Privacy notice

This notice explains, in plain language, what personal data Goose collects, why, who processes it for us, how long we keep it and your rights.

Version 2026-11-02.1 · last updated 2 November 2026

Who we are

[Company name] ("Goose", "we") is the data controller for the personal data described in this notice. We are a company registered in [England and Wales], company number [Company number], registered office [Registered office address]. We are registered with the Information Commission (the UK's data protection regulator, formerly the Information Commissioner's Office), registration number [ICO registration number]. For anything about your data, e-mail hello@ourgoose.com or write to us at our registered office. We have not appointed a data protection officer; [Founder name] is responsible for privacy at Goose.

When you register your interest

Registering your interest does not create an account. We collect only what you type into the form:

If you’d like to be a Best Friend: your first name and email address, and, if you choose to tell us, your town or area, what kind of dog you’d love to support and how you heard about Goose. If you arrive from a dog’s page or a friend’s invite link, we note which one.
If you register a rescue: your name, email address and the rescue’s name, and, if you choose to add them, your role, your town or region, roughly how many dogs are in your care, your website or social link, charity number, a message and how you heard about Goose. If you arrive through a friend’s invite link, we note which one.

We use these details only to contact you about Goose’s launch or, for rescues, the pilot, because you asked us to (your consent). They are stored with Supabase in London. We keep them until you ask us to delete them, or for 24 months after Goose launches, whichever comes first. You can withdraw at any time by emailing hello@ourgoose.com, and we will delete your details.

Other things we collect

Account data, if you created an account during our earlier preview. Your name, email address and a securely hashed password, plus the details you chose to add (such as a username and notification preferences).
Profile photo, only if you add one. It is shown next to your name and comments, so anyone who can see those can see it. Before upload it is cropped and re-saved on your device, which removes location and camera details. Remove it any time in Settings; deleting your account deletes it too.
Follows, likes and saves. Which dogs and rescues you follow, the posts you like and the dogs you save. Others only ever see totals (for example “120 followers”), never who; your saved dogs are visible to you alone. We also keep when you first followed each dog, even after you unfollow, so we can measure how the pilot is going (for example how many followers later become Best Friends); it is only ever counted, never shown, and it is deleted with your account.
Blocks. The members you block from their comments. Only you can see your list; the member you block is never told. Your blocks are deleted with your account.
Comments and reports. Comments are public and show your first name and last initial. You can edit or delete your own; a deleted comment disappears from Goose but is kept, hidden, for moderation records. Reports you send are seen only by Goose and the rescue that published the post. When something is reported, a copy of it is kept with the report, so moderators can still deal with it if it is deleted (including when its author deletes their account). If you delete your account, reports you sent stay as moderation records, without your name or the words you wrote.
Replies and profile photo reports. You can reply to a comment. Replies are public like comments and follow the same rules. A rescue’s team can reply as the rescue: the reply shows the rescue’s name and logo, and Goose keeps which team member wrote it, for the rescue’s team and our moderation records. If that team member deletes their account, the reply stays as the rescue’s and we no longer keep who wrote it. When you report someone’s profile photo, a copy of the photo’s address is kept with the report, and only Goose sees and decides it. For a profile photo, we keep the report but not the photo once it is changed or your account is deleted. If we remove your profile photo, we keep a record of the decision (the reason, when, and the photo’s address) with our moderation records and tell you why; you can add a new photo after 24 hours. When someone replies to your comment, we tell you in Activity and, if you allow notifications, on your iPhone; you can switch this off in Notifications.
Earlier pre-launch sign-ups. If you joined our earlier waitlist or made a no-charge reservation during the preview, your email address and the choices you made on that form. Ask us and we will delete them.
Best Friend memberships and payments. For each dog you support: when your membership started and its status, your Stripe customer and subscription references, and a record of each invoice line (amount, fees, refunds). When you join, we also record that you agreed to the membership terms and asked the membership to start straight away, with the time, the dog, the version of the wording you saw and the rescue’s charity statement if there was one. Card details go straight to Stripe and never reach Goose. Stripe also uses some of this data as its own controller, for example to prevent fraud and meet its legal duties: see stripe.com/gb/privacy.
In-app purchases on iPhone. If you become a Best Friend in the Goose iPhone app, Apple takes the payment as its own controller, under its own privacy policy: your Apple ID, your payment card and Apple’s receipt stay with Apple. For each purchase, renewal or refund, Apple tells us (through its App Store server messages): the transaction and original transaction numbers, which subscription it was (the “1st dog” to “5th dog” places), the purchase, expiry and any refund or cancellation dates, the price and currency, the App Store country, whether it was a test purchase, whether it is set to renew, and an app account token. That token is a random number we create for your Goose account (it is not your user id), so Apple’s messages reach the right account. Apple never tells us your card details or your Apple ID’s email address. As for any membership, we also record that you agreed to the iPhone app membership terms and asked the membership to start straight away.
Membership counts. When a Best Friend membership starts or stops, a payment fails, or a dog someone supports is adopted, we count it so we can see how Goose is doing. These counts are not linked to you.
Emails we send. A record of which account and optional emails we sent you, so we can honour unsubscribes, avoid sending the same email twice and investigate problems. We keep it for 13 months.
Team invitations, if a rescue invites you to its team on Goose: your email address, the rescue, the permissions offered and who invited you. An invitation that expires or is revoked is removed 30 days later.
Technical data. Your IP address and browser details, used to keep the site secure and to limit abuse (for example, too many log-in attempts). Our sign-in provider also keeps a log of sign-ins and sign-outs with your email address and IP address for 30 days.
Usage analytics, only if you allow them (see Cookies below).
Photos of your own dogs, if you added any during an earlier preview. That feature has closed: nothing new can be added and existing photos are no longer shown anywhere on Goose. Ask us and we will delete them.

Why we use it

To contact you about Goose’s launch or pilot when you register your interest. Basis: your consent, which you can withdraw at any time.
To run your account and the features you use, including following, comments, your Best Friend memberships, your scrapbook and Memories, and the emails and notifications you need (for example, a receipt, a payment problem or a change to your membership). Basis: our contract with you.
To send optional updates such as digests, milestone news, monthly recaps and the iPhone notifications you allow. They are about the dogs and rescues you follow or support, never advertising. You can switch each one off at any time from any email, your settings or your phone. Basis: our legitimate interest in keeping you up to date with dogs you chose to follow, balanced by your easy opt-out.
To keep Goose safe: moderating comments, handling reports, blocks, suspensions, appeals, preventing abuse, and keeping an audit trail of who did what. Basis: our legitimate interests in a safe service, and our legal duties under the Online Safety Act 2023.
To measure how the pilot is going, for example how many followers later become Best Friends (we keep when you first followed each dog, only ever counted). Basis: our legitimate interest in understanding whether Goose works for rescues.
To credit a friend who invited you (the referral cookie and link). Basis: our legitimate interest in running the invite feature.
To link your in-app purchases to your memberships on iPhone: matching Apple’s purchase, renewal and refund messages to the right account and dog, refunding you when we promised to, and stopping misuse (for example one Apple purchase claimed by two accounts). Basis: our contract with you; for refunds and preventing misuse, our legitimate interest in handling payments correctly.
To keep payment and tax records (including in-app purchase records) and to record that you agreed to the membership terms and asked your membership to start straight away. Basis: our legal obligations (tax and company law), and our legitimate interest in being able to show what you agreed to.
To pay rescues their share of membership revenue. Rescues get totals per dog and month, never your name. Basis: our contracts with rescues (our legitimate interest).
To understand how Goose is used. Basis: your consent (analytics cookies).

Who processes it for us

We use a small number of service providers, who may use your data only to provide their service to us. Today these are:

Supabase runs our database, sign-in and photo storage, in London.
Vercel hosts the website, whose server code runs in London. It handles every visit, so it sees your IP address and browser details.
Google (Google Workspace) runs our email inbox: if you email us, your message and email address are kept there.
Resend sends our emails: your email address and what each email says.

When we switch the features on, we will also use Stripe (payments, once memberships open), PostHog (analytics, hosted in the EU, only with your consent), Upstash (counting requests to limit abuse, which means seeing IP addresses) and Anthropic (suggesting posts from facts rescue staff type), and we will update this notice first.

If you use the Goose iPhone app, Apple delivers it under its own privacy policy. If you test the app through Apple’s TestFlight, Apple shares with us the details you were invited with and any crash reports and feedback you send.

Notifications on iPhone. If you allow notifications, we keep your phone’s notification address (a “device token”) so Apple can deliver them. Only our server can read it. It is removed when you sign out on that phone, when Apple tells us it no longer works, or when you delete your account. You can choose which notifications you get in the app, and turn them all off in your phone’s settings.

Sign in with Apple. If you sign in with Apple, Apple tells us an identifier for you and, if you choose, your email address (which may be a private relay address). We keep a token from Apple that only lets us end your Apple sign-in with Goose when you delete your account. Apple handles your Apple ID under its own privacy policy.

Where your data is processed

Each provider may use your data only to provide its service to us, under a contract that requires it to protect your data. This is where each one keeps it, and the safeguard that protects it if it leaves the UK. Data held in the European Economic Area is covered by the UK’s adequacy regulations.

Supabase
What it does
Database, sign-in, photo and video storage
Where your data is
Stored in London (UK). Supabase’s support and some of its own providers can access it from the US and elsewhere
Safeguard
UK International Data Transfer Addendum to the EU standard contractual clauses
Vercel
What it does
Hosts the website and staff console (server code runs in London)
Where your data is
UK, with a worldwide network that delivers pages
Safeguard
UK Extension to the EU–US Data Privacy Framework; and the UK Addendum to the EU standard contractual clauses
Resend
What it does
Sends our emails
Where your data is
United States
Safeguard
UK Extension to the EU–US Data Privacy Framework; and the UK Addendum to the EU standard contractual clauses
Stripe
What it does
Takes Best Friend payments
Where your data is
UK, EU and United States
Safeguard
UK Extension to the EU–US Data Privacy Framework; the UK Addendum as a fallback
PostHog
What it does
Analytics, only with your consent
Where your data is
EU (Frankfurt), covered by UK adequacy regulations; PostHog staff and providers elsewhere may access it
Safeguard
UK Extension to the EU–US Data Privacy Framework; and the UK Addendum
Google
What it does
Our email inbox (Google Workspace)
Where your data is
[United States and elsewhere]
Safeguard
[UK Extension to the EU–US Data Privacy Framework; and the UK Addendum in Google’s data processing terms]
Apple
What it does
iPhone notifications, Sign in with Apple, app delivery, in-app purchases
Where your data is
Worldwide
Safeguard
Apple’s own terms (Apple Distribution International, Ireland, uses standard contractual clauses for transfers to Apple Inc.)

Stripe also acts as an independent controller for some purposes, such as preventing fraud and meeting financial regulations. Apple is an independent controller for in-app purchases on iPhone. You can ask us for a copy of the safeguard a provider uses.

Rescues see only what the product shows them: how many followers and Best Friends a dog has, never who you are or your payment details.

Rescue posts, photos and memories

Rescues publish the posts, photos and videos on Goose. Before a photo or video is published, Goose checks that location details have been removed from it.

Memories are kept. Once a dog has had a Best Friend or has gone home, its published posts, photos, videos, journey and adoption history are kept for as long as Goose runs, so the people who were part of the dog’s story can still see it. This also applies if the rescue later leaves Goose. Content is removed only:

for a privacy or safety reason, straight away, by the rescue or by Goose (for example a home address, or someone who didn’t agree to be shown);
if a rescue removes a post as a mistake: it is hidden at once and deleted, with its files, 30 days later.

If you appear in a rescue’s post and want it removed, contact the rescue or email us, and we will act straight away.

Edited photos. When rescue staff edit a photo on Goose, we keep the unedited photo (with location details removed) in private storage that only the rescue’s posting staff and Goose staff can see, so the edit can be changed later. It is deleted with the photo or the post.

Rescue staff. If you work or volunteer for a rescue on Goose, we hold your name, email, the permissions your rescue gave you, your team invitations and the actions you take (in an audit trail your rescue’s admins and Goose staff can see). People named or shown in rescue posts, foster carers and adopters are mainly the rescue’s responsibility to inform; our agreement with each rescue requires it.

Cookies

Log-in cookies (sb-…-auth-token) that keep you logged in. Essential; set only when you log in, for up to 30 days (4 hours when you open the website from the Goose app).
App log-in cookies (goose_handoff and goose_session_until) when you open the website from the Goose app while logged in, so that log-in ends after 4 hours. Essential.
An app marker (goose_app) when you open the website from the Goose app, so it shows the app’s simpler pages. Essential; it ends when you close the app’s browser.
A referral cookie (goose_ref) for 30 days when you arrive through a friend’s invite link, so we can credit them if you register or join. Essential to that feature.
Your analytics choice (goose_consent), remembered for 180 days so we don’t ask again on every visit. Essential.
A rescue-team cookie (goose_rescue) for staff who belong to more than one rescue, remembering which one they last opened, for up to a year. Essential.
A reminder cookie (goose_reselect_not_now) when you choose “Not now” after a dog you support is adopted, so we stop reminding you on this device, for up to 90 days. Essential.
Storage in your browser (not cookies), used only on your device: a follow, save or like you tapped before signing up, so it completes once you have (used only within 24 hours); the email address you typed before asking to reset your password, to fill in the reset form (removed once used, or when you close the tab); and, for the open tab only, your place in a feed and that a founding pledge was just recorded. Essential.
Analytics cookies and browser storage (PostHog), set only after you say yes when we ask, for up to a year. Choosing “Essential only” removes them. Analytics are not switched on yet, so none are set today; we will ask with a banner before we turn them on. Events describe actions (a dog followed, a page viewed) using ids and counts, never names or free text. We never record your screen or what you type.

What we never do

No advertising tracking, and no selling or renting of your data, ever.
No analytics before you consent, and no session recording at any point.
No sharing of your details with rescues beyond the totals described above.

How long we keep it

Interest registrations: Until you ask us to delete them, or 24 months after Goose launches, whichever comes first
Account, follows, likes, saves, blocks, profile photo, notification devices, Activity: Until you delete your account (or the item)
Your comments: Until you delete them. A deleted comment is kept hidden for moderation records for 12 months, then deleted. It is deleted with your account unless it has been reported
Reports and moderation decisions: 3 years after the report is closed, then deleted. Reports you sent stay after you delete your account, without your name or words
Suspensions: Until you delete your account
Our audit trail of moderation decisions: 6 years, so we can deal with repeated abuse and legal claims
Best Friend memberships: Until you delete your account. After that the membership is kept without your name, as part of our payment records; Memories access ends then too
Payment and invoice records: 6 years after the end of the financial year they relate to (tax and company law). After you delete your account they are kept without your name
In-app purchase records (iPhone): 6 years after the end of the financial year they relate to, as accounting records. After you delete your account they are kept without the link to you
Apple’s purchase messages (as received): 13 months
Record of your agreement to the membership terms: 6 years after the membership ends, so we can show what you agreed to. After you delete your account it is kept without your name, then deleted automatically
Record of emails we sent: 13 months
Sign-in log (our sign-in provider): 30 days
Team invitations: 30 days after they expire or are revoked
Rescue posts and media: See “Memories are kept” above
Foster and adopter locations in audit records: Names and towns blanked after 12 months
Analytics (only with consent): 12 months in PostHog; deleted when you delete your account

Deleted data can stay in our encrypted backups for up to 7 days before it is overwritten.

Automated decisions

We don’t make decisions about you based solely on automated processing that have legal or similarly significant effects. A person reviews every report, suspension and appeal. The only automatic checks are the comment filter (no links, a short list of blocked slurs), which stops a comment being posted, and rate limits that slow down too many requests.

Do you have to give us your data?

You don’t have to give us any personal data to read Goose. To create an account we need your name, email address and confirmation that you are 18 or over. To become a Best Friend we need payment details (through Stripe), or, in the iPhone app, a purchase with your Apple ID (through Apple). Without them we can’t provide those features. Everything else is optional.

Children

Goose isn’t for children. You must be 18 or over to create an account; we ask you to confirm this when you sign up and record when you did. We don’t knowingly collect data from anyone under 18, and if we learn an account belongs to someone under 18, we delete it. If you think an account belongs to someone under 18, tell us by emailing hello@ourgoose.com, or report it as “Child safety”.

Anyone, including young people, can read Goose’s public pages without an account. Reading them asks for no personal data: we never ask a visitor’s age or date of birth, there is no advertising and no profiling, and analytics run only if you say yes. Our terms explain in plain words how Goose keeps young people safe.

Your rights

Under UK data protection law you can ask for a copy of your data, ask us to correct or delete it, object to or restrict how we use it, receive the data you gave us in a machine-readable format and have it passed to another organisation (data portability), and withdraw consent at any time. If you have an account, you can download a copy of your account data yourself (Settings, then “Download your data”; we keep a record of when you did, and how many records the file held) and delete your account there too. You can also unfollow, unsave, delete your own comments and manage email preferences yourself. To make any other request, contact us by emailing hello@ourgoose.com; we reply within one month.

Complaining to us. You have the right to complain to us about how we use your personal data. Email hello@ourgoose.com or write to our registered office. We acknowledge every complaint within 30 days, look into it, and tell you the outcome.

Complaining to the regulator. You also have the right to complain to the Information Commission, the UK’s data protection regulator (formerly the Information Commissioner’s Office): ico.org.uk/make-a-complaint, or 0303 123 1113.