Privacy & Security

BackToYou exists for one job: help a finder contact an owner and get a pet home. It’s not a social network. It’s not an analytics farm. It’s not here to “monetise engagement”.

What’s public

On your pet’s public page, these fields may be visible (depending what you enter):

• Pet name, species, identity details and Lost Mode information you choose to publish
• Your public message
• Phone number and/or email (if you add them)
• Up to three photos (if you upload them)

What we store

BackToYou stores only what is required to operate the service:

• The details you enter (pet identity, message, contact information, and up to three optional photos)
• A public token (the short code printed on your tag)
• A one-way hash of the private edit secret; the secret itself is not retained in the database after migration
• Recovery code hash (so you can regain access without changing your tag)
• Lost Mode status, a broad last-seen area, last-seen time, status history, and alert preferences
• Finder messages and the contact details a finder voluntarily shares with the owner
• Queued email-alert delivery status, attempts, and errors
• For optional owner accounts: a normalised email address, display name, password hash, sign-in protection state, linked-pet memberships, and limited account security events

Owner accounts are optional. Passwords are stored only as modern one-way hashes. Existing private links and recovery codes remain valid without an account. A strictly necessary secure session cookie protects account, owner, and admin actions after authentication.

Scan logging

BackToYou logs a small amount of scan activity to help owners see if a tag has been scanned.

• We store deduplicated scan timestamps and retain them for up to 180 days.
• We retain an encrypted network address and administrator-only device string for up to 30 days. Owners never see the IP or device details.
• An owner may request authorisation for a scan location. An administrator may approve only a broad location label; the raw IP and device remain private.

Finder messages and alerts

• Finders may send a private message, an optional name, phone, email, and broad location hint.
• Finder messages are visible only in the owner portal and admin tools. They are not placed on the public pet page.
• BackToYou does not store the finder’s IP address with a message.
• Archived finder messages are retained for up to 180 days.
• Lost Mode scan alerts are deduplicated to at most one queued alert per pet per hour.
• Email delivery records are retained for operational troubleshooting and old sent records are periodically purged.

Photos

If you upload photos, BackToYou re-encodes them to remove EXIF/metadata where possible (so it doesn’t leak device/location data). Thumbnails are generated for faster loading.

Encryption

• In transit: Yes. If you access BackToYou over HTTPS, your data is encrypted between your device and the server.
• At rest: Sensitive personal fields in the SQLite database are encrypted by the application using authenticated encryption. Operational identifiers, public routing tokens, statuses, timestamps, relationships and password/recovery hashes remain queryable.

The application encryption key is stored separately in the private server configuration and must be protected with the database backups. Uploaded public pet photographs are not encrypted by the application. Server logs, mail logs and backup media require separate server-side protection. A complete server compromise may still expose data available to the running service.

Owner accounts

• One account can link to several pet pages.
• A pet is linked by creating it while signed in, opening its private owner link and linking it, or proving control with its public token and recovery code.
• Unlinking a pet does not delete the pet page, tag URL, private link, or recovery code.
• BackToYou stores password hashes, never plaintext passwords.
• Repeated failed sign-ins can temporarily lock an account.
• Limited account security events are retained for up to 365 days.
• Account email addresses are private and are not placed on public pet pages unless separately entered as a public contact email.

Deletion & retention

You can remove your page from the edit link. Removal immediately makes the public page unavailable. The page and its photos are retained intact during a restoration grace period before permanent purge: 7 day(s).

If you want something gone, delete it. If you need help (lost edit link, abuse reports, urgent takedown), use the support form.

Spam, abuse, and protection

BackToYou uses rate-limiting and other basic protections to reduce automated abuse. If you hammer the service (even accidentally while testing), you may see “Too many requests”.

Who runs this?

BackToYou is operated as a separate service to ScotNet because it has a different purpose and different privacy tradeoffs. ScotNet branding may appear, but BackToYou’s rules are defined on this page.

Your choices and requests

Owners can edit, hide, restore, or schedule deletion of a pet page using its private owner link or a linked account. Requests about access, correction, deletion, abuse, or the handling of personal information can be submitted through Support. The operator of this service is responsible for responding to those requests.

Changes

Effective 4 August 2026. Privacy notice version 1.6.2. This notice may change as the service evolves; the published version and date identify the current terms.

Support and replies

Support requires a valid reply email. Ticket messages and reply addresses are encrypted in the application database. Administrators can queue a reply by email; reply content and delivery records are encrypted and retained for operational support history. Deleting a ticket also deletes its reply history.

Support spam protection

When the support form is submitted, the visitor’s network address is queried against the ScotNet DNSBL at bl.scott.ovh. A listed address is blocked before the support ticket is stored. The listing code and published DNSBL reason are shown to the visitor. Accepted support tickets store a one-way user-agent hash, but do not store the raw network address used for the DNSBL query.

Physical tag records

BackToYou stores each tag code, label, type, status, scan count and last scan time so owners can disable lost tags and replace damaged tags. Tag scans may hold an encrypted scanner IP and device string for a short security period. These are administrator-only. Owners see only a broad location explicitly approved by an administrator.