Privacy Policy

1. Who is responsible

HIHITEAM is the data controller for the Petnunu account system, the pet store, the coin wallet, pet care, the community forum and Petnunu Studio.

The macOS app runs offline with its built-in pets and needs no account. You only send us data once you sign in and use an online feature.

Write to HIHITEAM, Viet Nam, or email [email protected].

2. Our representative in the EU

We are established outside the European Economic Area but offer Petnunu to people in it, so we have appointed a representative under Article 27 of the GDPR: Viet Nam.

If you are in the EEA you can contact our representative about anything in this policy, in your own language, instead of writing to us directly. Supervisory authorities may address them as well as us.

3. The short version

• We collect what an account needs: your email address, your display name, and what you do inside Petnunu.
• We never see your password — only an argon2id hash of it.
• We never see your card number.
• We use Google Analytics to understand how Petnunu is used — on the website only if you allow it, and you can change your mind at any time. It never receives your name, your email or anything you write.
• No advertising, no profiling, and we never sell your data.
• You can delete your account yourself, and everything listed under "Deleting your account" goes with it.

4. What we store on our servers

• Account — your email address, your display name, an argon2id hash of your password, the date you signed up, and flags for whether the account is banned or allowed to sell pets.
• Sessions — a SHA-256 hash of each login token with its creation and expiry time. The token itself only exists on your device; the macOS app keeps it in the Keychain.
• Coin wallet — your balance, plus one ledger entry for every change: amount, reason (purchase, earn, feeding, generating, refund…) and time.
• Free-coin log — which daily check-in, mission or achievement you have already claimed, by day, so rewards cannot be farmed twice.
• Pets — each pet you adopt: its name, level, XP, streak, prestige rank and the days you last fed or petted it.
• Pets you own — which pet packs are unlocked on your account, when they were unlocked, and which one is active or marked as favourite.
• Pet packs you upload — the files themselves (PNG, JSON, WAV), plus name, description, version, preview image, size, download count, review status and, if a moderator rejected the pack, the reason.
• Community activity — your comments on pet packs, your likes, your forum topics and replies (stored as plain text, exactly as you typed them) and your upvotes.
• Reports you send — what you reported, the reason you wrote, and whether a moderator has dealt with it.
• Generator jobs — the prompt you typed, the animal and settings you chose, the coin cost, the status, the engine log and the resulting pet.
• The photo you upload to Studio, if you use a version that builds a pet from one — held only while the job runs, then deleted, on our server and on the machine that ran it. What stays behind is the pet, the prompt and the record that the job had a photo; the photo itself does not.
• Top-ups — the coin pack, amount and currency, the payment status, the reference the payment provider gave us, and the time. No card number, no bank details.

5. What we do not collect

• No advertising identifiers. The app does not use IDFA and never asks for tracking permission; Google’s advertising signals are switched off on the website.
• No tracking of you across other apps or websites, and nothing we send to Google Analytics is tied to your Petnunu account.
• No precise location. To choose a currency we read the country code that our network provider adds to the request (for example "VN"); we use it for that request only and do not store it.
• No card numbers, security codes or bank details — those go straight to the payment provider.
• No contacts, photo library, calendar, microphone or camera. The app never asks macOS for access to your Photos — the only picture we ever receive is one you pick yourself for Petnunu Studio, and that one is covered above.
• No screen content. The macOS app does not use the Accessibility or Screen Recording permissions and cannot read your screen or other apps.
• No real name, postal address or date of birth.

6. Analytics

We use Google Analytics 4 on the website and in the desktop apps — macOS, Windows and Linux — to understand how many people use Petnunu and which parts they use. This helps us decide what to build next.

On the website we ask first. Until you choose, Google’s script is not loaded, no request goes to Google and no analytics cookie is set. Say no and it stays that way; say yes and you can take it back at any time with "Cookie choice" at the bottom of any page — we then delete the analytics cookies we set. Your choice is remembered in your browser, so it is per browser and per device. In the desktop apps analytics is on and there is no switch yet.

On the website we send: which page you opened — as a pattern such as /packs/:id rather than the real address, so the name of a pet pack or the title of a forum topic never reaches Google — and a few product events: adopting a pet (its coin price, and whether it was free), creating a forum topic (which category), clicking the download button, and signing up or logging in (the fact that it happened, never your email).

In the desktop apps we send: which operating system you are on, opening the app (app version, system version, your language and how many pets you have), adopting a pet, finishing a focus session (how many minutes), opening the Shop, Studio or Settings, installing a pet pack, and purchase attempts and failures — how many coins were involved and a short failure code, never a real amount of money, a transaction id or a receipt.

The app identifies itself with a random ID it generates on first launch and stores on your Mac. It is not your device serial number, not an advertising identifier and not your Petnunu account — we cannot use it to work out who you are.

Each event also carries technical values that let the numbers add up: the time the event happened, a session marker (a new session starts after 30 minutes of inactivity), how many sessions you have had on that device, and how long the app was actually in use since the previous event. Time while your Mac is asleep is not counted.

If your Mac is offline, events wait in a small file on your own disk and are sent later — at most 200 events, and never older than 72 hours. Nothing is queued while analytics is switched off in a build.

Google also receives what any web request reveals: your IP address and your browser or app user agent. On the website Google Analytics sets a cookie named _ga, which recognises the same browser across visits. Google’s advertising features are switched off, so this data is not used to build an advertising profile of you.

Analytics never receives your email address, your display name, your Petnunu account id, your login token, the names you give your pets, what you type into Petnunu Studio, or anything you write in the community.

Google Analytics is operated by Google. What Google does with the data it receives is governed by Google’s own privacy policy.

7. Cookies and what the website stores in your browser

The Petnunu website uses very little. Almost everything below is browser storage rather than cookies, which means it is never attached to a request and never travels to another site.

Needed for the site to work at all — without these you cannot stay signed in or keep your language:

• propet_user_token — your login token, in local storage. Removed when you sign out.
• propet_user — a copy of your display name, email and coin balance so the page can render before the first request comes back. Removed when you sign out.
• petnunu_locale — the language you picked.
• propet_admin_token — only ever set on an administrator’s browser.
• A short-lived session cache of the changelog and the latest release number, and the id of the Studio job you are watching, so a refresh does not lose it.

Analytics — not needed for the site to work, and only ever set if you say yes:

• _ga and _ga_<id> — set by Google Analytics 4 to recognise the same browser across visits and to count sessions. They last up to two years and hold a random number, not your account.
• petnunu_analytics_consent — your answer to that question, with the date you gave it. This one is set either way, because remembering "no" is the only way to stop asking.

We ask before the first analytics cookie is set, the two answers are equally easy, and saying nothing counts as no. To change your answer later, use "Cookie choice" at the bottom of any page; if you switch to no, we delete the analytics cookies we set.

You can also delete everything through your browser (“clear site data”), or block it with an extension. Clearing site data signs you out and makes us ask about analytics again; nothing else breaks. The desktop apps set no cookies — what they store on your own machine is listed further down.

8. Data that stays on your Mac

• Your login token, in the macOS Keychain.
• App settings, the pets placed on your desktop, focus and Pomodoro sessions with their statistics, and the pet pack files you have installed.
• The list of creators you have blocked. That list is per-Mac and never leaves your device.
• A small analytics queue — usage events waiting to be sent while you are offline, held for at most 72 hours.

Removing the app removes this local data. We hold no copy of it.

9. IP addresses and server logs

Our rate limiter — the thing that stops password guessing and comment floods — keys on the IP address in the request. It lives in memory for the length of the window (a minute, or an hour) and is never written to the database.

The country code used to pick a payment gateway comes from a header added by our network provider and is used for that one request.

As with any website, our hosting provider and network provider keep short-lived technical logs (IP address, time, path, error) so the service can be operated and abuse investigated.

10. Why we use your data, and on what basis

• To provide what you asked for — signing in, unlocking pets, feeding them, posting, generating (performance of our contract with you).
• To keep Petnunu safe — moderation, reports, rate limits and bans (our legitimate interest in a safe service, and our legal obligations).
• To take payment and keep a record of it (contract, and accounting or tax law).
• To answer you when you write to us (legitimate interest).
• To fix bugs and improve the product based on what actually breaks (legitimate interest).
• To measure how Petnunu is used, through Google Analytics — on the website, your consent, asked before anything loads and withdrawable at any time; in the desktop apps, our legitimate interest in knowing which parts of the product are worth building.

Where we rely on a legitimate interest, we have weighed it against your privacy: we collect no identifiers, run no advertising and build no profile. You can object to processing based on legitimate interest — see "Your rights".

We do not use your data for advertising and we do not sell it. We do not make automated decisions with legal effects about you. The generator does filter prompts automatically, but the only consequence is that a prompt is refused and you can write another.

11. Who else sees your data

• Apple — if you install from the Mac App Store, or buy coins through an in-app purchase. Apple runs the payment and passes us only a transaction id and a product id; Apple’s own privacy policy covers what Apple holds. In-app coin purchases are switched off in version 1.0.
• Dodo Payments — merchant of record for card payments on the website. You enter your card on their page; we receive only a reference, an amount and a status.
• Our hosting and network providers — they run the servers and carry the traffic.
• Cloudinary — where cloud storage is enabled, public pet pack files and preview images are mirrored to their CDN so downloads are fast. Only public artwork goes there, never account data.
• The AI providers behind Petnunu Studio — Anthropic, which turns your prompt into a recipe, and OpenAI or Stability AI, which draw the frames. What reaches them is the prompt you typed and, if you uploaded one, the photo. Not your email, not your name, not your account.
• The people who run our generator machines — a Studio job does not run on our server. It runs on a computer belonging to someone we have given a runner key to, and your prompt and, if you uploaded one, your photo are copied there for the few minutes the job takes and deleted when it ends. They receive the job and nothing about your account.
• Authorities — only where we are legally required to, and only as far as required.

Payment by VietQR is not available yet and we do not currently use Stripe. If that changes, this policy changes with it.

12. What other people can see

• Your display name appears next to any pet pack, comment, forum topic, reply or leaderboard entry of yours.
• Your email address is never shown publicly.
• The leaderboard shows display names and pet power, nothing else.
• Anything you post is public, so please do not put personal details into a comment or a forum post.

13. How long we keep things

• Account data — while your account exists.
• Sessions — they expire after 30 days, and are deleted when you sign out or delete your account.
• Content you post — until you or a moderator deletes it, or you delete your account.
• Top-up records — deleted together with your account. Your payment provider (Apple or Dodo Payments) keeps its own record of the transaction under its own rules.
• Generator job records — the prompt, settings and engine log are kept while your account exists, so we can run and debug the generator; they are deleted together with your account.
• Server and network logs — short-lived, kept only for operating the service and investigating abuse.

14. Deleting your account

In the app: account menu ⋯ → Delete Account…. On the website: your account menu. It cannot be undone, and there is no grace period.

Deleting the account immediately and permanently removes:

• your user record — email address, display name and password hash;
• every login session, on every device;
• your coin wallet, its full ledger, your top-up records, your free-coin log and your coin migration record;
• the pets you had unlocked, together with active and favourite markers;
• your likes, your comments and the reports you sent;
• your forum topics — with every reply and vote on them — and your replies and votes elsewhere;
• every pet you adopted, along with its name, level and raising progress;
• the pets you asked Petnunu Studio to draw, including the descriptions you typed;
• the pet packs you published, including their files in our storage.

One honest note: copies of a public pet pack that other people already downloaded to their own Macs are beyond our reach.

Coins are not refunded when an account is deleted.

15. Your rights

Depending on where you live, you can ask us to:

• tell you what data we hold about you, and give you a copy;
• correct data that is wrong;
• delete your data;
• export your data in a portable form;
• restrict or object to certain processing;
• withdraw consent where our use of your data relies on it.

You can already do a lot yourself, without asking: delete your own comments, forum topics and replies, delete pet packs you uploaded, and delete the whole account.

For anything else, email [email protected]. We answer within one month, free of charge; for a complicated request we may take up to two months more and will tell you why within the first month. We may ask you to confirm you control the account’s email address before we hand over a copy of your data.

If you are in the EEA, you can also complain to the data protection authority of the country where you live, work, or where you think something went wrong — you do not have to come to us first. In the UK that authority is the Information Commissioner’s Office. Wherever you are, you can go to court.

16. How we protect your data

• Passwords are hashed with argon2id and never stored in readable form.
• Login tokens are random 256-bit values; the server keeps only a SHA-256 hash, so a leaked database does not leak working tokens.
• Traffic between the app or the website and our servers goes over HTTPS.
• Uploaded pet packs are validated before they are stored: PNG, JSON and WAV only, no symlinks, no path traversal, no executable code.
• Downloading a pack requires a short-lived signed token — there are no public download links.
• Payment webhooks are verified with a signature, compared in constant time.
• Banning an account takes effect on the next request, and signing out revokes the session immediately.

No system is perfect. If you find a security problem, please write to [email protected] before telling anyone else, and give us a reasonable chance to fix it.

17. If there is a data breach

If personal data we hold is exposed, we investigate at once and fix the hole first. Where the law requires it — in the EEA that means within 72 hours of becoming aware — we notify the competent supervisory authority, and where the breach is likely to put you at high risk we tell you directly and plainly: what happened, what data was involved, what we have done and what you should do.

Found a hole yourself? [email protected], please, before telling anyone else.

18. Children

Petnunu is not intended for children under 13, and we do not knowingly collect data from them.

In the EEA the age at which a child can agree to an online service on their own is set nationally, anywhere from 13 to 16. Where your country sets it higher than 13, a parent or guardian has to consent for a child below that age, and we act on any report that one has signed up without it.

If you believe a child under 13 has created an account, write to [email protected] and we will delete the account and its data.

19. Where your data is processed

Our servers, our network provider and our payment providers may be located in a country other than yours, so your data may be processed abroad.

For personal data coming from the EEA, the UK or Switzerland this means a transfer outside that area. Google (analytics), Dodo Payments (card payments), Cloudinary (public artwork on the CDN), the AI providers behind Petnunu Studio (Anthropic, OpenAI, Stability AI), the people who run our generator machines, and our hosting and network providers are the ones involved. We rely on the safeguards those providers offer: the European Commission’s standard contractual clauses, together with the UK addendum where the data comes from the UK, or — for a provider certified under the EU–US Data Privacy Framework — that framework.

Ask us and we will tell you which mechanism covers a particular provider, and send you a copy of the relevant clauses.

20. Changes to this policy

We update this page whenever our data practices change, and update the date shown at the top. Significant changes are announced in the app or on the website.

21. Contact

For any privacy question, or any request about your data, email [email protected].