Legal
Privacy and Terms of Service
What we collect
An email address (when you sign up), the password hash, OAuth provider IDs (if you use Google sign-in), the username and profile fields you choose, the replay payload of submitted runs (keystroke timing pattern, deterministic seed, cat/document IDs, outcome), and any cat photo you choose to upload.
What we don't collect
We don't collect your name, email, IP address (beyond Supabase's standard request logs), or any third-party tracking data. The only analytics we run is Vercel Web Analytics — privacy-friendly, no cookies, no PII.
How long we keep it
Top-50 daily and top-20 per-cat-doc replay payloads are kept indefinitely for the leaderboard. Non-top score rows persist; their replay payloads are discarded after verification. Pending uploads expire after 14 days. Approved photos are kept and credited to your handle. Rejected upload files are deleted immediately.
Your rights
Email a deletion request to delete your account, runs, profile, and any uploaded photos. Cascade deletes apply.
What you agree to
Light tick-once on first score submit. Explicit modal on first photo upload (image rights, takedown notice, deletion contact).