Current as of 1 September 2026
Please note. This policy is accurate as of the date above and describes exactly what our software does today. We chose to publish an honest policy rather than leave this page empty.
You probably do not know what Leashloop is, so here is the short version.
Your dog trainer uses Leashloop to keep their client records and schedule sessions. When they booked your session, our software emailed you a calendar invitation on their behalf so the appointment would appear in your calendar.
You do not have an account with us. You never signed up, and there is nothing to install or log in to. Your trainer entered your name and email address, and may also have entered a phone number.
We are not a reminder service. We put the appointment in your calendar. Whether your phone reminds you, and when, is decided by your own calendar settings, not by us.
If you reply to that email, your reply goes to your trainer, not to us.
If you would rather not receive these, tell your trainer and they can remove your email address. You can also contact us directly using section 11.
Leashloop is operated by Anish Kamlakar Hirlekar, a sole proprietor trading as Leashloop, based in Mumbai, Maharashtra, India.
If you are a trainer using Leashloop, we decide how your own personal data is handled. Under India's Digital Personal Data Protection Act, 2023, we are the Data Fiduciary for it.
If you are a client of a trainer, your trainer entered your details and decides what to record about you and why. We store it and show it back to them. Your trainer is the Data Fiduciary and we act as their Data Processor.
So if you want your details corrected or removed, please ask your trainer first. You can also contact us directly, and we will help, but the records belong to your trainer and we will normally check with them before changing anything.
Signing in with Google is the only way into Leashloop. We ask Google only for basic sign-in details. We cannot see your Google calendar, your email, your contacts or your files.
We hold no payment details and no identity document numbers for anyone.
We store this so your trainer can run their business, and we show it back to them.
The one thing we email to anyone else is the calendar invitation described in section 1, and only when a trainer has added a client's email address. It goes out when a session is booked, changed or cancelled. The invitation is sent from a Leashloop address, carries your trainer's name, and is set so that any reply you send goes to your trainer's own email address rather than to us.
We also publish a session summary page, when your trainer chooses to share one. After a session, your trainer can write a summary of what happened and what to practise, then tap Share. That creates a web page at an address made of random characters, and your trainer sends you the link themselves, usually over WhatsApp. There is no account and no sign-in. We ask search engines not to index it, but it is not password protected: anyone who has the address can read it.
What that page carries: your dog's name, your trainer's name, the session number, the date and time of the session, the text your trainer wrote, and the dates of that dog's other shared summaries.
What it does not carry: your name, your phone number, your email address or your address. Nothing from your dog's health records, vaccination dates or medication notes. Nothing about any other client of your trainer, and nothing about any other dog.
A shared link has no expiry and cannot be withdrawn. Once a summary is shared it stays readable, and it travels wherever the link is forwarded. If you would rather a summary were not shared this way, tell your trainer.
We do not sell personal data, share it with other trainers, use it for advertising, or use it to train any artificial intelligence system.
Two cookies, both ours, both strictly necessary.
| Cookie | Purpose | Lifetime |
|---|---|---|
| Session cookie | Keeps a trainer signed in. Contains only an account identifier | 365 days |
| Sign-in cookie | Protects the Google sign-in process against a known attack | 10 minutes |
No analytics, no advertising cookies, no tracking pixels, no tag managers. Because we set nothing non-essential, we do not show a cookie banner. Our typefaces are served from our own domain, so simply loading a page sends nothing to any third party.
| Who | What they receive |
|---|---|
| Vercel | Hosts the application. Receives technical request logs, which include IP addresses. Our servers run in Mumbai |
| Supabase | Stores the database and uploaded photographs, in Mumbai |
| Resend | Delivers the calendar invitation. Receives the recipient's email address and the session details |
| Signs trainers in, and returns their name and email | |
| If a trainer types into a location field, their typed text and their IP address go directly from their browser to Google to suggest addresses. This happens only while typing in that field | |
| Zoho Mail | Our own business mailbox, used for our correspondence. It does not send any of our application email |
Our database and application servers are in Mumbai, India. Some of the companies above are based outside India and may process technical data such as IP addresses on servers outside India.
The images in our invitation emails are served from our own domain, so opening one sends nothing to any third party beyond your own email provider.
We keep data until someone asks us to delete it. We do not currently run an automatic clean-up and we do not delete data simply because time has passed.
One thing stated plainly rather than glossed: archiving a client deletes nothing. It hides the record from the trainer's everyday view. Every field remains stored, including photographs and past sessions.
Under the Digital Personal Data Protection Act, 2023 you may ask us for a copy of the personal data we hold about you, ask us to correct or complete it, ask us to erase it, or nominate someone to exercise these rights on your behalf if you are unable to. You may also complain to the Data Protection Board of India.
How this works today, honestly. There is no self-service button that deletes an account or downloads your data. Every request is carried out by hand by the proprietor. We will acknowledge within 48 hours and complete the request within 30 days. We are building proper tools for this.
If you are a client of a trainer, please see section 3 and contact your trainer first.
Each trainer's data is separated so no trainer can see another's records, enforced both in the database and in the application. Connections use HTTPS. Sign-in cookies cannot be read by scripts in the browser. The code is in a private repository and only the proprietor has access to the production database.
One limitation you should know about. Photographs of dogs are currently stored at web addresses that do not require signing in. Those addresses are long and are not listed or published anywhere, but anyone who obtains one can open the image without an account. Photographs are also not deleted when a client is archived.
We are changing this. Until we do, please do not upload photographs showing people, house numbers, documents, or anything else you would not want stored this way.
Grievance Officer: Anish Kamlakar Hirlekar
Email: anish@leashloop.app
Location: Mumbai, Maharashtra, India
We acknowledge within 48 hours and respond within 30 days. If you are not satisfied with our response, you may complain to the Data Protection Board of India.
Leashloop is for professional dog trainers and is not intended for anyone under 18. We do not knowingly hold data about children, and trainers are asked not to enter details of a person under 18. If you believe we hold data about a child, tell us and we will delete it.
We will update this policy as the product changes, and the date at the top will change with it. If a change materially affects you, we will say so.