We collect only what we need to run FindMilo: your email address, your first name, your age range, your rough home area (the centre of a postcode) and chosen radius, your pet's profile, and, during a search, last-seen pins and sighting reports. You can also tell us how you heard about FindMilo, if you want to. If you sign up through one of our links, we also note which link brought you in, so we can see which local channels are working. If you opt in, we keep a record of that so we can email you our own updates, and you can stop those at any time. If you share your pets with a household, the people in it can see your pets, your searches and the sightings sent to you, and you can all see each other's first names. We do not hold a phone number for your account. The only phone number we hold is one a searcher chooses to add to a single sighting, so the owner and their household can message them on WhatsApp; it is off by default, we do not check it, and once the chat opens it is on WhatsApp, not us. Pet profiles stay sealed and are only shown to nearby searchers during a live alarm. During a live alarm there is also a limited public view of the pet, just a photo, name, rough area, how long ago and your advice on approaching them, that anyone with the link can open and that you can share yourself. It never names you, and the moment the alarm ends it shows nothing about the pet at all. Then the profile is sealed again. On iPhone, a live search can show on your lock screen; those updates carry no location and no photo. We only ask for your location when you drop a pin, never in the background. We record a basic log of app actions so we can measure our pilot. We do not show it to other members. Our website uses Google Analytics only if you accept analytics cookies. We do not sell your data, and we do not use it for advertising. FindMilo is for people aged 16 and over. You have rights over your data and can complain to the ICO.
Contact for privacy matters: findmiloapp@gmail.com. We have not appointed a data protection officer; a sole trader at this scale is not required to.
1.SCOPE
this policy explains what data we handle and why.
1.1.
This policy explains how we handle personal data when you use the FindMilo app, our website, and related services (the Service). It should be read with our Terms of Service.
2.SEALED PROFILES: OUR DATA-MINIMISATION DESIGN
your pet profile is private by default and only shown to nearby searchers during a live alarm. During a live alarm we also show a limited public view of the pet, just a photo, name, rough area, how long ago and your advice on approaching them, that anyone with the link can open and that you can share yourself on a poster or online. It never names you. The moment the alarm ends, that page shows nothing about the pet at all, and the profile is sealed again.
2.1.
Pet Profiles are private by default. A Pet Profile becomes readable by a Searcher only while an Alarm for that pet is live and only if that Searcher is inside the alert radius. When the search ends, the profile is sealed again and is no longer visible to Searchers. The Owner, and the members of the Owner's Household, can see the Pet Profile at any time. This is enforced at the database level (row-level security), not only in the app.
2.2.
We design the Service to collect and share the least data needed to run it.
2.3.
During a live Alarm we also make available a limited public view of the pet at a web link (for example, findmilo.app/a/ followed by an identifier). This view shows only the pet's photo, name, approximate area and how long ago it went missing, which is enough to make the Alarm real, together with the answers you gave about how to approach them and whether they come when called, so that anyone who spots them knows what to do. It never shows any notes you wrote in your own words. It never identifies you as the Owner, including never showing your first name, and the location stays approximate. There is no way to report a Sighting from this page; reporting a Sighting stays in the app, where it is tied to a real account.
2.4.
Anyone holding the link can open that limited view while the Alarm is live, not only Searchers inside the radius. Two different things happen here, and the difference matters. We send the link to the Searchers we have alerted; we do not publish it ourselves, and the page asks search engines not to index it. Separately, you may choose to share the link yourself, in a message, on social media, or as a QR code on a printed poster. When you do that, you are publishing your own pet's photo and details, not us, and once you have shared it we cannot control how far it travels.
2.5.
The moment the Alarm ends, whether you close it or it lapses after going quiet, the page stops showing anything about the pet. There is no photo, no name, no description, no area, and nothing about how the search ended. Every ended search shows the same short page, saying that the search has ended and thanking people for looking. It is not a broken link, because a poster can outlive a search by weeks and someone scanning it deserves an answer rather than an error. In this way the seal in clause 2.1 is kept in full, not only in part.
2.6.
Our lawful basis for this limited public view during a live Alarm is our legitimate interests, and yours, in running an effective tool for reuniting missing pets with their owners (Article 6(1)(f)), together with the performance of our contract with you in operating the Alarm you asked us to sound (Article 6(1)(b)). Where you share the link yourself, that is your own decision to make your pet's details public.
3.THE DATA WE PROCESS AND WHY
here is each type of data we handle, why we handle it, and our lawful basis.
3.1.
We process the following personal data:
| Data | Purpose | Lawful basis (UK GDPR) |
|---|---|---|
| Email address and one-time sign-in codes | Create and secure your account; sign you in; and send you missing-pet Alarms, Sighting updates and the all-clear, including by email if you have not installed the app | Performance of our contract with you (Art 6(1)(b)) |
| Your first name (required at sign-up; first name only, no surname) | Show who is who inside a Household, and greet you by name in the emails we send you, such as the welcome email and the email asking whether your pet is still missing | Contract (Art 6(1)(b)), where it identifies you to your Household; otherwise our legitimate interests in addressing you by name (Art 6(1)(f)) |
| Age range you give at sign-up (16-24, 25-44, 45-64 or 65+), asked of everyone, stored on your account and, if you are a Searcher, on your searcher profile and in the activity log below | Confirm you are 16 or over (see clause 10) and understand who is joining | Our legitimate interests in confirming eligibility and understanding who uses the Service (Art 6(1)(f)) |
| How you heard about FindMilo (optional; chosen from a fixed list, with no free text), stored on your account and, if you are a Searcher, on your searcher profile | See which local channels bring people to FindMilo | Our legitimate interests in measuring and improving how we reach people (Art 6(1)(f)) |
| Signup source (the "?src=" tag on the link you used to sign up, for example ?src=meta, ?src=poster or ?src=card-<business>) | See which local recruitment channels bring in Searchers, so we can compare them | Our legitimate interests in measuring and improving how we recruit Searchers (Art 6(1)(f)) |
| Your marketing opt-in and its record (that you opted in, the date and time, and the exact wording you agreed to) | Send you our own updates about FindMilo (not third-party advertising) | Consent (Art 6(1)(a)); you can withdraw at any time |
| Household membership: who belongs to which Household, who is the Account Holder, when each person joined, and the invitations created, including the email address of the person invited (until used or expired) | Let a Household share pets and searches, email the invitation to the person invited, and tell the Account Holder when someone joins | Contract (Art 6(1)(b)) |
| Which person in a Household sounded each Alarm | Run the Household's searches, and protect Members from false or malicious Alarms | Contract (Art 6(1)(b)); our legitimate interests in preventing misuse of the Alarm (Art 6(1)(f)) |
| Home area (centre of a postcode) and chosen radius | Match you to relevant local alerts as an Owner or Searcher | Contract (Art 6(1)(b)) |
| Temporary "watch from where I am" area (approximate, expires by itself) | Let a Searcher temporarily watch from where they are; reverts to home area | Contract (Art 6(1)(b)) |
| Pet Profile (photos, breed, markings, temperament, how to approach) | Let Searchers identify a missing pet during a live Alarm, and let your Household share your pets | Contract (Art 6(1)(b)) |
| Last-seen pin and Sighting reports (map pin, note, one optional photo) | Help Owners locate a missing pet | Contract (Art 6(1)(b)); our legitimate interests in running an effective alert tool (Art 6(1)(f)) |
| A UK mobile number a Searcher chooses to add to one Sighting (WhatsApp opt-in, off by default) | Let that pet's Owner and their Household contact the Searcher about that Sighting on WhatsApp | Consent (Art 6(1)(a)); see clause 5 |
| Device push tokens | Send alerts and notifications | Contract (Art 6(1)(b)) |
| Lock screen live search on iPhone: a push token for each phone showing the search, and the updates we send to it (the pet's name, how many Searchers were alerted and are looking, how many Sightings there are, and the time of the last one; no location and no photo) | Keep a live search up to date on your lock screen and in the Dynamic Island, including when the app is closed | Contract (Art 6(1)(b)) |
| Subscription status (held via the app store; we do not hold card details) | Manage your access | Contract (Art 6(1)(b)) |
| Website usage data via Google Analytics cookies (pages visited, how you arrived, and device and approximate location as Google derives them) | Understand how our website is used, only if you accept analytics cookies | Consent (Art 6(1)(a)); PECR reg 6; see clause 7 |
| In-app activity log: the action taken (for example joining as a Searcher, sharing an Alarm, reporting or blocking content, withdrawing a WhatsApp number, or deleting your account), when it happened, a few simple values (counts, yes/no, or an option chosen such as "cats" or "dogs"), your device platform (iPhone or Android) and app version. It is linked to your account once you have signed in. It holds no contact details, locations or free text | Measure and improve the Service during our pilot, whose questions are whether Searchers join and whether Alarms are answered. Only we can read it; it is never shared and never leaves our London database | Our legitimate interests in understanding and improving the Service (Art 6(1)(f)) |
| Personal data contained in post you send us | Receive and act on correspondence | Contract (Art 6(1)(b)); legitimate interests in handling correspondence (Art 6(1)(f)) |
3.2.
We do not hold a phone number as part of any account. The only phone number we process is one a Searcher voluntarily adds to a single Sighting under clause 5 (the WhatsApp opt-in).
Marketing email. Sending our own updates about FindMilo is separate from the emails above. We send them only if you tick an opt-in that starts unticked, and we record that you opted in, when, and the exact wording you agreed to. You can withdraw at any time, using the unsubscribe link in any such email or by emailing findmiloapp@gmail.com, and withdrawing is as easy as opting in. This does not change clause 7.3: we do not sell advertising and we do not use your data to advertise; we only send you our own updates because you asked us to.
3.3.
Where we rely on legitimate interests, we have balanced those interests against your rights. You can ask us for more detail at findmiloapp@gmail.com.
3.4.
We do not use profiling or automated decision-making that produces legal or similarly significant effects on you.
3.5.
Lock screen live search. On iPhone, a live search can be shown on the lock screen and in the Dynamic Island. Our server sends its updates directly to Apple's push notification service. Each update contains only the pet's name, how many Searchers were alerted and are looking, how many Sightings there are, and the time of the last one. It contains no location and no photo. The pet's photo is shown from a small copy that the app saves on your phone when the search starts and deletes from your phone when the search ends; that copy never passes through Apple's push service or our servers. Saving that copy is strictly necessary to provide the lock screen display you have chosen to use.
4.LOCATION DATA
we only ask for your location when you drop a pin, never in the background, and we never turn coordinates into a written address.
4.1.
We access your device location only in the foreground, at the moment you drop a pin, and never at signup and never in the background. We do not watch or track your location.
4.2.
There are only two pin drops: where a pet was last seen, and where a pet was spotted.
4.3.
A Searcher's home area is stored as the centre of a postcode, not an exact position. The temporary "watch from where I am" area is likewise approximate and expires by itself (after 4 hours, until the next day, or after 3 days), then reverts to the home area.
4.4.
We never reverse-geocode coordinates into text, so that an Alarm sounded from home cannot reveal a home address.
5.WHATSAPP OPT-IN: LETTING AN OWNER'S HOUSEHOLD MESSAGE A SEARCHER
a searcher can choose to share a mobile number on one sighting so the owner and their household can message them on WhatsApp. It is off by default, we do not check it, and once a chat opens it is on WhatsApp, not us.
5.1.
When a Searcher reports a Sighting, they may choose to tick a box, which is off by default, to let the Owner of that Alarm and the members of the Owner's Household contact them on WhatsApp. The box says that the number will be visible to everyone in that Household. If they tick it, they enter a UK mobile number, which is stored against that single Sighting only, not on their profile. The Owner and the members of their Household then see a "WhatsApp them" button.
5.2.
We store that number in our database (Supabase) and are the controller for it. We send nothing. No message passes through us, we hold no message content, we have no WhatsApp Business account, we do not use WhatsApp's or Meta's API, and we have no commercial relationship with Meta for this. Meta is not our processor for this feature. The "WhatsApp them" button simply opens the WhatsApp app of the person who taps it, through a public wa.me link.
5.3.
The number is not verified. We have no SMS provider and no way to confirm the number belongs to the Searcher who typed it; the app only checks that it is shaped like a UK mobile number. You must enter only your own number, never anyone else's.
5.4.
Once someone opens a chat, the conversation is between that person and the Searcher on WhatsApp, under Meta's terms. We cannot see, moderate, retrieve or store that conversation. Opening a chat also shows the Searcher's WhatsApp display name and profile photo to the person who opened it; the app tells the Searcher this before they opt in.
5.5.
The number, and the WhatsApp display name and profile photo revealed through a chat, can be read only by the Searcher who gave the number and by the Owner of that Alarm and the members of the Owner's Household, which is at most four people. No other Member can read it. This is enforced at the database level, not only in the app.
5.6.
Because sharing the number is optional, off by default and specific to one Sighting, and the Service works without it, our lawful basis is your consent (Art 6(1)(a)), not contract. You can withdraw your consent at any time by either of two standing routes: you can remove the number from that Sighting in the app, or you can email us at findmiloapp@gmail.com and we will remove it. Neither route replaces the other, and the email route remains available whether or not you can still access the app. Withdrawing your number leaves the pin, the note and the photo in place, because an Owner may still be relying on them during a live search. A Searcher can remove their number; there is no way to change it to a different one.
6.WHO WE SHARE DATA WITH
we share data only to run the service, mostly with providers who act on our instructions. We do not sell it.
6.1.
We share personal data only as needed to run the Service, with:
(a)
other Members, strictly as the Service requires (a Searcher sees a sealed Pet Profile only during a live Alarm within the radius; an Owner, and the members of the Owner's Household, see the Household's Pet Profiles, its searches and the Sightings sent to them, including any Sighting photo and any WhatsApp number added to it; members of a Household see each other's first names; a Sighting photo, and any WhatsApp number added to it, are otherwise readable only by the Searcher who sent it; and, during a live Alarm, a limited public view of the pet described in clause 2, showing only the photo, name, approximate area and how long ago and never identifying the Owner, can be opened by anyone holding the Alarm link, including people who are not Members);
(b)
our service providers acting as processors on our instructions, being hosting and database on Supabase, push notifications via Expo, website analytics via Google Analytics (Google LLC), business post handling (receiving, scanning and forwarding our post) by Capital Office Ltd (124 City Road, London EC1V 2NX, company number 06294297, ICO registration ZA084808, UK-based), delivery of the one-time sign-in codes members use to access the app, other transactional email, and our marketing email to members who have opted in, via Loops (our authentication provider, Supabase, sends its outbound email through Loops, so Loops processes the email address of every member on each sign-in, and the first name of any member who has given one, because it is included in some of those emails), and payment through the Apple App Store and Google Play;
(c)
Apple Inc., which provides Apple's push notification service, for the lock screen live search on iPhone (see clauses 3.5 and 8.4). Apple is not our processor for this; and
(d)
authorities, regulators or others where we are required or permitted by law, or to protect the safety of a person or animal.
6.2.
When an Owner uses the WhatsApp opt-in to open a chat, that is the Owner contacting the Searcher directly on WhatsApp using the Owner's own account; it is not us sharing the number with Meta, and Meta does not act as our processor for it. See clause 5.
6.3.
We do not sell your personal data and we do not use it for advertising.
6.4.
Households. If you are the Account Holder and invite someone into your Household, you are choosing to share your pets' profiles, your searches and the Sightings sent to you with that person, including any Sighting photo and any WhatsApp number a Searcher has added. We tell you in the app when someone joins. If you join a Household, the Account Holder and the other members can see your first name, and which Alarms you sounded. Your own searcher profile, blocks and email choices are not shared with the Household. If someone invites you, we use your email address to send you the invitation and to recognise it when you sign in. If you do not join, it is deleted when the invitation expires.
7.ANALYTICS AND COOKIES (OUR WEBSITE)
our website uses Google Analytics, but only if you accept analytics cookies. Nothing loads before you choose, rejecting is as easy as accepting, and you can change your mind at any time.
7.1.
Our website uses Google Analytics to understand how the site is used. Nothing loads before your consent. The Google Analytics tag is not placed on the page at all until you press "Accept cookies", and before that the site makes no request to any other domain. We do not use Google's "consent mode", which would load the tag before consent.
7.2.
Rejecting is as easy as accepting. The cookie banner offers two buttons of the same size and style. You can change your choice at any time from "Cookie settings" in the website footer. Changing your choice to reject deletes the cookies and reloads the page without the tag.
7.3.
Analytics only. Advertising storage, advertising user data and advertisement personalisation are permanently denied. We do not use Google Analytics for advertising or remarketing.
7.4.
Cookies. If you accept, two cookies are set: _ga and _ga_LE4PW0TBER. One further entry in your browser's local storage records your own cookie choice; that entry is strictly necessary and is stored whichever way you answer.
7.5.
What Google receives. Google Analytics receives which pages you visit, how you arrived at the site, and your device and approximate location as Google derives them. It does not receive anything you type into a form, and no photo you create with the poster tool ever leaves your device.
7.6.
Retention. Google Analytics event data is retained for 2 months, the shortest option, which is the setting we hold.
7.7.
Only the live website reports to Google Analytics; test and preview builds load no tag.
7.8.
Lawful basis. Our lawful basis for analytics is your consent (Art 6(1)(a)), and the cookies are set in reliance on regulation 6 of the Privacy and Electronic Communications (EC Directive) Regulations 2003.
8.INTERNATIONAL TRANSFERS
most of your data stays in the UK. Some is processed in the United States, by Google Analytics for the website, Loops, which delivers sign-in emails, and Expo, which delivers alerts to your phone, all under approved safeguards. On iPhone, lock screen updates for a live search also go to Apple in the United States, which does not offer those safeguards.
8.1.
Most of your personal data stays in the UK. Our hosting and database provider, Supabase, hosts in West Europe (London), in the UK, and our post-handling provider, Capital Office Ltd, is in London, so no international transfer arises for either.
8.2.
If you accept analytics cookies, our website analytics provider, Google Analytics (Google LLC), processes personal data in the United States. That transfer is protected by the EU-US Data Privacy Framework and its UK extension, and by the ICO's International Data Transfer Agreement or Addendum to the EU Standard Contractual Clauses, so that your data has an equivalent level of protection.
8.3.
Our email provider, Loops, processes personal data in the United States. Our authentication provider, Supabase, sends its outbound email, including the one-time codes members use to sign in, through Loops, so Loops processes the email address of every member on each sign-in, and the first name of any member who has given one, because it travels inside some of those emails. That transfer is protected by the EU-US Data Privacy Framework and its UK extension, and by the ICO's International Data Transfer Agreement or Addendum to the EU Standard Contractual Clauses, so that your data has an equivalent level of protection.
8.4.
Push notifications are delivered by providers in the United States. Expo, which sends our alerts and notifications, processes your device push token and the content of each notification in the United States, and passes them to Apple's push notification service for delivery to iPhones. For Expo, that transfer is protected by the EU-US Data Privacy Framework and its UK extension, under which Expo is certified. Our lock screen live search updates go directly to Apple's push notification service, run by Apple Inc. in the United States, which receives the push token for that phone and the update content set out in clause 3.5. Apple is not certified under the EU-US Data Privacy Framework, and Apple's developer terms do not provide transfer safeguards for this service.
9.HOW LONG WE KEEP DATA
we delete search data 30 days after a search ends, whether it was closed or simply went quiet, and we delete the photo files themselves, not just the database rows. Deletion runs nightly on a schedule.
9.1.
We keep personal data only as long as necessary. The periods below are enforced by a scheduled deletion job that runs nightly. A search ends when you close it or when it lapses after going quiet, and the deletion runs on the same timer either way, whether a search was closed, lapsed, or never closed by anyone. 30 days after a search ends, the job deletes:
(a)
the Sighting records for that search, being the note, the pin, the photo, and any WhatsApp number attached to them;
(b)
the last-seen pin on the Alarm; and
(c)
the record of which Members were alerted.
9.2.
When a Sighting photo is deleted, we delete the photo file itself from storage, not only its database record. The job removes the database record only once it has confirmed that the file itself is gone, so that no photo is left behind by a database-only deletion.
9.3.
The Alarm record itself survives after this deletion, carrying no location and no free text.
9.4.
Other data is kept as follows:
(a)
Pet Profiles: kept while your account is active, then deleted within 90 days of account closure;
(b)
Account email and sign-in data: kept while your account is active, then deleted within 90 days of account closure;
(c)
Your first name: kept while your account is active, then deleted with your account;
(d)
The in-app activity log: linked to your account for no longer than 12 months from each event. After that, and when you delete your account, the records are unlinked from you so that they no longer identify you, and are kept only as anonymous totals;
(e)
Your age range: kept on your account and, if you are a Searcher, on your searcher profile while your account is active, then deleted with your account. Where it is also recorded in the activity log, that record is unlinked from you as in (d). If you choose "Under 16" at sign-up, sign-up stops and nothing you entered is stored;
(f)
If you sign up as a Searcher on our website but never confirm your email address: everything you gave us is deleted after 7 days;
(g)
Records we must keep for legal and tax reasons (including subscription records we hold): kept for 6 years.
(h)
How you heard about FindMilo: kept on your account and, if you are a Searcher, on your searcher profile while your account is active, then deleted with your account;
(i)
Household membership: an invitation, including the email address it was made for, is deleted within a day of being used, or when it expires. A Household Member's membership record is kept while they are in the Household and deleted straight away when they leave, are removed, or the Household ends. The record of which person sounded an Alarm is deleted with the Alarm record, or unlinked from that person sooner if they delete their account;
(j)
The push token for a phone showing a lock screen live search: deleted when the search ends. The copy of the pet's photo saved on that phone is deleted from the phone when the search ends.
10.CHILDREN
FindMilo is for people aged 16 and over.
10.1.
The Service is intended for users aged 16 and over. Everyone is asked their age range at sign-up. If you choose "Under 16", sign-up stops, we tell you that FindMilo is for people aged 16 and over, and nothing you entered is stored. We do not knowingly collect data from anyone under 16. If we learn that we have, we will delete it.
11.YOUR RIGHTS
you can access, correct, delete and object to how we use your data, and complain to the ICO.
11.1.
You have the right to access your data; to have it corrected or deleted; to restrict or object to processing; to withdraw consent where we rely on it (including the WhatsApp opt-in, marketing email, and analytics cookies); and to data portability, in each case as provided by UK data protection law.
11.2.
To exercise any right, contact us at findmiloapp@gmail.com. We will respond within one month.
11.3.
If you are unhappy with how we handle your data, you can complain to the Information Commissioner's Office (ICO) at ico.org.uk or on 0303 123 1113. We would ask you to raise it with us first so we can try to help.
12.SECURITY
we take reasonable steps to keep your data safe.
12.1.
We use appropriate technical and organisational measures to protect personal data, including database access controls (row-level security), sealed profiles, read rules that limit a Sighting and any WhatsApp number to the Searcher who sent it and the Owner's Household, and encryption in transit. The limited public view of a pet during a live Alarm, described in clause 2, is a deliberate feature of how the Service works rather than a gap in these measures; it exposes only what clause 2 describes and never identifies the Owner. No system is completely secure, and you are responsible for keeping access to your email account safe, because your sign-in codes are sent there.
13.CHANGES
we will tell you if this policy changes in an important way.
13.1.
We may update this policy. For material changes we will give reasonable notice by in-app notice and email.