Privacy Policy Last updated: February 2026 1. Controller Sebastian Seidel Email: catchcat.game@gmail.com Website: https://catchcat.lol 2. Scope This Policy describes processing when you use CatchCat and our website (account deletion request, legal pages, marketing). 3. Categories of data Account & authentication: • Email address, display name, profile image (depending on sign-in provider) • Authentication tokens managed via secure storage on device Content & gameplay: • Photos you capture or upload of cats • Derived metadata such as detected breed labels, confidence scores, figurine or collection state, in-app progress • Optional text fields you provide (e.g. cat names) Social & engagement: • Friend relationships, invites, profile/showcase elements if you use those features • Battle or leaderboard entries where the feature exists Technical & diagnostics: • Device model, OS version, app version, locale • Push notification tokens (FCM / OneSignal) • Error/crash events if you consent (Sentry) or if needed for security • Aggregated analytics events if enabled (PostHog) Optional permissions: • Camera / photo library (to add images) • Microphone / contacts only if a feature you activate explicitly requests them We do not aim to process special-category data beyond what you voluntarily upload in cat photos. 4. Purposes & legal bases (GDPR) • Provide core features (Art. 6(1)(b) GDPR — contract / pre-contract) • Security, abuse prevention, debugging with consent where required (Art. 6(1)(f) or (a)) • Push notifications with consent or settings opt-in (Art. 6(1)(a)) • Analytics / product improvement based on legitimate interest or consent as configured • Legal obligations (Art. 6(1)(c)) 5. Processors & recipients Typical recipients include: • Convex — backend data & realtime sync (USA; DPA/SCCs as applicable) • Google (Sign-In, Firebase/FCM where used) • Apple (Sign-In where used) • OneSignal — push delivery (USA) • Sentry — error monitoring (with in-app consent flow where implemented) • PostHog — product analytics (usually pseudonymous) • RevenueCat — in-app purchases when enabled • Hosting/email providers for this website (e.g. Resend for deletion notifications) 6. International transfers Where data is processed outside the EEA, we rely on appropriate safeguards (e.g. SCCs) where required. 7. Retention Data is kept while your account is active. After deletion we erase or anonymise personal data within approximately 30 days unless law requires longer retention. 8. Your rights You may request access, rectification, erasure, restriction, portability, and object where applicable, and withdraw consent. You may lodge a complaint with a supervisory authority. 9. Children's privacy The App is not directed at children under 16. Do not sign up if you are younger. 10. Changes We will post updates here and in-app where appropriate. Contact: catchcat.game@gmail.com