Privacy Policy

Who we are

[TODO operator legal name], [TODO operator registered address]. Contact for privacy questions: [TODO operator contact email].

What we collect — account and authentication

Name, email address, a password hash (argon2id — the password itself is never stored), an email-verified flag, and a profile image URL if you set one. Session records holding a session token, your IP address, your browser's user-agent string, and creation/expiry timestamps. Where you sign in with an external provider, the provider's account identifiers and tokens. Email-verification, password-reset and magic-link tokens, stored only as SHA-256 hashes.

What we collect — your household's records

Household name, slug, image, each member's role and avatar colour. Pet profiles: name, species, breed, sex, neuter status, birth and adoption dates, microchip number, insurance and passport text, diet, allergies, adverse reactions, and an emergency vet name and phone number. Medications, their dose text and schedules, and every dose event. Vaccinations, vet notes and appointments. Journal entries and likes, activity-feed messages, weight entries, tracker readings, care tasks and events, tumour measurements, expenses, photo records, and any feature suggestions you send.

When a member invites someone to a household, we store that person's email address, who invited them, and a hashed invitation token, so the invitation can be sent and accepted. If you received an invitation you did not ask for, we hold your email address only for that invitation: it is deleted when the invitation is accepted or revoked, or when the inviter's account or the household is deleted. An invitation that is simply left unanswered until it expires is not automatically purged, so if you want it removed, ask us at [TODO operator contact email].

What we collect — device and operational

Mobile push tokens with the platform and a last-seen timestamp (these belong to the user, not the household). Rate-limit records. For the mobile API these are keyed to a user id. For sign-in, sign-up and password-reset requests the key is the requesting IP address together with the endpoint path, kept with a request count and a last-request timestamp for a 60-second window — this applies to anyone who reaches those endpoints, whether or not they have an account. Care-share link records: a SHA-256 hash of the link token, an optional label, the creator's name, an expiry, and a revocation timestamp.

Attribution snapshots

Each record carries a stored copy of the name of the person who created it, alongside the link to their account. If that account is deleted, the link is removed but the name snapshot stays, so the household's medical history remains readable. There are 19 such attribution fields. This is deliberate and it is not reversible.

Why we process it

Running your household's account and records, including the transactional email the product depends on (verification, password reset, sign-in links, invitations) — legal basis: performance of the contract you enter into when you create an account. Keeping accounts secure, rate-limiting abuse and running the optional bot check on sign-up — legal basis: our legitimate interest in protecting the service and the people using it. Push reminders on your phone — legal basis: your consent, given by allowing notifications on the device, which you can withdraw in the device's settings at any time. Meeting legal obligations where one applies to us — legal basis: legal obligation. No profiling, no advertising, no sale or sharing of personal data.

Analytics and tracking — none

There is no analytics SDK, no advertising SDK and no error-telemetry SDK in MoonCats. The only third-party script that can load is the Cloudflare Turnstile bot check on the sign-up and password-reset-request forms, and only when it is switched on; it runs on no other page. The Content-Security-Policy's connect-src allows only the application's own origin and its storage bucket.

Who inside MoonCats can see your data

MoonCats' own operator console can list households and accounts, see account email addresses, pending invitation email addresses and feature suggestions, and delete a household. It cannot browse pet, medication, journal or other health records. Every action taken there writes an audit record — who did it, what they did, and what it was done to.

Subprocessors

The table below lists everyone who processes MoonCats data on our behalf, with an honest note on what is confirmed and what still needs the operator to confirm it.

International transfers

Some of the subprocessors above are US companies. The transfer mechanism (for example Standard Contractual Clauses) requires owner confirmation and will be stated here before publication.

Retention and deletion

Deleting your account from account settings is immediate, irreversible, and runs as one transaction; there is no grace period and no soft delete. It requires re-authentication. Deleting your account removes your sessions, credentials, household memberships, sent invitations, journal likes and push devices. If you are a household's only member, the entire household and all of its records are deleted with you. If you are a household's only owner and it has other members, deletion is blocked until you transfer ownership — nothing is written until you do. Records you authored in a household that continues without you are kept, as described above. Revoked and expired care-share links are kept as an audit trail rather than purged.

While your account exists, we keep your household's records for as long as the household does — they are the history the product is for, and only you and your household can remove them. Sign-in sessions expire 7 days after they are created and the row is removed when you sign out. Rate-limit records are kept only for the length of their window, which is 60 seconds, and are overwritten thereafter. Care-share link records, including revoked and expired ones, are kept for as long as the household exists, so the household can always see who was given access; they are deleted with the household.

More detail: Deleting your account.

Your rights

Access and portability: a full household JSON export is available free from the web app, covering every record for that household. Member names and roles are included; member email addresses are deliberately excluded. Photo image files are not included in the export, only references to them. A per-user export is also available free, from your account settings in either client, covering everything you have logged across every household you have been part of — including one you have since left. Rectification: pet profiles, medications and household details can be corrected by any member at any time. A logged dose, expense or vet record cannot be edited after the fact — it is marked void instead, by whoever logged it within 24 hours, or by an owner or admin at any time, and the voided entry stays visible as part of the record. Journal entries can be edited by their author at any time, and deleted by their author or by an owner or admin. Erasure: the self-serve account deletion described above.

You also have the right to object to processing carried out on the basis of our legitimate interests, to ask us to restrict processing while a dispute about it is resolved, and to withdraw any consent you have given (which does not affect processing already carried out). If you think we have handled your data wrongly, you can complain to the data protection authority where you live or work. For [TODO operator legal name], established in Iceland, that authority is Persónuvernd (the Icelandic Data Protection Authority), Laugavegur 166, 105 Reykjavík, postur@personuvernd.is. Complaining to a supervisory authority does not require you to contact us first.

To exercise any of these rights, write to [TODO operator contact email]. We will answer every request, and we will tell you if we need more information to identify your records. These rights come from data protection law — the GDPR as it applies in Iceland and the EEA, and the UK GDPR if you are in the United Kingdom — regardless of which country's law governs our Terms of Service.

How we protect it

Passwords hashed with argon2id. Every auth-flow token stored only as a SHA-256 hash. Care-share and invitation tokens stored only as hashes — the token itself is never persisted. Mobile bearer tokens require an HMAC signature. Content-Security-Policy with a per-request nonce and no inline script execution; HSTS in production; nosniff; frame-ancestors none; a strict referrer policy. Rate limiting on authentication and on the mobile API. Photo uploads are presigned with a server-enforced size range and content type, and a key-namespace check before signing. Household data is re-verified against your membership on every request rather than trusted from the URL.

Care-share links are bearer links

Anyone who holds a care-share link can read that household's care sheet until it expires or is revoked. There is no identity check on it. Treat the URL itself as the credential.

Children

Minimum age to hold an account: [TODO minimum age requirement].

No age gate exists in MoonCats today. This section cannot be finalized until the minimum age above is confirmed by the operator.

Changes to this policy

If this policy changes, the updated version is posted on this page with a new effective date at the top.

Effective date: [TODO effective date].