Privacy Policy

This policy explains how Miauly handles personal data when you use miauly.cat, the installed web app (PWA), the Miauly Android app from Google Play (package name com.miauly.app) and related public pages.

Who we are

Miauly is operated by Boyan Breznishki, an independent developer at Vasil Levski 44, 2140 Botevgrad, Bulgaria. He is the data controller. You can contact him at support@miauly.cat.

Age and children

Miauly is intended for people aged 16 and over. We do not ask for your date of birth during registration and do not create age profiles. If we become aware that an account belongs to a child under 16, we may restrict or delete the account and associated personal data as appropriate. A parent or guardian who believes a child has provided personal data should contact us.

When an account is created, Miauly may record the date and version of the Terms and Privacy notice you acknowledged, for account administration. This is not age data.

Data we process

Depending on how you use Miauly, this can include:

• Account: your email address, account identifiers and, if you use Google sign-in, your Google account identifier and basic profile information.
• Community profile: your nickname, memberships and roles, and optionally a preferred messaging service with the handle or phone number you choose to provide.
• Your contributions: cat profiles, photos and short videos, captions, comments, reports, corrections, sightings and care records you submit. This includes any photo you attach to a comment.
• Notifications: your notification choices and, if you enable push notifications, the push subscription details needed to deliver them.
• Support: messages you send us.
• Technical data: limited security, diagnostic and device information, such as app version, current screen, language, online state and error details when something goes wrong.
• Location: information you deliberately provide or allow for a feature that needs it.

Please do not include passwords or authentication codes in support messages.

The Android app

The Miauly Android app is a Trusted Web Activity: it opens the Miauly web app from miauly.cat inside your device’s browser engine (normally Google Chrome). It is the same service as the website, so everything in this policy applies in the same way however you open Miauly.

The Android app does not contain its own advertising or analytics software, does not use the Android advertising ID, and does not read your contacts, SMS messages, call log or other apps.

Permissions

Permissions are requested only when you use a feature that needs them. You can change or withdraw them at any time in Android settings or in your browser’s site settings for miauly.cat.

• Notifications: to alert you about cats, Areas and requests you follow.
• Location: to centre Area discovery or record a location-related contribution.
• Camera, photos and videos: only to the extent you choose a photo or video to upload.

Data on your device and from Google Play

Sign-in sessions, caches and offline data are stored by the browser engine on your device. They are removed when you sign out where supported, or when you clear the app’s storage or uninstall it. Google may collect information about installs, updates and crashes through Google Play and Android under Google’s own privacy policy. Miauly receives only aggregated statistics in Google Play Console.

Why we process it and our legal bases

• To provide the service and your account: processing needed to perform our agreement with you.
• Safety, security, moderation and reliability: our legitimate interests in protecting cats, users, shared records and the service, balanced against your rights.
• Optional features: consent where required, including browser notifications, device location and any future non-essential advertising storage or personalised advertising.
• Legal obligations: when processing or retention is required by applicable law.

Where we ask for consent, you can refuse or withdraw it without affecting processing that was lawful before withdrawal. Some data is necessary to create an account or submit a contribution; if it is not provided, that feature may not work.

Public, Community and private information

Content marked public, including public Cat Cards, profile names, selected photos, biographies and public Moments, can be viewed without an account and may be indexed, cached or previewed by search engines, social networks and other bots.

Community membership does not make every contribution public. Exact Care Points, precise sightings and operational care details are intended for authorised members only.

Before uploading a photo or story, make sure you have the right to share it and that it does not expose a person, home, vehicle plate or sensitive animal location.

Location and cat safety

Miauly does not continuously track your device. A feature may request location after you choose an action such as centring Area discovery or recording a location-related contribution. You can deny the request and use the available manual alternatives. Location and Area information you submit may be stored as part of the relevant record, but public profile views are designed to exclude precise care and sighting locations.

Maps and place search

Miauly uses OpenStreetMap map data and may use Nominatim for user-requested place search. When you use those features, the service can receive the search text or location information needed to return the result. They are not used to track your device continuously.

Service providers and recipients

• Supabase: authentication, databases, storage, notifications and server-side access controls.
• Cloudflare: web hosting, delivery, security, edge functions and storage of uploaded videos (R2).
• Google: sign-in, if you choose “Continue with Google”; and, on Android, the push notification service your browser uses to deliver notifications.
• OpenStreetMap / Nominatim: map data and place search, as described above.

Data may also be shared with advisers, authorities or other recipients where reasonably necessary to comply with law, protect rights or investigate abuse. Miauly does not sell your personal data.

Advertising and sponsored content

Miauly may show direct sponsorships and other paid placements. They are placed by Miauly itself, are labelled as sponsored, and appear in places such as the Feed, Discover, Public Explore and guides.

• Miauly does not use a third-party advertising network, advertising IDs or cross-site tracking.
• Miauly does not build advertising profiles or personalise ads from your activity.
• No personal data is sold or shared with advertisers; they receive only aggregate figures.

What is processed

To choose and measure a sponsored placement, Miauly processes the placement, your app language and, when it is already known, the country of the Community Area you are viewing (otherwise a country derived by our hosting provider from your connection). When a sponsored card is shown or clicked, Miauly records the campaign, placement, event type, country, language and time. These events are not linked to your name, email address or account.

If you click a sponsored card, you leave Miauly and the advertiser’s own privacy policy applies. If Miauly later introduces a third-party advertising provider or personalised advertising, this policy and the consent controls will be updated before any personal data, device identifiers, cookies or similar information are shared with that provider, and consent will be requested where the law requires it.

Device storage, cookies and offline data

The PWA and the Android app use browser storage, caches and similar technologies for sign-in, preferences, security, performance and offline operation. They may keep recent Community, cat and Care Point information, private media already opened, and contributions waiting to synchronise. Account-scoped snapshots and private photo caches are cleared on sign-out where supported. Clearing browser or app data can erase unsynchronised device-only work.

How we protect your data

We use the following measures to protect personal data:

• Encrypted connections: Miauly is served over HTTPS, and data between your device and our servers is encrypted in transit.
• Access controls in the database: every table that holds app data is protected by row-level security, so members can only read or change what the rules allow. Exact Care Points and precise sightings are limited to authorised members.
• Private storage: photos, videos, notice-board images and report screenshots are kept in private storage and are served only to signed-in members who are allowed to see them, through short-lived links. Only sponsor images, which are public by design, are stored publicly. Photos attached to comments are kept in private storage in the same way.
• Passwords and sign-in: passwords are never stored in readable form; they are hashed by our authentication provider. Google sign-in is available, in which case we never see your Google password.
• Encryption at rest: our database and storage providers encrypt stored data on their infrastructure.
• Limited staff access: moderation and administration tools are available only to a small number of administrators, and administrative actions are recorded.
• Browser protections: the website sends security headers that prevent it from being embedded in other sites and limit camera, microphone and location access.
• Backups and recovery: the database is backed up regularly by our provider, as described under Retention.

No online service can promise absolute security. If a personal-data breach affects you, we will notify you and the supervisory authority where the law requires it.

Retention

We keep data only as long as needed for the purposes above.

• Account and profile data: while your account is active. When you delete your account, your sign-in account and email address are deleted, your nickname, biography, contact details and profile picture are cleared, and your follows, memberships, notifications, push subscriptions and similar personal settings are removed right away.
• Photos, videos and other uploads: until you delete them. When you delete a photo or video yourself in Miauly, the file is removed from storage (videos are removed by a cleanup job, normally within 30 days). If you delete your account without first deleting your uploads, the photos, videos and posts you added to shared cat records and Community areas are not removed automatically: they stay without your name, email or profile, shown as “Deleted member”. To have specific uploads removed, delete them before you delete your account or ask us at support@miauly.cat. When you delete a comment that has a photo, the photo is removed from storage as well.
• Shared cat history: cat records, corrections and care history that other members rely on may remain after your account is deleted, without your identity, so collective records are not broken.
• Support messages: up to 24 months after the matter is closed.
• Security and diagnostic logs: up to 90 days, unless needed longer to investigate abuse or an incident.
• Sponsored-placement events: up to 24 months, in a form not linked to your account.
• Backups: deleted data is removed from backups as they rotate, normally within 35 days.
• Legal obligations and disputes: longer, where the law requires it or where needed to establish, exercise or defend legal claims.

International transfers

Providers may process data outside Bulgaria or the European Economic Area. Where required, Miauly relies on an adequacy decision or appropriate safeguards such as the European Commission’s standard contractual clauses. You may ask for information about the safeguards relevant to your data.

Your rights

Subject to the GDPR and applicable exceptions, you can ask for access, correction, deletion, restriction, objection and data portability, and withdraw consent at any time. Write to support@miauly.cat; we respond within one month.

You may also complain to the Bulgarian Commission for Personal Data Protection or the supervisory authority where you live or work.

Delete your account

You can permanently delete your account in Miauly under Options & Tools → Account & security.

If you cannot access the app, use the public account deletion page to request deletion without reinstalling Miauly, or email support@miauly.cat. Deletion requests are handled within one month. What is removed and what may remain is described under Retention above.

Changes to this policy

We may update this policy when the service, providers or law changes and will provide additional notice where a change materially affects your choices.