Legal

Privacy Policy

Last updated: June 5, 2026

This Privacy Policy applies to the PuppyClicker app, webapp, services and data, as well as, where relevant, anything we control under PuppyClicker branding.

1. What we collect

PuppyClicker collects the following to provide the service:

• Email address — for account login via magic links
• Device ID — to identify your device for push notifications
• Friend codes and connections — to enable clicking between friends
• Click history — messages and interactions with friends
• Sensitive information — information given to fill out your social profile, including self-declared name, gender, pronouns, and sexually sensitive information

2. How we use your data

Your data is used solely to:

• Authenticate your account
• Deliver push notifications when friends click you and when you receive comments
• Enable friend connections and messaging
• Enable access to the pound social network features

3. OpenShock integration

If you connect an OpenShock device:

• API keys: your OpenShock API key is stored encrypted and never shared
• Device IDs: stored as hashed values and not shared
• Commands: shock, vibration, and sound commands are sent directly to OpenShock's API and not logged permanently
• Safety limits: your configured limits are stored securely and enforced by our servers
• Revocation: remove your integration at any time to delete all stored API keys and device configurations

4. Data security

• All data is encrypted in transit using TLS
• Passwords and sensitive data are encrypted at rest
• We use secure cloud infrastructure providers
• We will never sell your data. We will never transfer your data to a new owner or controller except for individual users who have given explicit opt-in consent by email. If you do not opt in, your data is deleted, not transferred.
• We will never transfer PII to any third party other than as part of normal operations, except via opt-in.

5. Third-party services

We use limited third-party services:

• Push notifications: Apple Push Notification Service (APNs), Firebase Cloud Messaging (FCM)
• Analytics: PostHog — anonymous usage analytics to improve the app (no personal information)
• Cloud infrastructure: DigitalOcean, Vultr, Linode
• Email: Mailgun, Amazon SES
• App store services: Apple, Google

6. Your rights

• Access: request a copy of your data
• Correction: update inaccurate information
• Deletion: delete your account and all associated data at any time
• Export: request your data in a portable format
• Restriction: ask us to restrict processing of your data (Article 18 GDPR)
• Objection: object to processing of your data (Article 21 GDPR)
• Withdraw consent: withdraw your consent at any time (Article 7(3) GDPR); withdrawal deletes your account and associated data
• Complain: lodge a complaint with your data protection authority — the ICO in the UK, or your national supervisory authority in the EU
• Opt-in to any transfer: any transfer of your data to a new owner or controller is opt-in only, by email. If you do not opt in, your data is deleted, not transferred. No buyer, successor, administrator, trustee, or other such person inherits your data except users who have personally re-consented. This protects you against the data being sold or handed on (for example, to a match group). PuppyClicker will stay community owned by Lucy forever. :3

7. Data retention

Your data is stored securely on our servers for as long as your account is active. When you delete your account, all associated data is permanently removed within 30 seconds, and within 90 days from backups.

8. Age requirement

PuppyClicker is intended for users 18 years of age or older. By using the app, you confirm you meet this age requirement.

9. International data transfers

Your information may be transferred to and maintained on servers located outside your country. We ensure appropriate safeguards are in place to protect your data.

Some of our processors (listed in Section 5) are located in the United States, so your information may be transferred there. For users in the EU/UK, we protect these transfers using the mechanisms permitted under Chapter V of the GDPR: the EU-US Data Privacy Framework where the processor is certified, and/or the European Commission's Standard Contractual Clauses under Article 46 GDPR. You may request a copy of the relevant safeguards by emailing privacy@boundfire.com.

10. Advertising

We will never use your data to target you with advertising material.

11. Legal basis (GDPR)

Legal basis (EU/UK users): your profile information — including gender, pronouns, and sexually sensitive information — and your OpenShock command data are special category data under Article 9 of the UK/EU GDPR. L. Martinez processes it solely on the basis of your explicit consent (Article 9(2)(a)), for the sole purpose of operating PuppyClicker.

Your consent covers only this purpose and this controller. It cannot be transferred. If PuppyClicker is sold, transferred, or passes to any buyer, administrator, receiver, or trustee, your consent does not pass with it. Any new controller must obtain your fresh explicit consent, by email, before processing your data. If you do not give it, your data is erased under Article 17, not transferred.

You may withdraw consent at any time (Article 7(3)) by contacting the data controller; withdrawal deletes your account and associated data.

12. Changes to this policy

We may from time to time have to update this policy to continue providing you services. However, we commit that we will never change the terms in Section 6 (Your rights) or Section 12 (Changes to this policy) without your express written consent.

In other cases, we will provide you with 90 days' notice before any changes come into effect and an explicit opt-in in-app or via email to continue using your account. When we do this, we will provide a concise explanation of the changes.

13. Contact us

Questions about this policy or your data?

• Data controller: L. Martinez — support@boundfire.com
• Email: privacy@boundfire.com
• Discord: discord.gg/j9CQJHAheM