Privacy Policy
Last updated: July 26, 2026
BondPals (operated by Metranox Labs) explains here how we handle personal data when you use our website at bondpals.com, pet profiles, QR codes, and Lost Mode features. This policy applies to the live production site, including the current soft-launch period.
1. Who we are
BondPals provides pet identity cards, breed atlas content, and emergency Lost Mode tools. We act as the data controller for account and pet profile data you submit. Platform-authored atlas content is separate from user-generated pet profiles and stories.
2. Data we collect
Account data: email, name, username, password hash, and optional profile settings. Pet data: pet name, breed, gender, photos, visibility, theme, health records (private), emergency notes, and Lost Mode status. Usage data: QR scan logs (timestamp, device type, anonymized IP hash), finder messages during Lost Mode, and operational logs for security and debugging. We do not sell your personal data.
3. How we use data
We use your data to operate your account, display pet profiles according to visibility settings, relay Lost Mode messages to owners, show QR scan analytics to owners, moderate user stories, and keep the platform secure. We may send transactional emails related to your account or emergency alerts.
4. QR codes and Lost Mode
Lost Mode is designed for emergencies. By default, finders cannot see the owner's phone number or email — they contact you through our secure form. We never request a finder's location automatically; location sharing requires an explicit action when that feature is available. Emergency notes you enter may be shown publicly while Lost Mode is active. QR scan events are logged for owners but are not published publicly.
5. Cookies and local storage
We use essential cookies for authentication sessions and language preference. Theme choice may be stored in your browser local storage. We do not use third-party advertising cookies on the core platform.
6. Your rights
Depending on your region (including GDPR and KVKK), you may have the right to access, correct, delete, or restrict processing of your personal data, and to object to certain processing. Account deletion will remove your owner profile; pet and story data will be deleted or anonymized according to our retention policy.
7. Retention and contact
Lost Mode finder messages and related logs are retained for operational purposes and will be deleted or anonymized after 30 days unless a longer period is required for abuse investigation. For privacy requests, contact us through your account settings or email [email protected].
8. First-party content traffic analytics
With Analytics permission, we measure approximate page interest on Atlas breed pages, public pet profiles, and stories using a first-party browser beacon (visible time ≥3 seconds). We may store approximate country (from our CDN), site/browser language, coarse device/OS/browser class, scroll depth bucket, referrer type/domain, landing path without query strings, and limited UTM tags (source/medium/campaign only). We do not store raw IP addresses, full User-Agent strings, email addresses, or third-party advertising cookies for this purpose. A short-lived sessionStorage key may help deduplicate views within a session after permission. If you are signed in, we may associate the event with your account id for admin traffic review; account deletion clears that link from raw analytics events. Raw events are pruned after about 14 days; durable daily totals (without your account id) may be kept longer for product operations. Access to detailed traffic reports is limited to platform operators (super admin). Cloudflare Free bot signals are approximate; we do not rely on Enterprise bot scores.
9. Consent management
On approved non-production environments, BondPals may use its own consent surface or the Usercentrics fallback to present and remember privacy choices. The first-party choice is stored in a versioned browser cookie for 180 days and is not copied into the BondPals database. You can reopen Privacy and cookie settings from the footer at any time.
10. Staging analytics and inactive services
Google Analytics 4 may run only on approved public staging pages after Analytics permission. It is excluded from account, admin, pet, story, demo, and Lost Mode routes; URL queries and fragments are not sent. Production GA4, Google Tag Manager, Google AdSense, and advertising signals remain inactive.