Privacy Policy

1. Scope and controller

This Policy covers the Me & My Cat app, related public websites and support features. The controller is Giannis Ntoupis, Athens, Greece. For privacy questions or rights requests: info@meandmycat.app. For technical or account support: support@meandmycat.app.

The data mainly concerns cats, but it may also be the guardian’s personal data when linked to an account, device, text, photo or usage behaviour.

2. Data we process

• Account: UID, email, display name, optional Google photo, sign-in method and security data.
• Cat profile: name, sex, age/date of birth, story, photo and details you choose to add.
• Journey and learning: mission/observation assignments and outcomes, context/dates, onboarding and character questionnaires, Academy/quiz answers, progress, Familiarity Points and derived personality indicators.
• Optional private material: notes, photos/metadata, health files/documents, diet and care-journal entries.
• AI requests: question, limited relevant context, necessary answers/photos, job state and result.
• Coins and purchases: balance/ledger, status, date, product, order identifier or hash, country/region and UID. We do not receive card or bank-account numbers.
• Neighbourhood/referrals/public features: digital participation and Coin receipts, referral identifiers/hashes and, only with opt-in, limited cat details in a leaderboard.
• Technical: app version, operating system/device, language, App Check/security tokens, error/request logs, FCM token and notification status.
• Optional analytics: pseudonymous events such as screens or feature completion. Collection is off by default and enabled in accordance with your consent choice.
• Website: necessary hosting/server logs and local language preference. No marketing cookies without prior consent.

Do not submit human medical information or unnecessary sensitive personal data in text or photos.

3. Purposes and legal bases

• Contract: account, sync, Journey, quizzes, Academy, points, Coins, purchases and requested features.
• Consent: optional analytics, notifications where required and optional public participation. Withdrawal does not affect earlier lawful processing.
• Legitimate interests: security, fraud/duplicate-reward prevention, troubleshooting and service integrity, balanced against your rights.
• Legal obligation: tax, accounting, consumer, litigation or regulatory records.

4. Behaviour indicators and AI

Personality bars are educational estimates from your records, not a diagnosis. We do not make solely automated decisions with legal or similarly significant effects about you.

When you request an AI clarification, the request passes through a protected queue and trusted Bridge and may be submitted to OpenAI/Codex. Only necessary context is sent. We do not intentionally send your email, but text/images may contain details you included.

5. Providers and transfers

We use Google/Firebase (Authentication, Firestore, Storage, Functions, App Check, Messaging and optional Analytics), Google Play for Coin purchase/verification, OpenAI/Codex for AI requests you activate, and hosting/security providers. We do not sell data or give it to advertisers for their own use.

Primary databases are configured in European regions where supported. Providers may process outside the EEA using an applicable transfer mechanism such as an adequacy decision or standard contractual clauses. Contact us for further information.

6. Retention

• Account, profile, Journey, questionnaires and private content: while the account is active or until deleted.
• AI jobs/results: until account deletion or earlier operational cleanup; temporary Bridge copies only to complete/troubleshoot the request.
• FCM tokens: until invalid, disabled or account deletion.
• Purchase, refund, security and anti-fraud records: as required for verification, disputes and lawful tax/accounting duties.
• Analytics: according to your choice and provider settings. Logs: for a limited proportionate period. Backups: until replaced in the secure cycle.

After deletion, only lawfully required or necessary fraud/dispute records may remain with restricted access. Campaign totals no longer linkable to you may remain as anonymous aggregates.

7. Security

We use authentication, UID rules, private Storage paths, App Check, encryption in transit and organisational controls. No system is absolutely secure. You decide whether to upload optional photos, documents and notes.

8. Rights and deletion

Subject to law, you may request access, correction, deletion, restriction or portability, object to legitimate-interest processing, and withdraw consent. We respond without undue delay and normally within one month, subject to lawful exceptions/extensions. You may complain to the Hellenic Data Protection Authority or your local supervisory authority.

In the app choose Account → Delete account. Alternatively see the instructions or email from the account address. Core deletion removes the Auth account, private user/cat tree, associated uploads and AI jobs, subject to the limited lawful exceptions above.

9. Children and changes

The Service is intended for adults 18+ and is not designed for children. If we learn that a child created an account without lawful authorisation, we will take appropriate action. Material changes will update the version/date and receive appropriate notice.