Security at Dana: who can see your pet’s record

Access is a role, not a password you pass around

Everyone you invite gets their own account and their own role. An owner runs the pet, a caregiver logs care, a limited caregiver sees only the parts you pick. Nobody shares a login, so nobody has to change one when a sitter moves on.

That separation is enforced on the server, per row, not by hiding buttons in the app. A request for a pet you have no role on does not come back empty; it does not come back at all.

Access that ends without you remembering

Sitter access can carry an end date and close itself. This exists because the usual failure is not a break-in, it is a permission nobody revoked: the dog walker from two summers ago is still on the account, and nobody has thought about it since.

Invites and ownership transfers expire on their own for the same reason. A link that lives forever is a link that eventually reaches someone you did not mean.

You can read the access history

Invites, accepted invites, removals, role changes and ownership transfers land in one account activity feed with who and when. A shared account is only trustworthy if you can answer "who was let in, and when" without asking anyone.

What is encrypted, plainly

Traffic between the app and Dana runs over HTTPS. The managed database and file storage encrypt at rest. On your phone, credentials sit in the operating system’s own secure storage rather than in a file the app invented.

That is the honest extent of it. Dana does not claim end-to-end encryption, because it would not be true: the server processes your records to send reminders, resolve shared timelines and answer AI checks.

Some things never leave your phone

The walk summary estimates how far you moved, not just the dog. That number is worked out on your device from the walk you just finished and stays there — never uploaded to Dana, never sent to analytics. It is your health data, and the cheapest way to protect it was to never collect it.

Getting your data out, or getting rid of it

Export everything, or delete the account, from inside the app on every tier including the free one. Deletion is a real deletion on a stated schedule rather than a flag that hides the rows, and there is a web page for it too, because someone who has already uninstalled the app still needs the door.