Profile sharing¶

Overview¶

Sharing is half of PetFolio's core value proposition. Consolidating pet information in one place is only useful if it can be shared with the people who need it - sitters, family members, vets, rehoming coordinators.

For MVP, sharing is read-only and requires the recipient to have a PetFolio account. Sharing supports two modes:

Temporary share - time-limited with a start and end date. Used for sitters, vets, or emergency carers. Access expires automatically.
Permanent share - ongoing, no end date. Used for household members, partners, or family who co-care for the animals long-term. Revocable by the profile owner at any time.

Why recipients need an account¶

This decision was made deliberately, weighing the tradeoffs:

Pros:

The owner knows exactly who has access to their animal's information - a named user, not an anonymous link holder
Enables future enhancements (editor rights, notes, updates) without requiring recipients to create an account later
Permanent shares between household members require identity on both sides - a link-based model does not support this well
Provides a foundation for ownership transfer, where the recipient already has an account to receive the profile
Reduces risk of shared links being forwarded to unintended people

Cons:

Adds friction to the recipient experience - a sitter must create an account before they can view a profile
Slows down emergency sharing - in urgent situations, sending a link is faster than requiring sign-up
May deter casual or one-time recipients who do not want yet another account

The tradeoff is accepted because the sharing model is central to PetFolio's future (editor rights, ownership transfer, household collaboration), and all of those require known users. Building on anonymous links would create a foundation that needs replacing later.

Discovery¶

Job stories¶

Setting up a share:

When I am going on holiday and leaving my pets with a sitter, I want to share their profiles for a specific time period, so the sitter has access before and during their visit but not indefinitely.
When I share a profile, I want to set a start date before the sitter arrives, so they can read through it and ask questions in advance.
When I return from holiday, I want access to expire automatically, so I do not have to remember to revoke it manually.
When circumstances change and I need to cut a visit short, I want to revoke access early, so the sitter no longer has access to my pet's information.

Receiving a share:

When I receive a shared pet profile as a sitter, I want to sign up quickly and see what has been shared with me, so I can access the information without unnecessary friction.
When I open a shared profile for the first time, I want to see the safety brief and Top Tips first, so I know the most critical things before anything else.
When the owner updates the profile after sharing it with me, I want to see the latest information immediately, so I am never working from outdated details.

Beyond the sitter use case:

When I take my pet to a new vet, I want to share their profile so the vet can see health conditions, medications, and allergies without me reciting it from memory.
When I am rehoming an animal, I want to share a comprehensive profile with the new owner, so the transition is smooth and no care knowledge is lost.
When a family emergency means someone unexpected needs to care for my pets, I want to create a share quickly, so they have everything they need at short notice.

The "5 Whys" - digging deeper¶

Starting statement: "We need to be able to share pet profiles."

Why? - "Because the profile is only useful to the owner if no one else can see it."
Why does someone else need to see it? - "Because other people care for the animal - sitters, family, vets, rehoming coordinators. They need the same information the owner has."
Why can't the owner just tell them? - "Because verbal handovers miss things. The owner forgets to mention the medication routine, or the fear of harness clips, or the rule about never being off lead. The information that lives in someone's head is the most at risk of being lost."
Why does it need to be time-limited? - "Because not everyone needs permanent access. A sitter for one week should not have access to your pet's information forever. Access should match the duration of the relationship."
Why can't we just let people revoke manually? - "Because people forget. Automatic expiry is a safety net - the default is that access ends, not that it persists."

Root requirement: Sharing must be time-limited by default because access should match the duration of the care relationship, and relying on manual revocation leaves sensitive information exposed when people inevitably forget.

Starting statement: "The safety brief must be shown first."

Why? - "Because it contains the most critical information."
Why can't the recipient just scroll to it? - "Because they might not know it exists, or they might skim past it if it is buried among less urgent content."
Why is that dangerous? - "Because the safety brief contains things that prevent harm - never leave unattended, never off lead, fear-based dislikes. Missing these is not an inconvenience, it is a risk."
Why can't we trust the recipient to read thoroughly? - "Because people are busy, distracted, or in a rush. The sitter arriving on Saturday might glance at the profile on their phone. The five-minute read must be the first thing they see."
Why is this our responsibility? - "Because the owner trusted PetFolio to communicate their care requirements. If the profile buries critical safety information and something goes wrong, the platform failed its core promise."

Root requirement: The safety brief must be encountered first because PetFolio is responsible for ensuring critical care information is not missed, regardless of how much attention the recipient gives the profile.

Event storming¶

Event	Who triggers it?	Who cares?	What happens next?	What could go wrong?
Share created (existing user)	Profile owner	Recipient, the owner	Recipient notified, access granted (or scheduled for start date)	Wrong dates set, wrong profile shared, notification missed
Share created (no account)	Profile owner	Recipient, the owner	Sign-up invitation sent, share held in pending state	Invitation lost in spam, recipient never signs up, pending share expires
Share link accessed before start date	Recipient	The recipient	Access denied with explanation that the share is not yet active	Recipient confused about why they cannot access
Share link accessed within valid period	Recipient	The recipient, the owner	Profile displayed read-only with safety brief prominent	Link broken, profile not loading, stale cache
Profile updated during active share	Profile owner	Recipients with active access	Latest information visible immediately to all viewers	Recipient viewing cached version, does not see update
Share access revoked early	Profile owner	The recipient	Access terminated, link no longer works	Recipient still has cached version open, no notification that access ended
Share expired automatically	System (date-based)	The recipient, the owner	Access revoked, link no longer works	Timezone differences cause unexpected early/late expiry
Recipient views safety brief	Recipient	The owner (indirectly)	Safety brief and Top Tips displayed prominently as first content	Recipient bypasses or skips safety brief
Expired share link accessed	Former recipient	The former recipient	Access denied with explanation that the share has expired	Recipient confused, no way to request renewed access

Requirement highlights¶

MVP¶

Temporary shares (start/end date, auto-expiry) and permanent shares (ongoing, revocable)
Recipients must have a PetFolio account
Read-only access for all recipients
Recipient notification on share creation
Pending share for recipients without accounts (7 day invitation expiry, resendable, revocable)
Safety brief and Top Tips surfaced prominently
Live updates visible to recipients immediately
Professional account role restrictions (Owner/Admin and Editor can share, Viewer cannot)

See MVP deep dive for detailed requirements.

Future¶

Editor rights for shared recipients (per-animal, time-limited)
Granular section-level permissions
Selective hiding of sections
Recipient notes and updates
Ownership transfer (see Ownership transfer)