, we will say so on this page, and we will send you the previous version if you ask at support@furrigins.com.

15. Contact and complaints

Origae (ABN 21 237 258 402)
Suite 329, 98-100 Elizabeth Street, Melbourne VIC 3000, Australia
support@furrigins.com

If you are unhappy with how we handle a privacy question or complaint, you can take it to the Office of the Australian Information Commissioner at www.oaic.gov.au.