Data Security & Privacy

Where your data lives

Book'n Buddy runs on Google Cloud / Firebase infrastructure. Your business data — bookings, customer profiles, pets, invoices, photos, and notes — is stored in Cloud Firestore, Google's enterprise-grade managed database, hosted in Google's secured data centers.

Google Cloud holds independent third-party certifications, audited annually, that apply to the infrastructure we use:

Encryption in transit and at rest

• In transit: Every connection between your browser, our servers, and the database is encrypted with TLS 1.2+ (HTTPS). The site is HTTPS-only — there is no unencrypted path in.
• At rest: All data stored in Firestore and Cloud Storage is encrypted at rest by default using AES-256, managed by Google.
• Redundancy: Firestore is replicated across multiple Google Cloud zones automatically, providing built-in durability.

Who can see what

Access is governed by Firebase Authentication and Firestore Security Rules — server-enforced rules that run on every read and write. This means:

• A customer can only see their own profile, their own pets, their own bookings, and their own invoices.
• A business admin can only see data for their own business — they cannot read other businesses' customers, bookings, or financials.
• A Book'n Buddy support admin can access aggregate data only when needed for support or billing, under signed agreements and with audit logging.

These rules are enforced on the server, not the client — meaning even a malicious browser request cannot bypass them.

Passwords and login

We use Firebase Authentication, the same identity system Google uses for its own products. Passwords are never stored in plain text — they are hashed using industry-standard algorithms (scrypt) on Google's infrastructure. We never see your password.

Optional security features available:

• Password reset over verified email
• Email-link sign-in
• Two-factor authentication for admin accounts (planned)

How payments are handled

We never store credit card numbers. Card data is processed directly by Stripe or Square (depending on your setup), both of which are PCI DSS Level 1 certified — the highest level of payment-industry compliance.

• When a customer pays, the card details go straight from their browser to Stripe or Square.
• We only store a non-sensitive reference token (e.g. "card ending in 4242") so saved cards can be charged on future visits.
• For "card on file," the token is held in Square's encrypted vault, not in our database.
• Payouts to your business go directly from the payment processor to your linked bank account — Book'n Buddy never holds your funds.

Server-side logic (Cloud Functions)

Booking emails, invoice generation, payment webhooks, and notification delivery run on Firebase Cloud Functions — Google's managed serverless platform. Every function:

• Validates the caller's authentication token before running
• Logs activity for audit and debugging
• Cannot be invoked anonymously without explicit allowances
• Runs in isolated containers, recycled between invocations

Your data, your control

• Data export: You can export your business's customers, pets, bookings, and invoices as CSV at any time from admin Settings → Data Export.
• Data deletion: On request, we can permanently remove your business and all associated data. Customer-facing data deletion is honored promptly.
• Data ownership: Your business and customer data is yours. Book'n Buddy does not sell or share your data with third parties for advertising.

What we do not collect or do

• We do not track customers across other websites.
• We do not embed third-party ad networks.
• We do not sell aggregated or anonymized customer lists.

Reporting a security issue

If you discover a security vulnerability, please report it to us at info@booknbuddy.com. We respond within one business day and patch verified issues promptly.