Security

Last Updated August 16, 2026

Pet health records are personal. Vaccine dates, medications, allergies, notes from your vet — that information belongs to you and your family, and MyPetVault is built around that idea. This page explains, in plain language, how we protect your account and the information you store with us.

MyPetVault is still in active development. The practices below describe what the app does today. When we add new protections, we will update this page and note the date at the top.

Security is an ongoing practice, not a fixed checklist. The technical measures described below reflect our current setup and will evolve over time as the threat landscape changes and our infrastructure matures. We may add, remove, or change individual safeguards without amending this page.

At a glance

Your vault is a locked box.

You choose when to open a small door. A clinic can drop records in. A vet, sitter, or family member can use a link you send. When the time is up, or when you turn it off, the old code stops working.

A drop-off door

Someone can send records in, but they cannot open the rest of your pet's vault.

Keys expire

An email can stay in an inbox, but the link inside is built to stop working.

You can close it

Turn sharing off or make a new code, and the old one no longer opens.

You check what gets saved

New records wait for you to review them before they go into your pet's profile.

1. How We Protect Your Account

1.1 Passwords

Password sign-in is handled by Supabase Auth, our authentication provider. Your password is never stored in MyPetVault's own application database, is never transmitted or displayed in plaintext, and no one on our team can see it. Supabase Auth stores only a hash produced by an industry-standard password-hashing function and compares your entry against that hash when you sign in. If the authentication store were ever compromised, attackers would find hashes, not passwords. We also enforce password complexity requirements when you choose a new password.

1.2 Sessions

After you sign in, the app or website uses a signed bearer session token that the server verifies on every protected request, which means tokens cannot be tampered with or forged. Website login stores the Supabase access and refresh tokens in that browser so the session can survive navigation and refresh safely. If a token is invalid, expired, or revoked, the protected request is rejected.

1.3 Rate Limiting

Sign-in, sign-up, and general API requests are rate-limited to levels consistent with industry guidance to defeat credential-stuffing and brute-force attacks. We do not publish specific thresholds because doing so would simply tell an attacker their budget.

1.4 Where Sign-In Lives

Account creation and the main account experience live inside the mobile app. The website offers email-and-password, Apple, and Google login for limited account actions such as redeeming a promotional code. We use Supabase Auth as our authentication processor. When you choose Apple or Google, that provider confirms your identity and we never receive the password for that provider account. Website social login uses a one-time PKCE authorization code; its temporary session is kept separate until our API confirms that it belongs to an existing MyPetVault account and applies the same email-verification and legal-consent checks used by the mobile app. Multi-factor sign-in is on our roadmap but not yet available.

Password recovery at /forgot-password and /reset-password uses a verified recovery link and requires its recovery marker even if the browser already has an ordinary login session. The reset flow calls signOut() the moment your new password is saved. Website login is separate: it deliberately keeps the Supabase session in that browser until you sign out, the session expires or is revoked, or you clear browser storage. A promotional redemption request sends only the current access token and the code you entered to our backend; the backend must validate the token before granting anything.

1.5 The Launch Waitlist

Before the app is published, the marketing site offers a launch-notification form. If you enter your email there, it is written to a single table in our Supabase project and used only to email you when MyPetVault launches. The form uses a publishable (anon) key whose database permissions are insert-only: it can add your address to the list but cannot read, change, or delete it, so the public site can never pull the waitlist back out. Repeat sign-ups are de-duplicated, and the form is guarded by a hidden honeypot field plus database-level checks on the address format and length to limit automated abuse. Your waitlist email is kept separate from any app account you may later create, is never sold, and is never added to advertising audiences.

You can ask us to remove your waitlist email at any time by writing to support@mypetvault.org.

2. How We Protect Your Data

2.1 Transport

All traffic between your device, our marketing site, and our API is carried over HTTPS using modern TLS. We use HSTS preload so that compliant browsers will refuse to connect over plain HTTP at all. Requests that arrive without TLS are rejected.

2.2 Storage

Structured records (visits, medications, vaccination entries, reminders, and similar data) are stored in a Postgres database managed by Supabase. Uploaded files — documents, clinic uploads, rabies certificates, avatars, and cloud Memories — are stored in private Cloudflare R2 buckets. These are separate systems: each encrypts data at rest and traffic to each is carried over TLS, but they are not one shared encryption boundary. Cloudflare R2 encrypts both objects and their metadata at rest. Each document is also associated with a content hash. We use that hash to avoid re-running document extraction on a file we have already processed for your account; it does not prevent duplicate copies of a file from being stored, so uploading the same file twice stores it twice and counts against your storage both times.

2.3 Access Controls

Only the application code that needs to read or write your records can do so, and only in the context of a request authenticated as you. Employees do not have routine access to customer data. Any access for debugging or support is limited to what is necessary and is never used for marketing, profiling, or model training.

2.4 Third-Party Risks

Our Services rely on third-party infrastructure providers (hosting, database, storage, analytics, authentication, AI). We exercise reasonable care in selecting providers but we do not control their internal security practices. A security incident at one of our providers could affect data we have entrusted to them, despite our safeguards.

2.5 No Guarantees

No method of electronic transmission, storage, or processing is 100% secure. While we use commercially reasonable safeguards, we cannot guarantee absolute security and you use the Services at your own risk.

3. Document Extraction and Google Gemini

Plain-English disclosure: When you upload a document to MyPetVault, its contents are sent to Google's Gemini API so that Google can read the document and return structured data (for example, extracting a vaccination name and date from a vet receipt). The structured prompt we send alongside the document includes an internal identifier for the pet the document belongs to; it does not include your email, your name, your address, or your subscription tier. We do not, however, modify, redact, or strip the document itself before sending it. Vet receipts, prescriptions, vaccination cards, and similar documents commonly have personal and contact information printed on them — for example, the pet owner's name and address, the veterinarian's name and clinic, phone numbers, and email addresses. Whatever is printed on the document is part of what Google receives. If you do not want a particular piece of information to leave our system, you can either redact it on the document before uploading, skip the upload entirely and enter the record manually, or contact us to discuss alternatives. Google processes the request under its own API terms and privacy practices.

Once Google returns the extracted fields, MyPetVault presents them to you as candidate records, card by card, and you review and confirm each one before a health record is saved to your pet's profile. Document details such as a suggested title, date, or category may be filled in for you automatically, but extracted health records wait for your confirmation.

If you would prefer not to have a document processed by Google Gemini, you do not have to upload it. You can always enter records (visits, medications, vaccinations, weights, allergies) manually in the app. Manual entry never sends your data to Google Gemini or any other document-extraction provider. Manually entered records are still stored and processed by our infrastructure providers — our API and background processing run on AWS, and our database is managed by Supabase.

For the full list of what data is handled and by whom, see our Privacy Policy.

4. Sharing Records Through Limited Links

4.1 One-Way Upload Links

Inside the app, you can invite someone — a veterinary clinic, a family member, or a friend — to send records straight into one of your pets' profiles without giving them any access to your account. You create a secure upload link, which the app can also display as a QR code so a clinic can open it by scanning. Each link is built around a few deliberate limits:

Time-limited. Every link expires 30 days after it is created. Once it lapses, the link stops working and can no longer be used to upload anything.
Closable. You can turn a link off or rotate it at any time, and the old link stops working right away.
Scoped. A link applies only to the specific pets and record types you choose when you create it. Whoever opens it can add records to those pets and nothing else, and cannot see or browse the rest of your account.
Upload-only. The link grants permission to add a document, not to read, change, or delete anything you already have. It carries no session and never signs the holder in to your account.
Capped. Each link limits how many files and how much total data can be sent through it.
Held for your approval. Anything sent through a link arrives marked as pending and is not added to your pet's records until you review and approve it. You can decline it, and the sender can withdraw it before you review it.

Before submitting, the person uploading is asked to confirm that they are sending the records at your request or with your authorization. The upload page is built to reveal as little as possible: it is hidden from search engines, sends no referrer, and is served fresh on every request without caching. The link itself is an opaque token — the website never decodes, stores, or logs it; it is handed directly to our API, which is the only place that resolves what the link is allowed to do.

For how an uploaded record is stored and what we log about an upload (such as the uploader's label, the time, and the originating IP address, kept for audit and abuse protection), see Section 2 above and Section 2.5 of our Privacy Policy.

4.2 Temporary Download Links in Record Emails

When you send records by email with Plus, original files can be attached directly or included as secure download links instead of treating someone's inbox like permanent storage. Download links expire automatically 2 days after they are created. The message may stay in an inbox, but the key inside is temporary.

These outbound download links work differently from the upload links in Section 4.1: they cannot currently be revoked or regenerated individually before they expire. If you need access to end sooner, deleting the underlying document from your vault stops the link from serving it. If a recipient already downloaded or saved a copy outside MyPetVault, we cannot remove that local copy from their device or inbox; expiration prevents future access through our link, not access to copies already made.

5. What We Do Not Do

Some security protections come from things we structurally do not do. MyPetVault does not:

Use session replay tools, full-keystroke recorders, or screen-capture instrumentation that would let us reconstruct your interactions with the app.
Fingerprint your device using browser, OS, or hardware characteristics in an attempt to identify you across other apps or websites that are not ours.
Sell, transfer, or otherwise disclose payment-card data to third parties — payment processing happens entirely inside Apple App Store or Google Play and we never see your card details.
Read or process documents you have not uploaded — manual record entry never sends data to our document-extraction provider.
Handle your password outside of sign-in. Passwords are managed by Supabase Auth; we never store, transmit, or display your password in plaintext, and no one on our team can see it.

What we may do — including using analytics inside the app and working with advertising partners — is described in our Privacy Policy. The Privacy Policy is the authoritative description of our data practices and may be updated from time to time as the Services evolve. Where applicable law gives you a right to opt out of any of these practices, the Cookie Settings page and the Data Rights page describe how to exercise that right.

We do collect anonymous web analytics on the marketing site for visitors from the United States and Canada, automatically, in line with the opt-out privacy frameworks those jurisdictions use. Analytics are processed in PostHog's and Google Analytics' US regions. The Tech Blog may also load Google AdSense for ads. We do not load analytics or AdSense for visitors with Do Not Track or Global Privacy Control enabled. See Privacy Policy Section 11 for what is collected and the Cookie Settings page to opt out at any time.

6. Reporting a Security Issue

If you believe you have found a security vulnerability in MyPetVault, we would like to hear about it. We support responsible disclosure and will not take legal action against researchers who act in good faith, avoid privacy violations, and give us a reasonable window to investigate and fix the issue before public disclosure.

Please email support@mypetvault.org with the subject line Security disclosure and include:

A clear description of the issue and its potential impact.
Steps to reproduce, or a proof of concept if you have one.
Any relevant URLs, request payloads, or screenshots.
How you would like to be credited, if at all.

We aim to respond to security reports as soon as practicable and will keep you informed throughout our investigation.

We also publish a security contact in /.well-known/security.txt per RFC 9116.

7. Questions

If you have general questions about how MyPetVault handles your data, the Privacy Policy and Data Rights pages are the best starting points. You can also reach us at:

Iterrum LLC
Email: support@mypetvault.org
Mailing address: 9528 Miramar Rd, Unit 6207, San Diego, CA 92126, United States