Privacy policy

Last updated 20 October 2026

This policy explains what Furr collects when you use our website, join our waitlist or use the Furr app, why we need it, who can see it, and the choices and rights you have. It is written for Sri Lanka's Personal Data Protection Act No. 9 of 2022, as amended in 2025.

1. Who we are

Furr is a pet care app made in Sri Lanka. It is run by its founders in Colombo, Sri Lanka. We are registering Furr as a company; when that is done, this page will give the company's name and number.

We are the "controller" of your information: we decide how it is used. For anything about your privacy, email [email protected]. We have not appointed a data protection officer, because the Act doesn't require one for a service of our size; the founders handle privacy requests themselves.

2. What we collect

When you visit the website

• The website doesn't use cookies, analytics or ads, and it loads nothing from other companies' servers.
• Our web host (Cloudflare) receives your IP address and browser details to deliver the pages and block attacks.
• Your browser remembers which app feature you last looked at on the home page, and whether you have joined the waitlist. That stays on your device.

When you join the waitlist

• The email address or WhatsApp number you choose to give us.
• Only if you answer them: what kind of pet you have, their name, what you find hardest about caring for them, and anything you add in your own words.
• The date you joined and which version of our sign-up wording you saw. That is our record of your consent.
• We don't store your IP address or details about your device with your sign-up.
• We use your email or number only to tell you when Furr opens. We use your answers to decide what to build first. We won't add you to any other list, and every message we send says how to stop: just reply "stop".

When you email us

• Your email address, your name if your email shows it, and anything you write to us.

When you use the Furr app

• Your account: your name, email address and password. Your password is handled by Google's Firebase sign-in service; we never see it. You can add a profile photo.
• Your pets: name, species, breed, sex, colour, birth date, photo, whether they are neutered, allergies, ongoing conditions and notes for your vet. A microchip number and council registration number only if you add them.
• Health records: vaccinations and their dates, batch and certificate numbers, who gave them, vet and clinic names, tick, flea and worm treatments, vet visit notes, and the photos and PDFs you attach.
• Daily care and weight: care tasks such as feeding, walks and medicines, their times, when they were done or skipped and by whom, and weight entries.
• Expenses: amounts, categories, notes, who paid, receipts you attach and your monthly budget.
• Family sharing: invite codes you create, who joined which pet, and when.
• Notifications: if you allow them, a token for your device so we can send you alerts. Care reminders are set on your phone and their contents stay there.
• "Notify me" taps: which upcoming features you asked to hear about.
• Technical data: your IP address and request details, used briefly to keep the service running and to stop abuse.

We don't collect your contacts, your location in the background, advertising IDs or payment card details.

Community features (when they arrive)

Lost & found, owner questions and tips, vet tips and events are coming in a later release. When they do, we will also store what you post (text, photos, comments, votes and reports), the district and town you choose, and, only if you tap "Use my location", a position rounded to about 1 km. Your phone's own maps service (Apple or Google) turns that position into a town name. Phone numbers appear on a post only if you choose to show them.

3. Why we use it

The Act only lets us use personal information when we have a lawful reason. Ours are:

We don't use your information for advertising, we don't sell it, and we don't build profiles of you. We never use your photos, your pets or your posts in our marketing without asking you first. Where we rely on consent, saying no doesn't stop you using the rest of Furr, and you can withdraw it at any time. Withdrawing doesn't undo what we did lawfully before. If we ever want to use your information for a new purpose, we will tell you first.

4. What you have to give us

• To create an account, you need to give your name, an email address and a password. Without them we can't give you an account.
• A pet needs a name, a species and a sex ("unknown" is fine). Everything else about your pets, your profile photo and any documents is optional: leave it out and the features that use it won't work, but the rest of Furr will.
• To join the waitlist, you only need to give an email address or a WhatsApp number. The questions about your pet are optional.
• No law requires you to give us any of this.

5. Who can see your information

• You. Your account and pets are private to you by default.
• People you share a pet with. Family members and carers you invite see everything about that pet: its profile, health records and files, care, weights, expenses and receipts. They also see your name and profile photo and who added or paid for what.
• Anyone you send a health card to. The health card is a PDF made on your phone. Once you share it, it is outside Furr and we can't take it back, so share it only with people you trust.
• Other Furr users, for community posts (when community arrives): what you post, your name, and the town you chose. Never your exact location or email.
• The Furr team, only when needed: to help you when you ask, to fix a problem, or to review reported community content.
• Our service providers, who store and process data for us under contract (section 6).
• Authorities, only when the law requires it (section 13).

If Furr is ever sold or merged, your information would move to the new owner under this policy, and we would tell you first.

6. Service providers and where data is stored

Furr runs on these providers. Each one may only use your information to provide its service to us.

These countries may not have the same data protection laws as Sri Lanka. Storing your information there is necessary to give you the service, because Furr runs on these providers. We protect it by using providers that commit to data protection terms with us, by encrypting data in transit and at rest, and by limiting who can reach it. We will adopt the transfer safeguards the Data Protection Authority sets under section 26 of the Act.

7. How long we keep it

• Your account, pets and records: for as long as you have an account.
• When you delete your account: we delete it straight away, with your pets, records, files, care, weights and expenses. See what is deleted and what is kept. Copies in our providers' backups disappear as those backups expire, normally within 30 days. Google can take up to 180 days to remove sign-in data from all its systems.
• Pets you shared: if you delete your account, a pet you share with family passes to the person who joined it first, with its records. Anything you added to someone else's pet stays with that pet, without your name.
• Waitlist sign-ups and answers: until we have told you Furr is open, and no longer than three months after that. Ask us to remove you earlier at any time. We may keep anonymous totals, such as how many dog owners joined.
• Support emails: up to two years after the conversation ends.
• Community reports and moderation decisions (when community arrives): up to one year after the case is closed.
• Device tokens for notifications: until you delete your account or the token stops working.
• Technical data: request counters are cleared within minutes. Our hosting providers keep their logs for a short time, usually up to 30 days.

We decide these periods by how long each item is needed for the reason we collected it. We keep something longer only if the law requires it, or for as long as needed to deal with a legal claim.

8. Your rights

Under the Personal Data Protection Act, you can ask us to:

• Show you the personal information we hold about you and give you a copy.
• Correct information that is wrong or incomplete. You can change most of it yourself in the app.
• Delete your information. You can delete your whole account in the app.
• Withdraw your consent, for example to waitlist messages, at any time.
• Object to us using your information for our legitimate interests.
• Review an automated decision by a person. Furr makes no automated decisions with legal or similar effects. In community, posts that several people report, or that read like an animal sale, are held automatically until our team checks them, and you can ask for a review.

Email [email protected] from the address on your account. We may ask you to confirm it is you. We reply within one month. If we need longer, we will tell you within that month, and we will never take more than three months in total. It is free. If we can't do what you ask, we will explain why and tell you how to appeal to the Data Protection Authority.

A parent or guardian can make a request for someone under 18, and anyone can make one for you if you authorise them in writing. The heirs of someone who has died can ask about that person's information within 10 years of their death.

9. Children

Furr is for adults aged 18 and over. We don't knowingly collect information about children. If we learn that someone under 18 has an account, we will close it and delete their information. If you think a child is using Furr, email us. Please don't post photos or details of children in Furr, and we will remove any we find or are told about.

10. Keeping it safe

• Everything between the app, our server and our providers is encrypted in transit.
• Photos and files are never public. The app gets links that expire after an hour, and only people who share the pet can get them.
• Every request to our server is checked against who is signed in and what they are allowed to see.
• Only the founders can reach the systems that hold your data, and only when they need to.

No system is perfectly secure. If a data breach is likely to put you at risk, we will tell you and the Data Protection Authority without delay, aiming to do so within 72 hours of finding out.

11. Information about other people

If you add information about someone else, such as a vet's name or, in community, a phone number, make sure they are happy for you to share it. People you invite to share a pet will see your name. Never post someone else's address or private details.

12. Cookies and storage on your device

• Website: no cookies. Two items in your browser's local storage: furr-module remembers the feature you last looked at, and furr-waitlist remembers that you joined the waitlist, so we don't ask again. Neither holds personal details. Clear them in your browser settings whenever you like.
• App: keeps you signed in, saves unfinished forms and stores your reminder settings on your phone. None of it is used for tracking or ads.

If we ever add analytics to the website, we will choose a tool that doesn't track you across sites, update this policy first, and ask for your consent where the law requires it.

13. Requests from authorities

We share information with the police, courts or regulators only when Sri Lankan law requires it, such as a court order or a warrant under the Computer Crime Act. We check that each request is lawful, share no more than it requires, and tell the people affected unless the law forbids it. We push back on requests that are unlawful or go too far. When we are lawfully asked to keep certain data while an investigation runs, we keep it for that time only. We never hand over information just because someone asks informally.

14. Changes to this policy

When we change this policy, we change the date at the top. If a change affects how we use your information, we will tell you in the app or by email before it applies, and ask for your consent again where the law requires it.

15. Contact and complaints

Questions, requests or complaints: email [email protected]. A real person reads every message, and we aim to reply within three working days. If something has gone wrong, tell us and we will put it right.

You also have the right to complain to the Data Protection Authority of Sri Lanka.

This policy is in English. You can write to us in Sinhala, Tamil or English, and we will explain anything that is unclear. If we publish a translation, this English version is the one that applies if they differ.