Privacy Policy

Effective 15 November 2026. This policy describes app version 1.0.0 (22) and later and the website.

Who we are and who the service is for

Pavel Filatov, autónomo, NIE Z1691803C, Lugar Palma de Siete Puertas, 44A, 35017 Las Palmas de Gran Canaria, Las Palmas, Spain, is the controller for personal data processed for Red Cat Link. Contact: filatov.pavel@gmail.com. The game and website are intended for adults aged 18 or over and are not marketed to children. If we become aware that a child has provided personal data, we will investigate and delete it as appropriate; contact us at the address above. This intended audience is not a statement of an app store age rating.

Data and purposes

You can play offline without an account. The app stores settings, onboarding, the cat avatar, lives and timer and guest game progress on your device. Removing the app or clearing its data may remove local progress. Device backups are controlled by the platform and its settings; Android backup is disabled in the current configuration. Local guest data is not automatically a cloud account.

In app version 1.0.0 (23) and later, after you request an email sign-in link, the app temporarily remembers the entered email address on this device so you can return from your mail app. It expires after 24 hours and is removed on the next read after expiry, successful sign-in or account change. The app does not save the sign-in URL or its one-time code to this file. This local expiry does not delete Firebase account data.

An optional account saves game progress and allows the signed-in leaderboard. Firebase Authentication handles the account identifier, email and sign-in provider information; Google may also process IP address and user agent for security. Google sign-in and email-link are supported. Availability of any additional provider depends on the released build. We use account identifiers to keep accounts separate, secure access, process support and deletion requests and deliver the requested service. Firestore and Functions store and validate profile nickname, avatar configuration, language preference, progress, inventories, attempts, action records, scores and dishes. These records may be linked to your account. Do not use your real name or other personal information as a nickname.

The in-app leaderboard is available to signed-in players. The website's public top 15 is separate and off by default. If you opt in, anyone may see your game nickname, cat avatar, language and accumulated scores and dish counts. Do not include personal information in the nickname. You can turn public participation off in the app; the candidate and cached public projection are invalidated when participation is withdrawn, an account is deleted or relevant profile details change. Ordinary score changes may be reflected after up to 15 minutes. Once information has been seen, copied or shared by others, we cannot retrieve their copies.

If you choose to share a result, your device opens its share menu and sends the result to the recipient or service you select. Their privacy policies apply. We receive the information you provide when contacting support and use it to respond, verify and handle the request.

Optional notifications and in-app announcements

From version 1.0.0 (25), life-refill reminders and game-news notifications have separate device preferences, both off by default. The app asks for the operating system's notification permission only after your action. Life reminders are scheduled locally; no server receives the reminder schedule. You can change notification preferences in the app or revoke permission in device settings. These choices do not enable Analytics or require an account.

If you enable game news on a supported build, Firebase Cloud Messaging processes an installation identifier, registration token and technical delivery information, and subscribes this installation to a language-specific news topic. We do not attach an account UID, email or nickname to these subscriptions or keep a separate server list of notification tokens. Disabling news requests topic unsubscription; if the device is offline or the service is unavailable, the app retains the pending change and retries. Until it reaches the service, previously subscribed news may still arrive; device notification settings can block their display. Turning off a subscription does not itself delete all provider service logs or identifiers. Availability on iOS depends on the released build's APNs configuration.

The main menu may retrieve general game announcements from our public server feed without account identifiers or analytics targeting. Hosting infrastructure may process ordinary request metadata such as IP address for delivery and security. Dismissed announcement IDs, recent feed content and display times are stored locally to limit repetition; expired content is hidden. This feed does not use the Firebase In-App Messaging SDK.

Optional analytics

In app version 1.0.0 (22) and later, Firebase Analytics is off by default and only enabled if you opt in; you can withdraw that choice in settings. We use it to understand game usage and improve the experience. Events use fixed screen names and game action categories; we do not intentionally send account UID, nickname, email or custom user properties. The SDK may collect an app instance identifier, automatic events and technical information, and may associate events with an installation. Advertising storage, advertising user data and advertising personalisation consent are denied in the app configuration; disabling advertising identifiers does not eliminate all identifiers. The app does not include the Crashlytics SDK.

The website offers a separate opt-in for Google Analytics. Its consent-choice record lasts 180 days and the analytics cookie up to 90 days when analytics is enabled. You can withdraw your choice to stop future analytics collection. Contact us about deletion of previously collected information. Website analytics and mobile analytics choices are independent. Essential hosting and security requests may be processed even when analytics is declined.

Legal bases and recipients

Where the GDPR applies, we process account and gameplay data as necessary to provide the account features you request; security, fraud prevention and service operation on our legitimate interests, balanced against your rights; optional analytics, game-news notifications and public leaderboard publication on consent; and information needed to respond to legal obligations on that basis. You may withdraw consent at any time without affecting earlier lawful processing. Contact us to object to legitimate-interest processing. Providing account data is necessary for an account, not for offline play.

Google provides Firebase Authentication, Cloud Firestore, Cloud Functions and, when enabled, Cloud Messaging and Google Analytics. For customer data covered by the relevant service agreements Google generally acts as processor, while Google may independently process service data or act in a different role for its own services. Google sign-in, your device platform, your chosen share recipient and their providers process data under their own terms where applicable. Google Analytics is a separate service with separate terms. We do not sell personal information or use it for advertising in this release.

International transfers

The Firestore database is configured in europe-west1. This does not mean all processing stays in Europe: Google states Firebase Authentication runs from US data centres, and other Google services may operate globally. Transfers are subject to applicable law and relevant contractual arrangements, including appropriate transfer mechanisms such as adequacy decisions or standard contractual clauses where applicable. The applicable Google terms depend on the service and contracting entity. You can contact us for information about applicable safeguards. See Google's Firebase privacy information, Firebase terms and data processing terms.

Retention and deletion

Account and related game records are retained while needed for the service and until deletion, subject to the exceptions below. In the app you can request account deletion after reauthentication; the deletion process removes the account's private data, leaderboard records and public candidate and invalidates the public cache. A deletion tombstone remains for security against old tokens and is scheduled for deletion 30 days after successful account deletion; automated deletion may take longer. If deletion is incomplete, the tombstone remains until the process is completed. Device-wide settings and guest data are separate. Email us to request deletion without the app; identity verification may be necessary.

Current Firestore point-in-time recovery is disabled, version retention is one hour and no scheduled Firestore backup is configured; deletion tombstones use the expiry policy described above. These facts do not establish a complete deletion deadline for all services. Current Cloud Logging settings include a 30-day Default bucket and a locked 400-day Required bucket; records are retained according to the relevant bucket and may not be individually deleted on request. Google states deleted Firebase Authentication data is removed from live and backup systems within 180 days; other providers and logs may have different periods. Support messages are kept until the request is resolved and for as long as reasonably necessary to meet obligations or defend legal claims. Google Analytics is configured to retain event data for 2 months and user data for 14 months; renewed user activity resets the user-data retention period. Standard aggregate reports are not subject to these settings in the same way. Contact us about deletion requests. Historical Analytics/Crashlytics data from earlier builds is not deleted merely by updating the app.

Your rights and security

Depending on where you live, you may request access, correction, deletion, portability, restriction or objection, and withdraw consent. Contact filatov.pavel@gmail.com; we may need to verify your identity. You may complain to your relevant supervisory authority, including Spain's Agencia Española de Protección de Datos (AEPD). We use access controls and service security measures, but no system can be guaranteed completely secure. We may update this policy when our practices change; the effective version will be available in the app and website, and we will provide additional notice where required.