PoCats Privacy Policy
PoCats is a game about photographing real cats you meet and collecting them as cards. This policy explains exactly what the app collects, why, who processes it on our behalf, and how to get it deleted. It covers the PoCats mobile app (Android package com.pocats.app) and nothing else.
PoCats is operated by Isaac Efraim, an independent developer. You can reach a human at hello@vegadigital.app.
The short version. We collect your email (or nothing at all, if you play as a guest), your in-game progress, your cat photos, and a deliberately blurred location for the sightings map. Your photos are sent to an AI vision service to confirm they show a real cat and to cut the cat out of the background. We run no analytics, no crash reporting, no advertising, and no tracking of any kind. We do not sell your data. You can delete your account and everything in it from inside the app.
1. What we collect
| Data | When | Why |
|---|---|---|
| Email address | If you sign in with an email link or with Google | To create and secure your account and to send the sign-in link. Guests do not provide one. |
| Name | Only if you sign in with Google | Supplied by Google as part of the sign-in. Used to pre-fill your profile. |
| Account identifier | Always, including guest sessions | The internal ID that ties your album, wallet and purchases to you. |
| Profile you choose | During setup | Username, trainer picture, country and language, so the app can address you and localise content. |
| Photos you take in the app | Each time you attempt a catch | To verify the photo shows a real, live cat, to cut the cat out of the background, and to become your card art. |
| Approximate location | Each catch, and when you open the map — only if you grant location permission | To place a sighting on the community map. Coordinates are rounded to three decimal places (roughly 110 metres) before they leave your device. We never store your precise position. |
| Gameplay data | As you play | Your album, cards and their rarity, snack cans, treats, coins, XP, streaks, daily rewards, battle results and sighting records — so your progress survives reinstalling. |
| Purchase records and device identifiers | Only if you buy something | Handled by RevenueCat and Google Play so we can unlock what you bought, restore it on a new device, and prevent fraud. We never see or store your card number, bank details or billing address — Google Play handles payment entirely. |
What we deliberately do not collect
- No analytics. There is no analytics SDK in the app at all — no Google Analytics, Firebase, PostHog, Amplitude, Mixpanel or Segment.
- No crash or diagnostic reporting. There is no Sentry or Crashlytics in the build.
- No advertising. No ads, no ad networks, and no advertising identifier is read or used.
- No microphone recording. The app plays sounds; it never records audio.
- No contacts, no calendar, no files, no browsing history, no health data.
- No photo library access. PoCats only uses the camera at the moment you take a catch photo. It does not read your gallery.
2. Your photos, in detail
This is the part most worth reading, so we are being specific.
When you take a catch photo, the image is sent over an encrypted connection to our server function, which forwards it to xAI (the Grok vision service) to answer one question: is this a genuine, live cat, rather than a photo of a screen, a poster or a printout? The verification result comes back and the photo becomes your card.
On phones that support on-device subject segmentation (iOS 17 and newer, or Android devices with Google ML Kit subject segmentation), the cat is cut out of the background entirely on your phone and the image never leaves it for that step. On phones without that capability, the image is sent to Replicate to perform the same cut-out.
Your photos are stored on your device as card art and are associated with your account so your album can be restored. Your photos are never shown to other players, never posted publicly, and never used for advertising. We do not use your photos to train any model of our own.
3. The community sightings map
When you catch a cat, PoCats can add a marker to a shared map that other players can see. That marker contains only: a blurred coordinate rounded to about 110 metres, a rarity tier, and a location label drawn from a fixed list built into the app. It does not contain your name, your username, your photo, your account identifier or your exact position. Markers expire automatically. If you decline location permission, no markers are created and the rest of the game works normally.
4. Who processes data for us
We use a small number of service providers. They process data on our instructions, for the purposes below, and for nothing else.
| Provider | What it handles |
|---|---|
| Supabase | Account sign-in, the database holding your profile, album, wallet and sightings, and the server functions the app calls. |
| xAI | Vision check on each catch photo to confirm it shows a real, live cat. |
| Replicate | Background removal on catch photos, on devices that cannot do it locally. |
| RevenueCat | Subscription and purchase management, entitlement checks and restore-purchases. |
| Google Play Billing | Takes the payment. We never receive your payment details. |
| Google Maps SDK | Draws the map. Governed by Google's own privacy policy. |
We do not sell your personal information, we do not share it with data brokers, and we do not use it for advertising or marketing profiling.
5. Legal bases
Where the GDPR or similar laws apply: we process your account data and gameplay data to perform our contract with you (running the game you asked to play); we process catch photos and approximate location on the basis of your consent, given through the camera and location permission prompts, which you can withdraw at any time in your device settings; and we process purchase and fraud-prevention data under our legitimate interests in delivering what you paid for and preventing abuse.
6. How long we keep it
- Account, profile and album data — until you delete your account.
- Map sightings — they expire automatically and drop off the map.
- Photos sent for verification — processed to return a result, not retained by us as a separate copy beyond your card art. Our AI providers apply their own short retention windows for abuse monitoring.
- Purchase records — retained while your entitlement is active and afterwards where tax, accounting or fraud-prevention law requires.
- Guest sessions — hold only an anonymous identifier and your gameplay data, and are removed with the account.
7. Deleting your data
In the app: open Settings → Delete account and confirm. This permanently removes your account, profile, album, wallet, purchase records and sightings from our servers. It cannot be undone.
By email: write to hello@vegadigital.app from the address you signed up with, or tell us your username, and we will delete everything within 30 days.
Deleting your PoCats account does not cancel a Google Play subscription. Cancel that separately in Google Play → Subscriptions.
8. Your other rights
Depending on where you live, you may have the right to access a copy of your data, correct it, restrict or object to processing, port it elsewhere, or complain to your local data protection authority. Email hello@vegadigital.app and we will respond within 30 days. We will not charge you or treat you differently for exercising any of these rights.
9. Security
All data sent between the app and our servers travels over encrypted HTTPS/TLS connections. Sign-in tokens are stored in your device's secure keystore, not in plain app storage. Database access is restricted per-account by row-level security so one player cannot read another player's album, profile or purchases. No system is perfect, and we do not claim otherwise — but we do not collect anything we do not need, which is the strongest protection available.
10. Children
PoCats is not directed at children under 13, and we do not knowingly collect personal information from anyone under 13. The app is rated for players aged 13 and over. If you believe a child under 13 has given us personal information, email hello@vegadigital.app and we will delete the account promptly.
11. International transfers
Our providers operate servers in the United States and the European Union, so your data may be processed outside your country. Where required, transfers rely on the European Commission's Standard Contractual Clauses or an equivalent safeguard.
12. Changes to this policy
If we change what we collect or who processes it, we will update this page and change the "Last updated" date at the top. Material changes will also be surfaced in the app. Continuing to use PoCats after a change means you accept the updated policy.
13. Contact
Isaac Efraim — PoCats
hello@vegadigital.app