PawHelp Privacy Policy

1. Who processes your data

Personal data operator: Andrei Makarov, address: 45 A. Kusaiynov Street, Uralsk, West Kazakhstan Region, Kazakhstan ("we", "PawHelp").

Owner of the personal data databases: the operator (the database owner and the operator are the same individual).

Person responsible for organising personal data processing: the operator personally, contact: privacy@pawhelp.app.

Personal data requests: privacy@pawhelp.app. Support: support@pawhelp.app.

2. Scope

This policy covers the processing of personal data in the PawHelp mobile app, on the account deletion web page (https://pawhelp.app/delete-account) and on the servers behind them.

PawHelp helps users in the Republic of Kazakhstan, as well as users from other countries, mark homeless animals that need help on a map and arrange that help.

PawHelp is for people aged 18 or over only. Age is confirmed by the user's own declaration; we do not ask for a date of birth or documents and do not verify age independently.

This policy does not replace the terms of Google, Supabase, Render and the OpenStreetMap Foundation, which govern their own processing.

3. Four distinct concepts

This policy distinguishes:

1. Storage location — the country where a database or storage is physically located.
2. Transfer to a processor or another party — another organisation (for example a hosting or cloud database provider) receives the data, whatever its country.
3. Cross-border transfer — transfer of personal data to the territory of a foreign state (Art. 16 of the Law of the Republic of Kazakhstan "On Personal Data and Their Protection").
4. Distribution to other users — data becomes visible to other PawHelp users (for example a report on the shared map).

One operation can fall under several of these at once. Each is described separately in sections 6–11.

4. Regional separation of accounts

At registration you choose your country of residence. The server assigns your account to one of two service regions. The region cannot be changed in the app; it can only be changed through a separate server-side procedure.

Kazakhstan contour (accounts that chose "Kazakhstan").

• The regional profile, consents, reports, chats, complaints, moderation, photos and notification devices belong to the Kazakhstan contour. Their source of truth is the regional server PawHelp KZ API and its PostgreSQL database.
• The international server (Render) receives only the data listed in section 11: the assigned region, a minimal record of the 18+ confirmation and eligibility, the shared-map projection of reports, and the data needed to check your account.
• Photos of Kazakhstan reports are not transferred to the international contour.
• Cross-region actions are forbidden: an account in one region cannot respond to a report, write in a chat or file a complaint about content of the other region.
• The Kazakhstan contour applies to new registrations from the date registration of Kazakhstan accounts is enabled in the app. Until then, registration with the country "Kazakhstan" is unavailable in the app.

International contour (accounts that chose any other country). Data is processed by the Render server and stored in Google Cloud Firestore; photos are stored in Supabase Storage; notifications are sent by the Render server through Firebase Cloud Messaging.

Common to both contours. Sign-in uses Google Sign-In and Firebase Authentication. This is a shared service for all accounts, and it operates in the United States (section 11).

5. What data we process, where it comes from and why

Processing methods. Data is processed automatically on PawHelp servers and by the recipients in section 11: collection, recording, storage, modification, use, distribution to other users (section 7), blocking and destruction. Complaints are reviewed manually by moderators. We do not make automated decisions with legal effects on you and do not profile users.

We do not sell personal data, show ads or use analytics, advertising or crash-reporting SDKs. The device location is not requested in the background and is not sent to the server on its own: only the coordinates of a report you publish reach the server.

6. Google sign-in and Firebase Authentication

You can sign in to PawHelp only with a Google account. We do not receive your Google password. Firebase Authentication (Google) stores your UID, email address, Google profile name and photo (if any), sign-in details, and service markers of the 18+ confirmation and declaration version. According to Google, Firebase Authentication processes data only in data centres in the United States and keeps IP address logs for a few weeks.

On every request to PawHelp servers, the app sends a Firebase ID token. The token contains your UID and email address and is valid for up to one hour.

Before every protected operation in the Kazakhstan contour, the regional server checks your account state through the Render server. Render receives only the UID and the last sign-in time (auth_time), not the token itself. Disabled accounts and sessions revoked after the last sign-in are refused.

7. Reports, location, photos and the shared map

Location. The app asks for precise and approximate location only while in use (ACCESS_FINE_LOCATION, ACCESS_COARSE_LOCATION) to show your position on the map and suggest a point for a report. You can revoke access in Android settings and pick a point manually.

Shared map. A published report is visible to all signed-in PawHelp users of both regions who have confirmed 18+, unless it is hidden. Other users see:

• animal type, description, help type and urgency, status, and the creation, update and last-seen times;
• exact coordinates, not rounded;
• internal account identifiers of the author and helpers (not names or email addresses);
• the photo — only users of the same region.

Exact coordinates may point to your home or workplace.

Showing a report to other users is distribution of personal data within the meaning of Art. 1 of the Law. It is based on the Personal Data Processing Consent (section 6), which the user gives in the app at registration.

For reports by Kazakhstan accounts, a projection is sent to the shared map: animal type, description, help type and urgency, status, coordinates, author and helper identifiers, the hidden flag and times. The city, reservations, counters, status requests, helper join times, photos and chats stay in the Kazakhstan contour. The projection is stored in Cloud Firestore (eur3 multi-region (European Union)).

Photos. Before upload the app removes EXIF metadata from the photo (including GPS coordinates and device details), downsizes it and re-encodes it. The server checks the file and serves only the re-encoded copy through temporary links valid for 15 minutes.

• International contour: photos are stored in Supabase Storage (Ireland, region eu-west-1).
• Kazakhstan contour: photos are stored with Hoster.kz (Almaty, Republic of Kazakhstan) and are not transferred between regions.

8. Chats and messages

Every report has a chat. Only the author and users who tapped "I'll help" can see it, unless the report is hidden. We store the text, author and time of each message.

• Messages in international reports are stored in Cloud Firestore.
• Messages in Kazakhstan reports are stored only in the Kazakhstan contour database and are not sent to Render.

9. Complaints, account restrictions and moderation

Complaints. You can report a post or a message, choosing a reason (spam, offensive content, personal information, cruelty, other) and adding a comment. Only moderators see the complaint; the content author does not.

Moderation in the international contour. Moderators review complaints manually. They can hide a whole report (with its chat and photos), delete a single message, issue a warning and restrict an account's actions. Actions are recorded in the moderator action log.

Moderation in the Kazakhstan contour. Complaints, restrictions and moderator actions are stored only in the Kazakhstan contour database. Moderators are appointed separately. They can:

• hide a report;
• delete a message;
• close a complaint;
• issue a warning;
• restrict an account's actions or lift a restriction.

Every moderator action is logged with identifiers and a reason code, without the complaint or message text.

Account restriction. A restricted account cannot create reports, upload photos, or send messages or complaints. It can read its chats and delete the account. A restriction lasts until the date set by the moderator or, if no date is set, until a moderator lifts it. Users learn about decisions on their complaints and measures concerning their account from the in-app notification list and the "My complaints" section.

User blocking. You can block another user of your region from a chat or a report. We keep the identifiers of both accounts and the time of the block until you unblock or one of the accounts is deleted. The blocked pair do not see each other's chat messages and are not notified of each other's actions; other participants do not see the block, and reports stay on the map. The blocked user is not told about the block. A block is not a complaint and is not reviewed by moderators. Blocks by Kazakhstan accounts are stored only in the Kazakhstan service database and are never sent to Render, Cloud Firestore or another region.

10. Push notifications, Firebase Installation ID and subscription

Notifications. If notifications are enabled in the service and allowed on the device (POST_NOTIFICATIONS), we store the Firebase installation ID (FID), language and platform. Notifications are delivered by Google Firebase Cloud Messaging (FCM). We notify you about:

• new reports in your region (for reports without high urgency, with a delay of up to 5 minutes);
• responses to your report;
• new messages in your reports' chats.

A notification contains only a fixed title, text in your language, the event type and the report identifier. Message text, report content, names and UIDs are not included.

• International contour: the Render server stores devices in Cloud Firestore and keeps the in-app notification list.
• Kazakhstan contour: devices and the delivery log are stored in the Kazakhstan contour database. Delivery records are deleted after 7 days, and an account may have at most 10 devices.

When you sign out, the device is removed from the recipients.

PawHelp Support subscription. As of the effective date the subscription is sold through Google Play (see "PawHelp Support Subscription Terms"). Payment is processed by Google Play: we never receive card details, the payer's name or the billing address.

Before a purchase, your region's server issues an obfuscated account identifier for Google Play. It is an HMAC of the UID with the server's secret key and cannot reveal your email, name or UID.

After payment the app sends the server only the purchase token. The server asks Google Play for the subscription's state itself and stores:

• the hash of the purchase token and the token itself (needed for later checks with Google);
• the subscription and base plan identifiers;
• the subscription state, the end of the paid period, the auto-renewal flag and the test-purchase flag;
• the latest Google Play order number;
• the history of changes: purchase, renewal, cancellation, refund, expiry.

We do not store the price or currency.

Where the records are kept:

• international region — in Cloud Firestore (Render server);
• Kazakhstan region — only in the Kazakhstan region's database. A Kazakhstan account's purchase token is never sent to Render.

Google reports subscription changes to the server through real-time notifications. After each notification, and in a daily reconciliation, the server asks Google for the current state again. The purchase token is never written to logs or sent to analytics.

11. Recipients, storage locations and cross-border transfer

What leaves the Republic of Kazakhstan for Kazakhstan accounts:

• Google account data — to Firebase Authentication (United States);
• the UID and auth_time on every protected operation, the region assignment, the 18+ confirmation record and report projections — to the Render server and Cloud Firestore (their countries are in the table);
• the FID and notification details — to FCM;
• when a subscription is bought, the obfuscated account identifier and the purchase token — to Google Play (the purchase records are kept in the Kazakhstan contour);
• map tile requests — to the map provider.

The basis for this transfer is the Personal Data Processing Consent (section 7), which the user gives in the app at registration.

Consent to cross-border transfer does not remove the requirement of Art. 12 of the Law to store personal data in a database located in the Republic of Kazakhstan. Some data of Kazakhstan accounts, in particular Firebase Authentication data, is stored abroad.

What stays in the Kazakhstan contour (provided the KZ API, database, photo storage and backups are hosted in the Republic of Kazakhstan — see the table):

• the regional profile and the detailed consent log;
• full reports, including the city, reservations, counters and status requests;
• report participants and their join times;
• chats;
• complaints and their comments;
• account restrictions, the moderator list and the moderation log;
• photos;
• notification devices and the delivery log;
• the account deletion record.

The legal status of each recipient (processor acting on our instructions, or third party) is set by our contract with it. Google, Render and Supabase process data on our instructions under the data processing terms that form part of their service terms. There is no data processing agreement with the OpenStreetMap Foundation: it handles map requests under its own rules (the OSMF tile usage policy and privacy policy). We disclose data to public authorities only where the law requires.

12. How we protect data

• Connections between the app and the servers use HTTPS.
• Access to Cloud Firestore is restricted by rules:
  • reports can be read only by users signed in with Google who have confirmed 18+ and the current document versions;
  • a chat can be read only by its participants;
  • the app can create complaints but not read them;
  • all other data is closed to the app.
• Only the server modifies data, after checking the request.
• Exchanges between the Kazakhstan contour server and Render are protected by an HMAC signature with a timestamp. Only a predefined list of fields is sent to Render.
• Photos are checked and re-encoded, metadata is removed, and they are served through temporary signed links.
• The production Kazakhstan contour server does not start with local file storage for photos.

No method of transmission or storage is completely secure. We will notify the authorised body (Information Security Committee of the Ministry of Artificial Intelligence and Digital Development of the Republic of Kazakhstan) of a personal data security breach within one working day of discovering it (Art. 25(2)(8) of the Law).

13. Retention and destruction

Retention periods set by the operator differ from the technical intervals the software applies automatically.

Retention periods set by the operator:

Technical intervals in the software:

• a publication reservation lasts 10 minutes;
• a temporary photo link is valid for 15 minutes;
• a photo upload link in the Kazakhstan contour is valid for 30 minutes;
• service records of international uploads are kept for 30 days after completion;
• unfinished uploads are removed after their links expire;
• a previously opened international photo may load from the delivery network cache for up to 24 hours after deletion;
• notification delivery records in the Kazakhstan contour are deleted after 7 days;
• the sign-in check before account deletion is valid for 5 minutes.

How long Google, Render and Supabase keep data after deletion is set by their own terms. For example, Google states that Firebase Authentication data is deleted from active and backup systems within 180 days. We do not promise any other deletion periods for these providers.

14. Account deletion

You can delete your account in the app (Profile → Delete account) or request deletion without installing the app at https://pawhelp.app/delete-account. What is deleted, what is kept and why is described in the "Account Deletion" document.

15. Your rights

Under Art. 24 of the Law you have the right to:

• know whether we process your data and receive information about the purposes, sources, methods of processing, the list of data and retention periods;
• have your data changed and supplemented;
• have unlawfully processed data blocked, anonymised, destroyed or deleted;
• withdraw consent to collection, processing, distribution in publicly available sources, transfer to third parties and cross-border transfer, except where withdrawal contradicts the laws of the Republic of Kazakhstan or an obligation remains unfulfilled (Art. 8(2));
• give or refuse consent to distribution in publicly available sources;
• protection of your rights, including compensation for harm;
• access your data free of charge;
• appeal against our actions to the authorised body (Information Security Committee of the Ministry of Artificial Intelligence and Digital Development of the Republic of Kazakhstan) or a court.

Response times:

• information about your data, or a reasoned refusal — within 3 working days (item 16 of the Rules for the Collection and Processing of Personal Data);
• changing, blocking, destroying or deleting data on confirmed grounds — within one working day (Art. 25(2)(8) of the Law);
• stopping processing after consent withdrawal, or a reasoned refusal — within 15 working days (Art. 8(7) of the Law).

Send requests to privacy@pawhelp.app from the email address of your Google account, or state that address in the request, so we can confirm the data is yours.

16. Withdrawing consent

You can withdraw consent by:

• deleting your account;
• sending a request to privacy@pawhelp.app.

Processing account, report and chat data is necessary for the app to work. Without it, and without the transfer of data to Firebase Authentication (United States), PawHelp cannot be used. Withdrawing consent to processing or to cross-border transfer therefore means ending use of the service and deleting the account, except for records we must or may keep under section 13.

17. Other people's data

Do not post faces, phone numbers, addresses, or car or house numbers of other people in reports, photos or messages. We do not automatically check photos or text. If you find your data in someone else's report, report it in the app (reason "Shares personal information") or write to privacy@pawhelp.app. You can do this without a PawHelp account.

18. Changes and languages

Each edition has a version number. After material changes the app will ask you to review and accept the new edition; you cannot continue using the app without doing so.

This policy is published in Russian, Kazakh and English. If the texts differ, the Russian text prevails.

References

• Law of the Republic of Kazakhstan No. 94-V of 21 May 2013 "On Personal Data and Their Protection" (Arts. 1, 7, 8, 12, 15, 16, 18, 24, 25): https://adilet.zan.kz/rus/docs/Z1300000094
• Law of the Republic of Kazakhstan No. 326-VIII of 24 June 2026 (amendments to Law No. 94-V, including Arts. 1, 8, 12, 18, 24, 25; the personal data amendments entered into force on 25 August 2026, other provisions of the Law have different dates): https://old.adilet.zan.kz/rus/docs/Z2600000326
• Rules for the Collection and Processing of Personal Data (Order No. 395/НҚ, reg. No. 21498; items 6, 6-3, 11, 16, 25), current version: https://old.adilet.zan.kz/rus/docs/V2000021498
• Order No. 556/НҚ of 17 September 2026 amending the Rules for the Collection and Processing of Personal Data (Order No. 395/НҚ), officially published on 21 September 2026, in force since 2 October 2026; the amendments are reflected in the version of the Rules linked above.
• Order No. 524/НҚ of 31 August 2026 (in force since 19 September 2026; amendments to Order No. 199/НҚ on the necessary and sufficient list of personal data). A separate act: it does not replace or amend the Rules for the Collection and Processing of Personal Data: https://old.adilet.zan.kz/rus/docs/V2600039799
• Google Play — User Data: https://support.google.com/googleplay/android-developer/answer/10144311
• Google Play — Account deletion: https://support.google.com/googleplay/android-developer/answer/13327111
• Google Play — User Generated Content: https://support.google.com/googleplay/android-developer/answer/9876937
• Firebase — Privacy and Security: https://firebase.google.com/support/privacy/
• Firebase Data Processing and Security Terms (Section 10 "Data Transfers", Section 11 "Subprocessors"): https://firebase.google.com/terms/data-processing-terms/