CARE DATA DESERVES CARE.

This policy explains what the Walkstack iPhone app and walkstack.world collect, why, who can see it, and how to delete it. Walkstack is run by Thought Garden Labs LLC, a New York company (“Walkstack,” “we,” “us”). It applies to walkers (independent pet-care providers who use Walkstack to run their business) and pet owners (the households they care for).

The short version

We collect what the app needs to coordinate care, and we use it for that. Every data type the app collects is used only to make the app work.
We do not sell your personal information. We do not share it for advertising. There are no ad or analytics SDKs in the app, and we do not track you across other companies’ apps or websites.
GPS is recorded only while a walker is on an active walk. It stops when the walk is paused or finished.
Owners decide when walkers may take photos and clips at each moment of a visit.
Household messages are encrypted end to end. We cannot read them.
You can delete your account in the app. Deletion is finished after a 14-day grace period, which you can cancel.

What we collect and why

Account details. Your email address, your name (including a name shared by Sign in with Apple, if you use it), your password (handled by our authentication provider; we never see it in plain text), and whether you are a walker or an owner. Used to create your account, sign you in, and recover access.
Profile. For walkers, optional details such as business name, bio, years of experience, whether you say you are insured or bonded, and a profile photo. Used to show the households you work with who their walker is.
Phone numbers. Numbers you add, each with its own setting for whether it is shared. Used so the people you work with can reach you.
Household and home details. Address, floor, apartment, entry notes, building and lobby instructions, and, if the owner saves them in the access vault, door, lockbox, and alarm codes. Used so a walker can get to the pet.
Pet and care information. Pet profiles and care plans, such as feeding, medication, and behavior notes, plus each walker’s acknowledgment of the current plan. Used to deliver the right care.
Visit records. Schedules, recurring visit patterns, visit requests (including any note the owner adds), start, pause, and finish times, care events such as water, bathroom, and feeding, notes, and handoffs between walkers. Used to run the visit and produce the visit report.
Precise location. The walker’s GPS route during an active walk. See “Location” below.
Photos and video clips. Photos from the camera or photo picker, and video clips of up to 20 seconds (12 MB at most) chosen from the photo library, added during a visit under the household’s camera rules. Used for visit reports and pet profiles.
Messages. Household conversations between a household’s owners and its walkers. The text and any photo in a message are encrypted on the device, so we store only ciphertext. See “Messages” below.
Payments and invoices. Rate cards, invoices, amounts, due dates, payment status, disputes, bank-fee reimbursements, automatic-charge attempts, the per-charge limit an owner sets, the card brand or bank name and last four digits, and Stripe reference IDs. Card and bank numbers are entered into Stripe’s payment form and go to Stripe. They are not stored in Walkstack’s database. Walkers give identity, tax, and bank details to Stripe directly when they set up payouts.
Subscription and purchase history. Whether a walker’s membership is active, when it renews or expires, and the related App Store events. Apple processes the purchase. We do not receive your Apple payment details.
Identifiers. Your Walkstack user ID, a push-notification token for each device where you allow notifications, and a public message key for each device where you open messages.
Things you send us. Emails to support and anything you include in them.

We use this information to provide, secure, and support Walkstack. That includes sending the notifications and emails you would expect, such as visit requests and updates, reminders, new-message alerts, visit reports and report links, invoices and payment updates, handoff requests, and account messages like sign-in and password recovery. We do not use it for advertising or sell it. We do not build profiles about you for anyone else.

The website. walkstack.world is a static site with no cookies, no analytics, and no ad scripts. Like any web host, our host (Vercel) processes standard request data such as IP address and browser type to deliver and protect the site.

Location

Walkstack asks for location only “While Using the App.” It never asks for “Always” access.
Location is recorded only when you are the assigned walker on a walk that is in progress. Recording stops when you pause or finish the walk.
During an active walk, recording continues if the app is in the background. iOS shows its location indicator while this happens.
Our server also enforces this. It rejects any route point that was not recorded between a walk’s start or resume and its next pause or finish.
The route is shared with that household as part of the visit report. A copy is kept on the walker’s phone so recording survives a weak signal. That copy is excluded from device backups.
Owners are never located by the app. We do not collect coarse location or track anyone outside an active walk.
You can turn off location at any time in iOS Settings. Walks will then have no route.

Who can see what

Your household. A household’s owners and the walkers they have authorized can see that household’s pets, care plans, visits, routes, visit reports, and invoices. Walkers see a household only after the owner accepts an invitation and agrees to share.
Profiles. Your name and profile are visible only to people you share a household with. Two clients of the same walker cannot see each other.
Phone numbers. A number is shown only if you mark it as shared.
Walker-only information. A walker’s private notes about a client or building are never visible to owners. A walker’s default rates are private. Each owner sees only the price that applies to them.
Home access. Apartment and entry notes can be read only by that household’s owners and the walkers the owner has authorized. Our server checks this on every request, and a walker loses access as soon as the owner removes them. Entry notes are not separately encrypted, so codes belong in the access vault. Shared building instructions, such as the front door or buzzer, are visible to walkers serving that building. Door, lockbox, and alarm codes saved in the access vault are encrypted in our database. A household’s owners can save and view them, and a walker can read them only while one of their visits for that household is active or paused. Our server decrypts the codes only for those requests. The codes are left out of care plans, the run sheet, notifications, and shared report links.
Backup walkers. A visit can be handed to another walker only if the owner approved that person as standing cover in advance, or approves the handoff. The incoming walker must acknowledge the current care plan first.
Photos and clips. The household sets a camera rule for each moment of a visit (pickup, on the walk, and dropoff): always, ask, or never. By default, on the walk is always, and pickup and dropoff are ask. Clips follow the same rule and can be added only during an active or paused visit. Under ask, a walker asks separately for a photo or a clip, and a yes applies to that moment of that visit. A clip can be viewed only by the household’s owners and the walker who added it. A removed photo or clip becomes unreadable to everyone right away.
Messages. Current members of a household (its owners and walkers) can read that household’s conversation on their own devices. We cannot.
Shared report links. A walker can send a link to one completed visit. The link expires after 14 days and can be revoked. Anyone who has the link can see that visit’s duration, distance, route, and any photos the household’s rules allow. The page never shows the address, door codes, video clips, or messages.
When access ends. When an owner removes a walker, that walker loses access to the household’s records immediately.
Private to you. Your device tokens and a walker’s Stripe account ID are never shown to other users.

Messages

Household messages are sealed on your device before they are sent. Each device keeps its own private key in the iPhone Keychain, where it is not included in backups and is never sent to us. Our servers store only the encrypted message, and any photo in it, and cannot read them. We can see who sent a message, in which household, when, and who marked it seen. Push notifications for messages name the sender, for example “Ada sent a message.” They do not include the text or the photo. Because we cannot read messages, we cannot moderate or recover them. A lost or replaced phone cannot read older messages, and someone who has not yet opened messages on a device cannot read messages sent before they do. Messages stay in the household conversation. The app does not currently let you delete a message.

Service providers

We share information only with the companies that run parts of Walkstack for us, and only what each one needs:

Supabase hosts our database, sign-in, file storage, and server functions.
Stripe processes owner card and bank payments, including automatic charges, and walker payouts through Stripe Connect. Stripe also receives the details you enter in its forms, under Stripe’s privacy policy (stripe.com/privacy). Care payments are processed on the walker’s own Stripe account. The owner’s payment details and records, such as the card or bank details and any name entered in Stripe’s form, the amount of each payment, and Walkstack reference numbers for the invoice, are kept in that walker’s Stripe account. The walker can see them in their Stripe Dashboard, under Stripe’s privacy policy. Walkstack keeps only the invoice and payment records the app needs, listed under “Payments and invoices” above, such as the card brand or bank name and last four digits, amounts, and payment status.
Apple and RevenueCat handle the walker membership. Apple processes the App Store purchase. RevenueCat receives your Walkstack user ID and subscription records to confirm whether your membership is active.
Apple Push Notification service delivers notifications using your device token and the notification’s title and text.
Resend sends our transactional email, such as invoices and visit reports.
Apple Maps draws route maps and opens directions when you ask for them. For directions, the street address of each stop is passed to Apple Maps. Door codes and entry notes are not.
Sign in with Apple signs you in if you choose it.
Vercel hosts walkstack.world.

We may also disclose information if the law requires it, to protect someone’s safety, to enforce our Terms, or as part of a merger or sale of the business, with this policy continuing to apply.

What we don’t do

We do not sell personal information, and we do not share it for targeted advertising. We do not use advertising identifiers or third-party ad or analytics tracking. The app does not include a crash-reporting SDK.

Retention and deletion

We keep your information while your account is open.
Delete in the app: Settings → Request account deletion. Walkers must finish any active care first, and saved changes waiting to send must be resolved.
Deletion is completed after a 14-day grace period. Until then, you can cancel it in Settings.
When deletion completes, we end all of your household connections and sign you out everywhere. Your profile becomes “Deleted account,” and your email address is removed from your account. We delete your phone numbers, device tokens, private client and building notes, rates, notifications, queued emails to you, and any unused invitations.
Photos you took as an owner are deleted. If you are a household’s last owner, or the last person still connected to it, that household’s personal data is deleted too: all of its photos and video clips, its messages, its address and entry notes, and the door, lockbox, and alarm codes in its access vault. Photos a walker took for a household stay with that household while an owner remains, because the visit report belongs to the household.
Messages you sent are deleted, along with your read and seen markers and your devices’ message keys. Messages other people sent stay in the household conversation while the household continues. Video clips you added are deleted, including clips already removed from a visit. If the household continues, its access-vault codes stay with it.
Invoices and payment records are kept as business and tax records, without your name or email. Saved cards and bank accounts can no longer be charged. Stripe, the walker’s Stripe account, and Apple keep their own records under their own policies.
Deleting your account does not cancel an App Store subscription. Cancel it in your Apple ID subscription settings.
You can export the care records you can currently access: Settings → Export my available care records.
You can also email support@walkstack.world to ask about, correct, or delete your information.

Security

All traffic between the app, our servers, and this website uses HTTPS. Our database checks every read and write against your household access on the server, not only in the app. Payment and service keys stay on our servers. Photos and clips are kept in private storage. Door, lockbox, and alarm codes in the access vault are encrypted at rest. Messages are encrypted end to end. Report links are stored as one-way hashes. No system is perfectly secure. If you think your account has been compromised, contact us right away.

Children

Walkstack is a professional tool for pet-care businesses and their clients. You must be 18 or older to use it. It is not directed to children under 13, and we do not knowingly collect their personal information. If you believe a child has given us information, email support@walkstack.world and we will delete it.

Your choices and rights

You can change location, camera, photo, and notification permissions in iOS Settings at any time. Owners can change camera rules and remove walkers. Anyone can choose which phone numbers to share. Depending on your state, you may have rights to access, correct, delete, or get a copy of your personal information, and to opt out of its sale or use for targeted advertising (we do neither). We honor these requests for every user, wherever they live, and we will not treat you differently for making one.

Where we operate

Walkstack is based in New York and offered in the United States. Your information is processed in the United States and wherever our service providers operate.

Changes

If we change this policy, we will post the new version here with a new effective date. If a change is significant, we will tell you in the app or by email before it takes effect.

Questions or requests: support@walkstack.world · Thought Garden Labs LLC, New York