Privacy Policy

This Privacy Policy describes what data the CatOnMap service (the mobile app and the catonmap.app website) collects, how it is used and what rights you have. The data controller is Sanders Soft LTD (sanderssoftltd.com).

1What data we collect

• Account data: e-mail address, nickname, avatar. When you sign in with Google, we receive your e-mail and profile name from Google; your Google password is never shared with us.
• Password (for e-mail registration) — stored only as a cryptographic hash; we never see or store the original password.
• Photos and geodata (Hunt mode): cat photos, the shooting location coordinates, the country and city derived from them, and the date and time of the shot. Geolocation is optional: you can shoot without it — the photo then stays off the map and out of battles, and no coordinates are written to our records or the image file. When geolocation is unavailable, the photo's country may be derived from the device's mobile carrier / SIM country. Your home country and city in the profile can be changed or removed at any time.
• Feed mode (Catogram) posts: photos and videos (up to 60 seconds) with sound uploaded from the device gallery; the caption; tagged cats; an optional location (coordinates, city, country) — only if you choose to add it; the chosen visibility ("Everyone" or "Friends only").
• Feed mode stories: a photo or a video with sound. A story is shown for 24 hours and is visible only to your followers. We store the fact and time of views — who watched your story and when; the author sees the view count.
• Cat profiles ("My cats"): the cat's name, colour, birth year, avatar photo and the number of posts the cat is tagged in.
• Microphone: microphone access is used only while recording a video in the app; the audio is stored as part of the video file. Audio is never recorded or analysed separately.
• Social content and actions: comments and replies, captions on photos and posts, likes, saves, notes, story replies, follows, friends lists, as well as reports, blocks and hidden posts.
• Lost Cat data: photos of the missing pet, the place and date it went missing — only if you create a search request.
• Purchase data: the fact and type of a purchase (subscription, storage pack, Lost Cat request) received from the App Store / Google Play. Payment details (card numbers etc.) are processed exclusively by the app stores and never reach us.
• Technical data: session tokens; an installation identifier (IDFV on iOS, Firebase installation ID); device model, OS version and language; IP address; API request logs. Advertising identifiers (Advertising ID, IDFA) are not collected — see section 4.
• Push notifications: the device push token (FCM/APNs) and the device language — stored on our server while you are signed in and deleted when you sign out. You can turn notifications off in your phone settings at any time.
• Friend invites: the invite code from the install link (delivered on Android via the Google Play Install Referrer). On iOS, when you tap an invite link catonmap.app/i/…, we temporarily store the IP address of the tap: it is used for up to 48 hours to match a new account to the invite and is deleted within 7 days at the latest.
• The "Where to go?" feature: your current coordinates are sent to the server only to find nearby cat spots; they are used for that request and are not stored.

2How we use the data

• Building your collections and country galleries — based on shooting coordinates.
• Showing Feed mode posts and stories to friends, followers or everyone — according to the visibility you chose.
• "For you" recommendations: a feed of public posts ranked automatically by likes, comments, saves and recency.
• Automatic content moderation: every photo and sampled frames of every video (including stories) are analysed by an ML model — a cat is present, no people, no inappropriate content. Uncertain cases are additionally reviewed by a human moderator.
• No face data or biometric data is collected. The moderation model performs object detection only — it determines whether a person appears in the frame. It does not perform facial recognition, does not map facial geometry, and does not create biometric templates or identifiers of any kind. The output of the analysis is limited to class labels (e.g. "cat", "person") and a confidence score, stored with the content as its moderation status. The analysis runs entirely on our own servers and is never shared with third parties.
• Automatic text moderation: comments, captions, notes, story replies and cat names are screened by a text filter (links, insults) and a local ML toxicity model. Highly toxic texts are hidden and escalated to a moderator; this processing never leaves the service's servers.
• Running the Lost Cat service: AI compares photos of a missing cat with approved public shots taken by other users within the search radius.
• Scoring weekly battles and rankings (Hunt mode only).
• Service e-mails: registration confirmation codes, password reset links, Lost Cat match notifications. Delivery is handled by the transactional e-mail service ZeptoMail (Zoho, EU servers).
• In-app and push notifications about content status, battles, likes, comments, follows and Lost Cat matches — delivered via Firebase Cloud Messaging and the Apple Push Notification service.
• Hunting streaks, weekly summaries and rankings — computed automatically from your published photos.
• A weekly digest e-mail with your week's results (cats, likes, rank) — sent on the basis of our legitimate interest; every e-mail contains an "Unsubscribe" link and opting out takes effect immediately.
• A social share card (generated at your request): an image built from your photo with your nickname, the city and a QR code linking to the photo's public page.

3Third-party services

We use a limited set of third-party providers to run the service. Each receives only the data required for its function:

• Google Sign-In / Sign in with Apple — account authentication; Google's and Apple's policies apply.
• App Store / Google Play — payment processing; card numbers never reach us.
• Cloudflare (CDN and R2 object storage) — storage and delivery of photos and videos; Cloudflare sees your IP address when content loads. Cloudflare privacy policy.
• OpenStreetMap (map tiles) — your IP address is visible to OSM servers when the map loads. OSMF privacy policy.
• Platform geocoder (Apple / Google) — shooting coordinates are passed to the system geocoder to resolve the city and country; Apple's and Google's policies apply.
• Google Firebase Cloud Messaging — push notification delivery on Android and iOS; receives the push token, the Firebase installation ID, the device model and OS version. Firebase is used for notification delivery only: Firebase Analytics is disabled in the app. Firebase privacy.
• Apple Push Notification service (APNs) — push notification delivery on iOS; receives the device token. Apple's policy applies.
• Google Play Install Referrer (Android) — when the app is installed via an invite link, it passes the invite code to the app so the friend's invite can be credited. No other data is passed.
• ZeptoMail (Zoho) — transactional e-mail and weekly digest delivery (EU servers).

ML moderation of photos, videos and texts runs on our own servers and is never outsourced to external providers.

4Tracking and advertising

We do not sell personal data. The app shows no third-party advertising and uses no advertising or tracking SDKs. Advertising identifiers (Advertising ID on Android, IDFA on iOS) are not collected; the iOS "Allow Tracking" prompt (App Tracking Transparency) is not used because no tracking takes place. Analytics is limited to our own service operation logs. Firebase is used solely to deliver push notifications — Firebase Analytics is disabled in the app configuration.

5Where the data is stored

Photos and videos are stored in Cloudflare R2 cloud object storage and served through a CDN. Credentials and metadata live in a protected database on the service's servers in Europe. Database backups are created daily and kept for 14 days.

6Who can see your content

• Content with the "pending moderation" status is visible only to you.
• Approved Hunt mode photos appear in public country galleries, the shared feed and your public profile. The "Who sees my gallery" setting (Everyone / Friends / Only me) limits the visibility of your photos and whether others can like and comment on them.
• Approved Feed mode posts are visible according to the chosen visibility: "Everyone" — to all users, in For you recommendations and on the post's public page; "Friends only" — to your friends only.
• Stories are visible only to your followers for 24 hours.
• Rejected content is never published anywhere.

7Retention and deletion

• Data is kept for as long as you have an account.
• Stories disappear from the app after 24 hours; story files are deleted from our servers within 30 days after expiry, and view records are deleted together with the story.
• Deleting a post or a story removes its media files from storage immediately.
• Deleting a cat removes its tags from posts; the posts themselves remain.
• Deleting your account removes posts, stories, cats, comments, likes, photos and all associated data; the data fully disappears from backups within 14 days. Purchase history remains with the App Store / Google Play as required by law and their policies. How to delete the account: in the app — Settings → Account → "Delete account", or follow the account deletion guide.
• The push notification token and device language are deleted when you sign out on that device.
• Invite link tap data (the IP address, on iOS) is used for no longer than 48 hours and deleted within 7 days at the latest.
• Confirmation codes are valid for 15 minutes and password reset links for 1 hour, after which they expire.

8Your rights

• Receive a copy of your data.
• Correct your profile data (in the app or website settings).
• Delete individual photos or your entire account with all its data — see the step-by-step account deletion guide.
• Withdraw consent to processing — by stopping use of the service and deleting your account.
• For EU/EEA users: the legal bases for processing are contract performance (running the service, showing content, purchases), legitimate interest (security, moderation, basic analytics, the weekly e-mail digest — with a one-click unsubscribe link in every e-mail) and consent (photo and post geolocation). You also have the right to lodge a complaint with your country's data protection authority.

9Children

The service is not intended for children under 13. We do not knowingly collect children's data; if you become aware of such a case, let us know and the data will be deleted.

10Changes to this policy

We may update this policy. The current version is always available on this page; the date of the last update is shown at the top. We will announce material changes in the app.