Privacy policy

Online alpha hosted on Cloudflare

This alpha uses Cloudflare Workers and a dedicated Durable Object database for accounts and progress, a private R2 bucket for images, Cloudflare Images for image processing and Workers AI for server-side cat detection. Cloudflare therefore processes uploaded photos and connection data. Request diagnostics are sampled; photos, passwords and API keys are not intentionally included in application logs. OpenAI processes a cat image only after a separate request for an AI portrait. Stripe is configured in a sandbox for web payment tests; Android purchases use Google Play Billing when configured. Password recovery email is available only when the app shows it as enabled. When enabled, Resend receives your email address and a private password-reset link valid for 30 minutes to deliver the requested message. Shared free-service quotas and the alpha's own limits can temporarily stop uploads, registration or AI generation. The current AI test period ends on 5 November 2026. Production arrangements and retention remain subject to the review described below. iPhone and iPad purchases use Apple In-App Purchase. TestFlight uses the Apple sandbox; no real charge is made. Signed transaction records and an account token are verified by the game server to deliver and restore purchases.

Who operates Cats GO?

The operator and proposed data controller is identified below. Contact us about access, correction, export, deletion, restrictions, objections or withdrawal of an optional sharing choice. You may also complain to the competent data protection authority, including the UK ICO where applicable.

A private album on your device

The private album stores photos and progress on this device. Optional walking uses GPS locally, without publishing your position. No online account is needed. Export before clearing app data or uninstalling; device backups follow your system settings. External links use internet.

Online accounts and photos

An online account stores your email, nickname, a salted password hash, progress, cat collection, settings and account sessions. An optional profile picture is stored privately on your account, included in your data export and removed when you delete it or your account. Selected photos are uploaded for cat verification, processing and storage. Photo metadata is removed from stored derivatives. The camera preview is processed locally; a selected photo is sent when you add it online. We do not require microphone, contacts or access to your whole photo library. Use photographs you are entitled to use; avoid people, house numbers and identifying documents in the background.

What other players see

New online profiles and reviewed cats are public by default. You can turn this off in Privacy and each cat’s settings. New cats have original-photo sharing enabled by default; you can disable it before adding a cat or later. Locations need separate permission. Sharing is optional. Reviewed portraits you publish may appear with your nickname and statistics in profiles and rankings. Home sharing is a separate choice. Other people can save screenshots; withdrawing sharing cannot remove copies they already made. Blocking hides the relevant profiles, pins and ranking entries between the affected players. Real photo sharing can be disabled separately for each cat. Full photos, after metadata removal and moderation, become visible to other logged-in players only when you publish the cat and enable photo sharing. Turn it off to revoke access. Avoid people and identifying information in the background. Other players see only the Purrrfect count, not voter identities. The server stores the voter account to enforce one vote per cat; this is not anonymous to the operator. Existing screenshots cannot be recalled.

Location and maps

Permission to access location and permission to publish it are separate choices. Walking uses recent coordinates to calculate distance. Player profiles never have location pins. Before adding an online cat, choose its encounter location: the camera can use GPS, while gallery photos require a manually selected place. Without GPS you can select the place manually too. The cat pin appears immediately to signed-in players with a standard icon until its photo is approved. Photos and rankings still require moderation. You can correct the cat's place from its details: open the map, select the cat, choose Adjust cat location, move the map beneath the crosshair and save. Corrections award no walking XP. Existing private choices are kept; a cat pin can be hidden or removed in the cat's details. A saved cat encounter can include exact coordinates and persists until edited or deleted. Do not publish your home, a child's location or another person's private location. A map tile provider receives network information such as your IP address and requested map area when a map loads. The default map uses OpenFreeMap (Hyperknot Software Kft., Hungary), with OpenMapTiles/OpenStreetMap data. OpenStreetMap raster tiles are an optional fallback. See https://openfreemap.org/privacy/.

Optional AI portraits and purchases

Only when you request a personal AI portrait is a processed cat image sent through our server to OpenAI. The image is not a biometric identity check. Generated results can differ from your cat. OpenAI processes requests under its service terms and applicable account settings; provider retention must be checked before launch. The app does not collect card details. Store purchase tokens, product identifiers and transaction status are processed to grant and restore purchases and prevent duplicate use.

Purpose and legal basis — proposed production model

Account operation and requested game features: performance of the service contract. Optional public location and optional sharing: a separate choice that can be withdrawn in the app; the final lawful basis and consent design require review. Security, fraud prevention and moderation: legitimate interests subject to a balancing assessment. Statutory accounting records: legal obligations where applicable. Camera permission is not blanket consent to every use. No advertising SDK or behavioural-advertising profile is included in this build.

Retention and security

Active account data is kept until account or item deletion. Sessions expire after 30 days; reset links after 30 minutes. Account deletion removes the active account, collection, media and related sessions. Purchase records are detached from the account but retained for duplicate-purchase/fraud handling; AI cost records and moderation logs can remain. Their final retention periods, backup rotation and deletion-after-restore process are not yet implemented for production. Access controls, hashed passwords and session protection are implemented; a public deployment must use HTTPS. This test notice does not promise a backup purge schedule that is not configured.

Providers and international transfers

The future hosting, email and map providers, processing locations, processor agreements and UK/EU transfer safeguards must be documented before public launch. OpenAI is the optional AI image provider; Google Play handles supported Android store transactions. Google/Apple social sign-in is not yet enabled. Do not treat this draft as a complete production processor list.

Younger players

The private local album is available without the adult online account. Online registration currently requires an adult declaration, but verified parental consent and parental account management have not been implemented. A declaration alone does not establish compliance for a game directed to children. Public release to children requires a documented child-safety and privacy assessment. Do not upload another child's personal information.

This website and support requests

This website does not use advertising cookies, tracking scripts, a player login or browser storage. The contact tools prepare an email on your device; they do not upload the form to a website database. Information is sent only when you send the email. Your email service and the operator’s mailbox provider then process that correspondence. Support requests are used to answer questions, investigate issues and handle account or data requests. Do not include passwords, card details or unnecessary personal information.

When the site is hosted, the hosting provider processes connection information needed to deliver and secure it. The final hosting log and support correspondence retention periods and international transfer arrangements are part of the outstanding production review. If analytics is introduced, this notice must be updated before it is enabled.

Questions or requests?

Contact support or request your data or account deletion. You do not need to sign in to prepare an email request.