Almost every app in this category starts the same way: an email, a password, maybe a social login, sometimes a phone number "just to verify it's really you." Before you've walked a single step with your dog, you've already handed over an account — something to remember, something to lose, something that lives on a server somewhere whether you like it or not.

Hapoo skips that entirely. The first time you open it, it generates a random identifier and keeps it on your device — no name, no email, nothing that ties back to you as a person. Everything the app knows about your walking lives behind that identifier, and nothing about that identifier tells anyone who you actually are.

What "device identity" technically means

It sounds abstract until you see the shape of it. On first launch, Hapoo generates a UUID — a long, effectively-unguessable random string — and stores it locally on the phone. That string is what the server sees on every request that needs one: "this device wants to join a league," "this device claims to have met this character," "this device's referral code was just used." The server never asks for a name, an email, a phone number, or anything else that would let it (or anyone who later got access to it) connect that string back to you.

Compare that to a normal account system, which usually looks like: email address → password hash → session token → user record with your name, your signup date, maybe your location history, all sitting in one table that's a single breach away from being someone else's problem.

Hapoo's version is closer to a coat-check ticket than a membership card — it proves the walk is yours without ever needing to know who "yours" refers to.

This is also why Hapoo never shows you a login screen, a "forgot password" flow, or a "verify your email" step. There's nothing to forget, because there was never a password to begin with.

Why this isn't just a gimmick

The obvious objection is: doesn't this mean you lose everything if you get a new phone? Yes, unless you transfer it first — and that's a real trade-off, not a hidden one. Apple's own device-to-device migration carries the app's local storage over automatically in most cases, but if you set up a phone from scratch rather than restoring from a backup, the identifier — and everything tied to it — starts over.

What you get in exchange is an app that has nothing to leak. There's no password database to breach, no account-recovery flow to social-engineer ("I forgot my password, but I can tell you my mother's maiden name"), no email address sitting in a table somewhere waiting to be part of the next breach headline you read about a completely different company. A lot of the security theatre other apps build — two-factor prompts, password-strength meters, "we noticed a login from a new device" emails — exists only because they collected something worth protecting in the first place. Hapoo mostly just didn't collect it.

What the device id actually unlocks

A handful of features do need a server, and it's worth being specific about exactly what each one sends, rather than leaving it vague:

  • Weekly leagues — your device id and a running points total, so a cohort of similarly-active walkers can be assembled and ranked. No name is ever attached to a league standing; if you finish top of your group, "top of your group" is all anyone else in it ever sees.
  • Referrals — a short code tied to your device id, and, once a friend uses it, confirmation that their device logged a genuine first walk of its own (not just an install).
  • The character network — which character you've met, where, and whether the meet's GPS coordinates were actually plausible for a walk. Keyed by device id, never a name.
  • The optional coach — your question, plus a short summary of your own walking (streak, distance, level, your dog's name) so it can answer specifically rather than generically. Never your location, your routes, or your photos.

See the full privacy policy for the complete, unambridged version of this list, and how it's built for the actual architecture behind the device-id model — it's the same trust model used throughout the whole app, not a special case bolted onto one feature.

What happens if you lose your phone

Practically: whatever was tied to that device id stays wherever it was, unrecoverable from a new device, because there's no account to log back into and reattach it. If you're switching phones deliberately, transfer your data across first (the standard Apple migration flow handles this in the overwhelming majority of cases) — start fresh without doing that, and Hapoo treats it exactly like a new install, because as far as the server's concerned, it is one.

This is the one place the trade-off is genuinely a trade-off, not just a marketing line. A traditional account would let you log back in from anywhere and pick up where you left off. Hapoo can't offer that, because offering it would mean building the very thing — a persistent identity tied to you as a person — that the rest of this design deliberately avoids.

A few things people ask

Does deleting the app delete everything? Yes — the app is the only place any of this data lives on the device side, and there's no separate account to also close.

Can two people share the same dog's progress from different phones? Not yet in the sense of syncing between two separate devices — each device keeps its own identity. See how it's built for what's already shipped around this.

Is the device id sent to anyone besides Hapoo's own server? No. It's never shared with advertisers, analytics networks, or any third party — see the privacy policy for the full account of what does and doesn't leave your phone.

The bet underneath all of this is a simple one: most of what a dog walking app actually needs to do doesn't require knowing who you are — just which walks are yours. So that's the only thing Hapoo asks for.