Privacy Policy

Effective date: August 5, 2026

1. Who we are

WhereIsMyCat ("we", "us") operates the WhereIsMyCat mobile app and the website at whereismycat.org (together, the "Service"). The Service helps people report missing cats, post sightings of cats seen on the street, and coordinate with neighbours to reunite cats with their owners.

This policy explains what personal data we process, why we process it, who we share it with, and the rights you have. It applies to the Service in all countries. If you have questions, contact us at support@whereismycat.org.

2. Data we collect

We only collect what we need to run the Service.

• Account data. Your email address when you sign in with Apple or Google. If you use Sign in with Apple with private relay, we only ever receive the relay address.
• Precise location. Your device's current location, used only when you actively create a missing-cat report or a street-cat sighting, and to show you cats near you. Location is not tracked in the background.
• Reports and sightings you create. Cat name, breed, colour, description, photos you attach, and the address you enter or pick from the map.
• Photos. Images you attach to reports or sightings. Each photo is sent to Anthropic's Claude vision model for a one-off check that the image contains a cat; Anthropic does not store the photo and does not use it to train models.
• Device push token. An anonymous identifier issued by Apple Push Notification service so we can send you alerts about nearby urgent reports and sightings on your own reports.
• Purchase records. When you buy an Urgent Boost, RevenueCat (mobile) or Stripe (web) processes the payment and returns an anonymous transaction identifier that we store to verify the purchase and prevent double-charging. We do not receive or store your card details.
• Product analytics. If enabled, PostHog receives an anonymous device identifier and screen-view events so we can understand which parts of the app are used. Analytics events do not include your email, location, or photos.
• Technical logs. Standard request logs (IP address, timestamp, endpoint) are retained by our backend provider for security and abuse prevention.

3. How we use your data

• Provide the core features: create reports, show cats nearby, send alerts.
• Verify Urgent Boost purchases and activate them for the correct report.
• Prevent abuse — for example, filtering out photos that don't contain a cat, and rate-limiting device-token registrations.
• Communicate with you about your reports, sightings, and account.
• Comply with legal obligations, respond to lawful requests, and enforce our Terms.

4. Legal basis (EU / UK users)

• Contract. Processing needed to deliver the Service you signed up for (accounts, reports, sightings, purchases).
• Consent. Push notifications, precise location, camera and photo library access — you can withdraw consent at any time in iOS Settings.
• Legitimate interest. Fraud and abuse prevention, service reliability, and product analytics.
• Legal obligation. Retention of financial records for tax law.

5. Who we share data with

We only share data with the providers that make the Service possible. We do not sell personal data, and we do not share it for advertising.

• Supabase — database, authentication, storage, edge functions.
• Apple Push Notification service — delivery of push notifications.
• RevenueCat (mobile in-app purchase management) and Stripe (web checkout). They process payments under their own privacy policies.
• Anthropic (Claude vision) — a one-off check on each photo you upload. No storage, no training on your data.
• PostHog — product analytics, anonymous device ID and event names only.
• Apple and Google — identity providers when you sign in.
• Other users of the Service can see the reports and sightings you post, including attached photos and the address you entered. Do not include information you don't want to be public.

6. International transfers

Our providers may process data in the United States and other countries outside your own. Where required, transfers are covered by the Standard Contractual Clauses approved by the European Commission or an equivalent safeguard.

7. Data retention

• Reports and sightings stay in your account until you delete them or delete your account.
• Urgent Boost purchase records are retained for the period required by tax law (typically 7 years).
• Invalid push tokens are removed automatically once Apple or Google reports the device is no longer reachable.
• Analytics events follow PostHog's default retention.

8. Your rights

You can access, correct, export, or delete your data at any time. In the app go to Settings and use Delete Account to remove your account and everything linked to it. You can also email us at support@whereismycat.org for any of these requests. EU / UK residents have the right to lodge a complaint with a supervisory authority.

9. Children

The Service is not directed to children under 13. If you believe a child has provided us with personal data, contact us and we will delete it.

10. Security

Data is transmitted over TLS and stored in a Supabase project protected by row-level-security policies. Passwords are never handled by us — sign-in is delegated to Apple and Google. No system is perfectly secure, but we work in good faith to protect your data.

11. Changes

If we make material changes, we will update the effective date at the top of this page and, where appropriate, notify you in the app. Continued use of the Service after changes means you accept the updated policy.

12. Contact

Questions or requests: support@whereismycat.org.