Client photos and stay logs deserve the same care as the pets themselves.
Before you move your roster off WhatsApp, you want to know where data lives and who can reach it. Here is how Wuuf is built — in plain language, no security theatre.
Full legal details in our Privacy PolicyWhat runs under the hood
Wuuf is a small team on proven infrastructure — not a home-grown server in someone's closet.
Cloudflare R2 & Workers
Pet photos and media live on Cloudflare R2. The API runs on Cloudflare Workers at the edge — HTTPS everywhere, fast delivery worldwide.
Supabase (Postgres)
Customers, pets, stays, and timeline events sit in a managed Postgres database. Authentication goes through Supabase Auth — no passwords stored in our app code.
Row-level security
Database policies isolate each workspace. Your team only sees your roster, your stays, and your media — not another facility’s data.
Lemon Squeezy
Card numbers never touch Wuuf. Checkout and billing run through Lemon Squeezy; we only receive subscription status and plan limits.
How we think about your data
Three rules we do not break — because your reputation depends on them.
- 1
You own your content
Customer names, pet profiles, photos, and stay logs belong to your business. Export photos from the media library anytime. Ask us to close an account when you leave.
- 2
Owners get a link, not your CRM
Pet parents open a public stay page with a unique URL. They never log into your dashboard or browse your full customer list.
- 3
Encryption in transit
Browser traffic and API calls use HTTPS/TLS. Media URLs are served over secure connections.
Operating in Europe?
We support GDPR-style rights: access, correction, deletion, and portability where applicable. Subprocessors, cookies, and retention periods are documented in our Privacy Policy — including Cloudflare, Supabase, and Lemon Squeezy.
Common security questions
Where are my photos stored?
On Cloudflare R2 — object storage on the same global network that serves the live owner pages.
Can another Wuuf customer see my data?
No. Row-level security in Postgres ties every record to your account. Staff must sign in to your workspace to access anything.
Does Wuuf store credit card numbers?
No. Lemon Squeezy handles payment details. Wuuf only stores enough billing metadata to apply your plan limits.
Are you GDPR-ready?
Yes. If you or your clients are in the EEA, see our Privacy Policy for lawful bases, retention, and your rights (access, erasure, portability). Email [email protected] for data requests.
Do you sell customer data?
No. We do not sell personal information. Subprocessors (Cloudflare, Supabase, Lemon Squeezy, email providers) process data only to run the service — listed in our Privacy Policy.
Need a DPA or security questionnaire?
Email [email protected] with what your team needs. We will answer honestly about our stack and subprocessors.
More detail in the data security help article.
Still have questions?
Ask about data location, subprocessors, or account deletion before you check in your first stay. We reply within 2 hours on business days.