Legal
Privacy Policy
Catify is a journal of your cat’s life, which means you trust us with photos and notes that matter to you. This page explains exactly what we collect, why, who else touches it, and how to get it back or get rid of it.
Last updated
1. Who is responsible
The data controller is Vilém Hujnák, Slovenská 240, 685 01 Bučovice, Czech Republic. For anything in this policy — including access and deletion requests — write to privacy@getcatify.app. We aim to reply within 2 working days, and always within one month as the GDPR requires.
2. What we collect
Data you give us
- Account — your email address and a securely hashed password (or, if you sign in with a provider, the identifier they give us). Optionally a display name and avatar.
- Your cats — name, breed, date of birth, sex, neuter status, microchip or ID notes, and a profile photo, for each cat you add.
- Journal and records — entries, captions, tags, dates, photos, weights, health and vet records, medications, meals and food notes, toys, expenses, to-dos and reactions.
- Household — the household name, its currency, who its members are and their roles, and any invitations you create.
- Support correspondence — if you email us, we keep the message and our reply.
Data we generate or receive
- Billing — if you subscribe, Stripe processes the payment and sends us a record of your subscription: a customer and subscription identifier, plan, status and renewal date. We never receive or store your full card number.
- Usage analytics — which features are used and when, with your account identifier attached, so we can see what works and what is broken. Only where you have consented to analytics (see Cookies).
- Error reports — when something crashes, a diagnostic report including the error, the page and technical details about the browser.
- Technical logs — our hosting and database providers record request logs containing IP address, timestamp, requested URL and user agent, for security and troubleshooting.
We do not ask for and do not want special-category data. We do not use automated decision-making or profiling that has a legal effect on you.
3. Why we use it, and on what legal basis
| What for | Legal basis (GDPR Art. 6) |
|---|---|
| Creating your account, storing your cats and journal, syncing your household, sending confirmation and password-reset emails | Performance of a contract — Art. 6(1)(b) |
| Taking payment for Catify+, managing renewals and cancellations | Performance of a contract — Art. 6(1)(b) |
| Keeping invoices and accounting records | Legal obligation — Art. 6(1)(c) |
| Keeping the service secure, preventing abuse, diagnosing crashes, and maintaining backups | Legitimate interests — Art. 6(1)(f) |
| Product analytics, and optional emails such as the weekly recap | Your consent — Art. 6(1)(a), withdrawable at any time |
4. Who else processes your data
We keep the list short and we do not sell data to anyone. Each provider below acts as our processor under a data processing agreement, and only handles what its job requires.
| Provider | What it does | Where |
|---|---|---|
| Supabase | Database, authentication and application backend | European Union (AWS eu-west-1, Ireland) |
| Vercel | Website and application hosting | European Union (primary region Frankfurt) and United States |
| Cloudflare | Photo storage, image delivery and DNS | European Union (R2 EU jurisdiction) and global edge network |
| Stripe | Subscription payments and billing | European Union and United States |
| Resend | Transactional email delivery | European Union and United States |
| PostHog | Product analytics and error monitoring | European Union (EU Cloud) |
Your photos are stored in Cloudflare R2 with EU jurisdiction, and your database records in Supabase in Ireland. Where a provider processes data outside the EEA, that transfer relies on the European Commission’s Standard Contractual Clauses and, where applicable, the EU–US Data Privacy Framework.
We may also disclose data if the law requires it, or to establish or defend legal claims. If we are ever legally compelled to hand over your data, we will tell you unless we are forbidden from doing so.
5. What your household can see
Catify is a shared product. Every member of a household can see and edit that household’s cats, journal, photos, health records, expenses and to-dos, and can see which member added what. Invite only people you are happy to share that with. Removing a member ends their access immediately, but entries they already added stay in the household’s records.
6. How long we keep it
- Your account and content — until you delete it. Ask us and we will remove it.
- Deleted photos — removing a photo queues the underlying file for deletion from storage, which happens automatically, normally within a day.
- Backups — database backups are kept on a rolling basis and expire on their own schedule, so deleted content can persist in a backup for a short period before it ages out.
- Billing and accounting records — retained as long as Czech tax and accounting law requires, currently up to 10 years, even after you close your account.
- Technical logs — a matter of days to a few weeks, depending on the provider.
- Analytics and error reports — retained by PostHog according to its retention policy, and not used to build a profile of you beyond product improvement.
7. Your rights
Under the GDPR you can ask us to:
- Accessyour data, or get a copy of it. You don’t have to wait for us — Account → Export my data gives you a machine-readable copy immediately.
- Correct anything that is wrong. Most of it you can edit directly in the app.
- Delete your data (the “right to be forgotten”). Email privacy@getcatify.app and we will delete your account and personal data, except records we must keep by law.
- Restrict or object to processing we base on legitimate interests.
- Port your data to another service, using the same export.
- Withdraw consent for analytics or optional email, at any time, without affecting anything we did before you withdrew it.
Exercising these rights is free and we will not treat you differently for it. If you think we have handled your data badly, please tell us first — and you also have the right to complain to your local data protection authority. In the Czech Republic that is the Office for Personal Data Protection (Úřad pro ochranu osobních údajů), Pplk. Sochora 27, 170 00 Praha 7, uoou.gov.cz.
8. How we protect it
Traffic is encrypted in transit with TLS, and data is encrypted at rest by our providers. Passwords are hashed, never stored in readable form. Access to each household’s data is enforced in the database itself with row-level security, so one household cannot read another’s records even if the application has a bug. Photo files are stored under unguessable identifiers and the storage bucket is not browsable. Administrative access is limited to the people who need it.
No system is perfect. If a breach ever affects your personal data and poses a risk to you, we will notify the supervisory authority within 72 hours and tell you directly.
9. Cookies
We use a small number of cookies, most of which are strictly necessary to keep you signed in. Analytics is optional and only runs with your consent. The details are on the Cookies page.
10. Children
Catify is not intended for children under 16, and we do not knowingly collect their data. If you believe a child has given us personal data, contact us and we will delete it.
11. Changes to this policy
As Catify grows, this policy will change. The date at the top always shows the current version. If a change materially affects how we use your personal data we will tell you by email before it takes effect, and where the law requires consent we will ask for it again.
12. Contact
Vilém Hujnák, Slovenská 240, 685 01 Bučovice, Czech Republic. Privacy and data requests: privacy@getcatify.app. General support: support@getcatify.app.