Privacy Policy

Version 1.2 — Last updated 17 August 2026

What changed in version 1.2

• We added a "report missing" feature: if a sitter opens your shared link and your pet goes missing, they can send you the details (last seen location, date and description) by email. We spelled this out in section 4, and don't store what's entered beyond what's needed to send that one alert.
• We added Resend, the provider that delivers our transactional emails (sign-in codes and missing-pet alerts), to our service providers (section 5).

The full record of changes between versions is on our change history page.

This policy explains what information Quirks & All collects, why, and what you can do about it. Quirks & All is operated by Monica Rattanong trading as Its Hypothetical (ABN 22 525 634 531) ("we", "us").

Signing up for updates (this website)

If you give us your email address on this site, we use it to tell you when Quirks & All launches and to send occasional updates — things like new guides, handover tips, and product news. We don't sell or share your address, and we won't send you anything you didn't sign up for. Every email identifies us as the sender and carries a working unsubscribe link; you can opt out at any time by clicking it or by contacting us at quirksandall@itshypothetical.com, as required under the Australian Spam Act.

1. Information we collect

Information you give us

• Account details — your name, email address and phone number. Your email signs you in; your name and phone appear on missing-pet posters you generate.
• Pet profiles — name, breed, date of birth, sex, weight, colour and markings, microchip number, photo, commands, quirks, escape risk, allergies, routine, medications and conditions.
• Emergency contacts — vet, after-hours clinic, insurer and backup contacts you choose to add, including which of them you nominate as a decision contact. These sit behind a PIN you set.
• Documents you upload — vaccination and parasite-treatment certificates, stored as images or PDFs. These are visible only to you and are never shown to anyone opening a share link. Certificates issued by a veterinary practice often carry your name, address and contact details in the clinic's own layout. We store the file as you upload it and can't edit or remove what's printed on it.
• PINs — stored hashed, so we can check them without holding the raw value.
• Roadmap suggestions — if you submit a feature suggestion on our marketing website, we collect the text you provide.

Information collected automatically

• Technical and usage data — device type, operating system, app version, and how the app is used: which screens are opened, which features are used, and where people stop during setup. We use this to fix problems and improve the Service.
• Share link activity — when a link you created was last opened, shown to you so you know your sitter has seen it.
• Failed PIN attempts — the time and IP address of failed attempts on a share link, kept to prevent guessing attacks and shown to you as a count. We don't record who made them.

Information from other people

When you add someone else's details — a backup contact, your vet — you're giving us their information. Please only do that where you have their permission or another lawful basis.

2. How we use information

We use it to:

• run the Service — store your pet's profile and show it to people you share a link with;
• keep your account and your emergency details secure, including PIN checks and rate limiting;
• process your purchase and remember that you've made it;
• understand how the app is used so we can improve it;
• classify and prioritise feature suggestions submitted on our marketing website;
• respond to you when you get in touch;
• meet our legal obligations;
• where you've switched it on in Settings, send you occasional offers from pet insurance partners. This is off unless you turn it on, you can turn it off at any time, and we don't share your account details, your pet's information or your emergency contacts with those partners in order to do it.

We don't sell your personal information, and we don't use it for third-party advertising.

3. Sharing your pet's profile

The Service works by generating a link that shows your pet's profile. Anyone with that link can see the parts of the profile that aren't behind your PIN. Emergency contacts sit behind the PIN.

You decide who gets a link, and you can revoke any link at any time — it stops working immediately. On a paid plan you can run several links at once and revoke them individually.

We can't control what someone does with information after they've seen it. Revoking a link stops future access; it doesn't undo what's already been read or saved.

Uploaded documents are never shown on a shared link. They're visible only to you in the app.

4. If someone has shared a link with you

You don't need an account to open a Quirks & All link, and we don't ask you to create one. A small amount of information is still involved:

• If the link is protected by a PIN, we store a token in your browser for 30 days so you're not asked to re-enter it every time. Clearing your browser data removes it. If the owner revokes the link, it stops working immediately regardless.
• We record when the link was last opened, and show that to the person who shared it with you.
• We count each time the link is opened, using our analytics provider (Mixpanel), so the owner can see it's been viewed and so we can measure how the Service is used. This is anonymous — you don't have an account and we don't try to identify you — and a small random identifier is stored on your device so the same visit isn't counted twice. Mixpanel processes this in the European Union (see section 10).
• If a PIN is entered incorrectly, we log the time and IP address to prevent guessing attacks, and show the owner a count of failed attempts. We don't record who made them.
• If you use the "report missing" feature, we send the details you enter (last seen location, date and description) directly to the owner by email, along with a link back to the profile. We don't store this beyond what's needed to send that one alert.

The pet information you see belongs to the person who shared the link. They decide what it contains and can revoke your access at any time. If you have questions about that information, speak to them.

5. Service providers

We use a small number of providers to run the Service. They only handle information as needed to provide it to us.

• Supabase — database, authentication and file storage for your account, pet profiles, photos and uploaded documents.
• Vercel — hosting for our website and for the shared profile pages your links open.
• Expo — infrastructure for building and updating the mobile app.
• Mixpanel — product analytics, to understand how the app is used and where it can be improved.
• Sentry — crash and error reporting for our mobile app. When the app hits an error, Sentry receives technical diagnostic information — device type, operating system, app version and the technical details of what went wrong — so we can find and fix it. We don't send your pet profiles, emergency contacts or uploaded documents to Sentry.
• Resend — delivers our transactional emails: sign-in codes and missing-pet alerts.
• Apple App Store and Google Play — to process your purchase. We don't receive your full payment details.
• RevenueCat — to verify and manage purchase entitlements.
• Anthropic — classifies themes in feature suggestions submitted on our marketing website, to help us prioritise what to build. No pet, account or emergency-contact data is sent — only the suggestion text itself, and the output is used internally by us, not shown to any user.

6. Security

We take reasonable steps to protect your information. PINs are stored hashed rather than in plain text. Emergency contacts are only returned to a device that has entered the correct PIN. Failed PIN attempts are rate limited. Uploaded documents are served through short-lived, signed links rather than public URLs. Photos and documents you upload have location and other identifying metadata (EXIF data) automatically removed before storage.

No system is completely secure, and we can't guarantee absolute security. Keep your account login and any PINs you set reasonably private, and share links only with people you trust.

7. Data retention

We keep your information for as long as your account is active.

When you delete a pet, a document or your account, we delete the associated data within 30 days. Deleting a pet or your account invalidates its share links immediately, so they stop working straight away even while the underlying data is being removed.

Failed PIN attempt records are kept for 30 days, then deleted.

We may keep limited information for longer where we're legally required to — for example, records relating to a purchase.

Missing-pet posters are never stored. Each one is generated at the moment you ask for it and sent straight to you. There's no copy on our servers, which also means a poster always reflects your pet's current details rather than an older saved version.

8. Your rights

You can access, correct or delete most of your information directly in the app. You can also ask us to:

• give you a copy of the information we hold about you;
• correct anything that's wrong;
• delete your information;
• restrict or object to how we use it;
• withdraw consent you've given, such as the insurance offers setting.

Email us at quirksandall@itshypothetical.com and we'll respond within a reasonable time and in line with the law that applies to you.

If you're in Australia and our response hasn't resolved things for you, the Office of the Australian Information Commissioner (oaic.gov.au) is available to help. If you're in the EEA or UK, your local data protection authority can assist in the same way.

9. Children

The Service isn't directed at children. You must be at least 16, or the age of digital consent where you live, to use it. We don't knowingly collect personal information from children — if you believe a child has given us information, contact us and we'll delete it.

10. International transfers

Our providers may store and process information outside Australia, including in the United States and the European Union. Our product analytics provider (Mixpanel) is configured for EU data residency, so analytics data is stored and processed in the European Union. Where information is transferred out of a jurisdiction with data protection laws, we rely on our providers' standard contractual clauses and take reasonable steps to make sure it receives an equivalent level of protection.

11. Changes to this policy

We may update this policy. If we make material changes we'll update the date above and, where appropriate, let you know in the app. See our change history for a record of what's changed between versions.

12. Contact

Questions about this policy, or want to exercise any of the rights above? Email quirksandall@itshypothetical.com.